diff --git a/.buildkite/ftr_configs.yml b/.buildkite/ftr_configs.yml
index ac9ccb04c68e26..ac53265b1c9799 100644
--- a/.buildkite/ftr_configs.yml
+++ b/.buildkite/ftr_configs.yml
@@ -215,7 +215,6 @@ enabled:
   - x-pack/test/api_integration/apis/search/config.ts
   - x-pack/test/api_integration/apis/searchprofiler/config.ts
   - x-pack/test/api_integration/apis/security/config.ts
-  - x-pack/test/api_integration/apis/security_solution/config.ts
   - x-pack/test/api_integration/apis/spaces/config.ts
   - x-pack/test/api_integration/apis/stats/config.ts
   - x-pack/test/api_integration/apis/status/config.ts
@@ -321,6 +320,7 @@ enabled:
   - x-pack/test/functional/apps/saved_objects_management/config.ts
   - x-pack/test/functional/apps/saved_query_management/config.ts
   - x-pack/test/functional/apps/security/config.ts
+  - x-pack/test/functional/apps/slo/embeddables/config.ts
   - x-pack/test/functional/apps/snapshot_restore/config.ts
   - x-pack/test/functional/apps/spaces/config.ts
   - x-pack/test/functional/apps/spaces/in_solution_navigation/config.ts
@@ -550,3 +550,17 @@ enabled:
   - x-pack/test/security_solution_api_integration/test_suites/lists_and_exception_lists/exception_lists_items/trial_license_complete_tier/configs/serverless.config.ts
   - x-pack/test/security_solution_api_integration/test_suites/lists_and_exception_lists/lists_items/trial_license_complete_tier/configs/ess.config.ts
   - x-pack/test/security_solution_api_integration/test_suites/lists_and_exception_lists/lists_items/trial_license_complete_tier/configs/serverless.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/explore/hosts/trial_license_complete_tier/configs/ess.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/explore/hosts/trial_license_complete_tier/configs/serverless.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/explore/network/trial_license_complete_tier/configs/ess.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/explore/network/trial_license_complete_tier/configs/serverless.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/explore/users/trial_license_complete_tier/configs/ess.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/explore/users/trial_license_complete_tier/configs/serverless.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/explore/overview/trial_license_complete_tier/configs/ess.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/explore/overview/trial_license_complete_tier/configs/serverless.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/investigation/saved_objects/trial_license_complete_tier/configs/ess.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/investigation/saved_objects/trial_license_complete_tier/configs/serverless.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/investigation/timeline/trial_license_complete_tier/configs/ess.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/investigation/timeline/trial_license_complete_tier/configs/serverless.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/sources/indices/trial_license_complete_tier/configs/ess.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/sources/indices/trial_license_complete_tier/configs/serverless.config.ts
diff --git a/.buildkite/pipelines/build_api_docs.yml b/.buildkite/pipelines/build_api_docs.yml
index ef1f875861387c..af05ec228d5a4e 100644
--- a/.buildkite/pipelines/build_api_docs.yml
+++ b/.buildkite/pipelines/build_api_docs.yml
@@ -6,7 +6,7 @@ steps:
     key: type_check
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: n2-standard-4
       preemptible: true
@@ -16,7 +16,7 @@ steps:
     label: 'Build API Docs'
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: n2-standard-4
       preemptible: true
@@ -33,7 +33,7 @@ steps:
     label: 'Publish API Docs'
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: n2-standard-4
       preemptible: true
diff --git a/.buildkite/pipelines/code_coverage/daily.yml b/.buildkite/pipelines/code_coverage/daily.yml
index 1160d7de5c9df3..cc63b002da5b18 100644
--- a/.buildkite/pipelines/code_coverage/daily.yml
+++ b/.buildkite/pipelines/code_coverage/daily.yml
@@ -4,7 +4,7 @@ steps:
     timeout_in_minutes: 10
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: n2-standard-2
 
@@ -14,7 +14,7 @@ steps:
     label: 'Pick Test Group Run Order'
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: n2-standard-2
     timeout_in_minutes: 10
@@ -28,7 +28,7 @@ steps:
     label: 'Merge and Ingest'
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: n2-standard-4
       preemptible: true
diff --git a/.buildkite/pipelines/es_serverless/verify_es_serverless_image.yml b/.buildkite/pipelines/es_serverless/verify_es_serverless_image.yml
index 23e490e88ec106..ee856a65fed93a 100644
--- a/.buildkite/pipelines/es_serverless/verify_es_serverless_image.yml
+++ b/.buildkite/pipelines/es_serverless/verify_es_serverless_image.yml
@@ -10,7 +10,7 @@
 
 agents:
   image: family/kibana-ubuntu-2004
-  imageProject: elastic-images-qa
+  imageProject: elastic-images-prod
   provider: gcp
   machineType: n2-standard-2
 
@@ -36,7 +36,7 @@ steps:
         timeout_in_minutes: 10
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-2
 
@@ -44,7 +44,7 @@ steps:
         command: .buildkite/scripts/steps/build_kibana.sh
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-16
         key: build
@@ -75,7 +75,7 @@ steps:
         if: "build.env('SKIP_CYPRESS') != '1' && build.env('SKIP_CYPRESS') != 'true'"
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -92,7 +92,7 @@ steps:
         if: "build.env('SKIP_CYPRESS') != '1' && build.env('SKIP_CYPRESS') != 'true'"
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -109,7 +109,7 @@ steps:
         if: "build.env('SKIP_CYPRESS') != '1' && build.env('SKIP_CYPRESS') != 'true'"
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -126,7 +126,7 @@ steps:
         if: "build.env('SKIP_CYPRESS') != '1' && build.env('SKIP_CYPRESS') != 'true'"
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -143,7 +143,7 @@ steps:
         if: "build.env('SKIP_CYPRESS') != '1' && build.env('SKIP_CYPRESS') != 'true'"
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -160,7 +160,7 @@ steps:
         if: "build.env('SKIP_CYPRESS') != '1' && build.env('SKIP_CYPRESS') != 'true'"
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -177,7 +177,7 @@ steps:
         if: "build.env('SKIP_CYPRESS') != '1' && build.env('SKIP_CYPRESS') != 'true'"
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -194,7 +194,7 @@ steps:
         if: "build.env('SKIP_CYPRESS') != '1' && build.env('SKIP_CYPRESS') != 'true'"
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -211,7 +211,7 @@ steps:
         if: "build.env('SKIP_CYPRESS') != '1' && build.env('SKIP_CYPRESS') != 'true'"
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           enableNestedVirtualization: true
           localSsds: 1
@@ -230,7 +230,7 @@ steps:
         if: "build.env('SKIP_CYPRESS') != '1' && build.env('SKIP_CYPRESS') != 'true'"
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
diff --git a/.buildkite/pipelines/es_snapshots/build.yml b/.buildkite/pipelines/es_snapshots/build.yml
index 5fcdae8dfc9865..1917750e602b1e 100644
--- a/.buildkite/pipelines/es_snapshots/build.yml
+++ b/.buildkite/pipelines/es_snapshots/build.yml
@@ -4,7 +4,7 @@ steps:
     timeout_in_minutes: 30
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       localSsds: 1
       localSsdInterface: nvme
diff --git a/.buildkite/pipelines/es_snapshots/promote.yml b/.buildkite/pipelines/es_snapshots/promote.yml
index 70df536a1fd2b3..d7b2a352c24a22 100644
--- a/.buildkite/pipelines/es_snapshots/promote.yml
+++ b/.buildkite/pipelines/es_snapshots/promote.yml
@@ -12,6 +12,6 @@ steps:
     command: .buildkite/scripts/steps/es_snapshots/promote.sh
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: n2-standard-2
diff --git a/.buildkite/pipelines/es_snapshots/verify.yml b/.buildkite/pipelines/es_snapshots/verify.yml
index 5321e12b9442d6..d91af527c8266e 100755
--- a/.buildkite/pipelines/es_snapshots/verify.yml
+++ b/.buildkite/pipelines/es_snapshots/verify.yml
@@ -16,7 +16,7 @@ steps:
     timeout_in_minutes: 10
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: n2-standard-2
 
@@ -26,7 +26,7 @@ steps:
     label: Build Kibana Distribution and Plugins
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: n2-standard-16
       preemptible: true
@@ -42,7 +42,7 @@ steps:
     label: 'Pick Test Group Run Order'
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: n2-standard-2
     timeout_in_minutes: 10
@@ -61,7 +61,7 @@ steps:
     timeout_in_minutes: 10
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: n2-standard-2
     depends_on:
@@ -76,6 +76,6 @@ steps:
     timeout_in_minutes: 10
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: n2-standard-2
diff --git a/.buildkite/pipelines/esql_grammar_sync.yml b/.buildkite/pipelines/esql_grammar_sync.yml
index ca924e18ad93b3..ffa532101cf3c4 100644
--- a/.buildkite/pipelines/esql_grammar_sync.yml
+++ b/.buildkite/pipelines/esql_grammar_sync.yml
@@ -4,7 +4,7 @@ steps:
     timeout_in_minutes: 10
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: n2-standard-2
       preemptible: true
diff --git a/.buildkite/pipelines/fips.yml b/.buildkite/pipelines/fips.yml
index 44e44ac69d8a43..d1dde1c08bfb1e 100644
--- a/.buildkite/pipelines/fips.yml
+++ b/.buildkite/pipelines/fips.yml
@@ -5,7 +5,7 @@ steps:
     label: Build Kibana Distribution and Plugins
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: n2-standard-16
       preemptible: true
@@ -23,7 +23,7 @@ steps:
     label: "Smoke testing for FIPS"
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       enableNestedVirtualization: true
       localSsds: 1
diff --git a/.buildkite/pipelines/flaky_tests/pipeline.ts b/.buildkite/pipelines/flaky_tests/pipeline.ts
index 63106c7fdeff2f..e311fed5af8517 100644
--- a/.buildkite/pipelines/flaky_tests/pipeline.ts
+++ b/.buildkite/pipelines/flaky_tests/pipeline.ts
@@ -48,7 +48,7 @@ const getAgentRule = (queueName: string = 'n2-4-spot') => {
     return {
       provider: 'gcp',
       image: 'family/kibana-ubuntu-2004',
-      imageProject: 'elastic-images-qa',
+      imageProject: 'elastic-images-prod',
       machineType: `${kind}-standard-${cores}`,
       ...additionalProps,
     };
diff --git a/.buildkite/pipelines/fleet/packages_daily.yml b/.buildkite/pipelines/fleet/packages_daily.yml
index 12d7b85f279195..682a40ef921f2f 100644
--- a/.buildkite/pipelines/fleet/packages_daily.yml
+++ b/.buildkite/pipelines/fleet/packages_daily.yml
@@ -4,7 +4,7 @@ steps:
     timeout_in_minutes: 10
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: n2-standard-2
 
@@ -14,7 +14,7 @@ steps:
     label: Install All Packages
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       localSsds: 1
       machineType: n2-standard-2
@@ -32,6 +32,6 @@ steps:
     command: .buildkite/scripts/lifecycle/post_build.sh
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: n2-standard-2
diff --git a/.buildkite/pipelines/on_merge.yml b/.buildkite/pipelines/on_merge.yml
index f8cba36ab85eee..77c4eef7afe44b 100644
--- a/.buildkite/pipelines/on_merge.yml
+++ b/.buildkite/pipelines/on_merge.yml
@@ -96,7 +96,9 @@ steps:
     label: 'Serverless Entity Analytics - Security Cypress Tests'
     agents:
       queue: n2-4-spot
-    depends_on: build
+    depends_on:
+      - build
+      - quick_checks
     timeout_in_minutes: 60
     parallelism: 2
     retry:
@@ -108,7 +110,9 @@ steps:
     label: 'Serverless Explore - Security Solution Cypress Tests'
     agents:
       queue: n2-4-spot
-    depends_on: build
+    depends_on:
+      - build
+      - quick_checks
     timeout_in_minutes: 60
     parallelism: 2
     retry:
@@ -120,7 +124,9 @@ steps:
     label: 'Serverless Investigations - Security Solution Cypress Tests'
     agents:
       queue: n2-4-spot
-    depends_on: build
+    depends_on:
+      - build
+      - quick_checks
     timeout_in_minutes: 60
     parallelism: 8
     retry:
@@ -132,7 +138,9 @@ steps:
     label: 'Serverless Rule Management - Security Solution Cypress Tests'
     agents:
       queue: n2-4-spot
-    depends_on: build
+    depends_on:
+      - build
+      - quick_checks
     timeout_in_minutes: 60
     parallelism: 5
     retry:
@@ -144,7 +152,9 @@ steps:
     label: 'Serverless Rule Management - Prebuilt Rules - Security Solution Cypress Tests'
     agents:
       queue: n2-4-spot
-    depends_on: build
+    depends_on:
+      - build
+      - quick_checks
     timeout_in_minutes: 60
     parallelism: 2
     retry:
@@ -156,7 +166,9 @@ steps:
     label: 'Rule Management - Security Solution Cypress Tests'
     agents:
       queue: n2-4-spot
-    depends_on: build
+    depends_on:
+      - build
+      - quick_checks
     timeout_in_minutes: 60
     parallelism: 4
     retry:
@@ -168,7 +180,9 @@ steps:
     label: 'Rule Management - Prebuilt Rules - Security Solution Cypress Tests'
     agents:
       queue: n2-4-spot
-    depends_on: build
+    depends_on:
+      - build
+      - quick_checks
     timeout_in_minutes: 60
     parallelism: 6
     retry:
@@ -180,7 +194,9 @@ steps:
     label: 'Serverless Detection Engine - Security Solution Cypress Tests'
     agents:
       queue: n2-4-spot
-    depends_on: build
+    depends_on:
+      - build
+      - quick_checks
     timeout_in_minutes: 60
     parallelism: 5
     retry:
@@ -192,7 +208,9 @@ steps:
     label: 'Serverless Detection Engine - Exceptions - Security Solution Cypress Tests'
     agents:
       queue: n2-4-spot
-    depends_on: build
+    depends_on:
+      - build
+      - quick_checks
     timeout_in_minutes: 60
     parallelism: 6
     retry:
@@ -204,7 +222,9 @@ steps:
     label: 'Detection Engine - Security Solution Cypress Tests'
     agents:
       queue: n2-4-spot
-    depends_on: build
+    depends_on:
+      - build
+      - quick_checks
     timeout_in_minutes: 60
     parallelism: 5
     retry:
@@ -216,7 +236,9 @@ steps:
     label: 'Detection Engine - Exceptions - Security Solution Cypress Tests'
     agents:
       queue: n2-4-spot
-    depends_on: build
+    depends_on:
+      - build
+      - quick_checks
     timeout_in_minutes: 60
     parallelism: 6
     retry:
@@ -228,7 +250,9 @@ steps:
     label: 'Serverless AI Assistant - Security Solution Cypress Tests'
     agents:
       queue: n2-4-spot
-    depends_on: build
+    depends_on:
+      - build
+      - quick_checks
     timeout_in_minutes: 60
     parallelism: 1
     retry:
@@ -240,7 +264,9 @@ steps:
     label: 'AI Assistant - Security Solution Cypress Tests'
     agents:
       queue: n2-4-spot
-    depends_on: build
+    depends_on:
+      - build
+      - quick_checks
     timeout_in_minutes: 60
     parallelism: 1
     retry:
@@ -252,7 +278,9 @@ steps:
     label: 'Entity Analytics - Security Solution Cypress Tests'
     agents:
       queue: n2-4-spot
-    depends_on: build
+    depends_on:
+      - build
+      - quick_checks
     timeout_in_minutes: 60
     parallelism: 2
     retry:
@@ -264,7 +292,9 @@ steps:
     label: 'Explore - Security Solution Cypress Tests'
     agents:
       queue: n2-4-spot
-    depends_on: build
+    depends_on:
+      - build
+      - quick_checks
     timeout_in_minutes: 60
     parallelism: 3
     retry:
@@ -276,7 +306,9 @@ steps:
     label: 'Investigations - Security Solution Cypress Tests'
     agents:
       queue: n2-4-spot
-    depends_on: build
+    depends_on:
+      - build
+      - quick_checks
     timeout_in_minutes: 60
     parallelism: 7
     retry:
@@ -288,7 +320,9 @@ steps:
     label: 'Threat Intelligence Cypress Tests'
     agents:
       queue: n2-4-spot
-    depends_on: build
+    depends_on:
+      - build
+      - quick_checks
     timeout_in_minutes: 60
     parallelism: 1
     retry:
@@ -300,7 +334,9 @@ steps:
     label: 'Osquery Cypress Tests'
     agents:
       queue: n2-4-spot
-    depends_on: build
+    depends_on:
+      - build
+      - quick_checks
     timeout_in_minutes: 60
     parallelism: 8
     retry:
@@ -312,7 +348,9 @@ steps:
     label: 'Serverless Osquery Cypress Tests'
     agents:
       queue: n2-4-spot
-    depends_on: build
+    depends_on:
+      - build
+      - quick_checks
     timeout_in_minutes: 60
     parallelism: 8
     retry:
@@ -326,6 +364,7 @@ steps:
       queue: n2-4-virt
     depends_on:
       - build
+      - quick_checks
     timeout_in_minutes: 60
     parallelism: 20
     retry:
@@ -339,6 +378,7 @@ steps:
       queue: n2-4-virt
     depends_on:
       - build
+      - quick_checks
     timeout_in_minutes: 60
     parallelism: 14
     retry:
@@ -351,6 +391,7 @@ steps:
     timeout_in_minutes: 10
     depends_on:
       - build
+      - quick_checks
     agents:
       queue: 'kibana-default'
 
diff --git a/.buildkite/pipelines/on_merge_unsupported_ftrs.yml b/.buildkite/pipelines/on_merge_unsupported_ftrs.yml
index 63ffb98d2858d1..24fc59fdbe26a7 100644
--- a/.buildkite/pipelines/on_merge_unsupported_ftrs.yml
+++ b/.buildkite/pipelines/on_merge_unsupported_ftrs.yml
@@ -4,7 +4,7 @@ steps:
     timeout_in_minutes: 10
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: n2-standard-2
     retry:
@@ -16,7 +16,7 @@ steps:
     label: Build Kibana Distribution and Plugins
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: n2-standard-16
       preemptible: true
@@ -32,7 +32,7 @@ steps:
     label: 'APM Cypress Tests'
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: n2-standard-4
       preemptible: true
@@ -49,7 +49,7 @@ steps:
     label: 'Profiling Cypress Tests'
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: n2-standard-4
       preemptible: true
@@ -66,7 +66,7 @@ steps:
     label: 'Synthetics @elastic/synthetics Tests'
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: n2-standard-4
       preemptible: true
@@ -85,7 +85,7 @@ steps:
     label: 'Defend Workflows Cypress Tests'
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       enableNestedVirtualization: true
       localSsdInterface: nvme
@@ -103,7 +103,7 @@ steps:
     label: 'Defend Workflows Cypress Tests on Serverless'
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       enableNestedVirtualization: true
       localSsdInterface: nvme
diff --git a/.buildkite/pipelines/performance/daily.yml b/.buildkite/pipelines/performance/daily.yml
index a9a350729e5c69..bbbdde955df760 100644
--- a/.buildkite/pipelines/performance/daily.yml
+++ b/.buildkite/pipelines/performance/daily.yml
@@ -3,7 +3,7 @@ steps:
     command: .buildkite/scripts/lifecycle/pre_build.sh
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: n2-standard-2
 
@@ -13,7 +13,7 @@ steps:
     command: .buildkite/scripts/steps/build_kibana.sh
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: c2-standard-16
     key: build
@@ -33,7 +33,7 @@ steps:
     command: .buildkite/scripts/steps/functional/report_performance_metrics.sh
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       localSsds: 1
       localSsdInterface: nvme
@@ -47,6 +47,6 @@ steps:
     command: .buildkite/scripts/lifecycle/post_build.sh
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: n2-standard-2
diff --git a/.buildkite/pipelines/performance/data_set_extraction_daily.yml b/.buildkite/pipelines/performance/data_set_extraction_daily.yml
index 34a5c680988dd4..bb2c33f7a2d335 100644
--- a/.buildkite/pipelines/performance/data_set_extraction_daily.yml
+++ b/.buildkite/pipelines/performance/data_set_extraction_daily.yml
@@ -3,7 +3,7 @@ steps:
     command: .buildkite/scripts/lifecycle/pre_build.sh
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: n2-standard-2
     timeout_in_minutes: 10
@@ -14,7 +14,7 @@ steps:
     command: .buildkite/scripts/steps/build_kibana.sh
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: c2-standard-16
     key: build
@@ -24,7 +24,7 @@ steps:
     command: .buildkite/scripts/steps/functional/performance_playwright.sh
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: n2-standard-2
       preemptible: true
@@ -42,7 +42,7 @@ steps:
     command: .buildkite/scripts/steps/functional/scalability_dataset_extraction.sh
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       localSsds: 1
       localSsdInterface: nvme
@@ -56,6 +56,6 @@ steps:
     command: .buildkite/scripts/lifecycle/post_build.sh
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: n2-standard-2
diff --git a/.buildkite/pipelines/pull_request/base.yml b/.buildkite/pipelines/pull_request/base.yml
index e36e3ab5f59ddd..b3e5817dfd783a 100644
--- a/.buildkite/pipelines/pull_request/base.yml
+++ b/.buildkite/pipelines/pull_request/base.yml
@@ -74,6 +74,7 @@ steps:
     label: 'Check Types'
     agents:
       queue: n2-4-spot
+    key: check_types
     timeout_in_minutes: 60
     retry:
       automatic:
@@ -93,6 +94,7 @@ steps:
 
   - command: .buildkite/scripts/steps/checks.sh
     label: 'Checks'
+    key: checks
     agents:
       queue: n2-2-spot
     timeout_in_minutes: 60
diff --git a/.buildkite/pipelines/pull_request/deploy_project.yml b/.buildkite/pipelines/pull_request/deploy_project.yml
index 5d6e442542304b..0aacf9b46c48d4 100644
--- a/.buildkite/pipelines/pull_request/deploy_project.yml
+++ b/.buildkite/pipelines/pull_request/deploy_project.yml
@@ -1,6 +1,7 @@
 steps:
-  - command: .buildkite/scripts/steps/serverless/build_and_deploy.sh
-    label: 'Build and Deploy Project'
+  - command: .buildkite/scripts/steps/artifacts/docker_image.sh
+    label: 'Build Project Image'
+    key: build_project_image
     agents:
       queue: n2-16-spot
     timeout_in_minutes: 60
@@ -9,3 +10,15 @@ steps:
       automatic:
         - exit_status: '-1'
           limit: 3
+  - command: .buildkite/scripts/steps/serverless/deploy.sh
+    label: 'Deploy Project'
+    agents:
+      queue: kibana-default
+    timeout_in_minutes: 10
+    depends_on:
+      - build_project_image
+      - linting
+      - linting_with_types
+      - checks
+      - check_types
+    soft_fail: true
diff --git a/.buildkite/pipelines/purge_cloud_deployments.yml b/.buildkite/pipelines/purge_cloud_deployments.yml
index 44060b056f8b63..bce1ea165e4b0a 100644
--- a/.buildkite/pipelines/purge_cloud_deployments.yml
+++ b/.buildkite/pipelines/purge_cloud_deployments.yml
@@ -4,6 +4,6 @@ steps:
     timeout_in_minutes: 10
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: n2-standard-2
diff --git a/.buildkite/pipelines/scalability/api_capacity_testing_daily.yml b/.buildkite/pipelines/scalability/api_capacity_testing_daily.yml
index cc20be1f025c03..785726bf95174c 100644
--- a/.buildkite/pipelines/scalability/api_capacity_testing_daily.yml
+++ b/.buildkite/pipelines/scalability/api_capacity_testing_daily.yml
@@ -3,7 +3,7 @@ steps:
     command: .buildkite/scripts/lifecycle/pre_build.sh
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: n2-standard-2
 
@@ -13,7 +13,7 @@ steps:
     command: .buildkite/scripts/steps/build_kibana.sh
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: n2-standard-16
       preemptible: true
@@ -43,6 +43,6 @@ steps:
     command: .buildkite/scripts/lifecycle/post_build.sh
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: n2-standard-2
diff --git a/.buildkite/pipelines/scalability/daily.yml b/.buildkite/pipelines/scalability/daily.yml
index 8499212347c569..feaef532634552 100644
--- a/.buildkite/pipelines/scalability/daily.yml
+++ b/.buildkite/pipelines/scalability/daily.yml
@@ -3,7 +3,7 @@ steps:
     command: .buildkite/scripts/lifecycle/pre_build.sh
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: n2-standard-2
     timeout_in_minutes: 10
@@ -27,7 +27,7 @@ steps:
     command: .buildkite/scripts/lifecycle/post_build.sh
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: n2-standard-2
     timeout_in_minutes: 10
diff --git a/.buildkite/pipelines/security_solution/api_integration.yml b/.buildkite/pipelines/security_solution/api_integration.yml
index 0ce0e4a1902f69..abf8d4f3f9e59c 100644
--- a/.buildkite/pipelines/security_solution/api_integration.yml
+++ b/.buildkite/pipelines/security_solution/api_integration.yml
@@ -4,7 +4,7 @@ steps:
     key: upload_runtime_info
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: n2-standard-4
       preemptible: true
diff --git a/.buildkite/pipelines/security_solution/api_integration_serverless_periodic.yml b/.buildkite/pipelines/security_solution/api_integration_serverless_periodic.yml
index fc994511cd1099..56edb10fb64a50 100644
--- a/.buildkite/pipelines/security_solution/api_integration_serverless_periodic.yml
+++ b/.buildkite/pipelines/security_solution/api_integration_serverless_periodic.yml
@@ -7,7 +7,7 @@ steps:
         key: exception_workflows:essentials:qa:serverless
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -22,7 +22,7 @@ steps:
         key: exception_operators_date_numeric_types:essentials:qa:serverless
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -37,7 +37,7 @@ steps:
         key: exception_operators_keyword:essentials:qa:serverless
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -52,7 +52,7 @@ steps:
         key: exception_operators_ips:essentials:qa:serverless
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -67,7 +67,7 @@ steps:
         key: exception_operators_long:essentials:qa:serverless
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -82,7 +82,7 @@ steps:
         key: exception_operators_text:essentials:qa:serverless
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -97,7 +97,7 @@ steps:
         key: alerts:qa:serverless
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -112,7 +112,7 @@ steps:
         key: alerts:essentials:qa:serverless
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -127,7 +127,7 @@ steps:
         key: actions:qa:serverless
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -142,7 +142,7 @@ steps:
         key: genai:qa:serverless
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -157,7 +157,7 @@ steps:
         key: rule_execution_logic:qa:serverless
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -172,7 +172,7 @@ steps:
         key: rule_patch:qa:serverless
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -187,7 +187,7 @@ steps:
         key: rule_patch:essentials:qa:serverless
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -202,7 +202,7 @@ steps:
         key: rule_update:qa:serverless
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -217,7 +217,7 @@ steps:
         key: rule_update:essentials:qa:serverless
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -232,7 +232,7 @@ steps:
         key: rules_management:essentials:qa:serverless
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -247,7 +247,7 @@ steps:
         key: prebuilt_rules_management:qa:serverless
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -262,7 +262,7 @@ steps:
         key: prebuilt_rules_bundled_prebuilt_rules_package:qa:serverless
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -277,7 +277,7 @@ steps:
         key: prebuilt_rules_large_prebuilt_rules_package:qa:serverless
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -292,7 +292,7 @@ steps:
         key: prebuilt_rules_update_prebuilt_rules_package:qa:serverless
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -307,7 +307,7 @@ steps:
         key: rule_bulk_actions:qa:serverless
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -322,7 +322,7 @@ steps:
         key: rule_read:qa:serverless
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -337,7 +337,7 @@ steps:
         key: rule_import_export:essentials:qa:serverless
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -352,7 +352,7 @@ steps:
         key: rule_import_export:qa:serverless
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -367,7 +367,7 @@ steps:
         key: rule_management:qa:serverless
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -382,7 +382,7 @@ steps:
         key: rule_read:essentials:qa:serverless
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -397,7 +397,7 @@ steps:
         key: rule_creation:qa:serverless
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -412,7 +412,7 @@ steps:
         key: rule_creation:essentials:qa:serverless
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -427,7 +427,7 @@ steps:
         key: rule_delete:qa:serverless
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -442,7 +442,7 @@ steps:
         key: rule_delete:essentials:qa:serverless
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -457,7 +457,7 @@ steps:
         key: exception_lists_items:qa:serverless
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -472,7 +472,7 @@ steps:
         key: lists_items:qa:serverless
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -487,7 +487,7 @@ steps:
         key: user_roles:qa:serverless
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -502,7 +502,7 @@ steps:
         key: telemetry:qa:serverless
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -517,7 +517,7 @@ steps:
         key: entity_analytics:qa:serverless
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
diff --git a/.buildkite/pipelines/security_solution/api_integration_serverless_release.yml b/.buildkite/pipelines/security_solution/api_integration_serverless_release.yml
index 045f4b5b662dbc..6d2a8c17168926 100644
--- a/.buildkite/pipelines/security_solution/api_integration_serverless_release.yml
+++ b/.buildkite/pipelines/security_solution/api_integration_serverless_release.yml
@@ -7,7 +7,7 @@ steps:
         key: exception_workflows:essentials:qa:serverless:release
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -22,7 +22,7 @@ steps:
         key: exception_operators_date_numeric_types:essentials:qa:serverless:release
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -37,7 +37,7 @@ steps:
         key: exception_operators_keyword:essentials:qa:serverless:release
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -52,7 +52,7 @@ steps:
         key: exception_operators_ips:essentials:qa:serverless:release
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -67,7 +67,7 @@ steps:
         key: exception_operators_long:essentials:qa:serverless:release
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -82,7 +82,7 @@ steps:
         key: exception_operators_text:essentials:qa:serverless:release
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -97,7 +97,7 @@ steps:
         key: alerts:qa:serverless:release
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -112,7 +112,7 @@ steps:
         key: alerts:essentials:qa:serverless:release
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -127,7 +127,7 @@ steps:
         key: actions:qa:serverless:release
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -142,7 +142,7 @@ steps:
         key: genai:qa:serverless:release
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -157,7 +157,7 @@ steps:
         key: rule_execution_logic:qa:serverless:release
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -172,7 +172,7 @@ steps:
         key: rule_patch:qa:serverless:release
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -187,7 +187,7 @@ steps:
         key: rule_patch:essentials:qa:serverless:release
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -202,7 +202,7 @@ steps:
         key: rule_update:qa:serverless:release
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -217,7 +217,7 @@ steps:
         key: rule_update:essentials:qa:serverless:release
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -232,7 +232,7 @@ steps:
         key: rules_management:essentials:qa:serverless:release
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -247,7 +247,7 @@ steps:
         key: prebuilt_rules_management:qa:serverless:release
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -262,7 +262,7 @@ steps:
         key: prebuilt_rules_bundled_prebuilt_rules_package:qa:serverless:release
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -277,7 +277,7 @@ steps:
         key: prebuilt_rules_large_prebuilt_rules_package:qa:serverless:release
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -292,7 +292,7 @@ steps:
         key: prebuilt_rules_update_prebuilt_rules_package:qa:serverless:release
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -307,7 +307,7 @@ steps:
         key: rule_bulk_actions:qa:serverless:release
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -322,7 +322,7 @@ steps:
         key: rule_read:qa:serverless:release
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -337,7 +337,7 @@ steps:
         key: rule_import_export:essentials:qa:serverless:release
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -352,7 +352,7 @@ steps:
         key: rule_import_export:qa:serverless:release
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -367,7 +367,7 @@ steps:
         key: rule_management:qa:serverless:release
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -382,7 +382,7 @@ steps:
         key: rule_read:essentials:qa:serverless:release
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -397,7 +397,7 @@ steps:
         key: rule_creation:qa:serverless:release
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -412,7 +412,7 @@ steps:
         key: rule_creation:essentials:qa:serverless:release
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -427,7 +427,7 @@ steps:
         key: rule_delete:qa:serverless:release
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -442,7 +442,7 @@ steps:
         key: rule_delete:essentials:qa:serverless:release
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -457,7 +457,7 @@ steps:
         key: exception_lists_items:qa:serverless:release
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -472,7 +472,7 @@ steps:
         key: lists_items:qa:serverless:release
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -487,7 +487,7 @@ steps:
         key: user_roles:qa:serverless:release
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -502,7 +502,7 @@ steps:
         key: telemetry:qa:serverless:release
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
@@ -517,7 +517,7 @@ steps:
         key: entity_analytics:qa:serverless:release
         agents:
           image: family/kibana-ubuntu-2004
-          imageProject: elastic-images-qa
+          imageProject: elastic-images-prod
           provider: gcp
           machineType: n2-standard-4
           preemptible: true
diff --git a/.buildkite/pipelines/security_solution_quality_gate/mki_security_solution_defend_workflows.yml b/.buildkite/pipelines/security_solution_quality_gate/mki_security_solution_defend_workflows.yml
index 87906082ec5aaf..ec829a5dd4e452 100644
--- a/.buildkite/pipelines/security_solution_quality_gate/mki_security_solution_defend_workflows.yml
+++ b/.buildkite/pipelines/security_solution_quality_gate/mki_security_solution_defend_workflows.yml
@@ -4,7 +4,7 @@ steps:
     key: upload_runtime_info
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: n2-standard-4
       preemptible: true
@@ -19,7 +19,7 @@ steps:
     key: test_defend_workflows
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       enableNestedVirtualization: true
       localSsds: 1
diff --git a/.buildkite/pipelines/security_solution_quality_gate/mki_security_solution_detection_engine.yml b/.buildkite/pipelines/security_solution_quality_gate/mki_security_solution_detection_engine.yml
index a57659281d731c..f9ad0d58177834 100644
--- a/.buildkite/pipelines/security_solution_quality_gate/mki_security_solution_detection_engine.yml
+++ b/.buildkite/pipelines/security_solution_quality_gate/mki_security_solution_detection_engine.yml
@@ -4,7 +4,7 @@ steps:
     key: upload_runtime_info
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: n2-standard-4
       preemptible: true
@@ -21,7 +21,7 @@ steps:
       BK_TEST_SUITE_KEY: "serverless-cypress-detection-engine"
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: n2-standard-4
       preemptible: true
@@ -40,7 +40,7 @@ steps:
       BK_TEST_SUITE_KEY: "serverless-cypress-detection-engine"
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: n2-standard-4
       preemptible: true
diff --git a/.buildkite/pipelines/security_solution_quality_gate/mki_security_solution_entity_analytics.yml b/.buildkite/pipelines/security_solution_quality_gate/mki_security_solution_entity_analytics.yml
index 97947ed98fd24c..9c553176429d04 100644
--- a/.buildkite/pipelines/security_solution_quality_gate/mki_security_solution_entity_analytics.yml
+++ b/.buildkite/pipelines/security_solution_quality_gate/mki_security_solution_entity_analytics.yml
@@ -4,7 +4,7 @@ steps:
     key: upload_runtime_info
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: n2-standard-4
       preemptible: true
@@ -21,7 +21,7 @@ steps:
       BK_TEST_SUITE_KEY: "serverless-cypress-entity-analytics"
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: n2-standard-4
       preemptible: true
diff --git a/.buildkite/pipelines/security_solution_quality_gate/mki_security_solution_explore.yml b/.buildkite/pipelines/security_solution_quality_gate/mki_security_solution_explore.yml
index 95a87db37bb31e..6d5e47e96054f9 100644
--- a/.buildkite/pipelines/security_solution_quality_gate/mki_security_solution_explore.yml
+++ b/.buildkite/pipelines/security_solution_quality_gate/mki_security_solution_explore.yml
@@ -4,7 +4,7 @@ steps:
     key: upload_runtime_info
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: n2-standard-4
       preemptible: true
@@ -21,7 +21,7 @@ steps:
       BK_TEST_SUITE_KEY: "serverless-cypress-explore"
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: n2-standard-4
       preemptible: true
diff --git a/.buildkite/pipelines/security_solution_quality_gate/mki_security_solution_gen_ai.yml b/.buildkite/pipelines/security_solution_quality_gate/mki_security_solution_gen_ai.yml
index 90018caab7024f..d6ac5cd764a6f5 100644
--- a/.buildkite/pipelines/security_solution_quality_gate/mki_security_solution_gen_ai.yml
+++ b/.buildkite/pipelines/security_solution_quality_gate/mki_security_solution_gen_ai.yml
@@ -4,7 +4,7 @@ steps:
     key: upload_runtime_info
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: n2-standard-4
       preemptible: true
@@ -21,7 +21,7 @@ steps:
       BK_TEST_SUITE_KEY: "serverless-cypress-gen-ai"
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: n2-standard-4
       preemptible: true
diff --git a/.buildkite/pipelines/security_solution_quality_gate/mki_security_solution_investigations.yml b/.buildkite/pipelines/security_solution_quality_gate/mki_security_solution_investigations.yml
index 39f4b66d5c6072..504cb562b02b0d 100644
--- a/.buildkite/pipelines/security_solution_quality_gate/mki_security_solution_investigations.yml
+++ b/.buildkite/pipelines/security_solution_quality_gate/mki_security_solution_investigations.yml
@@ -4,7 +4,7 @@ steps:
     key: upload_runtime_info
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: n2-standard-4
       preemptible: true
@@ -21,7 +21,7 @@ steps:
       BK_TEST_SUITE_KEY: "serverless-cypress-investigations"
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: n2-standard-4
       preemptible: true
diff --git a/.buildkite/pipelines/security_solution_quality_gate/mki_security_solution_rule_management.yml b/.buildkite/pipelines/security_solution_quality_gate/mki_security_solution_rule_management.yml
index 933d7b2de0ac50..bc46cdffb36278 100644
--- a/.buildkite/pipelines/security_solution_quality_gate/mki_security_solution_rule_management.yml
+++ b/.buildkite/pipelines/security_solution_quality_gate/mki_security_solution_rule_management.yml
@@ -4,7 +4,7 @@ steps:
     key: upload_runtime_info
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: n2-standard-4
       preemptible: true
@@ -21,7 +21,7 @@ steps:
       BK_TEST_SUITE_KEY: "serverless-cypress-rule-management"
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: n2-standard-4
       preemptible: true
@@ -40,7 +40,7 @@ steps:
       BK_TEST_SUITE_KEY: "serverless-cypress-rule-management"
     agents:
       image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-qa
+      imageProject: elastic-images-prod
       provider: gcp
       machineType: n2-standard-4
       preemptible: true
diff --git a/.buildkite/pipelines/serverless_deployment/run_serverless_release_assistant.yml b/.buildkite/pipelines/serverless_deployment/run_serverless_release_assistant.yml
index 555b50efb22941..734b87aa6cef98 100644
--- a/.buildkite/pipelines/serverless_deployment/run_serverless_release_assistant.yml
+++ b/.buildkite/pipelines/serverless_deployment/run_serverless_release_assistant.yml
@@ -4,7 +4,7 @@
 
 agents:
   image: family/kibana-ubuntu-2004
-  imageProject: elastic-images-qa
+  imageProject: elastic-images-prod
   provider: gcp
   machineType: n2-standard-2
 
diff --git a/.buildkite/scripts/lifecycle/post_command.sh b/.buildkite/scripts/lifecycle/post_command.sh
index 218184d36f65ab..b22293dbcb8b68 100755
--- a/.buildkite/scripts/lifecycle/post_command.sh
+++ b/.buildkite/scripts/lifecycle/post_command.sh
@@ -43,7 +43,10 @@ if [[ "$IS_TEST_EXECUTION_STEP" == "true" ]]; then
   buildkite-agent artifact upload '.es/**/*.hprof'
   buildkite-agent artifact upload 'data/es_debug_*.tar.gz'
 
-  if [[ $BUILDKITE_COMMAND_EXIT_STATUS -ne 0 ]]; then
+  if [[ $BUILDKITE_COMMAND_EXIT_STATUS -ne 0 ]] && \
+      # Skip when triggered from elasticsearch's validation pipeline
+     [[ $BUILDKITE_TRIGGERED_FROM_BUILD_PIPELINE_SLUG != 'elasticsearch-serverless-intake' ]]
+  then
     echo "--- Run Failed Test Reporter"
     node scripts/report_failed_tests --build-url="${BUILDKITE_BUILD_URL}#${BUILDKITE_JOB_ID}" 'target/junit/**/*.xml'
   fi
diff --git a/.buildkite/scripts/steps/serverless/build_and_deploy.sh b/.buildkite/scripts/steps/serverless/deploy.sh
similarity index 96%
rename from .buildkite/scripts/steps/serverless/build_and_deploy.sh
rename to .buildkite/scripts/steps/serverless/deploy.sh
index 8fb982c11d9bfa..11191e803509cf 100644
--- a/.buildkite/scripts/steps/serverless/build_and_deploy.sh
+++ b/.buildkite/scripts/steps/serverless/deploy.sh
@@ -4,8 +4,8 @@ set -euo pipefail
 
 
 source .buildkite/scripts/common/util.sh
-source .buildkite/scripts/steps/artifacts/docker_image.sh
 
+KIBANA_IMAGE="docker.elastic.co/kibana-ci/kibana-serverless:pr-$BUILDKITE_PULL_REQUEST-${BUILDKITE_COMMIT:0:12}"
 
 deploy() {
   PROJECT_TYPE=$1
@@ -154,7 +154,7 @@ $BUILDKITE_PULL_REQUEST
 
 ### Further details
 
-Caused by @$GITHUB_PR_TRIGGER_USER using the github label in https://github.com/elastic/kibana/pull/$BUILDKITE_PULL_REQUEST
+Caused by the GitHub label 'ci:project-deploy-observability' in https://github.com/elastic/kibana/pull/$BUILDKITE_PULL_REQUEST
 EOF
 
   GH_TOKEN="$GITHUB_TOKEN" \
diff --git a/.buildkite/scripts/steps/test/jest_parallel.sh b/.buildkite/scripts/steps/test/jest_parallel.sh
index d8c05bb3cea2f1..2a7cf780f57873 100755
--- a/.buildkite/scripts/steps/test/jest_parallel.sh
+++ b/.buildkite/scripts/steps/test/jest_parallel.sh
@@ -57,7 +57,10 @@ echo "
 while read -r config; do
   echo "--- $ node scripts/jest --config $config"
 
-  cmd="NODE_OPTIONS=\"--max-old-space-size=14336\" node ./scripts/jest --config=\"$config\" $parallelism --coverage=false --passWithNoTests"
+  # --trace-warnings to debug
+  # Node.js process-warning detected:
+  # Warning: Closing file descriptor 24 on garbage collection
+  cmd="NODE_OPTIONS=\"--max-old-space-size=12288 --trace-warnings\" node ./scripts/jest --config=\"$config\" $parallelism --coverage=false --passWithNoTests"
   echo "actual full command is:"
   echo "$cmd"
   echo ""
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index c503ad05d345dd..d8e8361061b78d 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -406,6 +406,7 @@ packages/kbn-eslint-plugin-telemetry @elastic/obs-knowledge-team
 examples/eso_model_version_example @elastic/kibana-security
 x-pack/test/encrypted_saved_objects_api_integration/plugins/api_consumer_plugin @elastic/kibana-security
 packages/kbn-esql-ast @elastic/kibana-esql
+examples/esql_ast_inspector @elastic/kibana-esql
 packages/kbn-esql-utils @elastic/kibana-esql
 packages/kbn-esql-validation-autocomplete @elastic/kibana-esql
 examples/esql_validation_example @elastic/kibana-esql
@@ -532,6 +533,7 @@ examples/locator_examples @elastic/appex-sharedux
 examples/locator_explorer @elastic/appex-sharedux
 packages/kbn-logging @elastic/kibana-core
 packages/kbn-logging-mocks @elastic/kibana-core
+x-pack/plugins/observability_solution/logs_data_access @elastic/obs-ux-logs-team
 x-pack/plugins/observability_solution/logs_explorer @elastic/obs-ux-logs-team
 x-pack/plugins/observability_solution/logs_shared @elastic/obs-ux-logs-team
 x-pack/plugins/logstash @elastic/logstash
@@ -1028,10 +1030,9 @@ packages/kbn-monaco/src/esql @elastic/kibana-esql
 
 ### Observability Plugins
 
-# Observability robots
-/.github/workflows/deploy-my-kibana.yml @elastic/observablt-robots
-/.github/workflows/undeploy-my-kibana.yml @elastic/observablt-robots
-/.github/workflows/oblt-github-commands @elastic/observablt-robots
+# Observability AI Assistant
+x-pack/test/observability_ai_assistant_api_integration @elastic/obs-ai-assistant
+x-pack/test/observability_ai_assistant_functional @elastic/obs-ai-assistant
 
 # Infra Monitoring
 ## This plugin mostly contains the codebase for the infra services, but also includes some code for the Logs UI app.
@@ -1378,6 +1379,9 @@ x-pack/plugins/cloud_integrations/cloud_full_story/server/config.ts @elastic/kib
 x-pack/test/security_solution_api_integration/test_suites/detections_response/utils @elastic/security-detections-response
 x-pack/test/security_solution_api_integration/test_suites/detections_response/telemetry @elastic/security-detections-response
 x-pack/test/security_solution_api_integration/test_suites/detections_response/user_roles @elastic/security-detections-response
+x-pack/test/security_solution_api_integration/test_suites/explore @elastic/security-threat-hunting-explore
+x-pack/test/security_solution_api_integration/test_suites/investigations @elastic/security-threat-hunting-investigations
+x-pack/test/security_solution_api_integration/test_suites/sources @elastic/security-detections-response
 
 # Security Solution sub teams
 
@@ -1432,6 +1436,7 @@ x-pack/test/security_solution_cypress/cypress/tasks/expandable_flyout  @elastic/
 /x-pack/test/security_solution_cypress/cypress/tasks/hosts @elastic/security-threat-hunting-explore
 /x-pack/test/security_solution_cypress/cypress/tasks/network @elastic/security-threat-hunting-explore
 
+/x-pack/plugins/security_solution/public/app/actions @elastic/security-threat-hunting-explore
 /x-pack/plugins/security_solution/public/common/components/guided_onboarding_tour @elastic/security-threat-hunting-explore
 /x-pack/plugins/security_solution/public/common/components/charts @elastic/security-threat-hunting-explore
 /x-pack/plugins/security_solution/public/detections/components/alerts_table/grouping_settings @elastic/security-threat-hunting-explore
@@ -1686,6 +1691,11 @@ x-pack/plugins/observability_solution/synthetics/server/saved_objects/saved_obje
 x-pack/plugins/observability_solution/synthetics/server/saved_objects/synthetics_monitor.ts @elastic/obs-ux-infra_services-team @elastic/kibana-security
 x-pack/plugins/observability_solution/synthetics/server/saved_objects/synthetics_param.ts @elastic/obs-ux-infra_services-team @elastic/kibana-security
 
+# Specialised GitHub workflows for the Observability robots
+/.github/workflows/deploy-my-kibana.yml   @elastic/observablt-robots @elastic/kibana-operations
+/.github/workflows/oblt-github-commands   @elastic/observablt-robots @elastic/kibana-operations
+/.github/workflows/undeploy-my-kibana.yml @elastic/observablt-robots @elastic/kibana-operations
+
 ####
 ## These rules are always last so they take ultimate priority over everything else
 ####
diff --git a/.github/workflows/undeploy-my-kibana.yml b/.github/workflows/undeploy-my-kibana.yml
index a288702cbb537d..778ab4c73e302e 100644
--- a/.github/workflows/undeploy-my-kibana.yml
+++ b/.github/workflows/undeploy-my-kibana.yml
@@ -10,7 +10,7 @@
 name: undeploy-my-kibana
 
 on:
-  pull_request:
+  pull_request_target:
     types: [closed]
 
 permissions:
diff --git a/.i18nrc.json b/.i18nrc.json
index 1a29b7b9ed68da..4d546716ffe2e8 100644
--- a/.i18nrc.json
+++ b/.i18nrc.json
@@ -96,6 +96,7 @@
     "randomSampling": "x-pack/packages/kbn-random-sampling",
     "reactPackages": "packages/react",
     "textBasedEditor": "packages/kbn-text-based-editor",
+    "esqlUtils": "packages/kbn-esql-utils",
     "reporting": "packages/kbn-reporting",
     "savedObjects": "src/plugins/saved_objects",
     "savedObjectsFinder": "src/plugins/saved_objects_finder",
diff --git a/api_docs/actions.mdx b/api_docs/actions.mdx
index 0024b7036c12d4..451c1b1ea22f9f 100644
--- a/api_docs/actions.mdx
+++ b/api_docs/actions.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/actions
 title: "actions"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the actions plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'actions']
 ---
 import actionsObj from './actions.devdocs.json';
diff --git a/api_docs/advanced_settings.mdx b/api_docs/advanced_settings.mdx
index 40537f6bc3efa8..ac55b2bb8314eb 100644
--- a/api_docs/advanced_settings.mdx
+++ b/api_docs/advanced_settings.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/advancedSettings
 title: "advancedSettings"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the advancedSettings plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'advancedSettings']
 ---
 import advancedSettingsObj from './advanced_settings.devdocs.json';
diff --git a/api_docs/ai_assistant_management_selection.mdx b/api_docs/ai_assistant_management_selection.mdx
index 9c66f645d9e99f..b7584372154ca8 100644
--- a/api_docs/ai_assistant_management_selection.mdx
+++ b/api_docs/ai_assistant_management_selection.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/aiAssistantManagementSelection
 title: "aiAssistantManagementSelection"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the aiAssistantManagementSelection plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'aiAssistantManagementSelection']
 ---
 import aiAssistantManagementSelectionObj from './ai_assistant_management_selection.devdocs.json';
diff --git a/api_docs/aiops.mdx b/api_docs/aiops.mdx
index 535eaf0b3c3d67..e0492be8f792d4 100644
--- a/api_docs/aiops.mdx
+++ b/api_docs/aiops.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/aiops
 title: "aiops"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the aiops plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'aiops']
 ---
 import aiopsObj from './aiops.devdocs.json';
diff --git a/api_docs/alerting.devdocs.json b/api_docs/alerting.devdocs.json
index c1009c6c43b1c2..7f1c75d19103a6 100644
--- a/api_docs/alerting.devdocs.json
+++ b/api_docs/alerting.devdocs.json
@@ -6400,6 +6400,54 @@
         "returnComment": [],
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "alerting",
+        "id": "def-common.validateBackfillSchedule",
+        "type": "Function",
+        "tags": [],
+        "label": "validateBackfillSchedule",
+        "description": [],
+        "signature": [
+          "(start: string, end: string | undefined) => string | void"
+        ],
+        "path": "x-pack/plugins/alerting/common/lib/validate_backfill_schedule.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "alerting",
+            "id": "def-common.validateBackfillSchedule.$1",
+            "type": "string",
+            "tags": [],
+            "label": "start",
+            "description": [],
+            "signature": [
+              "string"
+            ],
+            "path": "x-pack/plugins/alerting/common/lib/validate_backfill_schedule.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "isRequired": true
+          },
+          {
+            "parentPluginId": "alerting",
+            "id": "def-common.validateBackfillSchedule.$2",
+            "type": "string",
+            "tags": [],
+            "label": "end",
+            "description": [],
+            "signature": [
+              "string | undefined"
+            ],
+            "path": "x-pack/plugins/alerting/common/lib/validate_backfill_schedule.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "isRequired": false
+          }
+        ],
+        "returnComment": [],
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "alerting",
         "id": "def-common.validateDurationSchema",
diff --git a/api_docs/alerting.mdx b/api_docs/alerting.mdx
index e90c347a9bcd1f..1bb84ca6f090f6 100644
--- a/api_docs/alerting.mdx
+++ b/api_docs/alerting.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/alerting
 title: "alerting"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the alerting plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'alerting']
 ---
 import alertingObj from './alerting.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/response-ops](https://github.com/orgs/elastic/teams/response-o
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 862 | 1 | 830 | 54 |
+| 865 | 1 | 833 | 54 |
 
 ## Client
 
diff --git a/api_docs/apm.devdocs.json b/api_docs/apm.devdocs.json
index 284c66b4eb5c9d..d7cac23f6082c5 100644
--- a/api_docs/apm.devdocs.json
+++ b/api_docs/apm.devdocs.json
@@ -418,7 +418,7 @@
         "label": "APIEndpoint",
         "description": [],
         "signature": [
-          "\"POST /internal/apm/data_view/static\" | \"GET /internal/apm/data_view/index_pattern\" | \"GET /internal/apm/environments\" | \"GET /internal/apm/services/{serviceName}/errors/groups/main_statistics\" | \"GET /internal/apm/services/{serviceName}/errors/groups/main_statistics_by_transaction_name\" | \"POST /internal/apm/services/{serviceName}/errors/groups/detailed_statistics\" | \"GET /internal/apm/services/{serviceName}/errors/{groupId}/samples\" | \"GET /internal/apm/services/{serviceName}/errors/{groupId}/error/{errorId}\" | \"GET /internal/apm/services/{serviceName}/errors/distribution\" | \"GET /internal/apm/services/{serviceName}/errors/{groupId}/top_erroneous_transactions\" | \"POST /internal/apm/latency/overall_distribution/transactions\" | \"GET /internal/apm/services/{serviceName}/metrics/charts\" | \"GET /internal/apm/services/{serviceName}/metrics/nodes\" | \"GET /internal/apm/services/{serviceName}/metrics/serverless/charts\" | \"GET /internal/apm/services/{serviceName}/metrics/serverless/summary\" | \"GET /internal/apm/services/{serviceName}/metrics/serverless/functions_overview\" | \"GET /internal/apm/services/{serviceName}/metrics/serverless/active_instances\" | \"GET /internal/apm/observability_overview\" | \"GET /internal/apm/observability_overview/has_data\" | \"GET /internal/apm/service-map\" | \"GET /internal/apm/service-map/service/{serviceName}\" | \"GET /internal/apm/service-map/dependency\" | \"GET /internal/apm/services\" | \"POST /internal/apm/services/detailed_statistics\" | \"GET /internal/apm/services/{serviceName}/metadata/details\" | \"GET /internal/apm/services/{serviceName}/metadata/icons\" | \"GET /internal/apm/services/{serviceName}/agent\" | \"GET /internal/apm/services/{serviceName}/transaction_types\" | \"GET /internal/apm/services/{serviceName}/node/{serviceNodeName}/metadata\" | \"GET /api/apm/services/{serviceName}/annotation/search 2023-10-31\" | \"POST /api/apm/services/{serviceName}/annotation 2023-10-31\" | \"GET /internal/apm/services/{serviceName}/service_overview_instances/details/{serviceNodeName}\" | \"GET /internal/apm/services/{serviceName}/throughput\" | \"GET /internal/apm/services/{serviceName}/service_overview_instances/main_statistics\" | \"GET /internal/apm/services/{serviceName}/service_overview_instances/detailed_statistics\" | \"GET /internal/apm/services/{serviceName}/dependencies\" | \"GET /internal/apm/services/{serviceName}/dependencies/breakdown\" | \"GET /internal/apm/services/{serviceName}/anomaly_charts\" | \"GET /internal/apm/services/{serviceName}/alerts_count\" | \"GET /internal/apm/service-groups\" | \"GET /internal/apm/service-group\" | \"POST /internal/apm/service-group\" | \"DELETE /internal/apm/service-group\" | \"GET /internal/apm/service-group/services\" | \"GET /internal/apm/service-group/counts\" | \"GET /internal/apm/suggestions\" | \"GET /internal/apm/traces/{traceId}\" | \"GET /internal/apm/traces\" | \"GET /internal/apm/traces/{traceId}/root_transaction\" | \"GET /internal/apm/transactions/{transactionId}\" | \"GET /internal/apm/traces/find\" | \"POST /internal/apm/traces/aggregated_critical_path\" | \"GET /internal/apm/traces/{traceId}/transactions/{transactionId}\" | \"GET /internal/apm/traces/{traceId}/spans/{spanId}\" | \"GET /internal/apm/transactions\" | \"GET /internal/apm/services/{serviceName}/transactions/groups/main_statistics\" | \"GET /internal/apm/services/{serviceName}/transactions/groups/detailed_statistics\" | \"GET /internal/apm/services/{serviceName}/transactions/charts/latency\" | \"GET /internal/apm/services/{serviceName}/transactions/traces/samples\" | \"GET /internal/apm/services/{serviceName}/transaction/charts/breakdown\" | \"GET /internal/apm/services/{serviceName}/transactions/charts/error_rate\" | \"GET /internal/apm/services/{serviceName}/transactions/charts/coldstart_rate\" | \"GET /internal/apm/services/{serviceName}/transactions/charts/coldstart_rate_by_transaction_name\" | \"GET /internal/apm/rule_types/transaction_error_rate/chart_preview\" | \"GET /internal/apm/rule_types/error_count/chart_preview\" | \"GET /internal/apm/rule_types/transaction_duration/chart_preview\" | \"GET /api/apm/settings/agent-configuration 2023-10-31\" | \"GET /api/apm/settings/agent-configuration/view 2023-10-31\" | \"DELETE /api/apm/settings/agent-configuration 2023-10-31\" | \"PUT /api/apm/settings/agent-configuration 2023-10-31\" | \"POST /api/apm/settings/agent-configuration/search 2023-10-31\" | \"GET /api/apm/settings/agent-configuration/environments 2023-10-31\" | \"GET /api/apm/settings/agent-configuration/agent_name 2023-10-31\" | \"GET /internal/apm/settings/anomaly-detection/jobs\" | \"POST /internal/apm/settings/anomaly-detection/jobs\" | \"GET /internal/apm/settings/anomaly-detection/environments\" | \"POST /internal/apm/settings/anomaly-detection/update_to_v3\" | \"GET /internal/apm/settings/apm-index-settings\" | \"GET /internal/apm/settings/apm-indices\" | \"POST /internal/apm/settings/apm-indices/save\" | \"GET /internal/apm/settings/custom_links/transaction\" | \"GET /internal/apm/settings/custom_links\" | \"POST /internal/apm/settings/custom_links\" | \"PUT /internal/apm/settings/custom_links/{id}\" | \"DELETE /internal/apm/settings/custom_links/{id}\" | \"GET /api/apm/sourcemaps 2023-10-31\" | \"POST /api/apm/sourcemaps 2023-10-31\" | \"DELETE /api/apm/sourcemaps/{id} 2023-10-31\" | \"POST /internal/apm/sourcemaps/migrate_fleet_artifacts\" | \"GET /internal/apm/fleet/has_apm_policies\" | \"GET /internal/apm/fleet/agents\" | \"POST /api/apm/fleet/apm_server_schema 2023-10-31\" | \"GET /internal/apm/fleet/apm_server_schema/unsupported\" | \"GET /internal/apm/fleet/migration_check\" | \"POST /internal/apm/fleet/cloud_apm_package_policy\" | \"GET /internal/apm/fleet/java_agent_versions\" | \"GET /internal/apm/dependencies/top_dependencies\" | \"GET /internal/apm/dependencies/upstream_services\" | \"GET /internal/apm/dependencies/metadata\" | \"GET /internal/apm/dependencies/charts/latency\" | \"GET /internal/apm/dependencies/charts/throughput\" | \"GET /internal/apm/dependencies/charts/error_rate\" | \"GET /internal/apm/dependencies/operations\" | \"GET /internal/apm/dependencies/charts/distribution\" | \"GET /internal/apm/dependencies/operations/spans\" | \"GET /internal/apm/correlations/field_candidates/transactions\" | \"GET /internal/apm/correlations/field_value_stats/transactions\" | \"POST /internal/apm/correlations/field_value_pairs/transactions\" | \"POST /internal/apm/correlations/significant_correlations/transactions\" | \"POST /internal/apm/correlations/p_values/transactions\" | \"GET /internal/apm/fallback_to_transactions\" | \"GET /internal/apm/has_data\" | \"GET /internal/apm/event_metadata/{processorEvent}/{id}\" | \"GET /internal/apm/agent_keys\" | \"GET /internal/apm/agent_keys/privileges\" | \"POST /internal/apm/api_key/invalidate\" | \"POST /api/apm/agent_keys 2023-10-31\" | \"GET /internal/apm/storage_explorer\" | \"GET /internal/apm/services/{serviceName}/storage_details\" | \"GET /internal/apm/storage_chart\" | \"GET /internal/apm/storage_explorer/privileges\" | \"GET /internal/apm/storage_explorer_summary_stats\" | \"GET /internal/apm/storage_explorer/is_cross_cluster_search\" | \"GET /internal/apm/storage_explorer/get_services\" | \"GET /internal/apm/traces/{traceId}/span_links/{spanId}/parents\" | \"GET /internal/apm/traces/{traceId}/span_links/{spanId}/children\" | \"GET /internal/apm/services/{serviceName}/infrastructure_attributes\" | \"GET /internal/apm/debug-telemetry\" | \"GET /internal/apm/time_range_metadata\" | \"GET /internal/apm/settings/labs\" | \"GET /internal/apm/get_agents_per_service\" | \"GET /internal/apm/get_latest_agent_versions\" | \"GET /internal/apm/services/{serviceName}/agent_instances\" | \"GET /internal/apm/mobile-services/{serviceName}/error/http_error_rate\" | \"GET /internal/apm/mobile-services/{serviceName}/errors/groups/main_statistics\" | \"POST /internal/apm/mobile-services/{serviceName}/errors/groups/detailed_statistics\" | \"GET /internal/apm/mobile-services/{serviceName}/error_terms\" | \"POST /internal/apm/mobile-services/{serviceName}/crashes/groups/detailed_statistics\" | \"GET /internal/apm/mobile-services/{serviceName}/crashes/groups/main_statistics\" | \"GET /internal/apm/mobile-services/{serviceName}/crashes/distribution\" | \"GET /internal/apm/services/{serviceName}/mobile/filters\" | \"GET /internal/apm/mobile-services/{serviceName}/most_used_charts\" | \"GET /internal/apm/mobile-services/{serviceName}/transactions/charts/sessions\" | \"GET /internal/apm/mobile-services/{serviceName}/transactions/charts/http_requests\" | \"GET /internal/apm/mobile-services/{serviceName}/stats\" | \"GET /internal/apm/mobile-services/{serviceName}/location/stats\" | \"GET /internal/apm/mobile-services/{serviceName}/terms\" | \"GET /internal/apm/mobile-services/{serviceName}/main_statistics\" | \"GET /internal/apm/mobile-services/{serviceName}/detailed_statistics\" | \"GET /internal/apm/diagnostics\" | \"POST /internal/apm/assistant/get_apm_timeseries\" | \"GET /internal/apm/assistant/get_downstream_dependencies\" | \"GET /internal/apm/services/{serviceName}/profiling/flamegraph\" | \"GET /internal/apm/profiling/status\" | \"GET /internal/apm/services/{serviceName}/profiling/functions\" | \"GET /internal/apm/services/{serviceName}/profiling/hosts/flamegraph\" | \"GET /internal/apm/services/{serviceName}/profiling/hosts/functions\" | \"POST /internal/apm/custom-dashboard\" | \"DELETE /internal/apm/custom-dashboard\" | \"GET /internal/apm/services/{serviceName}/dashboards\""
+          "\"POST /internal/apm/data_view/static\" | \"GET /internal/apm/data_view/index_pattern\" | \"GET /internal/apm/environments\" | \"GET /internal/apm/services/{serviceName}/errors/groups/main_statistics\" | \"GET /internal/apm/services/{serviceName}/errors/groups/main_statistics_by_transaction_name\" | \"POST /internal/apm/services/{serviceName}/errors/groups/detailed_statistics\" | \"GET /internal/apm/services/{serviceName}/errors/{groupId}/samples\" | \"GET /internal/apm/services/{serviceName}/errors/{groupId}/error/{errorId}\" | \"GET /internal/apm/services/{serviceName}/errors/distribution\" | \"GET /internal/apm/services/{serviceName}/errors/{groupId}/top_erroneous_transactions\" | \"POST /internal/apm/latency/overall_distribution/transactions\" | \"GET /internal/apm/services/{serviceName}/metrics/charts\" | \"GET /internal/apm/services/{serviceName}/metrics/nodes\" | \"GET /internal/apm/services/{serviceName}/metrics/serverless/charts\" | \"GET /internal/apm/services/{serviceName}/metrics/serverless/summary\" | \"GET /internal/apm/services/{serviceName}/metrics/serverless/functions_overview\" | \"GET /internal/apm/services/{serviceName}/metrics/serverless/active_instances\" | \"GET /internal/apm/observability_overview\" | \"GET /internal/apm/observability_overview/has_data\" | \"GET /internal/apm/service-map\" | \"GET /internal/apm/service-map/service/{serviceName}\" | \"GET /internal/apm/service-map/dependency\" | \"GET /internal/apm/services\" | \"POST /internal/apm/services/detailed_statistics\" | \"GET /internal/apm/services/{serviceName}/metadata/details\" | \"GET /internal/apm/services/{serviceName}/metadata/icons\" | \"GET /internal/apm/services/{serviceName}/agent\" | \"GET /internal/apm/services/{serviceName}/transaction_types\" | \"GET /internal/apm/services/{serviceName}/node/{serviceNodeName}/metadata\" | \"GET /api/apm/services/{serviceName}/annotation/search 2023-10-31\" | \"POST /api/apm/services/{serviceName}/annotation 2023-10-31\" | \"GET /internal/apm/services/{serviceName}/service_overview_instances/details/{serviceNodeName}\" | \"GET /internal/apm/services/{serviceName}/throughput\" | \"GET /internal/apm/services/{serviceName}/service_overview_instances/main_statistics\" | \"GET /internal/apm/services/{serviceName}/service_overview_instances/detailed_statistics\" | \"GET /internal/apm/services/{serviceName}/dependencies\" | \"GET /internal/apm/services/{serviceName}/dependencies/breakdown\" | \"GET /internal/apm/services/{serviceName}/anomaly_charts\" | \"GET /internal/apm/services/{serviceName}/alerts_count\" | \"GET /internal/apm/assets/services\" | \"GET /internal/apm/service-groups\" | \"GET /internal/apm/service-group\" | \"POST /internal/apm/service-group\" | \"DELETE /internal/apm/service-group\" | \"GET /internal/apm/service-group/services\" | \"GET /internal/apm/service-group/counts\" | \"GET /internal/apm/suggestions\" | \"GET /internal/apm/traces/{traceId}\" | \"GET /internal/apm/traces\" | \"GET /internal/apm/traces/{traceId}/root_transaction\" | \"GET /internal/apm/transactions/{transactionId}\" | \"GET /internal/apm/traces/find\" | \"POST /internal/apm/traces/aggregated_critical_path\" | \"GET /internal/apm/traces/{traceId}/transactions/{transactionId}\" | \"GET /internal/apm/traces/{traceId}/spans/{spanId}\" | \"GET /internal/apm/transactions\" | \"GET /internal/apm/services/{serviceName}/transactions/groups/main_statistics\" | \"GET /internal/apm/services/{serviceName}/transactions/groups/detailed_statistics\" | \"GET /internal/apm/services/{serviceName}/transactions/charts/latency\" | \"GET /internal/apm/services/{serviceName}/transactions/traces/samples\" | \"GET /internal/apm/services/{serviceName}/transaction/charts/breakdown\" | \"GET /internal/apm/services/{serviceName}/transactions/charts/error_rate\" | \"GET /internal/apm/services/{serviceName}/transactions/charts/coldstart_rate\" | \"GET /internal/apm/services/{serviceName}/transactions/charts/coldstart_rate_by_transaction_name\" | \"GET /internal/apm/rule_types/transaction_error_rate/chart_preview\" | \"GET /internal/apm/rule_types/error_count/chart_preview\" | \"GET /internal/apm/rule_types/transaction_duration/chart_preview\" | \"GET /api/apm/settings/agent-configuration 2023-10-31\" | \"GET /api/apm/settings/agent-configuration/view 2023-10-31\" | \"DELETE /api/apm/settings/agent-configuration 2023-10-31\" | \"PUT /api/apm/settings/agent-configuration 2023-10-31\" | \"POST /api/apm/settings/agent-configuration/search 2023-10-31\" | \"GET /api/apm/settings/agent-configuration/environments 2023-10-31\" | \"GET /api/apm/settings/agent-configuration/agent_name 2023-10-31\" | \"GET /internal/apm/settings/anomaly-detection/jobs\" | \"POST /internal/apm/settings/anomaly-detection/jobs\" | \"GET /internal/apm/settings/anomaly-detection/environments\" | \"POST /internal/apm/settings/anomaly-detection/update_to_v3\" | \"GET /internal/apm/settings/apm-index-settings\" | \"GET /internal/apm/settings/apm-indices\" | \"POST /internal/apm/settings/apm-indices/save\" | \"GET /internal/apm/settings/custom_links/transaction\" | \"GET /internal/apm/settings/custom_links\" | \"POST /internal/apm/settings/custom_links\" | \"PUT /internal/apm/settings/custom_links/{id}\" | \"DELETE /internal/apm/settings/custom_links/{id}\" | \"GET /api/apm/sourcemaps 2023-10-31\" | \"POST /api/apm/sourcemaps 2023-10-31\" | \"DELETE /api/apm/sourcemaps/{id} 2023-10-31\" | \"POST /internal/apm/sourcemaps/migrate_fleet_artifacts\" | \"GET /internal/apm/fleet/has_apm_policies\" | \"GET /internal/apm/fleet/agents\" | \"POST /api/apm/fleet/apm_server_schema 2023-10-31\" | \"GET /internal/apm/fleet/apm_server_schema/unsupported\" | \"GET /internal/apm/fleet/migration_check\" | \"POST /internal/apm/fleet/cloud_apm_package_policy\" | \"GET /internal/apm/fleet/java_agent_versions\" | \"GET /internal/apm/dependencies/top_dependencies\" | \"GET /internal/apm/dependencies/upstream_services\" | \"GET /internal/apm/dependencies/metadata\" | \"GET /internal/apm/dependencies/charts/latency\" | \"GET /internal/apm/dependencies/charts/throughput\" | \"GET /internal/apm/dependencies/charts/error_rate\" | \"GET /internal/apm/dependencies/operations\" | \"GET /internal/apm/dependencies/charts/distribution\" | \"GET /internal/apm/dependencies/operations/spans\" | \"GET /internal/apm/correlations/field_candidates/transactions\" | \"GET /internal/apm/correlations/field_value_stats/transactions\" | \"POST /internal/apm/correlations/field_value_pairs/transactions\" | \"POST /internal/apm/correlations/significant_correlations/transactions\" | \"POST /internal/apm/correlations/p_values/transactions\" | \"GET /internal/apm/fallback_to_transactions\" | \"GET /internal/apm/has_data\" | \"GET /internal/apm/event_metadata/{processorEvent}/{id}\" | \"GET /internal/apm/agent_keys\" | \"GET /internal/apm/agent_keys/privileges\" | \"POST /internal/apm/api_key/invalidate\" | \"POST /api/apm/agent_keys 2023-10-31\" | \"GET /internal/apm/storage_explorer\" | \"GET /internal/apm/services/{serviceName}/storage_details\" | \"GET /internal/apm/storage_chart\" | \"GET /internal/apm/storage_explorer/privileges\" | \"GET /internal/apm/storage_explorer_summary_stats\" | \"GET /internal/apm/storage_explorer/is_cross_cluster_search\" | \"GET /internal/apm/storage_explorer/get_services\" | \"GET /internal/apm/traces/{traceId}/span_links/{spanId}/parents\" | \"GET /internal/apm/traces/{traceId}/span_links/{spanId}/children\" | \"GET /internal/apm/services/{serviceName}/infrastructure_attributes\" | \"GET /internal/apm/debug-telemetry\" | \"GET /internal/apm/time_range_metadata\" | \"GET /internal/apm/settings/labs\" | \"GET /internal/apm/get_agents_per_service\" | \"GET /internal/apm/get_latest_agent_versions\" | \"GET /internal/apm/services/{serviceName}/agent_instances\" | \"GET /internal/apm/mobile-services/{serviceName}/error/http_error_rate\" | \"GET /internal/apm/mobile-services/{serviceName}/errors/groups/main_statistics\" | \"POST /internal/apm/mobile-services/{serviceName}/errors/groups/detailed_statistics\" | \"GET /internal/apm/mobile-services/{serviceName}/error_terms\" | \"POST /internal/apm/mobile-services/{serviceName}/crashes/groups/detailed_statistics\" | \"GET /internal/apm/mobile-services/{serviceName}/crashes/groups/main_statistics\" | \"GET /internal/apm/mobile-services/{serviceName}/crashes/distribution\" | \"GET /internal/apm/services/{serviceName}/mobile/filters\" | \"GET /internal/apm/mobile-services/{serviceName}/most_used_charts\" | \"GET /internal/apm/mobile-services/{serviceName}/transactions/charts/sessions\" | \"GET /internal/apm/mobile-services/{serviceName}/transactions/charts/http_requests\" | \"GET /internal/apm/mobile-services/{serviceName}/stats\" | \"GET /internal/apm/mobile-services/{serviceName}/location/stats\" | \"GET /internal/apm/mobile-services/{serviceName}/terms\" | \"GET /internal/apm/mobile-services/{serviceName}/main_statistics\" | \"GET /internal/apm/mobile-services/{serviceName}/detailed_statistics\" | \"GET /internal/apm/diagnostics\" | \"POST /internal/apm/assistant/get_apm_timeseries\" | \"GET /internal/apm/assistant/get_downstream_dependencies\" | \"GET /internal/apm/services/{serviceName}/profiling/flamegraph\" | \"GET /internal/apm/profiling/status\" | \"GET /internal/apm/services/{serviceName}/profiling/functions\" | \"GET /internal/apm/services/{serviceName}/profiling/hosts/flamegraph\" | \"GET /internal/apm/services/{serviceName}/profiling/hosts/functions\" | \"POST /internal/apm/custom-dashboard\" | \"DELETE /internal/apm/custom-dashboard\" | \"GET /internal/apm/services/{serviceName}/dashboards\""
         ],
         "path": "x-pack/plugins/observability_solution/apm/server/routes/apm_routes/get_global_apm_server_route_repository.ts",
         "deprecated": false,
@@ -5661,6 +5661,26 @@
           "SavedServiceGroup",
           "[]; }>; } & ",
           "APMRouteCreateOptions",
+          "; \"GET /internal/apm/assets/services\": { endpoint: \"GET /internal/apm/assets/services\"; params?: ",
+          "TypeC",
+          "<{ query: ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ kuery: ",
+          "StringC",
+          "; }>, ",
+          "TypeC",
+          "<{ start: ",
+          "Type",
+          "<number, string, unknown>; end: ",
+          "Type",
+          "<number, string, unknown>; }>]>; }> | undefined; handler: ({}: ",
+          "APMRouteHandlerResources",
+          " & { params: { query: { kuery: string; } & { start: number; end: number; }; }; }) => Promise<",
+          "AssetServicesResponse",
+          ">; } & ",
+          "APMRouteCreateOptions",
           "; \"GET /internal/apm/services/{serviceName}/alerts_count\": { endpoint: \"GET /internal/apm/services/{serviceName}/alerts_count\"; params?: ",
           "TypeC",
           "<{ path: ",
diff --git a/api_docs/apm.mdx b/api_docs/apm.mdx
index 7c4c49462a8c67..ff484fffbedd48 100644
--- a/api_docs/apm.mdx
+++ b/api_docs/apm.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/apm
 title: "apm"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the apm plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'apm']
 ---
 import apmObj from './apm.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/obs-ux-infra_services-team](https://github.com/orgs/elastic/te
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 29 | 0 | 29 | 122 |
+| 29 | 0 | 29 | 123 |
 
 ## Client
 
diff --git a/api_docs/apm_data_access.mdx b/api_docs/apm_data_access.mdx
index 80a6fc8e95c48c..2fd4c46c4c6876 100644
--- a/api_docs/apm_data_access.mdx
+++ b/api_docs/apm_data_access.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/apmDataAccess
 title: "apmDataAccess"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the apmDataAccess plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'apmDataAccess']
 ---
 import apmDataAccessObj from './apm_data_access.devdocs.json';
diff --git a/api_docs/asset_manager.mdx b/api_docs/asset_manager.mdx
index 256d8489bc1729..661355584ec55f 100644
--- a/api_docs/asset_manager.mdx
+++ b/api_docs/asset_manager.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/assetManager
 title: "assetManager"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the assetManager plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'assetManager']
 ---
 import assetManagerObj from './asset_manager.devdocs.json';
diff --git a/api_docs/assets_data_access.mdx b/api_docs/assets_data_access.mdx
index 0f888ef73cfb64..07ef589e5a2e96 100644
--- a/api_docs/assets_data_access.mdx
+++ b/api_docs/assets_data_access.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/assetsDataAccess
 title: "assetsDataAccess"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the assetsDataAccess plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'assetsDataAccess']
 ---
 import assetsDataAccessObj from './assets_data_access.devdocs.json';
diff --git a/api_docs/banners.mdx b/api_docs/banners.mdx
index 06162e4d0bdbc7..9cf97b5f48042b 100644
--- a/api_docs/banners.mdx
+++ b/api_docs/banners.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/banners
 title: "banners"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the banners plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'banners']
 ---
 import bannersObj from './banners.devdocs.json';
diff --git a/api_docs/bfetch.mdx b/api_docs/bfetch.mdx
index 8568d66cc91a19..4214c10ed39907 100644
--- a/api_docs/bfetch.mdx
+++ b/api_docs/bfetch.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/bfetch
 title: "bfetch"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the bfetch plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'bfetch']
 ---
 import bfetchObj from './bfetch.devdocs.json';
diff --git a/api_docs/canvas.mdx b/api_docs/canvas.mdx
index c81333834a4869..fe34cd822d0081 100644
--- a/api_docs/canvas.mdx
+++ b/api_docs/canvas.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/canvas
 title: "canvas"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the canvas plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'canvas']
 ---
 import canvasObj from './canvas.devdocs.json';
diff --git a/api_docs/cases.mdx b/api_docs/cases.mdx
index 7405871ccccf6c..3578a7daabd204 100644
--- a/api_docs/cases.mdx
+++ b/api_docs/cases.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/cases
 title: "cases"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the cases plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cases']
 ---
 import casesObj from './cases.devdocs.json';
diff --git a/api_docs/charts.mdx b/api_docs/charts.mdx
index dc1b676960da1c..15dfbc4f855028 100644
--- a/api_docs/charts.mdx
+++ b/api_docs/charts.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/charts
 title: "charts"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the charts plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'charts']
 ---
 import chartsObj from './charts.devdocs.json';
diff --git a/api_docs/cloud.mdx b/api_docs/cloud.mdx
index 8230a1bbd091d2..eb4073530489b6 100644
--- a/api_docs/cloud.mdx
+++ b/api_docs/cloud.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/cloud
 title: "cloud"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the cloud plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cloud']
 ---
 import cloudObj from './cloud.devdocs.json';
diff --git a/api_docs/cloud_data_migration.mdx b/api_docs/cloud_data_migration.mdx
index 98be65ddae27dd..727969a55cf3b5 100644
--- a/api_docs/cloud_data_migration.mdx
+++ b/api_docs/cloud_data_migration.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/cloudDataMigration
 title: "cloudDataMigration"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the cloudDataMigration plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cloudDataMigration']
 ---
 import cloudDataMigrationObj from './cloud_data_migration.devdocs.json';
diff --git a/api_docs/cloud_defend.mdx b/api_docs/cloud_defend.mdx
index 1fbdc26f79c5fb..4a70bed78bba17 100644
--- a/api_docs/cloud_defend.mdx
+++ b/api_docs/cloud_defend.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/cloudDefend
 title: "cloudDefend"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the cloudDefend plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cloudDefend']
 ---
 import cloudDefendObj from './cloud_defend.devdocs.json';
diff --git a/api_docs/cloud_experiments.mdx b/api_docs/cloud_experiments.mdx
index a3b9f713ad2e42..51c0f63b264cf7 100644
--- a/api_docs/cloud_experiments.mdx
+++ b/api_docs/cloud_experiments.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/cloudExperiments
 title: "cloudExperiments"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the cloudExperiments plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cloudExperiments']
 ---
 import cloudExperimentsObj from './cloud_experiments.devdocs.json';
diff --git a/api_docs/cloud_security_posture.mdx b/api_docs/cloud_security_posture.mdx
index f48b7e99397fb3..b6662f4d0297fb 100644
--- a/api_docs/cloud_security_posture.mdx
+++ b/api_docs/cloud_security_posture.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/cloudSecurityPosture
 title: "cloudSecurityPosture"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the cloudSecurityPosture plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cloudSecurityPosture']
 ---
 import cloudSecurityPostureObj from './cloud_security_posture.devdocs.json';
diff --git a/api_docs/console.mdx b/api_docs/console.mdx
index b17be506e6f25b..70e8ad1791669a 100644
--- a/api_docs/console.mdx
+++ b/api_docs/console.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/console
 title: "console"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the console plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'console']
 ---
 import consoleObj from './console.devdocs.json';
diff --git a/api_docs/content_management.mdx b/api_docs/content_management.mdx
index 61241131bc7598..b40c1b5d0a0346 100644
--- a/api_docs/content_management.mdx
+++ b/api_docs/content_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/contentManagement
 title: "contentManagement"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the contentManagement plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'contentManagement']
 ---
 import contentManagementObj from './content_management.devdocs.json';
diff --git a/api_docs/controls.mdx b/api_docs/controls.mdx
index 26d83121fe6607..eb440c61b26051 100644
--- a/api_docs/controls.mdx
+++ b/api_docs/controls.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/controls
 title: "controls"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the controls plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'controls']
 ---
 import controlsObj from './controls.devdocs.json';
diff --git a/api_docs/custom_integrations.mdx b/api_docs/custom_integrations.mdx
index 5ff6bb57966ffc..065dbe5d50c57b 100644
--- a/api_docs/custom_integrations.mdx
+++ b/api_docs/custom_integrations.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/customIntegrations
 title: "customIntegrations"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the customIntegrations plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'customIntegrations']
 ---
 import customIntegrationsObj from './custom_integrations.devdocs.json';
diff --git a/api_docs/dashboard.mdx b/api_docs/dashboard.mdx
index e84bbaaba214c2..d555389d187d37 100644
--- a/api_docs/dashboard.mdx
+++ b/api_docs/dashboard.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dashboard
 title: "dashboard"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the dashboard plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dashboard']
 ---
 import dashboardObj from './dashboard.devdocs.json';
diff --git a/api_docs/dashboard_enhanced.mdx b/api_docs/dashboard_enhanced.mdx
index fd432d385317a4..21cc64869a0ac9 100644
--- a/api_docs/dashboard_enhanced.mdx
+++ b/api_docs/dashboard_enhanced.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dashboardEnhanced
 title: "dashboardEnhanced"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the dashboardEnhanced plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dashboardEnhanced']
 ---
 import dashboardEnhancedObj from './dashboard_enhanced.devdocs.json';
diff --git a/api_docs/data.devdocs.json b/api_docs/data.devdocs.json
index 0fbdccbfc5babc..c5c55378bddd53 100644
--- a/api_docs/data.devdocs.json
+++ b/api_docs/data.devdocs.json
@@ -3372,58 +3372,6 @@
             ],
             "returnComment": []
           },
-          {
-            "parentPluginId": "data",
-            "id": "def-public.SearchSource.setFields",
-            "type": "Function",
-            "tags": [
-              "private"
-            ],
-            "label": "setFields",
-            "description": [
-              "\nInternal, do not use. Overrides all search source fields with the new field array.\n"
-            ],
-            "signature": [
-              "(newFields: ",
-              {
-                "pluginId": "data",
-                "scope": "common",
-                "docId": "kibDataSearchPluginApi",
-                "section": "def-common.SearchSourceFields",
-                "text": "SearchSourceFields"
-              },
-              ") => this"
-            ],
-            "path": "src/plugins/data/common/search/search_source/search_source.ts",
-            "deprecated": false,
-            "trackAdoption": false,
-            "children": [
-              {
-                "parentPluginId": "data",
-                "id": "def-public.SearchSource.setFields.$1",
-                "type": "Object",
-                "tags": [],
-                "label": "newFields",
-                "description": [
-                  "New field array."
-                ],
-                "signature": [
-                  {
-                    "pluginId": "data",
-                    "scope": "common",
-                    "docId": "kibDataSearchPluginApi",
-                    "section": "def-common.SearchSourceFields",
-                    "text": "SearchSourceFields"
-                  }
-                ],
-                "path": "src/plugins/data/common/search/search_source/search_source.ts",
-                "deprecated": false,
-                "trackAdoption": false,
-                "isRequired": true
-              }
-            ],
-            "returnComment": []
-          },
           {
             "parentPluginId": "data",
             "id": "def-public.SearchSource.getId",
@@ -9578,22 +9526,6 @@
             "section": "def-common.SearchSource",
             "text": "SearchSource"
           },
-          "; setFields: (newFields: ",
-          {
-            "pluginId": "data",
-            "scope": "common",
-            "docId": "kibDataSearchPluginApi",
-            "section": "def-common.SearchSourceFields",
-            "text": "SearchSourceFields"
-          },
-          ") => ",
-          {
-            "pluginId": "data",
-            "scope": "common",
-            "docId": "kibDataSearchPluginApi",
-            "section": "def-common.SearchSource",
-            "text": "SearchSource"
-          },
           "; getId: () => string; getFields: () => ",
           {
             "pluginId": "data",
diff --git a/api_docs/data.mdx b/api_docs/data.mdx
index 929ad09c595158..07fb1cf533bc78 100644
--- a/api_docs/data.mdx
+++ b/api_docs/data.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/data
 title: "data"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the data plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'data']
 ---
 import dataObj from './data.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/kibana-visualizations](https://github.com/orgs/elastic/teams/k
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 3186 | 31 | 2575 | 23 |
+| 3182 | 31 | 2575 | 23 |
 
 ## Client
 
diff --git a/api_docs/data_query.mdx b/api_docs/data_query.mdx
index fba801c23db311..914b90f0ef6a25 100644
--- a/api_docs/data_query.mdx
+++ b/api_docs/data_query.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/data-query
 title: "data.query"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the data.query plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'data.query']
 ---
 import dataQueryObj from './data_query.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/kibana-visualizations](https://github.com/orgs/elastic/teams/k
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 3186 | 31 | 2575 | 23 |
+| 3182 | 31 | 2575 | 23 |
 
 ## Client
 
diff --git a/api_docs/data_search.devdocs.json b/api_docs/data_search.devdocs.json
index b4bd0847179abd..d3a56c12bd53c8 100644
--- a/api_docs/data_search.devdocs.json
+++ b/api_docs/data_search.devdocs.json
@@ -7036,22 +7036,6 @@
                     "section": "def-common.SearchSource",
                     "text": "SearchSource"
                   },
-                  "; setFields: (newFields: ",
-                  {
-                    "pluginId": "data",
-                    "scope": "common",
-                    "docId": "kibDataSearchPluginApi",
-                    "section": "def-common.SearchSourceFields",
-                    "text": "SearchSourceFields"
-                  },
-                  ") => ",
-                  {
-                    "pluginId": "data",
-                    "scope": "common",
-                    "docId": "kibDataSearchPluginApi",
-                    "section": "def-common.SearchSource",
-                    "text": "SearchSource"
-                  },
                   "; getId: () => string; getFields: () => ",
                   {
                     "pluginId": "data",
@@ -9884,58 +9868,6 @@
             ],
             "returnComment": []
           },
-          {
-            "parentPluginId": "data",
-            "id": "def-common.SearchSource.setFields",
-            "type": "Function",
-            "tags": [
-              "private"
-            ],
-            "label": "setFields",
-            "description": [
-              "\nInternal, do not use. Overrides all search source fields with the new field array.\n"
-            ],
-            "signature": [
-              "(newFields: ",
-              {
-                "pluginId": "data",
-                "scope": "common",
-                "docId": "kibDataSearchPluginApi",
-                "section": "def-common.SearchSourceFields",
-                "text": "SearchSourceFields"
-              },
-              ") => this"
-            ],
-            "path": "src/plugins/data/common/search/search_source/search_source.ts",
-            "deprecated": false,
-            "trackAdoption": false,
-            "children": [
-              {
-                "parentPluginId": "data",
-                "id": "def-common.SearchSource.setFields.$1",
-                "type": "Object",
-                "tags": [],
-                "label": "newFields",
-                "description": [
-                  "New field array."
-                ],
-                "signature": [
-                  {
-                    "pluginId": "data",
-                    "scope": "common",
-                    "docId": "kibDataSearchPluginApi",
-                    "section": "def-common.SearchSourceFields",
-                    "text": "SearchSourceFields"
-                  }
-                ],
-                "path": "src/plugins/data/common/search/search_source/search_source.ts",
-                "deprecated": false,
-                "trackAdoption": false,
-                "isRequired": true
-              }
-            ],
-            "returnComment": []
-          },
           {
             "parentPluginId": "data",
             "id": "def-common.SearchSource.getId",
@@ -33028,22 +32960,6 @@
             "section": "def-common.SearchSource",
             "text": "SearchSource"
           },
-          "; setFields: (newFields: ",
-          {
-            "pluginId": "data",
-            "scope": "common",
-            "docId": "kibDataSearchPluginApi",
-            "section": "def-common.SearchSourceFields",
-            "text": "SearchSourceFields"
-          },
-          ") => ",
-          {
-            "pluginId": "data",
-            "scope": "common",
-            "docId": "kibDataSearchPluginApi",
-            "section": "def-common.SearchSource",
-            "text": "SearchSource"
-          },
           "; getId: () => string; getFields: () => ",
           {
             "pluginId": "data",
diff --git a/api_docs/data_search.mdx b/api_docs/data_search.mdx
index 8d97225e9c340f..dfde9b85621aad 100644
--- a/api_docs/data_search.mdx
+++ b/api_docs/data_search.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/data-search
 title: "data.search"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the data.search plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'data.search']
 ---
 import dataSearchObj from './data_search.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/kibana-visualizations](https://github.com/orgs/elastic/teams/k
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 3186 | 31 | 2575 | 23 |
+| 3182 | 31 | 2575 | 23 |
 
 ## Client
 
diff --git a/api_docs/data_view_editor.mdx b/api_docs/data_view_editor.mdx
index 62ee6a25e60c32..92d0b152ec4dec 100644
--- a/api_docs/data_view_editor.mdx
+++ b/api_docs/data_view_editor.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dataViewEditor
 title: "dataViewEditor"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the dataViewEditor plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dataViewEditor']
 ---
 import dataViewEditorObj from './data_view_editor.devdocs.json';
diff --git a/api_docs/data_view_field_editor.mdx b/api_docs/data_view_field_editor.mdx
index b5d9c46d50411e..e54990cc369105 100644
--- a/api_docs/data_view_field_editor.mdx
+++ b/api_docs/data_view_field_editor.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dataViewFieldEditor
 title: "dataViewFieldEditor"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the dataViewFieldEditor plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dataViewFieldEditor']
 ---
 import dataViewFieldEditorObj from './data_view_field_editor.devdocs.json';
diff --git a/api_docs/data_view_management.mdx b/api_docs/data_view_management.mdx
index cae57f617679c0..3c28b41780ae95 100644
--- a/api_docs/data_view_management.mdx
+++ b/api_docs/data_view_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dataViewManagement
 title: "dataViewManagement"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the dataViewManagement plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dataViewManagement']
 ---
 import dataViewManagementObj from './data_view_management.devdocs.json';
diff --git a/api_docs/data_views.mdx b/api_docs/data_views.mdx
index 843bcf1faa3168..146ea9f65b96dd 100644
--- a/api_docs/data_views.mdx
+++ b/api_docs/data_views.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dataViews
 title: "dataViews"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the dataViews plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dataViews']
 ---
 import dataViewsObj from './data_views.devdocs.json';
diff --git a/api_docs/data_visualizer.devdocs.json b/api_docs/data_visualizer.devdocs.json
index ea7c9cc2f6c47a..c3122154727588 100644
--- a/api_docs/data_visualizer.devdocs.json
+++ b/api_docs/data_visualizer.devdocs.json
@@ -493,7 +493,9 @@
         "Props",
         ">>; getDataDriftComponent: () => Promise<() => React.FC<",
         "DataDriftDetectionAppStateProps",
-        ">>; getMaxBytesFormatted: () => string; }"
+        ">>; getMaxBytesFormatted: () => string; FieldStatisticsTable: React.ForwardRefExoticComponent<",
+        "FieldStatisticTableEmbeddableProps",
+        " & React.RefAttributes<{}>>; }"
       ],
       "path": "x-pack/plugins/data_visualizer/public/plugin.ts",
       "deprecated": false,
diff --git a/api_docs/data_visualizer.mdx b/api_docs/data_visualizer.mdx
index 9cf018297f5008..099712df04a838 100644
--- a/api_docs/data_visualizer.mdx
+++ b/api_docs/data_visualizer.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dataVisualizer
 title: "dataVisualizer"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the dataVisualizer plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dataVisualizer']
 ---
 import dataVisualizerObj from './data_visualizer.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/ml-ui](https://github.com/orgs/elastic/teams/ml-ui) for questi
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 31 | 3 | 25 | 3 |
+| 31 | 3 | 25 | 4 |
 
 ## Client
 
diff --git a/api_docs/dataset_quality.devdocs.json b/api_docs/dataset_quality.devdocs.json
index b4ed739f30770f..607e01fe7287f0 100644
--- a/api_docs/dataset_quality.devdocs.json
+++ b/api_docs/dataset_quality.devdocs.json
@@ -210,7 +210,7 @@
           "<{ query: ",
           "IntersectionC",
           "<[",
-          "PartialC",
+          "TypeC",
           "<{ start: ",
           "Type",
           "<number, string, unknown>; end: ",
@@ -225,7 +225,7 @@
           "StringC",
           "; }>]>; }> | undefined; handler: ({}: ",
           "DatasetQualityRouteHandlerResources",
-          " & { params: { query: { start?: number | undefined; end?: number | undefined; } & { type?: \"metrics\" | \"synthetics\" | \"traces\" | \"logs\" | \"profiling\" | undefined; } & { datasetQuery?: string | undefined; }; }; }) => Promise<{ degradedDocs: { dataset: string; percentage: number; count: number; }[]; }>; } & ",
+          " & { params: { query: { start: number; end: number; } & { type?: \"metrics\" | \"synthetics\" | \"traces\" | \"logs\" | \"profiling\" | undefined; } & { datasetQuery?: string | undefined; }; }; }) => Promise<{ degradedDocs: { dataset: string; count: number; totalDocs: number; percentage: number; }[]; }>; } & ",
           "DatasetQualityRouteCreateOptions",
           "; \"GET /internal/dataset_quality/data_streams/stats\": { endpoint: \"GET /internal/dataset_quality/data_streams/stats\"; params?: ",
           "TypeC",
@@ -345,7 +345,7 @@
           "<{ query: ",
           "IntersectionC",
           "<[",
-          "PartialC",
+          "TypeC",
           "<{ start: ",
           "Type",
           "<number, string, unknown>; end: ",
@@ -360,7 +360,7 @@
           "StringC",
           "; }>]>; }> | undefined; handler: ({}: ",
           "DatasetQualityRouteHandlerResources",
-          " & { params: { query: { start?: number | undefined; end?: number | undefined; } & { type?: \"metrics\" | \"synthetics\" | \"traces\" | \"logs\" | \"profiling\" | undefined; } & { datasetQuery?: string | undefined; }; }; }) => Promise<{ degradedDocs: { dataset: string; percentage: number; count: number; }[]; }>; } & ",
+          " & { params: { query: { start: number; end: number; } & { type?: \"metrics\" | \"synthetics\" | \"traces\" | \"logs\" | \"profiling\" | undefined; } & { datasetQuery?: string | undefined; }; }; }) => Promise<{ degradedDocs: { dataset: string; count: number; totalDocs: number; percentage: number; }[]; }>; } & ",
           "DatasetQualityRouteCreateOptions",
           "; \"GET /internal/dataset_quality/data_streams/stats\": { endpoint: \"GET /internal/dataset_quality/data_streams/stats\"; params?: ",
           "TypeC",
diff --git a/api_docs/dataset_quality.mdx b/api_docs/dataset_quality.mdx
index dcfc00e706997c..45153bce89f9ef 100644
--- a/api_docs/dataset_quality.mdx
+++ b/api_docs/dataset_quality.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/datasetQuality
 title: "datasetQuality"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the datasetQuality plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'datasetQuality']
 ---
 import datasetQualityObj from './dataset_quality.devdocs.json';
diff --git a/api_docs/deprecations_by_api.mdx b/api_docs/deprecations_by_api.mdx
index 7adb51c6f54a22..329af37364bb4c 100644
--- a/api_docs/deprecations_by_api.mdx
+++ b/api_docs/deprecations_by_api.mdx
@@ -7,7 +7,7 @@ id: kibDevDocsDeprecationsByApi
 slug: /kibana-dev-docs/api-meta/deprecated-api-list-by-api
 title: Deprecated API usage by API
 description: A list of deprecated APIs, which plugins are still referencing them, and when they need to be removed by.
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana']
 ---
 
@@ -17,6 +17,8 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | Deprecated API | Referencing plugin(s) | Remove By |
 | ---------------|-----------|-----------|
 | <DocLink id="kibAlertingPluginApi" section="def-public.PluginSetupContract.registerNavigation" text="registerNavigation"/> | ml, stackAlerts | - |
+| <DocLink id="kibEmbeddablePluginApi" section="def-public.EmbeddableSetup.registerEmbeddableFactory" text="registerEmbeddableFactory"/> | visualizations, lens, controls, dashboard, aiops, maps, discover, ml, infra, profiling, slo, links | - |
+| <DocLink id="kibEmbeddablePluginApi" section="def-public.EmbeddableStart.getEmbeddableFactory" text="getEmbeddableFactory"/> | lens, controls, dashboard, aiops, observabilityShared, ml, securitySolution | - |
 | <DocLink id="kibSecurityPluginApi" section="def-server.SecurityPluginSetup.authc" text="authc"/> | encryptedSavedObjects, actions, data, ml, logstash, securitySolution, cloudChat | - |
 | <DocLink id="kibSecurityPluginApi" section="def-server.SecurityPluginSetup.authz" text="authz"/> | actions, savedObjectsTagging, ml, enterpriseSearch | - |
 | <DocLink id="kibKbnCoreSavedObjectsApiBrowserPluginApi" section="def-common.SimpleSavedObject" text="SimpleSavedObject"/> | @kbn/core-saved-objects-browser-internal, @kbn/core, savedObjects, visualizations, aiops, dataVisualizer, ml, dashboardEnhanced, graph, lens, securitySolution, eventAnnotation, @kbn/core-saved-objects-browser-mocks | - |
@@ -57,7 +59,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibKbnSecuritysolutionListConstantsPluginApi" section="def-common.ENDPOINT_BLOCKLISTS_LIST_NAME" text="ENDPOINT_BLOCKLISTS_LIST_NAME"/> | securitySolution | - |
 | <DocLink id="kibKbnSecuritysolutionListConstantsPluginApi" section="def-common.ENDPOINT_BLOCKLISTS_LIST_DESCRIPTION" text="ENDPOINT_BLOCKLISTS_LIST_DESCRIPTION"/> | securitySolution | - |
 | <DocLink id="kibKbnUiThemePluginApi" section="def-common.darkMode" text="darkMode"/> | @kbn/monaco, securitySolution | - |
-| <DocLink id="kibDiscoverPluginApi" section="def-common.DiscoverAppLocatorParams.indexPatternId" text="indexPatternId"/> | fleet, cloudSecurityPosture, dataVisualizer, exploratoryView, osquery, synthetics | - |
+| <DocLink id="kibDiscoverPluginApi" section="def-common.DiscoverAppLocatorParams.indexPatternId" text="indexPatternId"/> | fleet, cloudSecurityPosture, exploratoryView, osquery, synthetics | - |
 | <DocLink id="kibTaskManagerPluginApi" section="def-server.TaskManagerSetupContract.index" text="index"/> | actions, alerting | - |
 | <DocLink id="kibUiActionsPluginApi" section="def-public.UiActionsService.executeTriggerActions" text="executeTriggerActions"/> | data, discover, imageEmbeddable, embeddable | - |
 | <DocLink id="kibKbnCoreLifecycleBrowserPluginApi" section="def-common.CoreStart.savedObjects" text="savedObjects"/> | @kbn/core-plugins-browser-internal, @kbn/core-root-browser-internal, home, savedObjects, unifiedSearch, visualizations, fileUpload, dashboardEnhanced, transform, dashboard, discover, dataVisualizer | - |
@@ -100,7 +102,9 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibDataPluginApi" section="def-server.DataView.getNonScriptedFields" text="getNonScriptedFields"/> | graph, visTypeTimeseries, dataViewManagement, dataViews | - |
 | <DocLink id="kibDataViewsPluginApi" section="def-public.DataView.getNonScriptedFields" text="getNonScriptedFields"/> | graph, visTypeTimeseries, dataViewManagement | - |
 | <DocLink id="kibSavedObjectsFinderPluginApi" section="def-public.SavedObjectMetaData.includeFields" text="includeFields"/> | visualizations, graph | - |
+| <DocLink id="kibTimelinesPluginApi" section="def-public.TimelinesUIStart.getHoverActions" text="getHoverActions"/> | kubernetesSecurity, osquery, threatIntelligence | - |
 | <DocLink id="kibKbnCoreSavedObjectsBrowserMocksPluginApi" section="def-common.simpleSavedObjectMock" text="simpleSavedObjectMock"/> | @kbn/core, lens, savedObjects | - |
+| <DocLink id="kibEmbeddablePluginApi" section="def-public.EmbeddableStart.getEmbeddableFactories" text="getEmbeddableFactories"/> | dashboard, canvas | - |
 | <DocLink id="kibKbnPresentationPublishingPluginApi" section="def-common.apiHasLegacyLibraryTransforms" text="apiHasLegacyLibraryTransforms"/> | dashboard | - |
 | <DocLink id="kibKbnPresentationPublishingPluginApi" section="def-common.HasLegacyLibraryTransforms" text="HasLegacyLibraryTransforms"/> | embeddable, dashboard | - |
 | <DocLink id="kibDataPluginApi" section="def-common.DataView.flattenHit" text="flattenHit"/> | dataViews, maps | - |
@@ -110,15 +114,15 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibDataPluginApi" section="def-server.DataView.removeScriptedField" text="removeScriptedField"/> | dataViews, dataViewManagement | - |
 | <DocLink id="kibDataPluginApi" section="def-server.DataView.getScriptedFields" text="getScriptedFields"/> | dataViews, dataViewManagement | - |
 | <DocLink id="kibDataViewsPluginApi" section="def-public.DataView.flattenHit" text="flattenHit"/> | maps | - |
-| <DocLink id="kibEmbeddablePluginApi" section="def-public.registerSavedObjectToPanelMethod" text="registerSavedObjectToPanelMethod"/> | savedSearch, visualizations, lens, maps | - |
 | <DocLink id="kibDataViewsPluginApi" section="def-public.DataView.removeScriptedField" text="removeScriptedField"/> | dataViewManagement | - |
 | <DocLink id="kibDataViewsPluginApi" section="def-public.DataView.getScriptedFields" text="getScriptedFields"/> | dataViewManagement | - |
 | <DocLink id="kibDataViewsPluginApi" section="def-server.getFieldByName" text="getFieldByName"/> | unifiedSearch | - |
 | <DocLink id="kibDataViewsPluginApi" section="def-server.findIndexPatternById" text="findIndexPatternById"/> | unifiedSearch | - |
 | <DocLink id="kibEmbeddablePluginApi" section="def-public.EmbeddableContext" text="EmbeddableContext"/> | embeddableEnhanced | - |
-| <DocLink id="kibExpressionGaugePluginApi" section="def-common.GaugeState.percentageMode" text="percentageMode"/> | visTypeGauge | - |
-| <DocLink id="kibExpressionPartitionVisPluginApi" section="def-common.LabelsParams.truncate" text="truncate"/> | visTypePie | - |
-| <DocLink id="kibExpressionPartitionVisPluginApi" section="def-common.LabelsParams.last_level" text="last_level"/> | visTypePie | - |
+| <DocLink id="kibEmbeddablePluginApi" section="def-public.EmbeddableSetup.setCustomEmbeddableFactoryProvider" text="setCustomEmbeddableFactoryProvider"/> | embeddableEnhanced | - |
+| <DocLink id="kibKibanaReactPluginApi" section="def-public.KibanaThemeProvider" text="KibanaThemeProvider"/> | infra, metricsDataAccess, apm, observabilityOnboarding | - |
+| <DocLink id="kibEmbeddablePluginApi" section="def-public.EmbeddableSetup.registerEnhancement" text="registerEnhancement"/> | uiActionsEnhanced | - |
+| <DocLink id="kibKibanaReactPluginApi" section="def-public.toMountPoint" text="toMountPoint"/> | observabilityShared | - |
 | <DocLink id="kibExpressionsPluginApi" section="def-public.ExpressionFunctionDefinition.context" text="context"/> | canvas | - |
 | <DocLink id="kibExpressionsPluginApi" section="def-public.ExpressionsServiceSetup.getFunction" text="getFunction"/> | canvas | - |
 | <DocLink id="kibExpressionsPluginApi" section="def-public.ExpressionsServiceSetup.getFunctions" text="getFunctions"/> | canvas | - |
@@ -129,9 +133,11 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibExpressionsPluginApi" section="def-common.ExpressionsServiceSetup.getFunctions" text="getFunctions"/> | canvas | - |
 | <DocLink id="kibExpressionsPluginApi" section="def-common.ExpressionsServiceSetup.getTypes" text="getTypes"/> | canvas | - |
 | <DocLink id="kibExpressionsPluginApi" section="def-server.ExpressionFunctionDefinition.context" text="context"/> | canvas | - |
+| <DocLink id="kibExpressionGaugePluginApi" section="def-common.GaugeState.percentageMode" text="percentageMode"/> | visTypeGauge | - |
+| <DocLink id="kibExpressionPartitionVisPluginApi" section="def-common.LabelsParams.truncate" text="truncate"/> | visTypePie | - |
+| <DocLink id="kibExpressionPartitionVisPluginApi" section="def-common.LabelsParams.last_level" text="last_level"/> | visTypePie | - |
+| <DocLink id="kibKbnCoreLoggingServerPluginApi" section="def-common.NumericRollingStrategyConfig.max" text="max"/> | @kbn/core-logging-server-internal, security | - |
 | <DocLink id="kibKbnCoreSavedObjectsCommonPluginApi" section="def-common.SavedObjectsImportSuccess.createNewCopy" text="createNewCopy"/> | spaces, savedObjectsManagement | - |
-| <DocLink id="kibKibanaReactPluginApi" section="def-public.KibanaThemeProvider" text="KibanaThemeProvider"/> | devTools, console, crossClusterReplication, grokdebugger, ingestPipelines, infra, painlessLab, searchprofiler, metricsDataAccess, apm, observabilityOnboarding | - |
-| <DocLink id="kibKibanaReactPluginApi" section="def-public.toMountPoint" text="toMountPoint"/> | observabilityShared, console, runtimeFields, indexManagement | - |
 | <DocLink id="kibKbnCoreElasticsearchServerPluginApi" section="def-common.ElasticsearchServiceSetup.legacy" text="legacy"/> | @kbn/core-elasticsearch-server-internal, @kbn/core-plugins-server-internal, enterpriseSearch, observabilityOnboarding, console | - |
 | <DocLink id="kibKibanaReactPluginApi" section="def-common.KibanaStyledComponentsThemeProviderDecorator" text="KibanaStyledComponentsThemeProviderDecorator"/> | @kbn/react-kibana-context-styled, kibanaReact | - |
 | <DocLink id="kibSecurityPluginApi" section="def-public.SecurityPluginStart.uiApi" text="uiApi"/> | enterpriseSearch | - |
diff --git a/api_docs/deprecations_by_plugin.mdx b/api_docs/deprecations_by_plugin.mdx
index 75ca802622d620..f517aff2dda5c1 100644
--- a/api_docs/deprecations_by_plugin.mdx
+++ b/api_docs/deprecations_by_plugin.mdx
@@ -7,7 +7,7 @@ id: kibDevDocsDeprecationsByPlugin
 slug: /kibana-dev-docs/api-meta/deprecated-api-list-by-plugin
 title: Deprecated API usage by plugin
 description: A list of deprecated APIs, which plugins are still referencing them, and when they need to be removed by.
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana']
 ---
 
@@ -91,6 +91,14 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 
 
 
+## @kbn/core-logging-server-internal
+
+| Deprecated API | Reference location(s) | Remove By |
+| ---------------|-----------|-----------|
+| <DocLink id="kibKbnCoreLoggingServerPluginApi" section="def-common.NumericRollingStrategyConfig.max" text="max"/> | [index.ts](https://github.com/elastic/kibana/tree/main/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/strategies/index.ts#:~:text=max), [create_retention_policy.ts](https://github.com/elastic/kibana/tree/main/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/retention/create_retention_policy.ts#:~:text=max), [appenders.test.ts](https://github.com/elastic/kibana/tree/main/packages/core/logging/core-logging-server-internal/src/appenders/appenders.test.ts#:~:text=max), [rolling_file_appender.test.ts](https://github.com/elastic/kibana/tree/main/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/rolling_file_appender.test.ts#:~:text=max), [create_retention_policy.test.ts](https://github.com/elastic/kibana/tree/main/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/retention/create_retention_policy.test.ts#:~:text=max), [numeric_strategy.test.ts](https://github.com/elastic/kibana/tree/main/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/strategies/numeric/numeric_strategy.test.ts#:~:text=max) | - |
+
+
+
 ## @kbn/core-plugins-browser-internal
 
 | Deprecated API | Reference location(s) | Remove By |
@@ -404,6 +412,8 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 
 | Deprecated API | Reference location(s) | Remove By |
 | ---------------|-----------|-----------|
+| <DocLink id="kibEmbeddablePluginApi" section="def-public.EmbeddableSetup.registerEmbeddableFactory" text="registerEmbeddableFactory"/> | [register_embeddable.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/aiops/public/embeddable/register_embeddable.ts#:~:text=registerEmbeddableFactory) | - |
+| <DocLink id="kibEmbeddablePluginApi" section="def-public.EmbeddableStart.getEmbeddableFactory" text="getEmbeddableFactory"/> | [embeddable_change_point_chart_component.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/aiops/public/embeddable/embeddable_change_point_chart_component.tsx#:~:text=getEmbeddableFactory) | - |
 | <DocLink id="kibLicensingPluginApi" section="def-public.LicensingPluginSetup.license$" text="license$"/> | [plugin.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/aiops/public/plugin.tsx#:~:text=license%24) | 8.8.0 |
 | <DocLink id="kibLicensingPluginApi" section="def-server.LicensingPluginSetup.license$" text="license$"/> | [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/aiops/server/plugin.ts#:~:text=license%24) | 8.8.0 |
 | <DocLink id="kibKbnCoreSavedObjectsApiBrowserPluginApi" section="def-common.SimpleSavedObject" text="SimpleSavedObject"/> | [search_utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/aiops/public/application/utils/search_utils.ts#:~:text=SimpleSavedObject), [search_utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/aiops/public/application/utils/search_utils.ts#:~:text=SimpleSavedObject) | - |
@@ -454,6 +464,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 
 | Deprecated API | Reference location(s) | Remove By |
 | ---------------|-----------|-----------|
+| <DocLink id="kibEmbeddablePluginApi" section="def-public.EmbeddableStart.getEmbeddableFactories" text="getEmbeddableFactories"/> | [embeddable.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/canvas/canvas_plugin_src/renderers/embeddable/embeddable.tsx#:~:text=getEmbeddableFactories), [embeddables.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/canvas/public/services/kibana/embeddables.ts#:~:text=getEmbeddableFactories) | - |
 | <DocLink id="kibExpressionsPluginApi" section="def-public.ExpressionFunctionDefinition.context" text="context"/> | [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/canvas/canvas_plugin_src/functions/server/demodata/index.ts#:~:text=context), [embeddable.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/canvas/canvas_plugin_src/functions/external/embeddable.ts#:~:text=context), [esdocs.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/canvas/canvas_plugin_src/functions/browser/esdocs.ts#:~:text=context), [escount.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/canvas/canvas_plugin_src/functions/browser/escount.ts#:~:text=context), [filters.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/canvas/common/functions/filters.ts#:~:text=context), [neq.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/canvas/canvas_plugin_src/functions/common/neq.ts#:~:text=context), [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/canvas/canvas_plugin_src/functions/server/pointseries/index.ts#:~:text=context) | - |
 | <DocLink id="kibExpressionsPluginApi" section="def-public.ExpressionsServiceSetup.getFunction" text="getFunction"/> | [setup_expressions.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/canvas/public/setup_expressions.ts#:~:text=getFunction) | - |
 | <DocLink id="kibExpressionsPluginApi" section="def-public.ExpressionsServiceSetup.getFunctions" text="getFunctions"/> | [functions.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/canvas/server/routes/functions/functions.ts#:~:text=getFunctions), [functions.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/canvas/server/routes/functions/functions.ts#:~:text=getFunctions), [functions.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/canvas/server/routes/functions/functions.test.ts#:~:text=getFunctions) | - |
@@ -507,8 +518,6 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 
 | Deprecated API | Reference location(s) | Remove By |
 | ---------------|-----------|-----------|
-| <DocLink id="kibKibanaReactPluginApi" section="def-public.toMountPoint" text="toMountPoint"/> | [shared_imports.ts](https://github.com/elastic/kibana/tree/main/src/plugins/console/public/shared_imports.ts#:~:text=toMountPoint), [use_send_current_request.ts](https://github.com/elastic/kibana/tree/main/src/plugins/console/public/application/hooks/use_send_current_request/use_send_current_request.ts#:~:text=toMountPoint), [use_send_current_request.ts](https://github.com/elastic/kibana/tree/main/src/plugins/console/public/application/hooks/use_send_current_request/use_send_current_request.ts#:~:text=toMountPoint) | - |
-| <DocLink id="kibKibanaReactPluginApi" section="def-public.KibanaThemeProvider" text="KibanaThemeProvider"/> | [shared_imports.ts](https://github.com/elastic/kibana/tree/main/src/plugins/console/public/shared_imports.ts#:~:text=KibanaThemeProvider) | - |
 | <DocLink id="kibKbnCoreElasticsearchServerPluginApi" section="def-common.ElasticsearchServiceSetup.legacy" text="legacy"/> | [plugin.ts](https://github.com/elastic/kibana/tree/main/src/plugins/console/server/plugin.ts#:~:text=legacy) | - |
 
 
@@ -517,6 +526,8 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 
 | Deprecated API | Reference location(s) | Remove By |
 | ---------------|-----------|-----------|
+| <DocLink id="kibEmbeddablePluginApi" section="def-public.EmbeddableSetup.registerEmbeddableFactory" text="registerEmbeddableFactory"/> | [plugin.ts](https://github.com/elastic/kibana/tree/main/src/plugins/controls/public/plugin.ts#:~:text=registerEmbeddableFactory), [plugin.ts](https://github.com/elastic/kibana/tree/main/src/plugins/controls/public/plugin.ts#:~:text=registerEmbeddableFactory), [plugin.ts](https://github.com/elastic/kibana/tree/main/src/plugins/controls/public/plugin.ts#:~:text=registerEmbeddableFactory), [plugin.ts](https://github.com/elastic/kibana/tree/main/src/plugins/controls/public/plugin.ts#:~:text=registerEmbeddableFactory) | - |
+| <DocLink id="kibEmbeddablePluginApi" section="def-public.EmbeddableStart.getEmbeddableFactory" text="getEmbeddableFactory"/> | [types.ts](https://github.com/elastic/kibana/tree/main/src/plugins/controls/public/services/embeddable/types.ts#:~:text=getEmbeddableFactory), [embeddable_service.ts](https://github.com/elastic/kibana/tree/main/src/plugins/controls/public/services/embeddable/embeddable_service.ts#:~:text=getEmbeddableFactory), [embeddable.story.ts](https://github.com/elastic/kibana/tree/main/src/plugins/controls/public/services/embeddable/embeddable.story.ts#:~:text=getEmbeddableFactory) | - |
 | <DocLink id="kibKbnCoreSavedObjectsCommonPluginApi" section="def-common.SavedObjectReference" text="SavedObjectReference"/> | [options_list_persistable_state.ts](https://github.com/elastic/kibana/tree/main/src/plugins/controls/common/options_list/options_list_persistable_state.ts#:~:text=SavedObjectReference), [options_list_persistable_state.ts](https://github.com/elastic/kibana/tree/main/src/plugins/controls/common/options_list/options_list_persistable_state.ts#:~:text=SavedObjectReference), [options_list_persistable_state.ts](https://github.com/elastic/kibana/tree/main/src/plugins/controls/common/options_list/options_list_persistable_state.ts#:~:text=SavedObjectReference), [range_slider_persistable_state.ts](https://github.com/elastic/kibana/tree/main/src/plugins/controls/common/range_slider/range_slider_persistable_state.ts#:~:text=SavedObjectReference), [range_slider_persistable_state.ts](https://github.com/elastic/kibana/tree/main/src/plugins/controls/common/range_slider/range_slider_persistable_state.ts#:~:text=SavedObjectReference), [range_slider_persistable_state.ts](https://github.com/elastic/kibana/tree/main/src/plugins/controls/common/range_slider/range_slider_persistable_state.ts#:~:text=SavedObjectReference), [time_slider_persistable_state.ts](https://github.com/elastic/kibana/tree/main/src/plugins/controls/common/time_slider/time_slider_persistable_state.ts#:~:text=SavedObjectReference), [time_slider_persistable_state.ts](https://github.com/elastic/kibana/tree/main/src/plugins/controls/common/time_slider/time_slider_persistable_state.ts#:~:text=SavedObjectReference), [time_slider_persistable_state.ts](https://github.com/elastic/kibana/tree/main/src/plugins/controls/common/time_slider/time_slider_persistable_state.ts#:~:text=SavedObjectReference), [control_group_persistable_state.ts](https://github.com/elastic/kibana/tree/main/src/plugins/controls/common/control_group/control_group_persistable_state.ts#:~:text=SavedObjectReference)+ 2 more | - |
 
 
@@ -525,7 +536,6 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 
 | Deprecated API | Reference location(s) | Remove By |
 | ---------------|-----------|-----------|
-| <DocLink id="kibKibanaReactPluginApi" section="def-public.KibanaThemeProvider" text="KibanaThemeProvider"/> | [shared_imports.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cross_cluster_replication/public/shared_imports.ts#:~:text=KibanaThemeProvider) | - |
 | <DocLink id="kibLicensingPluginApi" section="def-public.LicensingPluginSetup.license$" text="license$"/> | [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cross_cluster_replication/public/plugin.ts#:~:text=license%24) | 8.8.0 |
 
 
@@ -535,6 +545,9 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | Deprecated API | Reference location(s) | Remove By |
 | ---------------|-----------|-----------|
 | <DocLink id="kibDataPluginApi" section="def-public.DataPublicPluginStart.fieldFormats" text="fieldFormats"/> | [types.ts](https://github.com/elastic/kibana/tree/main/src/plugins/dashboard/public/services/data/types.ts#:~:text=fieldFormats), [data_service.ts](https://github.com/elastic/kibana/tree/main/src/plugins/dashboard/public/services/data/data_service.ts#:~:text=fieldFormats) | - |
+| <DocLink id="kibEmbeddablePluginApi" section="def-public.EmbeddableSetup.registerEmbeddableFactory" text="registerEmbeddableFactory"/> | [plugin.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/dashboard/public/plugin.tsx#:~:text=registerEmbeddableFactory) | - |
+| <DocLink id="kibEmbeddablePluginApi" section="def-public.EmbeddableStart.getEmbeddableFactory" text="getEmbeddableFactory"/> | [migrate_dashboard_input.ts](https://github.com/elastic/kibana/tree/main/src/plugins/dashboard/public/services/dashboard_content_management/lib/migrate_dashboard_input.ts#:~:text=getEmbeddableFactory), [migrate_dashboard_input.ts](https://github.com/elastic/kibana/tree/main/src/plugins/dashboard/public/services/dashboard_content_management/lib/migrate_dashboard_input.ts#:~:text=getEmbeddableFactory), [create_dashboard.ts](https://github.com/elastic/kibana/tree/main/src/plugins/dashboard/public/dashboard_container/embeddable/create/create_dashboard.ts#:~:text=getEmbeddableFactory), [dashboard_container.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx#:~:text=getEmbeddableFactory), [dashboard_container.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx#:~:text=getEmbeddableFactory), [dashboard_renderer.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/dashboard/public/dashboard_container/external_api/dashboard_renderer.tsx#:~:text=getEmbeddableFactory), [embeddable.stub.ts](https://github.com/elastic/kibana/tree/main/src/plugins/dashboard/public/services/embeddable/embeddable.stub.ts#:~:text=getEmbeddableFactory), [duplicate_dashboard_panel.test.ts](https://github.com/elastic/kibana/tree/main/src/plugins/dashboard/public/dashboard_container/embeddable/api/duplicate_dashboard_panel.test.ts#:~:text=getEmbeddableFactory), [create_dashboard.test.ts](https://github.com/elastic/kibana/tree/main/src/plugins/dashboard/public/dashboard_container/embeddable/create/create_dashboard.test.ts#:~:text=getEmbeddableFactory), [create_dashboard.test.ts](https://github.com/elastic/kibana/tree/main/src/plugins/dashboard/public/dashboard_container/embeddable/create/create_dashboard.test.ts#:~:text=getEmbeddableFactory)+ 10 more | - |
+| <DocLink id="kibEmbeddablePluginApi" section="def-public.EmbeddableStart.getEmbeddableFactories" text="getEmbeddableFactories"/> | [editor_menu.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/dashboard/public/dashboard_app/top_nav/editor_menu.tsx#:~:text=getEmbeddableFactories), [embeddable.stub.ts](https://github.com/elastic/kibana/tree/main/src/plugins/dashboard/public/services/embeddable/embeddable.stub.ts#:~:text=getEmbeddableFactories), [embeddable.stub.ts](https://github.com/elastic/kibana/tree/main/src/plugins/dashboard/public/services/embeddable/embeddable.stub.ts#:~:text=getEmbeddableFactories) | - |
 | <DocLink id="kibSavedObjectsPluginApi" section="def-public.SavedObjectSaveModal" text="SavedObjectSaveModal"/> | [save_modal.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/dashboard/public/dashboard_container/embeddable/api/overlays/save_modal.tsx#:~:text=SavedObjectSaveModal), [save_modal.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/dashboard/public/dashboard_container/embeddable/api/overlays/save_modal.tsx#:~:text=SavedObjectSaveModal), [add_to_library_action.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/dashboard/public/dashboard_actions/add_to_library_action.tsx#:~:text=SavedObjectSaveModal), [add_to_library_action.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/dashboard/public/dashboard_actions/add_to_library_action.tsx#:~:text=SavedObjectSaveModal) | 8.8.0 |
 | <DocLink id="kibKbnCoreLifecycleBrowserPluginApi" section="def-common.CoreStart.savedObjects" text="savedObjects"/> | [duplicate_dashboard_panel.test.ts](https://github.com/elastic/kibana/tree/main/src/plugins/dashboard/public/dashboard_container/embeddable/api/duplicate_dashboard_panel.test.ts#:~:text=savedObjects), [duplicate_dashboard_panel.test.ts](https://github.com/elastic/kibana/tree/main/src/plugins/dashboard/public/dashboard_container/embeddable/api/duplicate_dashboard_panel.test.ts#:~:text=savedObjects) | - |
 | <DocLink id="kibKbnCoreSavedObjectsApiBrowserPluginApi" section="def-common.SavedObjectsClientContract.create" text="create"/> | [duplicate_dashboard_panel.test.ts](https://github.com/elastic/kibana/tree/main/src/plugins/dashboard/public/dashboard_container/embeddable/api/duplicate_dashboard_panel.test.ts#:~:text=create) | - |
@@ -612,26 +625,18 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | Deprecated API | Reference location(s) | Remove By |
 | ---------------|-----------|-----------|
 | <DocLink id="kibDataPluginApi" section="def-public.DataPublicPluginStart.fieldFormats" text="fieldFormats"/> | [document_stats.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/data_visualizer/public/application/common/components/stats_table/components/field_data_row/document_stats.tsx#:~:text=fieldFormats), [distinct_values.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/data_visualizer/public/application/common/components/stats_table/components/field_data_row/distinct_values.tsx#:~:text=fieldFormats), [top_values.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/data_visualizer/public/application/common/components/top_values/top_values.tsx#:~:text=fieldFormats), [choropleth_map.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/data_visualizer/public/application/common/components/stats_table/components/field_data_expanded_row/choropleth_map.tsx#:~:text=fieldFormats), [default_value_formatter.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/data_visualizer/public/application/data_drift/charts/default_value_formatter.ts#:~:text=fieldFormats) | - |
-| <DocLink id="kibDiscoverPluginApi" section="def-common.DiscoverAppLocatorParams.indexPatternId" text="indexPatternId"/> | [results_links.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/data_visualizer/public/application/common/components/results_links/results_links.tsx#:~:text=indexPatternId), [actions_panel.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/actions_panel/actions_panel.tsx#:~:text=indexPatternId) | - |
 | <DocLink id="kibKbnCoreLifecycleBrowserPluginApi" section="def-common.CoreStart.savedObjects" text="savedObjects"/> | [index_data_visualizer.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/index_data_visualizer.tsx#:~:text=savedObjects) | - |
 | <DocLink id="kibKbnCoreSavedObjectsApiBrowserPluginApi" section="def-common.SimpleSavedObject" text="SimpleSavedObject"/> | [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/data_visualizer/common/types/index.ts#:~:text=SimpleSavedObject), [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/data_visualizer/common/types/index.ts#:~:text=SimpleSavedObject) | - |
 
 
 
-## devTools
-
-| Deprecated API | Reference location(s) | Remove By |
-| ---------------|-----------|-----------|
-| <DocLink id="kibKibanaReactPluginApi" section="def-public.KibanaThemeProvider" text="KibanaThemeProvider"/> | [application.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/dev_tools/public/application.tsx#:~:text=KibanaThemeProvider), [application.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/dev_tools/public/application.tsx#:~:text=KibanaThemeProvider), [application.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/dev_tools/public/application.tsx#:~:text=KibanaThemeProvider) | - |
-
-
-
 ## discover
 
 | Deprecated API | Reference location(s) | Remove By |
 | ---------------|-----------|-----------|
 | <DocLink id="kibDataPluginApi" section="def-public.SearchSource.create" text="create"/> | [saved_search_embeddable.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/discover/public/embeddable/saved_search_embeddable.tsx#:~:text=create), [saved_search_embeddable.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/discover/public/embeddable/saved_search_embeddable.tsx#:~:text=create) | - |
 | <DocLink id="kibDataPluginApi" section="def-common.SearchSource.create" text="create"/> | [saved_search_embeddable.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/discover/public/embeddable/saved_search_embeddable.tsx#:~:text=create), [saved_search_embeddable.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/discover/public/embeddable/saved_search_embeddable.tsx#:~:text=create) | - |
+| <DocLink id="kibEmbeddablePluginApi" section="def-public.EmbeddableSetup.registerEmbeddableFactory" text="registerEmbeddableFactory"/> | [plugin.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/discover/public/plugin.tsx#:~:text=registerEmbeddableFactory) | - |
 | <DocLink id="kibSavedObjectsPluginApi" section="def-public.SavedObjectSaveModal" text="SavedObjectSaveModal"/> | [on_save_search.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/discover/public/application/main/components/top_nav/on_save_search.tsx#:~:text=SavedObjectSaveModal), [on_save_search.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/discover/public/application/main/components/top_nav/on_save_search.tsx#:~:text=SavedObjectSaveModal) | 8.8.0 |
 | <DocLink id="kibUiActionsPluginApi" section="def-public.UiActionsService.executeTriggerActions" text="executeTriggerActions"/> | [saved_search_embeddable.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/discover/public/embeddable/saved_search_embeddable.tsx#:~:text=executeTriggerActions), [saved_search_embeddable.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/discover/public/embeddable/saved_search_embeddable.tsx#:~:text=executeTriggerActions), [search_embeddable_factory.ts](https://github.com/elastic/kibana/tree/main/src/plugins/discover/public/embeddable/search_embeddable_factory.ts#:~:text=executeTriggerActions), [plugin.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/discover/public/plugin.tsx#:~:text=executeTriggerActions) | - |
 | <DocLink id="kibKbnCoreLifecycleBrowserPluginApi" section="def-common.CoreStart.savedObjects" text="savedObjects"/> | [discover_state.test.ts](https://github.com/elastic/kibana/tree/main/src/plugins/discover/public/application/main/state_management/discover_state.test.ts#:~:text=savedObjects) | - |
@@ -657,6 +662,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | Deprecated API | Reference location(s) | Remove By |
 | ---------------|-----------|-----------|
 | <DocLink id="kibEmbeddablePluginApi" section="def-public.EmbeddableContext" text="EmbeddableContext"/> | [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/embeddable_enhanced/public/plugin.ts#:~:text=EmbeddableContext), [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/embeddable_enhanced/public/plugin.ts#:~:text=EmbeddableContext), [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/embeddable_enhanced/public/plugin.ts#:~:text=EmbeddableContext) | - |
+| <DocLink id="kibEmbeddablePluginApi" section="def-public.EmbeddableSetup.setCustomEmbeddableFactoryProvider" text="setCustomEmbeddableFactoryProvider"/> | [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/embeddable_enhanced/public/plugin.ts#:~:text=setCustomEmbeddableFactoryProvider) | - |
 
 
 
@@ -776,14 +782,6 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 
 
 
-## grokdebugger
-
-| Deprecated API | Reference location(s) | Remove By |
-| ---------------|-----------|-----------|
-| <DocLink id="kibKibanaReactPluginApi" section="def-public.KibanaThemeProvider" text="KibanaThemeProvider"/> | [shared_imports.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/grokdebugger/public/shared_imports.ts#:~:text=KibanaThemeProvider) | - |
-
-
-
 ## home
 
 | Deprecated API | Reference location(s) | Remove By |
@@ -811,31 +809,16 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 
 
 
-## indexManagement
-
-| Deprecated API | Reference location(s) | Remove By |
-| ---------------|-----------|-----------|
-| <DocLink id="kibKibanaReactPluginApi" section="def-public.toMountPoint" text="toMountPoint"/> | [use_datastreams_rollover.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/index_management/public/application/components/component_templates/component_template_wizard/component_template_datastreams_rollover/use_datastreams_rollover.tsx#:~:text=toMountPoint), [use_datastreams_rollover.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/index_management/public/application/components/component_templates/component_template_wizard/component_template_datastreams_rollover/use_datastreams_rollover.tsx#:~:text=toMountPoint) | - |
-
-
-
 ## infra
 
 | Deprecated API | Reference location(s) | Remove By |
 | ---------------|-----------|-----------|
+| <DocLink id="kibEmbeddablePluginApi" section="def-public.EmbeddableSetup.registerEmbeddableFactory" text="registerEmbeddableFactory"/> | [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_solution/infra/public/plugin.ts#:~:text=registerEmbeddableFactory) | - |
 | <DocLink id="kibKibanaReactPluginApi" section="def-public.KibanaThemeProvider" text="KibanaThemeProvider"/> | [common_providers.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_solution/infra/public/apps/common_providers.tsx#:~:text=KibanaThemeProvider), [common_providers.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_solution/infra/public/apps/common_providers.tsx#:~:text=KibanaThemeProvider), [common_providers.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_solution/infra/public/apps/common_providers.tsx#:~:text=KibanaThemeProvider) | - |
 | <DocLink id="kibKbnCoreSavedObjectsServerPluginApi" section="def-common.SavedObjectsType.migrations" text="migrations"/> | [saved_object_type.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_solution/infra/server/lib/sources/saved_object_type.ts#:~:text=migrations) | - |
 
 
 
-## ingestPipelines
-
-| Deprecated API | Reference location(s) | Remove By |
-| ---------------|-----------|-----------|
-| <DocLink id="kibKibanaReactPluginApi" section="def-public.KibanaThemeProvider" text="KibanaThemeProvider"/> | [shared_imports.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ingest_pipelines/public/shared_imports.ts#:~:text=KibanaThemeProvider) | - |
-
-
-
 ## inputControlVis
 
 | Deprecated API | Reference location(s) | Remove By |
@@ -870,11 +853,20 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 
 
 
+## kubernetesSecurity
+
+| Deprecated API | Reference location(s) | Remove By |
+| ---------------|-----------|-----------|
+| <DocLink id="kibTimelinesPluginApi" section="def-public.TimelinesUIStart.getHoverActions" text="getHoverActions"/> | [use_filter.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/kubernetes_security/public/hooks/use_filter.ts#:~:text=getHoverActions) | - |
+
+
+
 ## lens
 
 | Deprecated API | Reference location(s) | Remove By |
 | ---------------|-----------|-----------|
-| <DocLink id="kibEmbeddablePluginApi" section="def-public.registerSavedObjectToPanelMethod" text="registerSavedObjectToPanelMethod"/> | [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/lens/public/plugin.ts#:~:text=registerSavedObjectToPanelMethod), [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/lens/public/plugin.ts#:~:text=registerSavedObjectToPanelMethod) | - |
+| <DocLink id="kibEmbeddablePluginApi" section="def-public.EmbeddableSetup.registerEmbeddableFactory" text="registerEmbeddableFactory"/> | [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/lens/public/plugin.ts#:~:text=registerEmbeddableFactory) | - |
+| <DocLink id="kibEmbeddablePluginApi" section="def-public.EmbeddableStart.getEmbeddableFactory" text="getEmbeddableFactory"/> | [embeddable_component.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/lens/public/embeddable/embeddable_component.tsx#:~:text=getEmbeddableFactory) | - |
 | <DocLink id="kibSavedObjectsPluginApi" section="def-public.SavedObjectSaveModal" text="SavedObjectSaveModal"/> | [save_action.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/lens/public/visualizations/xy/annotations/actions/save_action.tsx#:~:text=SavedObjectSaveModal), [save_action.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/lens/public/visualizations/xy/annotations/actions/save_action.tsx#:~:text=SavedObjectSaveModal) | 8.8.0 |
 | <DocLink id="kibKbnCoreSavedObjectsApiBrowserPluginApi" section="def-common.SavedObjectsClientContract" text="SavedObjectsClientContract"/> | [find_object_by_title.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/lens/public/persistence/saved_objects_utils/find_object_by_title.test.ts#:~:text=SavedObjectsClientContract), [find_object_by_title.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/lens/public/persistence/saved_objects_utils/find_object_by_title.test.ts#:~:text=SavedObjectsClientContract), [find_object_by_title.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/lens/public/persistence/saved_objects_utils/find_object_by_title.test.ts#:~:text=SavedObjectsClientContract) | - |
 | <DocLink id="kibKbnCoreSavedObjectsApiBrowserPluginApi" section="def-common.SimpleSavedObject" text="SimpleSavedObject"/> | [find_object_by_title.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/lens/public/persistence/saved_objects_utils/find_object_by_title.test.ts#:~:text=SimpleSavedObject), [find_object_by_title.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/lens/public/persistence/saved_objects_utils/find_object_by_title.test.ts#:~:text=SimpleSavedObject) | - |
@@ -898,6 +890,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 
 | Deprecated API | Reference location(s) | Remove By |
 | ---------------|-----------|-----------|
+| <DocLink id="kibEmbeddablePluginApi" section="def-public.EmbeddableSetup.registerEmbeddableFactory" text="registerEmbeddableFactory"/> | [plugin.ts](https://github.com/elastic/kibana/tree/main/src/plugins/links/public/plugin.ts#:~:text=registerEmbeddableFactory) | - |
 | <DocLink id="kibSavedObjectsPluginApi" section="def-public.SavedObjectSaveModal" text="SavedObjectSaveModal"/> | [save_to_library.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/links/public/content_management/save_to_library.tsx#:~:text=SavedObjectSaveModal), [save_to_library.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/links/public/content_management/save_to_library.tsx#:~:text=SavedObjectSaveModal) | 8.8.0 |
 | <DocLink id="kibKbnCoreSavedObjectsServerPluginApi" section="def-common.SavedObjectsType.migrations" text="migrations"/> | [links.ts](https://github.com/elastic/kibana/tree/main/src/plugins/links/server/saved_objects/links.ts#:~:text=migrations) | - |
 
@@ -951,7 +944,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibDataPluginApi" section="def-common.DataView.flattenHit" text="flattenHit"/> | [es_search_source.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.tsx#:~:text=flattenHit), [es_search_source.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.tsx#:~:text=flattenHit), [es_search_source.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.tsx#:~:text=flattenHit), [es_search_source.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.tsx#:~:text=flattenHit) | - |
 | <DocLink id="kibDataPluginApi" section="def-server.DataView.flattenHit" text="flattenHit"/> | [es_search_source.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.tsx#:~:text=flattenHit), [es_search_source.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.tsx#:~:text=flattenHit), [es_search_source.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.tsx#:~:text=flattenHit), [es_search_source.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.tsx#:~:text=flattenHit) | - |
 | <DocLink id="kibDataViewsPluginApi" section="def-public.DataView.flattenHit" text="flattenHit"/> | [es_search_source.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.tsx#:~:text=flattenHit), [es_search_source.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.tsx#:~:text=flattenHit) | - |
-| <DocLink id="kibEmbeddablePluginApi" section="def-public.registerSavedObjectToPanelMethod" text="registerSavedObjectToPanelMethod"/> | [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/maps/public/plugin.ts#:~:text=registerSavedObjectToPanelMethod), [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/maps/public/plugin.ts#:~:text=registerSavedObjectToPanelMethod) | - |
+| <DocLink id="kibEmbeddablePluginApi" section="def-public.EmbeddableSetup.registerEmbeddableFactory" text="registerEmbeddableFactory"/> | [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/maps/public/plugin.ts#:~:text=registerEmbeddableFactory) | - |
 | <DocLink id="kibKbnCoreSavedObjectsApiBrowserPluginApi" section="def-common.ResolvedSimpleSavedObject" text="ResolvedSimpleSavedObject"/> | [map_attribute_service.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/maps/public/map_attribute_service.ts#:~:text=ResolvedSimpleSavedObject), [map_attribute_service.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/maps/public/map_attribute_service.ts#:~:text=ResolvedSimpleSavedObject), [map_attribute_service.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/maps/public/map_attribute_service.ts#:~:text=ResolvedSimpleSavedObject), [map_attribute_service.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/maps/public/map_attribute_service.ts#:~:text=ResolvedSimpleSavedObject) | - |
 | <DocLink id="kibKbnCoreSavedObjectsCommonPluginApi" section="def-common.SavedObjectReference" text="SavedObjectReference"/> | [references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/maps/common/migrations/references.ts#:~:text=SavedObjectReference), [references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/maps/common/migrations/references.ts#:~:text=SavedObjectReference), [references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/maps/common/migrations/references.ts#:~:text=SavedObjectReference), [references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/maps/common/migrations/references.ts#:~:text=SavedObjectReference), [references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/maps/common/migrations/references.ts#:~:text=SavedObjectReference), [map_attribute_service.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/maps/public/map_attribute_service.ts#:~:text=SavedObjectReference), [map_attribute_service.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/maps/public/map_attribute_service.ts#:~:text=SavedObjectReference) | - |
 | <DocLink id="kibKbnCoreSavedObjectsServerPluginApi" section="def-common.SavedObjectsType.migrations" text="migrations"/> | [setup_saved_objects.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/maps/server/saved_objects/setup_saved_objects.ts#:~:text=migrations) | - |
@@ -981,6 +974,8 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | Deprecated API | Reference location(s) | Remove By |
 | ---------------|-----------|-----------|
 | <DocLink id="kibAlertingPluginApi" section="def-public.PluginSetupContract.registerNavigation" text="registerNavigation"/> | [register_ml_alerts.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/alerting/register_ml_alerts.ts#:~:text=registerNavigation) | - |
+| <DocLink id="kibEmbeddablePluginApi" section="def-public.EmbeddableSetup.registerEmbeddableFactory" text="registerEmbeddableFactory"/> | [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/embeddables/index.ts#:~:text=registerEmbeddableFactory) | - |
+| <DocLink id="kibEmbeddablePluginApi" section="def-public.EmbeddableStart.getEmbeddableFactory" text="getEmbeddableFactory"/> | [get_embeddable_component.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/embeddables/get_embeddable_component.tsx#:~:text=getEmbeddableFactory) | - |
 | <DocLink id="kibLicensingPluginApi" section="def-public.LicensingPluginSetup.license$" text="license$"/> | [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/plugin.ts#:~:text=license%24) | 8.8.0 |
 | <DocLink id="kibLicensingPluginApi" section="def-server.LicensingPluginSetup.license$" text="license$"/> | [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/plugin.ts#:~:text=license%24) | 8.8.0 |
 | <DocLink id="kibSecurityPluginApi" section="def-server.SecurityPluginSetup.authc" text="authc"/> | [annotations.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/routes/annotations.ts#:~:text=authc) | - |
@@ -1012,6 +1007,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 
 | Deprecated API | Reference location(s) | Remove By |
 | ---------------|-----------|-----------|
+| <DocLink id="kibEmbeddablePluginApi" section="def-public.EmbeddableStart.getEmbeddableFactory" text="getEmbeddableFactory"/> | [profiling_embeddable.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_solution/observability_shared/public/components/profiling/embeddables/profiling_embeddable.tsx#:~:text=getEmbeddableFactory), [embeddable_profiling_search_bar.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_solution/observability_shared/public/components/profiling/embeddables/embeddable_profiling_search_bar.tsx#:~:text=getEmbeddableFactory) | - |
 | <DocLink id="kibKibanaReactPluginApi" section="def-public.toMountPoint" text="toMountPoint"/> | [header_menu_portal.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_solution/observability_shared/public/components/header_menu/header_menu_portal.tsx#:~:text=toMountPoint), [header_menu_portal.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_solution/observability_shared/public/components/header_menu/header_menu_portal.tsx#:~:text=toMountPoint) | - |
 
 
@@ -1024,6 +1020,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibDataPluginApi" section="def-common.SavedObject.migrationVersion" text="migrationVersion"/> | [read_pack_route.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/osquery/server/routes/pack/read_pack_route.ts#:~:text=migrationVersion), [read_pack_route.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/osquery/server/routes/pack/read_pack_route.ts#:~:text=migrationVersion), [read_pack_route.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/osquery/server/routes/pack/read_pack_route.ts#:~:text=migrationVersion), [read_pack_route.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/osquery/server/routes/pack/read_pack_route.ts#:~:text=migrationVersion) | - |
 | <DocLink id="kibDiscoverPluginApi" section="def-common.DiscoverAppLocatorParams.indexPatternId" text="indexPatternId"/> | [pack_queries_status_table.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/osquery/public/packs/pack_queries_status_table.tsx#:~:text=indexPatternId), [view_results_in_discover.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/osquery/public/discover/view_results_in_discover.tsx#:~:text=indexPatternId), [use_discover_link.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/osquery/public/common/hooks/use_discover_link.tsx#:~:text=indexPatternId) | - |
 | <DocLink id="kibLicensingPluginApi" section="def-server.LicensingPluginSetup.license$" text="license$"/> | [create_action_service.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/osquery/server/handlers/action/create_action_service.ts#:~:text=license%24) | 8.8.0 |
+| <DocLink id="kibTimelinesPluginApi" section="def-public.TimelinesUIStart.getHoverActions" text="getHoverActions"/> | [add_to_timeline_button.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/osquery/public/timelines/add_to_timeline_button.tsx#:~:text=getHoverActions) | - |
 
 
 
@@ -1031,7 +1028,6 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 
 | Deprecated API | Reference location(s) | Remove By |
 | ---------------|-----------|-----------|
-| <DocLink id="kibKibanaReactPluginApi" section="def-public.KibanaThemeProvider" text="KibanaThemeProvider"/> | [shared_imports.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/painless_lab/public/shared_imports.ts#:~:text=KibanaThemeProvider), [index.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/painless_lab/public/application/index.tsx#:~:text=KibanaThemeProvider), [index.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/painless_lab/public/application/index.tsx#:~:text=KibanaThemeProvider), [index.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/painless_lab/public/application/index.tsx#:~:text=KibanaThemeProvider) | - |
 | <DocLink id="kibLicensingPluginApi" section="def-public.LicensingPluginSetup.license$" text="license$"/> | [plugin.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/painless_lab/public/plugin.tsx#:~:text=license%24), [plugin.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/painless_lab/public/plugin.tsx#:~:text=license%24) | 8.8.0 |
 | <DocLink id="kibLicensingPluginApi" section="def-server.LicensingPluginSetup.license$" text="license$"/> | [license.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/painless_lab/server/services/license.ts#:~:text=license%24) | 8.8.0 |
 
@@ -1049,6 +1045,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 
 | Deprecated API | Reference location(s) | Remove By |
 | ---------------|-----------|-----------|
+| <DocLink id="kibEmbeddablePluginApi" section="def-public.EmbeddableSetup.registerEmbeddableFactory" text="registerEmbeddableFactory"/> | [register_embeddables.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_solution/profiling/public/embeddables/register_embeddables.ts#:~:text=registerEmbeddableFactory), [register_embeddables.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_solution/profiling/public/embeddables/register_embeddables.ts#:~:text=registerEmbeddableFactory), [register_embeddables.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_solution/profiling/public/embeddables/register_embeddables.ts#:~:text=registerEmbeddableFactory), [register_embeddables.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_solution/profiling/public/embeddables/register_embeddables.ts#:~:text=registerEmbeddableFactory) | - |
 | <DocLink id="kibLicensingPluginApi" section="def-public.LicensingPluginSetup.license$" text="license$"/> | [license_context.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_solution/profiling/public/components/contexts/license/license_context.tsx#:~:text=license%24) | 8.8.0 |
 
 
@@ -1090,14 +1087,6 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 
 
 
-## runtimeFields
-
-| Deprecated API | Reference location(s) | Remove By |
-| ---------------|-----------|-----------|
-| <DocLink id="kibKibanaReactPluginApi" section="def-public.toMountPoint" text="toMountPoint"/> | [shared_imports.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/runtime_fields/public/shared_imports.ts#:~:text=toMountPoint), [load_editor.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/runtime_fields/public/load_editor.tsx#:~:text=toMountPoint), [load_editor.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/runtime_fields/public/load_editor.tsx#:~:text=toMountPoint) | - |
-
-
-
 ## savedObjects
 
 | Deprecated API | Reference location(s) | Remove By |
@@ -1156,7 +1145,6 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 
 | Deprecated API | Reference location(s) | Remove By |
 | ---------------|-----------|-----------|
-| <DocLink id="kibEmbeddablePluginApi" section="def-public.registerSavedObjectToPanelMethod" text="registerSavedObjectToPanelMethod"/> | [plugin.ts](https://github.com/elastic/kibana/tree/main/src/plugins/saved_search/public/plugin.ts#:~:text=registerSavedObjectToPanelMethod), [plugin.ts](https://github.com/elastic/kibana/tree/main/src/plugins/saved_search/public/plugin.ts#:~:text=registerSavedObjectToPanelMethod) | - |
 | <DocLink id="kibKbnCoreSavedObjectsApiBrowserPluginApi" section="def-common.ResolvedSimpleSavedObject" text="ResolvedSimpleSavedObject"/> | [types.ts](https://github.com/elastic/kibana/tree/main/src/plugins/saved_search/public/services/saved_searches/types.ts#:~:text=ResolvedSimpleSavedObject), [types.ts](https://github.com/elastic/kibana/tree/main/src/plugins/saved_search/public/services/saved_searches/types.ts#:~:text=ResolvedSimpleSavedObject), [types.ts](https://github.com/elastic/kibana/tree/main/src/plugins/saved_search/public/services/saved_searches/types.ts#:~:text=ResolvedSimpleSavedObject), [types.ts](https://github.com/elastic/kibana/tree/main/src/plugins/saved_search/public/services/saved_searches/types.ts#:~:text=ResolvedSimpleSavedObject) | - |
 | <DocLink id="kibKbnCoreSavedObjectsApiServerPluginApi" section="def-common.SavedObjectAttributes" text="SavedObjectAttributes"/> | [search_migrations.ts](https://github.com/elastic/kibana/tree/main/src/plugins/saved_search/server/saved_objects/search_migrations.ts#:~:text=SavedObjectAttributes), [search_migrations.ts](https://github.com/elastic/kibana/tree/main/src/plugins/saved_search/server/saved_objects/search_migrations.ts#:~:text=SavedObjectAttributes), [search_migrations.ts](https://github.com/elastic/kibana/tree/main/src/plugins/saved_search/server/saved_objects/search_migrations.ts#:~:text=SavedObjectAttributes), [search_migrations.ts](https://github.com/elastic/kibana/tree/main/src/plugins/saved_search/server/saved_objects/search_migrations.ts#:~:text=SavedObjectAttributes) | - |
 | <DocLink id="kibKbnCoreSavedObjectsServerPluginApi" section="def-common.SavedObjectsType.migrations" text="migrations"/> | [search.ts](https://github.com/elastic/kibana/tree/main/src/plugins/saved_search/server/saved_objects/search.ts#:~:text=migrations) | - |
@@ -1169,7 +1157,6 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 
 | Deprecated API | Reference location(s) | Remove By |
 | ---------------|-----------|-----------|
-| <DocLink id="kibKibanaReactPluginApi" section="def-public.KibanaThemeProvider" text="KibanaThemeProvider"/> | [shared_imports.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/searchprofiler/public/shared_imports.ts#:~:text=KibanaThemeProvider), [index.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/searchprofiler/public/application/index.tsx#:~:text=KibanaThemeProvider), [index.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/searchprofiler/public/application/index.tsx#:~:text=KibanaThemeProvider), [index.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/searchprofiler/public/application/index.tsx#:~:text=KibanaThemeProvider) | - |
 | <DocLink id="kibLicensingPluginApi" section="def-public.LicensingPluginSetup.license$" text="license$"/> | [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/searchprofiler/public/plugin.ts#:~:text=license%24), [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/searchprofiler/public/plugin.ts#:~:text=license%24) | 8.8.0 |
 | <DocLink id="kibLicensingPluginApi" section="def-server.LicensingPluginSetup.license$" text="license$"/> | [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/searchprofiler/server/plugin.ts#:~:text=license%24) | 8.8.0 |
 
@@ -1194,6 +1181,7 @@ migrates to using the Kibana Privilege model: https://github.com/elastic/kibana/
 | <DocLink id="kibLicensingPluginApi" section="def-server.PublicLicense.mode" text="mode"/> | [license_service.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/common/licensing/license_service.test.ts#:~:text=mode), [license_service.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/common/licensing/license_service.test.ts#:~:text=mode), [license_service.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/common/licensing/license_service.test.ts#:~:text=mode) | 8.8.0 |
 | <DocLink id="kibLicensingPluginApi" section="def-server.LicensingPluginSetup.license$" text="license$"/> | [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/server/plugin.ts#:~:text=license%24) | 8.8.0 |
 | <DocLink id="kibKbnCoreApplicationBrowserPluginApi" section="def-common.AppMountParameters.appBasePath" text="appBasePath"/> | [logout_app.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/public/authentication/logout/logout_app.test.ts#:~:text=appBasePath) | 8.8.0 |
+| <DocLink id="kibKbnCoreLoggingServerPluginApi" section="def-common.NumericRollingStrategyConfig.max" text="max"/> | [config.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/server/config.ts#:~:text=max) | - |
 
 
 
@@ -1210,6 +1198,7 @@ migrates to using the Kibana Privilege model: https://github.com/elastic/kibana/
 | <DocLink id="kibDataPluginApi" section="def-common.SearchSource.create" text="create"/> | [wrap_search_source_client.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/lib/detection_engine/rule_preview/api/preview_rules/wrap_search_source_client.ts#:~:text=create) | - |
 | <DocLink id="kibDataPluginApi" section="def-common.SearchSource.fetch" text="fetch"/> | [wrap_search_source_client.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/lib/detection_engine/rule_preview/api/preview_rules/wrap_search_source_client.test.ts#:~:text=fetch), [wrap_search_source_client.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/lib/detection_engine/rule_preview/api/preview_rules/wrap_search_source_client.test.ts#:~:text=fetch), [wrap_search_source_client.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/lib/detection_engine/rule_preview/api/preview_rules/wrap_search_source_client.test.ts#:~:text=fetch), [wrap_search_source_client.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/lib/detection_engine/rule_preview/api/preview_rules/wrap_search_source_client.test.ts#:~:text=fetch) | - |
 | <DocLink id="kibDataPluginApi" section="def-common.EqlSearchStrategyRequest.options" text="options"/> | [api.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/common/hooks/eql/api.ts#:~:text=options) | - |
+| <DocLink id="kibEmbeddablePluginApi" section="def-public.EmbeddableStart.getEmbeddableFactory" text="getEmbeddableFactory"/> | [create_embeddable.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/explore/network/components/embeddables/create_embeddable.tsx#:~:text=getEmbeddableFactory) | - |
 | <DocLink id="kibLicensingPluginApi" section="def-public.PublicLicense.mode" text="mode"/> | [policy_config.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/common/license/policy_config.test.ts#:~:text=mode), [policy_config.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/common/license/policy_config.test.ts#:~:text=mode), [policy_config.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/common/license/policy_config.test.ts#:~:text=mode), [fleet_integration.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/fleet_integration/fleet_integration.test.ts#:~:text=mode), [fleet_integration.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/fleet_integration/fleet_integration.test.ts#:~:text=mode), [create_default_policy.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/fleet_integration/handlers/create_default_policy.test.ts#:~:text=mode), [create_default_policy.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/fleet_integration/handlers/create_default_policy.test.ts#:~:text=mode), [license_watch.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/endpoint/lib/policy/license_watch.test.ts#:~:text=mode), [license_watch.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/endpoint/lib/policy/license_watch.test.ts#:~:text=mode), [license_watch.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/endpoint/lib/policy/license_watch.test.ts#:~:text=mode)+ 7 more | 8.8.0 |
 | <DocLink id="kibLicensingPluginApi" section="def-server.PublicLicense.mode" text="mode"/> | [policy_config.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/common/license/policy_config.test.ts#:~:text=mode), [policy_config.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/common/license/policy_config.test.ts#:~:text=mode), [policy_config.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/common/license/policy_config.test.ts#:~:text=mode), [fleet_integration.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/fleet_integration/fleet_integration.test.ts#:~:text=mode), [fleet_integration.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/fleet_integration/fleet_integration.test.ts#:~:text=mode), [create_default_policy.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/fleet_integration/handlers/create_default_policy.test.ts#:~:text=mode), [create_default_policy.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/fleet_integration/handlers/create_default_policy.test.ts#:~:text=mode), [license_watch.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/endpoint/lib/policy/license_watch.test.ts#:~:text=mode), [license_watch.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/endpoint/lib/policy/license_watch.test.ts#:~:text=mode), [license_watch.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/endpoint/lib/policy/license_watch.test.ts#:~:text=mode)+ 7 more | 8.8.0 |
 | <DocLink id="kibLicensingPluginApi" section="def-server.LicensingPluginSetup.license$" text="license$"/> | [get_is_alert_suppression_active.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/utils/get_is_alert_suppression_active.ts#:~:text=license%24), [create_threat_signals.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/indicator_match/threat_mapping/create_threat_signals.ts#:~:text=license%24), [query.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/query/query.ts#:~:text=license%24), [threshold.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/threshold/threshold.ts#:~:text=license%24), [get_is_alert_suppression_active.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/utils/get_is_alert_suppression_active.test.ts#:~:text=license%24), [get_is_alert_suppression_active.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/utils/get_is_alert_suppression_active.test.ts#:~:text=license%24), [get_is_alert_suppression_active.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/utils/get_is_alert_suppression_active.test.ts#:~:text=license%24) | 8.8.0 |
@@ -1255,6 +1244,7 @@ migrates to using the Kibana Privilege model: https://github.com/elastic/kibana/
 | Deprecated API | Reference location(s) | Remove By |
 | ---------------|-----------|-----------|
 | <DocLink id="kibAlertingPluginApi" section="def-server.RuleExecutorServices.alertFactory" text="alertFactory"/> | [executor.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_solution/slo/server/lib/rules/slo_burn_rate/executor.test.ts#:~:text=alertFactory) | - |
+| <DocLink id="kibEmbeddablePluginApi" section="def-public.EmbeddableSetup.registerEmbeddableFactory" text="registerEmbeddableFactory"/> | [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_solution/slo/public/plugin.ts#:~:text=registerEmbeddableFactory) | - |
 | <DocLink id="kibLicensingPluginApi" section="def-public.LicensingPluginSetup.license$" text="license$"/> | [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_solution/slo/public/plugin.ts#:~:text=license%24) | 8.8.0 |
 | <DocLink id="kibKbnCoreSavedObjectsServerPluginApi" section="def-common.SavedObjectsType.migrations" text="migrations"/> | [slo.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_solution/slo/server/saved_objects/slo.ts#:~:text=migrations) | - |
 
@@ -1312,6 +1302,14 @@ migrates to using the Kibana Privilege model: https://github.com/elastic/kibana/
 
 
 
+## threatIntelligence
+
+| Deprecated API | Reference location(s) | Remove By |
+| ---------------|-----------|-----------|
+| <DocLink id="kibTimelinesPluginApi" section="def-public.TimelinesUIStart.getHoverActions" text="getHoverActions"/> | [add_to_timeline.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/threat_intelligence/public/modules/timeline/components/add_to_timeline.tsx#:~:text=getHoverActions), [add_to_timeline.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/threat_intelligence/public/modules/timeline/components/add_to_timeline.tsx#:~:text=getHoverActions), [add_to_timeline.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/threat_intelligence/public/modules/timeline/components/add_to_timeline.tsx#:~:text=getHoverActions), [add_to_timeline.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/threat_intelligence/public/modules/timeline/components/add_to_timeline.tsx#:~:text=getHoverActions) | - |
+
+
+
 ## transform
 
 | Deprecated API | Reference location(s) | Remove By |
@@ -1336,6 +1334,7 @@ migrates to using the Kibana Privilege model: https://github.com/elastic/kibana/
 
 | Deprecated API | Reference location(s) | Remove By |
 | ---------------|-----------|-----------|
+| <DocLink id="kibEmbeddablePluginApi" section="def-public.EmbeddableSetup.registerEnhancement" text="registerEnhancement"/> | [plugin.ts](https://github.com/elastic/kibana/tree/main/src/plugins/ui_actions_enhanced/public/plugin.ts#:~:text=registerEnhancement) | - |
 | <DocLink id="kibKbnCoreSavedObjectsCommonPluginApi" section="def-common.SavedObjectReference" text="SavedObjectReference"/> | [action_factory.ts](https://github.com/elastic/kibana/tree/main/src/plugins/ui_actions_enhanced/public/dynamic_actions/action_factory.ts#:~:text=SavedObjectReference), [action_factory.ts](https://github.com/elastic/kibana/tree/main/src/plugins/ui_actions_enhanced/public/dynamic_actions/action_factory.ts#:~:text=SavedObjectReference), [ui_actions_service_enhancements.ts](https://github.com/elastic/kibana/tree/main/src/plugins/ui_actions_enhanced/public/services/ui_actions_service_enhancements.ts#:~:text=SavedObjectReference), [ui_actions_service_enhancements.ts](https://github.com/elastic/kibana/tree/main/src/plugins/ui_actions_enhanced/public/services/ui_actions_service_enhancements.ts#:~:text=SavedObjectReference), [ui_actions_service_enhancements.ts](https://github.com/elastic/kibana/tree/main/src/plugins/ui_actions_enhanced/public/services/ui_actions_service_enhancements.ts#:~:text=SavedObjectReference), [dynamic_action_enhancement.ts](https://github.com/elastic/kibana/tree/main/src/plugins/ui_actions_enhanced/public/dynamic_actions/dynamic_action_enhancement.ts#:~:text=SavedObjectReference), [dynamic_action_enhancement.ts](https://github.com/elastic/kibana/tree/main/src/plugins/ui_actions_enhanced/public/dynamic_actions/dynamic_action_enhancement.ts#:~:text=SavedObjectReference), [dynamic_action_enhancement.ts](https://github.com/elastic/kibana/tree/main/src/plugins/ui_actions_enhanced/server/dynamic_action_enhancement.ts#:~:text=SavedObjectReference), [dynamic_action_enhancement.ts](https://github.com/elastic/kibana/tree/main/src/plugins/ui_actions_enhanced/server/dynamic_action_enhancement.ts#:~:text=SavedObjectReference), [dynamic_action_enhancement.ts](https://github.com/elastic/kibana/tree/main/src/plugins/ui_actions_enhanced/server/dynamic_action_enhancement.ts#:~:text=SavedObjectReference) | - |
 
 
@@ -1399,7 +1398,7 @@ migrates to using the Kibana Privilege model: https://github.com/elastic/kibana/
 
 | Deprecated API | Reference location(s) | Remove By |
 | ---------------|-----------|-----------|
-| <DocLink id="kibEmbeddablePluginApi" section="def-public.registerSavedObjectToPanelMethod" text="registerSavedObjectToPanelMethod"/> | [plugin.ts](https://github.com/elastic/kibana/tree/main/src/plugins/visualizations/public/plugin.ts#:~:text=registerSavedObjectToPanelMethod), [plugin.ts](https://github.com/elastic/kibana/tree/main/src/plugins/visualizations/public/plugin.ts#:~:text=registerSavedObjectToPanelMethod) | - |
+| <DocLink id="kibEmbeddablePluginApi" section="def-public.EmbeddableSetup.registerEmbeddableFactory" text="registerEmbeddableFactory"/> | [plugin.ts](https://github.com/elastic/kibana/tree/main/src/plugins/visualizations/public/plugin.ts#:~:text=registerEmbeddableFactory) | - |
 | <DocLink id="kibSavedObjectsFinderPluginApi" section="def-public.SavedObjectMetaData.includeFields" text="includeFields"/> | [search_selection.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/visualizations/public/wizard/search_selection/search_selection.tsx#:~:text=includeFields), [visualize_embeddable_factory.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/visualizations/public/embeddable/visualize_embeddable_factory.tsx#:~:text=includeFields) | - |
 | <DocLink id="kibKbnCoreLifecycleBrowserPluginApi" section="def-common.CoreStart.savedObjects" text="savedObjects"/> | [plugin.ts](https://github.com/elastic/kibana/tree/main/src/plugins/visualizations/public/plugin.ts#:~:text=savedObjects), [visualize_listing.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/visualizations/public/visualize_app/components/visualize_listing.tsx#:~:text=savedObjects) | - |
 | <DocLink id="kibKbnCoreSavedObjectsApiBrowserPluginApi" section="def-common.SavedObjectsClientContract" text="SavedObjectsClientContract"/> | [plugin.ts](https://github.com/elastic/kibana/tree/main/src/plugins/visualizations/public/plugin.ts#:~:text=SavedObjectsClientContract), [plugin.ts](https://github.com/elastic/kibana/tree/main/src/plugins/visualizations/public/plugin.ts#:~:text=SavedObjectsClientContract) | - |
diff --git a/api_docs/deprecations_by_team.mdx b/api_docs/deprecations_by_team.mdx
index 42ba2230557dca..b3fac3991faf7d 100644
--- a/api_docs/deprecations_by_team.mdx
+++ b/api_docs/deprecations_by_team.mdx
@@ -7,7 +7,7 @@ id: kibDevDocsDeprecationsDueByTeam
 slug: /kibana-dev-docs/api-meta/deprecations-due-by-team
 title: Deprecated APIs due to be removed, by team
 description: Lists the teams that are referencing deprecated APIs with a remove by date.
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana']
 ---
 
@@ -61,7 +61,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 
 | Plugin | Deprecated API | Reference location(s) | Remove By |
 | --------|-------|-----------|-----------|
-| crossClusterReplication | <DocLink id="kibLicensingPluginApi" section="def-public.LicensingPluginSetup.license$" text="license$"/> | [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cross_cluster_replication/public/plugin.ts#:~:text=license%24), [plugin.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/painless_lab/public/plugin.tsx#:~:text=license%24), [plugin.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/painless_lab/public/plugin.tsx#:~:text=license%24), [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/searchprofiler/public/plugin.ts#:~:text=license%24), [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/searchprofiler/public/plugin.ts#:~:text=license%24), [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/license_management/public/plugin.ts#:~:text=license%24), [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/watcher/public/plugin.ts#:~:text=license%24), [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/watcher/public/plugin.ts#:~:text=license%24) | 8.8.0 |
+| licenseManagement | <DocLink id="kibLicensingPluginApi" section="def-public.LicensingPluginSetup.license$" text="license$"/> | [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/license_management/public/plugin.ts#:~:text=license%24), [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cross_cluster_replication/public/plugin.ts#:~:text=license%24), [plugin.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/painless_lab/public/plugin.tsx#:~:text=license%24), [plugin.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/painless_lab/public/plugin.tsx#:~:text=license%24), [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/searchprofiler/public/plugin.ts#:~:text=license%24), [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/searchprofiler/public/plugin.ts#:~:text=license%24), [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/watcher/public/plugin.ts#:~:text=license%24), [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/watcher/public/plugin.ts#:~:text=license%24) | 8.8.0 |
 | painlessLab | <DocLink id="kibLicensingPluginApi" section="def-server.LicensingPluginSetup.license$" text="license$"/> | [license.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/painless_lab/server/services/license.ts#:~:text=license%24), [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/searchprofiler/server/plugin.ts#:~:text=license%24), [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/remote_clusters/server/plugin.ts#:~:text=license%24), [license.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/index_lifecycle_management/server/services/license.ts#:~:text=license%24), [license.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/rollup/server/services/license.ts#:~:text=license%24), [license.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/snapshot_restore/server/services/license.ts#:~:text=license%24), [reindex_service.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/upgrade_assistant/server/lib/reindexing/reindex_service.ts#:~:text=license%24), [reindex_service.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/upgrade_assistant/server/lib/reindexing/reindex_service.test.ts#:~:text=license%24), [reindex_service.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/upgrade_assistant/server/lib/reindexing/reindex_service.test.ts#:~:text=license%24) | 8.8.0 |
 | management | <DocLink id="kibKbnCoreApplicationBrowserPluginApi" section="def-common.AppMountParameters.appBasePath" text="appBasePath"/> | [application.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/management/public/application.tsx#:~:text=appBasePath) | 8.8.0 |
 
@@ -71,7 +71,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 
 | Plugin | Deprecated API | Reference location(s) | Remove By |
 | --------|-------|-----------|-----------|
-| dashboard | <DocLink id="kibSavedObjectsPluginApi" section="def-public.SavedObjectSaveModal" text="SavedObjectSaveModal"/> | [save_modal.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/dashboard/public/dashboard_container/embeddable/api/overlays/save_modal.tsx#:~:text=SavedObjectSaveModal), [save_modal.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/dashboard/public/dashboard_container/embeddable/api/overlays/save_modal.tsx#:~:text=SavedObjectSaveModal), [add_to_library_action.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/dashboard/public/dashboard_actions/add_to_library_action.tsx#:~:text=SavedObjectSaveModal), [add_to_library_action.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/dashboard/public/dashboard_actions/add_to_library_action.tsx#:~:text=SavedObjectSaveModal), [attribute_service.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/embeddable/public/lib/attribute_service/attribute_service.tsx#:~:text=SavedObjectSaveModal), [attribute_service.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/embeddable/public/lib/attribute_service/attribute_service.tsx#:~:text=SavedObjectSaveModal), [saved_object_save_modal_dashboard.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/presentation_util/public/components/saved_object_save_modal_dashboard.tsx#:~:text=SavedObjectSaveModal), [saved_object_save_modal_dashboard.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/presentation_util/public/components/saved_object_save_modal_dashboard.tsx#:~:text=SavedObjectSaveModal), [save_to_library.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/links/public/content_management/save_to_library.tsx#:~:text=SavedObjectSaveModal), [save_to_library.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/links/public/content_management/save_to_library.tsx#:~:text=SavedObjectSaveModal) | 8.8.0 |
+| dashboard | <DocLink id="kibSavedObjectsPluginApi" section="def-public.SavedObjectSaveModal" text="SavedObjectSaveModal"/> | [save_modal.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/dashboard/public/dashboard_container/embeddable/api/overlays/save_modal.tsx#:~:text=SavedObjectSaveModal), [save_modal.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/dashboard/public/dashboard_container/embeddable/api/overlays/save_modal.tsx#:~:text=SavedObjectSaveModal), [add_to_library_action.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/dashboard/public/dashboard_actions/add_to_library_action.tsx#:~:text=SavedObjectSaveModal), [add_to_library_action.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/dashboard/public/dashboard_actions/add_to_library_action.tsx#:~:text=SavedObjectSaveModal), [save_to_library.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/links/public/content_management/save_to_library.tsx#:~:text=SavedObjectSaveModal), [save_to_library.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/links/public/content_management/save_to_library.tsx#:~:text=SavedObjectSaveModal), [attribute_service.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/embeddable/public/lib/attribute_service/attribute_service.tsx#:~:text=SavedObjectSaveModal), [attribute_service.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/embeddable/public/lib/attribute_service/attribute_service.tsx#:~:text=SavedObjectSaveModal), [saved_object_save_modal_dashboard.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/presentation_util/public/components/saved_object_save_modal_dashboard.tsx#:~:text=SavedObjectSaveModal), [saved_object_save_modal_dashboard.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/presentation_util/public/components/saved_object_save_modal_dashboard.tsx#:~:text=SavedObjectSaveModal) | 8.8.0 |
 
 
 
@@ -127,9 +127,9 @@ migrates to using the Kibana Privilege model: https://github.com/elastic/kibana/
 
 | Plugin | Deprecated API | Reference location(s) | Remove By |
 | --------|-------|-----------|-----------|
+| profiling | <DocLink id="kibLicensingPluginApi" section="def-public.LicensingPluginSetup.license$" text="license$"/> | [license_context.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_solution/profiling/public/components/contexts/license/license_context.tsx#:~:text=license%24), [license_context.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_solution/apm/public/context/license/license_context.tsx#:~:text=license%24) | 8.8.0 |
 | apm | <DocLink id="kibHomePluginApi" section="def-public.HomePublicPluginSetup.environment" text="environment"/> | [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_solution/apm/public/plugin.ts#:~:text=environment) | 8.8.0 |
 | apm | <DocLink id="kibLicensingPluginApi" section="def-public.PublicLicense.mode" text="mode"/> | [license_check.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_solution/apm/common/license_check.test.ts#:~:text=mode), [license_check.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_solution/apm/common/license_check.test.ts#:~:text=mode), [license_check.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_solution/apm/common/license_check.test.ts#:~:text=mode), [license_check.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_solution/apm/common/license_check.test.ts#:~:text=mode), [license_check.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_solution/apm/common/license_check.test.ts#:~:text=mode), [license_check.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_solution/apm/common/license_check.test.ts#:~:text=mode), [license_check.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_solution/apm/common/license_check.test.ts#:~:text=mode), [license_check.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_solution/apm/common/license_check.test.ts#:~:text=mode), [license_check.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_solution/apm/common/license_check.test.ts#:~:text=mode), [license_check.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_solution/apm/common/license_check.test.ts#:~:text=mode)+ 2 more | 8.8.0 |
-| apm | <DocLink id="kibLicensingPluginApi" section="def-public.LicensingPluginSetup.license$" text="license$"/> | [license_context.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_solution/apm/public/context/license/license_context.tsx#:~:text=license%24), [license_context.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_solution/profiling/public/components/contexts/license/license_context.tsx#:~:text=license%24) | 8.8.0 |
 | apm | <DocLink id="kibLicensingPluginApi" section="def-server.PublicLicense.mode" text="mode"/> | [license_check.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_solution/apm/common/license_check.test.ts#:~:text=mode), [license_check.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_solution/apm/common/license_check.test.ts#:~:text=mode), [license_check.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_solution/apm/common/license_check.test.ts#:~:text=mode), [license_check.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_solution/apm/common/license_check.test.ts#:~:text=mode), [license_check.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_solution/apm/common/license_check.test.ts#:~:text=mode), [license_check.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_solution/apm/common/license_check.test.ts#:~:text=mode), [license_check.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_solution/apm/common/license_check.test.ts#:~:text=mode), [license_check.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_solution/apm/common/license_check.test.ts#:~:text=mode), [license_check.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_solution/apm/common/license_check.test.ts#:~:text=mode), [license_check.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_solution/apm/common/license_check.test.ts#:~:text=mode)+ 2 more | 8.8.0 |
 
 
diff --git a/api_docs/dev_tools.mdx b/api_docs/dev_tools.mdx
index 4e7b2e4e176092..c05125eee839a9 100644
--- a/api_docs/dev_tools.mdx
+++ b/api_docs/dev_tools.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/devTools
 title: "devTools"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the devTools plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'devTools']
 ---
 import devToolsObj from './dev_tools.devdocs.json';
diff --git a/api_docs/discover.devdocs.json b/api_docs/discover.devdocs.json
index 7351d240bf4084..fc1fe785c87e6a 100644
--- a/api_docs/discover.devdocs.json
+++ b/api_docs/discover.devdocs.json
@@ -2622,14 +2622,6 @@
                 "plugin": "cloudSecurityPosture",
                 "path": "x-pack/plugins/cloud_security_posture/public/pages/configurations/findings_flyout/overview_tab.tsx"
               },
-              {
-                "plugin": "dataVisualizer",
-                "path": "x-pack/plugins/data_visualizer/public/application/common/components/results_links/results_links.tsx"
-              },
-              {
-                "plugin": "dataVisualizer",
-                "path": "x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/actions_panel/actions_panel.tsx"
-              },
               {
                 "plugin": "exploratoryView",
                 "path": "x-pack/plugins/observability_solution/exploratory_view/public/components/shared/exploratory_view/hooks/use_discover_link.tsx"
diff --git a/api_docs/discover.mdx b/api_docs/discover.mdx
index 7084e624d8f4e6..8dd3dfc878f048 100644
--- a/api_docs/discover.mdx
+++ b/api_docs/discover.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/discover
 title: "discover"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the discover plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'discover']
 ---
 import discoverObj from './discover.devdocs.json';
diff --git a/api_docs/discover_enhanced.mdx b/api_docs/discover_enhanced.mdx
index fa64182133a501..9a88e43feaca30 100644
--- a/api_docs/discover_enhanced.mdx
+++ b/api_docs/discover_enhanced.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/discoverEnhanced
 title: "discoverEnhanced"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the discoverEnhanced plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'discoverEnhanced']
 ---
 import discoverEnhancedObj from './discover_enhanced.devdocs.json';
diff --git a/api_docs/discover_shared.mdx b/api_docs/discover_shared.mdx
index 778eb248ae0771..b16b32190471db 100644
--- a/api_docs/discover_shared.mdx
+++ b/api_docs/discover_shared.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/discoverShared
 title: "discoverShared"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the discoverShared plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'discoverShared']
 ---
 import discoverSharedObj from './discover_shared.devdocs.json';
diff --git a/api_docs/ecs_data_quality_dashboard.mdx b/api_docs/ecs_data_quality_dashboard.mdx
index 7b2bfc47994a22..6ae3128cf130ca 100644
--- a/api_docs/ecs_data_quality_dashboard.mdx
+++ b/api_docs/ecs_data_quality_dashboard.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/ecsDataQualityDashboard
 title: "ecsDataQualityDashboard"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the ecsDataQualityDashboard plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'ecsDataQualityDashboard']
 ---
 import ecsDataQualityDashboardObj from './ecs_data_quality_dashboard.devdocs.json';
diff --git a/api_docs/elastic_assistant.mdx b/api_docs/elastic_assistant.mdx
index 11443315bc7ff9..beb852a9da9689 100644
--- a/api_docs/elastic_assistant.mdx
+++ b/api_docs/elastic_assistant.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/elasticAssistant
 title: "elasticAssistant"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the elasticAssistant plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'elasticAssistant']
 ---
 import elasticAssistantObj from './elastic_assistant.devdocs.json';
diff --git a/api_docs/embeddable.devdocs.json b/api_docs/embeddable.devdocs.json
index cdac7c2c9c91f1..7b7c6fd7b56227 100644
--- a/api_docs/embeddable.devdocs.json
+++ b/api_docs/embeddable.devdocs.json
@@ -8174,6 +8174,39 @@
         "returnComment": [],
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "embeddable",
+        "id": "def-public.getReactEmbeddableSavedObjects",
+        "type": "Function",
+        "tags": [],
+        "label": "getReactEmbeddableSavedObjects",
+        "description": [],
+        "signature": [
+          "<TSavedObjectAttributes extends ",
+          {
+            "pluginId": "savedObjectsFinder",
+            "scope": "common",
+            "docId": "kibSavedObjectsFinderPluginApi",
+            "section": "def-common.FinderAttributes",
+            "text": "FinderAttributes"
+          },
+          ">() => IterableIterator<[string, ",
+          {
+            "pluginId": "embeddable",
+            "scope": "public",
+            "docId": "kibEmbeddablePluginApi",
+            "section": "def-public.ReactEmbeddableSavedObject",
+            "text": "ReactEmbeddableSavedObject"
+          },
+          "<TSavedObjectAttributes>]>"
+        ],
+        "path": "src/plugins/embeddable/public/lib/embeddable_saved_object_registry/embeddable_saved_object_registry.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [],
+        "returnComment": [],
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "embeddable",
         "id": "def-public.isContextMenuTriggerContext",
@@ -8919,39 +8952,6 @@
         "returnComment": [],
         "initialIsOpen": false
       },
-      {
-        "parentPluginId": "embeddable",
-        "id": "def-public.reactEmbeddableRegistryHasKey",
-        "type": "Function",
-        "tags": [],
-        "label": "reactEmbeddableRegistryHasKey",
-        "description": [],
-        "signature": [
-          "(key: string) => boolean"
-        ],
-        "path": "src/plugins/embeddable/public/react_embeddable_system/react_embeddable_registry.ts",
-        "deprecated": false,
-        "trackAdoption": false,
-        "children": [
-          {
-            "parentPluginId": "embeddable",
-            "id": "def-public.reactEmbeddableRegistryHasKey.$1",
-            "type": "string",
-            "tags": [],
-            "label": "key",
-            "description": [],
-            "signature": [
-              "string"
-            ],
-            "path": "src/plugins/embeddable/public/react_embeddable_system/react_embeddable_registry.ts",
-            "deprecated": false,
-            "trackAdoption": false,
-            "isRequired": true
-          }
-        ],
-        "returnComment": [],
-        "initialIsOpen": false
-      },
       {
         "parentPluginId": "embeddable",
         "id": "def-public.ReactEmbeddableRenderer",
@@ -9204,608 +9204,122 @@
       },
       {
         "parentPluginId": "embeddable",
-        "id": "def-public.registerReactEmbeddableFactory",
+        "id": "def-public.runEmbeddableFactoryMigrations",
         "type": "Function",
         "tags": [],
-        "label": "registerReactEmbeddableFactory",
+        "label": "runEmbeddableFactoryMigrations",
         "description": [
-          "\nRegisters a new React embeddable factory. This should be called at plugin start time.\n"
+          "\nA helper function that migrates an Embeddable Input to its latest version. Note that this function\nonly runs the embeddable factory's migrations."
         ],
         "signature": [
-          "<StateType extends object = object, APIType extends ",
+          "<ToType extends ",
           {
             "pluginId": "embeddable",
-            "scope": "public",
+            "scope": "common",
             "docId": "kibEmbeddablePluginApi",
-            "section": "def-public.DefaultEmbeddableApi",
-            "text": "DefaultEmbeddableApi"
+            "section": "def-common.EmbeddableInput",
+            "text": "EmbeddableInput"
           },
-          "<StateType> = ",
+          ">(initialInput: { version?: string | undefined; }, factory: { migrations?: ",
           {
-            "pluginId": "embeddable",
-            "scope": "public",
-            "docId": "kibEmbeddablePluginApi",
-            "section": "def-public.DefaultEmbeddableApi",
-            "text": "DefaultEmbeddableApi"
+            "pluginId": "kibanaUtils",
+            "scope": "common",
+            "docId": "kibKibanaUtilsPluginApi",
+            "section": "def-common.MigrateFunctionsObject",
+            "text": "MigrateFunctionsObject"
           },
-          "<StateType>>(type: string, getFactory: () => Promise<",
+          " | ",
           {
-            "pluginId": "embeddable",
-            "scope": "public",
-            "docId": "kibEmbeddablePluginApi",
-            "section": "def-public.ReactEmbeddableFactory",
-            "text": "ReactEmbeddableFactory"
+            "pluginId": "kibanaUtils",
+            "scope": "common",
+            "docId": "kibKibanaUtilsPluginApi",
+            "section": "def-common.GetMigrationFunctionObjectFn",
+            "text": "GetMigrationFunctionObjectFn"
           },
-          "<StateType, APIType, StateType>>) => void"
+          " | undefined; latestVersion?: string | undefined; }) => { input: ToType; migrationRun: boolean; }"
         ],
-        "path": "src/plugins/embeddable/public/react_embeddable_system/react_embeddable_registry.ts",
+        "path": "src/plugins/embeddable/public/lib/factory_migrations/run_factory_migrations.ts",
         "deprecated": false,
         "trackAdoption": false,
         "children": [
           {
             "parentPluginId": "embeddable",
-            "id": "def-public.registerReactEmbeddableFactory.$1",
-            "type": "string",
+            "id": "def-public.runEmbeddableFactoryMigrations.$1",
+            "type": "Object",
             "tags": [],
-            "label": "type",
-            "description": [
-              "The key to register the factory under. This should be the same as the `type` key in the factory definition."
-            ],
-            "signature": [
-              "string"
-            ],
-            "path": "src/plugins/embeddable/public/react_embeddable_system/react_embeddable_registry.ts",
+            "label": "initialInput",
+            "description": [],
+            "path": "src/plugins/embeddable/public/lib/factory_migrations/run_factory_migrations.ts",
             "deprecated": false,
             "trackAdoption": false,
-            "isRequired": true
-          },
-          {
-            "parentPluginId": "embeddable",
-            "id": "def-public.registerReactEmbeddableFactory.$2",
-            "type": "Function",
-            "tags": [],
-            "label": "getFactory",
-            "description": [
-              "an async function that gets the factory definition for this key. This should always async import the\nactual factory definition file to avoid polluting page load."
-            ],
-            "signature": [
-              "() => Promise<",
+            "children": [
               {
-                "pluginId": "embeddable",
-                "scope": "public",
-                "docId": "kibEmbeddablePluginApi",
-                "section": "def-public.ReactEmbeddableFactory",
-                "text": "ReactEmbeddableFactory"
-              },
-              "<StateType, APIType, StateType>>"
-            ],
-            "path": "src/plugins/embeddable/public/react_embeddable_system/react_embeddable_registry.ts",
-            "deprecated": false,
-            "trackAdoption": false,
-            "isRequired": true
-          }
-        ],
-        "returnComment": [],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "embeddable",
-        "id": "def-public.registerReactEmbeddableSavedObject",
-        "type": "Function",
-        "tags": [],
-        "label": "registerReactEmbeddableSavedObject",
-        "description": [
-          "\nRegister an embeddable API saved object with the Add from library flyout.\n"
-        ],
-        "signature": [
-          "<TSavedObjectAttributes extends ",
-          {
-            "pluginId": "savedObjectsFinder",
-            "scope": "common",
-            "docId": "kibSavedObjectsFinderPluginApi",
-            "section": "def-common.FinderAttributes",
-            "text": "FinderAttributes"
-          },
-          ">({ onAdd, embeddableType, savedObjectType, savedObjectName, getIconForSavedObject, getSavedObjectSubType, getTooltipForSavedObject, }: { onAdd: SOToEmbeddable<TSavedObjectAttributes>; embeddableType: string; savedObjectType: string; savedObjectName: string; getIconForSavedObject: (savedObject: ",
-          {
-            "pluginId": "savedObjectsFinder",
-            "scope": "common",
-            "docId": "kibSavedObjectsFinderPluginApi",
-            "section": "def-common.SavedObjectCommon",
-            "text": "SavedObjectCommon"
-          },
-          "<TSavedObjectAttributes>) => ",
-          "IconType",
-          "; getSavedObjectSubType?: ((savedObject: ",
-          {
-            "pluginId": "savedObjectsFinder",
-            "scope": "common",
-            "docId": "kibSavedObjectsFinderPluginApi",
-            "section": "def-common.SavedObjectCommon",
-            "text": "SavedObjectCommon"
-          },
-          "<TSavedObjectAttributes>) => string) | undefined; getTooltipForSavedObject?: ((savedObject: ",
-          {
-            "pluginId": "savedObjectsFinder",
-            "scope": "common",
-            "docId": "kibSavedObjectsFinderPluginApi",
-            "section": "def-common.SavedObjectCommon",
-            "text": "SavedObjectCommon"
+                "parentPluginId": "embeddable",
+                "id": "def-public.runEmbeddableFactoryMigrations.$1.version",
+                "type": "string",
+                "tags": [],
+                "label": "version",
+                "description": [],
+                "signature": [
+                  "string | undefined"
+                ],
+                "path": "src/plugins/embeddable/public/lib/factory_migrations/run_factory_migrations.ts",
+                "deprecated": false,
+                "trackAdoption": false
+              }
+            ]
           },
-          "<TSavedObjectAttributes>) => string) | undefined; }) => void"
-        ],
-        "path": "src/plugins/embeddable/public/lib/embeddable_saved_object_registry/embeddable_saved_object_registry.ts",
-        "deprecated": false,
-        "trackAdoption": false,
-        "children": [
           {
             "parentPluginId": "embeddable",
-            "id": "def-public.registerReactEmbeddableSavedObject.$1",
+            "id": "def-public.runEmbeddableFactoryMigrations.$2",
             "type": "Object",
             "tags": [],
-            "label": "{\n  onAdd,\n  embeddableType,\n  savedObjectType,\n  savedObjectName,\n  getIconForSavedObject,\n  getSavedObjectSubType,\n  getTooltipForSavedObject,\n}",
+            "label": "factory",
             "description": [],
-            "path": "src/plugins/embeddable/public/lib/embeddable_saved_object_registry/embeddable_saved_object_registry.ts",
+            "path": "src/plugins/embeddable/public/lib/factory_migrations/run_factory_migrations.ts",
             "deprecated": false,
             "trackAdoption": false,
             "children": [
               {
                 "parentPluginId": "embeddable",
-                "id": "def-public.registerReactEmbeddableSavedObject.$1.onAdd",
-                "type": "Function",
+                "id": "def-public.runEmbeddableFactoryMigrations.$2.migrations",
+                "type": "CompoundType",
                 "tags": [],
-                "label": "onAdd",
+                "label": "migrations",
                 "description": [],
                 "signature": [
-                  "(container: ",
                   {
-                    "pluginId": "@kbn/presentation-containers",
+                    "pluginId": "kibanaUtils",
                     "scope": "common",
-                    "docId": "kibKbnPresentationContainersPluginApi",
-                    "section": "def-common.PresentationContainer",
-                    "text": "PresentationContainer"
+                    "docId": "kibKibanaUtilsPluginApi",
+                    "section": "def-common.MigrateFunctionsObject",
+                    "text": "MigrateFunctionsObject"
                   },
-                  ", savedObject: ",
+                  " | ",
                   {
-                    "pluginId": "savedObjectsFinder",
+                    "pluginId": "kibanaUtils",
                     "scope": "common",
-                    "docId": "kibSavedObjectsFinderPluginApi",
-                    "section": "def-common.SavedObjectCommon",
-                    "text": "SavedObjectCommon"
+                    "docId": "kibKibanaUtilsPluginApi",
+                    "section": "def-common.GetMigrationFunctionObjectFn",
+                    "text": "GetMigrationFunctionObjectFn"
                   },
-                  "<TSavedObjectAttributes>) => void"
+                  " | undefined"
                 ],
-                "path": "src/plugins/embeddable/public/lib/embeddable_saved_object_registry/embeddable_saved_object_registry.ts",
-                "deprecated": false,
-                "trackAdoption": false,
-                "returnComment": [],
-                "children": [
-                  {
-                    "parentPluginId": "embeddable",
-                    "id": "def-public.registerReactEmbeddableSavedObject.$1.onAdd.$1",
-                    "type": "Object",
-                    "tags": [],
-                    "label": "container",
-                    "description": [],
-                    "signature": [
-                      {
-                        "pluginId": "@kbn/presentation-containers",
-                        "scope": "common",
-                        "docId": "kibKbnPresentationContainersPluginApi",
-                        "section": "def-common.PresentationContainer",
-                        "text": "PresentationContainer"
-                      }
-                    ],
-                    "path": "src/plugins/embeddable/public/lib/embeddable_saved_object_registry/embeddable_saved_object_registry.ts",
-                    "deprecated": false,
-                    "trackAdoption": false
-                  },
-                  {
-                    "parentPluginId": "embeddable",
-                    "id": "def-public.registerReactEmbeddableSavedObject.$1.onAdd.$2",
-                    "type": "Object",
-                    "tags": [],
-                    "label": "savedObject",
-                    "description": [],
-                    "signature": [
-                      {
-                        "pluginId": "@kbn/content-management-utils",
-                        "scope": "common",
-                        "docId": "kibKbnContentManagementUtilsPluginApi",
-                        "section": "def-common.SOWithMetadata",
-                        "text": "SOWithMetadata"
-                      },
-                      "<TSavedObjectAttributes>"
-                    ],
-                    "path": "src/plugins/embeddable/public/lib/embeddable_saved_object_registry/embeddable_saved_object_registry.ts",
-                    "deprecated": false,
-                    "trackAdoption": false
-                  }
-                ]
-              },
-              {
-                "parentPluginId": "embeddable",
-                "id": "def-public.registerReactEmbeddableSavedObject.$1.embeddableType",
-                "type": "string",
-                "tags": [],
-                "label": "embeddableType",
-                "description": [],
-                "path": "src/plugins/embeddable/public/lib/embeddable_saved_object_registry/embeddable_saved_object_registry.ts",
-                "deprecated": false,
-                "trackAdoption": false
-              },
-              {
-                "parentPluginId": "embeddable",
-                "id": "def-public.registerReactEmbeddableSavedObject.$1.savedObjectType",
-                "type": "string",
-                "tags": [],
-                "label": "savedObjectType",
-                "description": [],
-                "path": "src/plugins/embeddable/public/lib/embeddable_saved_object_registry/embeddable_saved_object_registry.ts",
+                "path": "src/plugins/embeddable/public/lib/factory_migrations/run_factory_migrations.ts",
                 "deprecated": false,
                 "trackAdoption": false
               },
               {
                 "parentPluginId": "embeddable",
-                "id": "def-public.registerReactEmbeddableSavedObject.$1.savedObjectName",
+                "id": "def-public.runEmbeddableFactoryMigrations.$2.latestVersion",
                 "type": "string",
                 "tags": [],
-                "label": "savedObjectName",
+                "label": "latestVersion",
                 "description": [],
-                "path": "src/plugins/embeddable/public/lib/embeddable_saved_object_registry/embeddable_saved_object_registry.ts",
-                "deprecated": false,
-                "trackAdoption": false
-              },
-              {
-                "parentPluginId": "embeddable",
-                "id": "def-public.registerReactEmbeddableSavedObject.$1.getIconForSavedObject",
-                "type": "Function",
-                "tags": [],
-                "label": "getIconForSavedObject",
-                "description": [],
-                "signature": [
-                  "(savedObject: ",
-                  {
-                    "pluginId": "savedObjectsFinder",
-                    "scope": "common",
-                    "docId": "kibSavedObjectsFinderPluginApi",
-                    "section": "def-common.SavedObjectCommon",
-                    "text": "SavedObjectCommon"
-                  },
-                  "<TSavedObjectAttributes>) => ",
-                  "IconType"
-                ],
-                "path": "src/plugins/embeddable/public/lib/embeddable_saved_object_registry/embeddable_saved_object_registry.ts",
-                "deprecated": false,
-                "trackAdoption": false,
-                "children": [
-                  {
-                    "parentPluginId": "embeddable",
-                    "id": "def-public.registerReactEmbeddableSavedObject.$1.getIconForSavedObject.$1",
-                    "type": "Object",
-                    "tags": [],
-                    "label": "savedObject",
-                    "description": [],
-                    "signature": [
-                      {
-                        "pluginId": "savedObjectsFinder",
-                        "scope": "common",
-                        "docId": "kibSavedObjectsFinderPluginApi",
-                        "section": "def-common.SavedObjectCommon",
-                        "text": "SavedObjectCommon"
-                      },
-                      "<TSavedObjectAttributes>"
-                    ],
-                    "path": "src/plugins/embeddable/public/lib/embeddable_saved_object_registry/embeddable_saved_object_registry.ts",
-                    "deprecated": false,
-                    "trackAdoption": false,
-                    "isRequired": true
-                  }
-                ],
-                "returnComment": []
-              },
-              {
-                "parentPluginId": "embeddable",
-                "id": "def-public.registerReactEmbeddableSavedObject.$1.getSavedObjectSubType",
-                "type": "Function",
-                "tags": [],
-                "label": "getSavedObjectSubType",
-                "description": [],
-                "signature": [
-                  "((savedObject: ",
-                  {
-                    "pluginId": "savedObjectsFinder",
-                    "scope": "common",
-                    "docId": "kibSavedObjectsFinderPluginApi",
-                    "section": "def-common.SavedObjectCommon",
-                    "text": "SavedObjectCommon"
-                  },
-                  "<TSavedObjectAttributes>) => string) | undefined"
-                ],
-                "path": "src/plugins/embeddable/public/lib/embeddable_saved_object_registry/embeddable_saved_object_registry.ts",
-                "deprecated": false,
-                "trackAdoption": false,
-                "children": [
-                  {
-                    "parentPluginId": "embeddable",
-                    "id": "def-public.registerReactEmbeddableSavedObject.$1.getSavedObjectSubType.$1",
-                    "type": "Object",
-                    "tags": [],
-                    "label": "savedObject",
-                    "description": [],
-                    "signature": [
-                      {
-                        "pluginId": "savedObjectsFinder",
-                        "scope": "common",
-                        "docId": "kibSavedObjectsFinderPluginApi",
-                        "section": "def-common.SavedObjectCommon",
-                        "text": "SavedObjectCommon"
-                      },
-                      "<TSavedObjectAttributes>"
-                    ],
-                    "path": "src/plugins/embeddable/public/lib/embeddable_saved_object_registry/embeddable_saved_object_registry.ts",
-                    "deprecated": false,
-                    "trackAdoption": false,
-                    "isRequired": true
-                  }
-                ],
-                "returnComment": []
-              },
-              {
-                "parentPluginId": "embeddable",
-                "id": "def-public.registerReactEmbeddableSavedObject.$1.getTooltipForSavedObject",
-                "type": "Function",
-                "tags": [],
-                "label": "getTooltipForSavedObject",
-                "description": [],
-                "signature": [
-                  "((savedObject: ",
-                  {
-                    "pluginId": "savedObjectsFinder",
-                    "scope": "common",
-                    "docId": "kibSavedObjectsFinderPluginApi",
-                    "section": "def-common.SavedObjectCommon",
-                    "text": "SavedObjectCommon"
-                  },
-                  "<TSavedObjectAttributes>) => string) | undefined"
-                ],
-                "path": "src/plugins/embeddable/public/lib/embeddable_saved_object_registry/embeddable_saved_object_registry.ts",
-                "deprecated": false,
-                "trackAdoption": false,
-                "children": [
-                  {
-                    "parentPluginId": "embeddable",
-                    "id": "def-public.registerReactEmbeddableSavedObject.$1.getTooltipForSavedObject.$1",
-                    "type": "Object",
-                    "tags": [],
-                    "label": "savedObject",
-                    "description": [],
-                    "signature": [
-                      {
-                        "pluginId": "savedObjectsFinder",
-                        "scope": "common",
-                        "docId": "kibSavedObjectsFinderPluginApi",
-                        "section": "def-common.SavedObjectCommon",
-                        "text": "SavedObjectCommon"
-                      },
-                      "<TSavedObjectAttributes>"
-                    ],
-                    "path": "src/plugins/embeddable/public/lib/embeddable_saved_object_registry/embeddable_saved_object_registry.ts",
-                    "deprecated": false,
-                    "trackAdoption": false,
-                    "isRequired": true
-                  }
-                ],
-                "returnComment": []
-              }
-            ]
-          }
-        ],
-        "returnComment": [],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "embeddable",
-        "id": "def-public.registerSavedObjectToPanelMethod",
-        "type": "Function",
-        "tags": [
-          "deprecated"
-        ],
-        "label": "registerSavedObjectToPanelMethod",
-        "description": [],
-        "signature": [
-          "<TSavedObjectAttributes, TByValueAttributes>(savedObjectType: string, method: SavedObjectToPanelMethod<TSavedObjectAttributes, TByValueAttributes>) => void"
-        ],
-        "path": "src/plugins/embeddable/public/registry/saved_object_to_panel_methods.ts",
-        "deprecated": true,
-        "trackAdoption": false,
-        "references": [
-          {
-            "plugin": "savedSearch",
-            "path": "src/plugins/saved_search/public/plugin.ts"
-          },
-          {
-            "plugin": "savedSearch",
-            "path": "src/plugins/saved_search/public/plugin.ts"
-          },
-          {
-            "plugin": "visualizations",
-            "path": "src/plugins/visualizations/public/plugin.ts"
-          },
-          {
-            "plugin": "visualizations",
-            "path": "src/plugins/visualizations/public/plugin.ts"
-          },
-          {
-            "plugin": "lens",
-            "path": "x-pack/plugins/lens/public/plugin.ts"
-          },
-          {
-            "plugin": "lens",
-            "path": "x-pack/plugins/lens/public/plugin.ts"
-          },
-          {
-            "plugin": "maps",
-            "path": "x-pack/plugins/maps/public/plugin.ts"
-          },
-          {
-            "plugin": "maps",
-            "path": "x-pack/plugins/maps/public/plugin.ts"
-          }
-        ],
-        "children": [
-          {
-            "parentPluginId": "embeddable",
-            "id": "def-public.registerSavedObjectToPanelMethod.$1",
-            "type": "string",
-            "tags": [],
-            "label": "savedObjectType",
-            "description": [],
-            "signature": [
-              "string"
-            ],
-            "path": "src/plugins/embeddable/public/registry/saved_object_to_panel_methods.ts",
-            "deprecated": false,
-            "trackAdoption": false,
-            "isRequired": true
-          },
-          {
-            "parentPluginId": "embeddable",
-            "id": "def-public.registerSavedObjectToPanelMethod.$2",
-            "type": "Function",
-            "tags": [],
-            "label": "method",
-            "description": [],
-            "signature": [
-              "SavedObjectToPanelMethod<TSavedObjectAttributes, TByValueAttributes>"
-            ],
-            "path": "src/plugins/embeddable/public/registry/saved_object_to_panel_methods.ts",
-            "deprecated": false,
-            "trackAdoption": false,
-            "isRequired": true
-          }
-        ],
-        "returnComment": [],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "embeddable",
-        "id": "def-public.runEmbeddableFactoryMigrations",
-        "type": "Function",
-        "tags": [],
-        "label": "runEmbeddableFactoryMigrations",
-        "description": [
-          "\nA helper function that migrates an Embeddable Input to its latest version. Note that this function\nonly runs the embeddable factory's migrations."
-        ],
-        "signature": [
-          "<ToType extends ",
-          {
-            "pluginId": "embeddable",
-            "scope": "common",
-            "docId": "kibEmbeddablePluginApi",
-            "section": "def-common.EmbeddableInput",
-            "text": "EmbeddableInput"
-          },
-          ">(initialInput: { version?: string | undefined; }, factory: { migrations?: ",
-          {
-            "pluginId": "kibanaUtils",
-            "scope": "common",
-            "docId": "kibKibanaUtilsPluginApi",
-            "section": "def-common.MigrateFunctionsObject",
-            "text": "MigrateFunctionsObject"
-          },
-          " | ",
-          {
-            "pluginId": "kibanaUtils",
-            "scope": "common",
-            "docId": "kibKibanaUtilsPluginApi",
-            "section": "def-common.GetMigrationFunctionObjectFn",
-            "text": "GetMigrationFunctionObjectFn"
-          },
-          " | undefined; latestVersion?: string | undefined; }) => { input: ToType; migrationRun: boolean; }"
-        ],
-        "path": "src/plugins/embeddable/public/lib/factory_migrations/run_factory_migrations.ts",
-        "deprecated": false,
-        "trackAdoption": false,
-        "children": [
-          {
-            "parentPluginId": "embeddable",
-            "id": "def-public.runEmbeddableFactoryMigrations.$1",
-            "type": "Object",
-            "tags": [],
-            "label": "initialInput",
-            "description": [],
-            "path": "src/plugins/embeddable/public/lib/factory_migrations/run_factory_migrations.ts",
-            "deprecated": false,
-            "trackAdoption": false,
-            "children": [
-              {
-                "parentPluginId": "embeddable",
-                "id": "def-public.runEmbeddableFactoryMigrations.$1.version",
-                "type": "string",
-                "tags": [],
-                "label": "version",
-                "description": [],
-                "signature": [
-                  "string | undefined"
-                ],
-                "path": "src/plugins/embeddable/public/lib/factory_migrations/run_factory_migrations.ts",
-                "deprecated": false,
-                "trackAdoption": false
-              }
-            ]
-          },
-          {
-            "parentPluginId": "embeddable",
-            "id": "def-public.runEmbeddableFactoryMigrations.$2",
-            "type": "Object",
-            "tags": [],
-            "label": "factory",
-            "description": [],
-            "path": "src/plugins/embeddable/public/lib/factory_migrations/run_factory_migrations.ts",
-            "deprecated": false,
-            "trackAdoption": false,
-            "children": [
-              {
-                "parentPluginId": "embeddable",
-                "id": "def-public.runEmbeddableFactoryMigrations.$2.migrations",
-                "type": "CompoundType",
-                "tags": [],
-                "label": "migrations",
-                "description": [],
-                "signature": [
-                  {
-                    "pluginId": "kibanaUtils",
-                    "scope": "common",
-                    "docId": "kibKibanaUtilsPluginApi",
-                    "section": "def-common.MigrateFunctionsObject",
-                    "text": "MigrateFunctionsObject"
-                  },
-                  " | ",
-                  {
-                    "pluginId": "kibanaUtils",
-                    "scope": "common",
-                    "docId": "kibKibanaUtilsPluginApi",
-                    "section": "def-common.GetMigrationFunctionObjectFn",
-                    "text": "GetMigrationFunctionObjectFn"
-                  },
-                  " | undefined"
-                ],
-                "path": "src/plugins/embeddable/public/lib/factory_migrations/run_factory_migrations.ts",
-                "deprecated": false,
-                "trackAdoption": false
-              },
-              {
-                "parentPluginId": "embeddable",
-                "id": "def-public.runEmbeddableFactoryMigrations.$2.latestVersion",
-                "type": "string",
-                "tags": [],
-                "label": "latestVersion",
-                "description": [],
-                "signature": [
-                  "string | undefined"
-                ],
-                "path": "src/plugins/embeddable/public/lib/factory_migrations/run_factory_migrations.ts",
+                "signature": [
+                  "string | undefined"
+                ],
+                "path": "src/plugins/embeddable/public/lib/factory_migrations/run_factory_migrations.ts",
                 "deprecated": false,
                 "trackAdoption": false
               }
@@ -13396,7 +12910,7 @@
         "tags": [],
         "label": "ReactEmbeddableFactory",
         "description": [
-          "\nThe React Embeddable Factory interface is used to register a series of functions that\ncreate and manage an embeddable instance.\n\nEmbeddables are React components that manage their own state, can be serialized and\ndeserialized, and return an API that can be used to interact with them imperatively.\nprovided by the parent, and will not save any state to an external store."
+          "\nThe React Embeddable Factory interface is used to register a series of functions that\ncreate and manage an embeddable instance.\n\nEmbeddables are React components that manage their own state, can be serialized and\ndeserialized, and return an API that can be used to interact with them imperatively."
         ],
         "signature": [
           {
@@ -14137,6 +13651,37 @@
         ],
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "embeddable",
+        "id": "def-public.ReactEmbeddableSavedObject",
+        "type": "Type",
+        "tags": [],
+        "label": "ReactEmbeddableSavedObject",
+        "description": [],
+        "signature": [
+          "{ onAdd: SOToEmbeddable<TSavedObjectAttributes>; savedObjectMetaData: ",
+          {
+            "pluginId": "savedObjectsFinder",
+            "scope": "public",
+            "docId": "kibSavedObjectsFinderPluginApi",
+            "section": "def-public.SavedObjectMetaData",
+            "text": "SavedObjectMetaData"
+          },
+          "<",
+          {
+            "pluginId": "savedObjectsFinder",
+            "scope": "common",
+            "docId": "kibSavedObjectsFinderPluginApi",
+            "section": "def-common.FinderAttributes",
+            "text": "FinderAttributes"
+          },
+          ">; }"
+        ],
+        "path": "src/plugins/embeddable/public/lib/embeddable_saved_object_registry/embeddable_saved_object_registry.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "embeddable",
         "id": "def-public.SELECT_RANGE_TRIGGER",
@@ -14490,9 +14035,257 @@
       "children": [
         {
           "parentPluginId": "embeddable",
-          "id": "def-public.EmbeddableSetup.registerEmbeddableFactory",
+          "id": "def-public.EmbeddableSetup.registerReactEmbeddableSavedObject",
+          "type": "Function",
+          "tags": [],
+          "label": "registerReactEmbeddableSavedObject",
+          "description": [],
+          "signature": [
+            "<TSavedObjectAttributes extends ",
+            {
+              "pluginId": "savedObjectsFinder",
+              "scope": "common",
+              "docId": "kibSavedObjectsFinderPluginApi",
+              "section": "def-common.FinderAttributes",
+              "text": "FinderAttributes"
+            },
+            ">({ onAdd, embeddableType, savedObjectType, savedObjectName, getIconForSavedObject, getSavedObjectSubType, getTooltipForSavedObject, }: { onAdd: SOToEmbeddable<TSavedObjectAttributes>; embeddableType: string; savedObjectType: string; savedObjectName: string; getIconForSavedObject: (savedObject: ",
+            {
+              "pluginId": "savedObjectsFinder",
+              "scope": "common",
+              "docId": "kibSavedObjectsFinderPluginApi",
+              "section": "def-common.SavedObjectCommon",
+              "text": "SavedObjectCommon"
+            },
+            "<TSavedObjectAttributes>) => ",
+            "IconType",
+            "; getSavedObjectSubType?: ((savedObject: ",
+            {
+              "pluginId": "savedObjectsFinder",
+              "scope": "common",
+              "docId": "kibSavedObjectsFinderPluginApi",
+              "section": "def-common.SavedObjectCommon",
+              "text": "SavedObjectCommon"
+            },
+            "<TSavedObjectAttributes>) => string) | undefined; getTooltipForSavedObject?: ((savedObject: ",
+            {
+              "pluginId": "savedObjectsFinder",
+              "scope": "common",
+              "docId": "kibSavedObjectsFinderPluginApi",
+              "section": "def-common.SavedObjectCommon",
+              "text": "SavedObjectCommon"
+            },
+            "<TSavedObjectAttributes>) => string) | undefined; }) => void"
+          ],
+          "path": "src/plugins/embeddable/public/plugin.tsx",
+          "deprecated": false,
+          "trackAdoption": false,
+          "returnComment": [],
+          "children": [
+            {
+              "parentPluginId": "embeddable",
+              "id": "def-public.EmbeddableSetup.registerReactEmbeddableSavedObject.$1",
+              "type": "Object",
+              "tags": [],
+              "label": "__0",
+              "description": [],
+              "signature": [
+                "{ onAdd: SOToEmbeddable<TSavedObjectAttributes>; embeddableType: string; savedObjectType: string; savedObjectName: string; getIconForSavedObject: (savedObject: ",
+                {
+                  "pluginId": "savedObjectsFinder",
+                  "scope": "common",
+                  "docId": "kibSavedObjectsFinderPluginApi",
+                  "section": "def-common.SavedObjectCommon",
+                  "text": "SavedObjectCommon"
+                },
+                "<TSavedObjectAttributes>) => ",
+                "IconType",
+                "; getSavedObjectSubType?: ((savedObject: ",
+                {
+                  "pluginId": "savedObjectsFinder",
+                  "scope": "common",
+                  "docId": "kibSavedObjectsFinderPluginApi",
+                  "section": "def-common.SavedObjectCommon",
+                  "text": "SavedObjectCommon"
+                },
+                "<TSavedObjectAttributes>) => string) | undefined; getTooltipForSavedObject?: ((savedObject: ",
+                {
+                  "pluginId": "savedObjectsFinder",
+                  "scope": "common",
+                  "docId": "kibSavedObjectsFinderPluginApi",
+                  "section": "def-common.SavedObjectCommon",
+                  "text": "SavedObjectCommon"
+                },
+                "<TSavedObjectAttributes>) => string) | undefined; }"
+              ],
+              "path": "src/plugins/embeddable/public/lib/embeddable_saved_object_registry/embeddable_saved_object_registry.ts",
+              "deprecated": false,
+              "trackAdoption": false
+            }
+          ]
+        },
+        {
+          "parentPluginId": "embeddable",
+          "id": "def-public.EmbeddableSetup.registerSavedObjectToPanelMethod",
+          "type": "Function",
+          "tags": [],
+          "label": "registerSavedObjectToPanelMethod",
+          "description": [],
+          "signature": [
+            "<TSavedObjectAttributes, TByValueAttributes>(savedObjectType: string, method: SavedObjectToPanelMethod<TSavedObjectAttributes, TByValueAttributes>) => void"
+          ],
+          "path": "src/plugins/embeddable/public/plugin.tsx",
+          "deprecated": false,
+          "trackAdoption": false,
+          "returnComment": [],
+          "children": [
+            {
+              "parentPluginId": "embeddable",
+              "id": "def-public.EmbeddableSetup.registerSavedObjectToPanelMethod.$1",
+              "type": "string",
+              "tags": [],
+              "label": "savedObjectType",
+              "description": [],
+              "path": "src/plugins/embeddable/public/registry/saved_object_to_panel_methods.ts",
+              "deprecated": false,
+              "trackAdoption": false
+            },
+            {
+              "parentPluginId": "embeddable",
+              "id": "def-public.EmbeddableSetup.registerSavedObjectToPanelMethod.$2",
+              "type": "Function",
+              "tags": [],
+              "label": "method",
+              "description": [],
+              "signature": [
+                "(savedObject: ",
+                {
+                  "pluginId": "savedObjectsFinder",
+                  "scope": "common",
+                  "docId": "kibSavedObjectsFinderPluginApi",
+                  "section": "def-common.SavedObjectCommon",
+                  "text": "SavedObjectCommon"
+                },
+                "<TSavedObjectAttributes>) => { savedObjectId: string; } | Partial<TByValueAttributes>"
+              ],
+              "path": "src/plugins/embeddable/public/registry/saved_object_to_panel_methods.ts",
+              "deprecated": false,
+              "trackAdoption": false,
+              "returnComment": [],
+              "children": [
+                {
+                  "parentPluginId": "embeddable",
+                  "id": "def-public.EmbeddableSetup.registerSavedObjectToPanelMethod.$2.$1",
+                  "type": "Object",
+                  "tags": [],
+                  "label": "savedObject",
+                  "description": [],
+                  "signature": [
+                    {
+                      "pluginId": "@kbn/content-management-utils",
+                      "scope": "common",
+                      "docId": "kibKbnContentManagementUtilsPluginApi",
+                      "section": "def-common.SOWithMetadata",
+                      "text": "SOWithMetadata"
+                    },
+                    "<TSavedObjectAttributes>"
+                  ],
+                  "path": "src/plugins/embeddable/public/registry/saved_object_to_panel_methods.ts",
+                  "deprecated": false,
+                  "trackAdoption": false
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "parentPluginId": "embeddable",
+          "id": "def-public.EmbeddableSetup.registerReactEmbeddableFactory",
           "type": "Function",
           "tags": [],
+          "label": "registerReactEmbeddableFactory",
+          "description": [
+            "\nRegisters an async {@link ReactEmbeddableFactory} getter."
+          ],
+          "signature": [
+            "<StateType extends object = object, APIType extends ",
+            {
+              "pluginId": "embeddable",
+              "scope": "public",
+              "docId": "kibEmbeddablePluginApi",
+              "section": "def-public.DefaultEmbeddableApi",
+              "text": "DefaultEmbeddableApi"
+            },
+            "<StateType> = ",
+            {
+              "pluginId": "embeddable",
+              "scope": "public",
+              "docId": "kibEmbeddablePluginApi",
+              "section": "def-public.DefaultEmbeddableApi",
+              "text": "DefaultEmbeddableApi"
+            },
+            "<StateType>>(type: string, getFactory: () => Promise<",
+            {
+              "pluginId": "embeddable",
+              "scope": "public",
+              "docId": "kibEmbeddablePluginApi",
+              "section": "def-public.ReactEmbeddableFactory",
+              "text": "ReactEmbeddableFactory"
+            },
+            "<StateType, APIType, StateType>>) => void"
+          ],
+          "path": "src/plugins/embeddable/public/plugin.tsx",
+          "deprecated": false,
+          "trackAdoption": false,
+          "children": [
+            {
+              "parentPluginId": "embeddable",
+              "id": "def-public.EmbeddableSetup.registerReactEmbeddableFactory.$1",
+              "type": "string",
+              "tags": [],
+              "label": "type",
+              "description": [],
+              "signature": [
+                "string"
+              ],
+              "path": "src/plugins/embeddable/public/plugin.tsx",
+              "deprecated": false,
+              "trackAdoption": false,
+              "isRequired": true
+            },
+            {
+              "parentPluginId": "embeddable",
+              "id": "def-public.EmbeddableSetup.registerReactEmbeddableFactory.$2",
+              "type": "Function",
+              "tags": [],
+              "label": "getFactory",
+              "description": [],
+              "signature": [
+                "() => Promise<",
+                {
+                  "pluginId": "embeddable",
+                  "scope": "public",
+                  "docId": "kibEmbeddablePluginApi",
+                  "section": "def-public.ReactEmbeddableFactory",
+                  "text": "ReactEmbeddableFactory"
+                },
+                "<StateType, APIType, StateType>>"
+              ],
+              "path": "src/plugins/embeddable/public/plugin.tsx",
+              "deprecated": false,
+              "trackAdoption": false,
+              "isRequired": true
+            }
+          ],
+          "returnComment": []
+        },
+        {
+          "parentPluginId": "embeddable",
+          "id": "def-public.EmbeddableSetup.registerEmbeddableFactory",
+          "type": "Function",
+          "tags": [
+            "deprecated"
+          ],
           "label": "registerEmbeddableFactory",
           "description": [],
           "signature": [
@@ -14563,8 +14356,82 @@
             ">"
           ],
           "path": "src/plugins/embeddable/public/plugin.tsx",
-          "deprecated": false,
+          "deprecated": true,
           "trackAdoption": false,
+          "references": [
+            {
+              "plugin": "visualizations",
+              "path": "src/plugins/visualizations/public/plugin.ts"
+            },
+            {
+              "plugin": "lens",
+              "path": "x-pack/plugins/lens/public/plugin.ts"
+            },
+            {
+              "plugin": "controls",
+              "path": "src/plugins/controls/public/plugin.ts"
+            },
+            {
+              "plugin": "controls",
+              "path": "src/plugins/controls/public/plugin.ts"
+            },
+            {
+              "plugin": "controls",
+              "path": "src/plugins/controls/public/plugin.ts"
+            },
+            {
+              "plugin": "controls",
+              "path": "src/plugins/controls/public/plugin.ts"
+            },
+            {
+              "plugin": "dashboard",
+              "path": "src/plugins/dashboard/public/plugin.tsx"
+            },
+            {
+              "plugin": "aiops",
+              "path": "x-pack/plugins/aiops/public/embeddable/register_embeddable.ts"
+            },
+            {
+              "plugin": "maps",
+              "path": "x-pack/plugins/maps/public/plugin.ts"
+            },
+            {
+              "plugin": "discover",
+              "path": "src/plugins/discover/public/plugin.tsx"
+            },
+            {
+              "plugin": "ml",
+              "path": "x-pack/plugins/ml/public/embeddables/index.ts"
+            },
+            {
+              "plugin": "infra",
+              "path": "x-pack/plugins/observability_solution/infra/public/plugin.ts"
+            },
+            {
+              "plugin": "profiling",
+              "path": "x-pack/plugins/observability_solution/profiling/public/embeddables/register_embeddables.ts"
+            },
+            {
+              "plugin": "profiling",
+              "path": "x-pack/plugins/observability_solution/profiling/public/embeddables/register_embeddables.ts"
+            },
+            {
+              "plugin": "profiling",
+              "path": "x-pack/plugins/observability_solution/profiling/public/embeddables/register_embeddables.ts"
+            },
+            {
+              "plugin": "profiling",
+              "path": "x-pack/plugins/observability_solution/profiling/public/embeddables/register_embeddables.ts"
+            },
+            {
+              "plugin": "slo",
+              "path": "x-pack/plugins/observability_solution/slo/public/plugin.ts"
+            },
+            {
+              "plugin": "links",
+              "path": "src/plugins/links/public/plugin.ts"
+            }
+          ],
           "children": [
             {
               "parentPluginId": "embeddable",
@@ -14618,7 +14485,9 @@
           "parentPluginId": "embeddable",
           "id": "def-public.EmbeddableSetup.registerEnhancement",
           "type": "Function",
-          "tags": [],
+          "tags": [
+            "deprecated"
+          ],
           "label": "registerEnhancement",
           "description": [],
           "signature": [
@@ -14641,8 +14510,14 @@
             ">) => void"
           ],
           "path": "src/plugins/embeddable/public/plugin.tsx",
-          "deprecated": false,
+          "deprecated": true,
           "trackAdoption": false,
+          "references": [
+            {
+              "plugin": "uiActionsEnhanced",
+              "path": "src/plugins/ui_actions_enhanced/public/plugin.ts"
+            }
+          ],
           "children": [
             {
               "parentPluginId": "embeddable",
@@ -14681,7 +14556,9 @@
           "parentPluginId": "embeddable",
           "id": "def-public.EmbeddableSetup.setCustomEmbeddableFactoryProvider",
           "type": "Function",
-          "tags": [],
+          "tags": [
+            "deprecated"
+          ],
           "label": "setCustomEmbeddableFactoryProvider",
           "description": [],
           "signature": [
@@ -14690,8 +14567,14 @@
             ") => void"
           ],
           "path": "src/plugins/embeddable/public/plugin.tsx",
-          "deprecated": false,
+          "deprecated": true,
           "trackAdoption": false,
+          "references": [
+            {
+              "plugin": "embeddableEnhanced",
+              "path": "x-pack/plugins/embeddable_enhanced/public/plugin.ts"
+            }
+          ],
           "children": [
             {
               "parentPluginId": "embeddable",
@@ -14754,9 +14637,45 @@
       "children": [
         {
           "parentPluginId": "embeddable",
-          "id": "def-public.EmbeddableStart.getEmbeddableFactory",
+          "id": "def-public.EmbeddableStart.reactEmbeddableRegistryHasKey",
           "type": "Function",
           "tags": [],
+          "label": "reactEmbeddableRegistryHasKey",
+          "description": [
+            "\nChecks if a {@link ReactEmbeddableFactory} has been registered using {@link registerReactEmbeddableFactory}"
+          ],
+          "signature": [
+            "(type: string) => boolean"
+          ],
+          "path": "src/plugins/embeddable/public/plugin.tsx",
+          "deprecated": false,
+          "trackAdoption": false,
+          "children": [
+            {
+              "parentPluginId": "embeddable",
+              "id": "def-public.EmbeddableStart.reactEmbeddableRegistryHasKey.$1",
+              "type": "string",
+              "tags": [],
+              "label": "type",
+              "description": [],
+              "signature": [
+                "string"
+              ],
+              "path": "src/plugins/embeddable/public/plugin.tsx",
+              "deprecated": false,
+              "trackAdoption": false,
+              "isRequired": true
+            }
+          ],
+          "returnComment": []
+        },
+        {
+          "parentPluginId": "embeddable",
+          "id": "def-public.EmbeddableStart.getEmbeddableFactory",
+          "type": "Function",
+          "tags": [
+            "deprecated"
+          ],
           "label": "getEmbeddableFactory",
           "description": [],
           "signature": [
@@ -14827,8 +14746,126 @@
             "> | undefined"
           ],
           "path": "src/plugins/embeddable/public/plugin.tsx",
-          "deprecated": false,
+          "deprecated": true,
           "trackAdoption": false,
+          "references": [
+            {
+              "plugin": "lens",
+              "path": "x-pack/plugins/lens/public/embeddable/embeddable_component.tsx"
+            },
+            {
+              "plugin": "controls",
+              "path": "src/plugins/controls/public/services/embeddable/types.ts"
+            },
+            {
+              "plugin": "controls",
+              "path": "src/plugins/controls/public/services/embeddable/embeddable_service.ts"
+            },
+            {
+              "plugin": "dashboard",
+              "path": "src/plugins/dashboard/public/services/dashboard_content_management/lib/migrate_dashboard_input.ts"
+            },
+            {
+              "plugin": "dashboard",
+              "path": "src/plugins/dashboard/public/services/dashboard_content_management/lib/migrate_dashboard_input.ts"
+            },
+            {
+              "plugin": "dashboard",
+              "path": "src/plugins/dashboard/public/dashboard_container/embeddable/create/create_dashboard.ts"
+            },
+            {
+              "plugin": "dashboard",
+              "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx"
+            },
+            {
+              "plugin": "dashboard",
+              "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx"
+            },
+            {
+              "plugin": "dashboard",
+              "path": "src/plugins/dashboard/public/dashboard_container/external_api/dashboard_renderer.tsx"
+            },
+            {
+              "plugin": "aiops",
+              "path": "x-pack/plugins/aiops/public/embeddable/embeddable_change_point_chart_component.tsx"
+            },
+            {
+              "plugin": "observabilityShared",
+              "path": "x-pack/plugins/observability_solution/observability_shared/public/components/profiling/embeddables/profiling_embeddable.tsx"
+            },
+            {
+              "plugin": "observabilityShared",
+              "path": "x-pack/plugins/observability_solution/observability_shared/public/components/profiling/embeddables/embeddable_profiling_search_bar.tsx"
+            },
+            {
+              "plugin": "ml",
+              "path": "x-pack/plugins/ml/public/embeddables/get_embeddable_component.tsx"
+            },
+            {
+              "plugin": "securitySolution",
+              "path": "x-pack/plugins/security_solution/public/explore/network/components/embeddables/create_embeddable.tsx"
+            },
+            {
+              "plugin": "dashboard",
+              "path": "src/plugins/dashboard/public/services/embeddable/embeddable.stub.ts"
+            },
+            {
+              "plugin": "controls",
+              "path": "src/plugins/controls/public/services/embeddable/embeddable.story.ts"
+            },
+            {
+              "plugin": "dashboard",
+              "path": "src/plugins/dashboard/public/dashboard_container/embeddable/api/duplicate_dashboard_panel.test.ts"
+            },
+            {
+              "plugin": "dashboard",
+              "path": "src/plugins/dashboard/public/dashboard_container/embeddable/create/create_dashboard.test.ts"
+            },
+            {
+              "plugin": "dashboard",
+              "path": "src/plugins/dashboard/public/dashboard_container/embeddable/create/create_dashboard.test.ts"
+            },
+            {
+              "plugin": "dashboard",
+              "path": "src/plugins/dashboard/public/dashboard_container/embeddable/create/create_dashboard.test.ts"
+            },
+            {
+              "plugin": "dashboard",
+              "path": "src/plugins/dashboard/public/dashboard_container/embeddable/create/create_dashboard.test.ts"
+            },
+            {
+              "plugin": "dashboard",
+              "path": "src/plugins/dashboard/public/dashboard_container/embeddable/create/create_dashboard.test.ts"
+            },
+            {
+              "plugin": "dashboard",
+              "path": "src/plugins/dashboard/public/services/dashboard_content_management/lib/migrate_dashboard_input.test.ts"
+            },
+            {
+              "plugin": "dashboard",
+              "path": "src/plugins/dashboard/public/services/dashboard_content_management/lib/migrate_dashboard_input.test.ts"
+            },
+            {
+              "plugin": "dashboard",
+              "path": "src/plugins/dashboard/public/services/dashboard_content_management/lib/migrate_dashboard_input.test.ts"
+            },
+            {
+              "plugin": "dashboard",
+              "path": "src/plugins/dashboard/public/services/dashboard_content_management/lib/migrate_dashboard_input.test.ts"
+            },
+            {
+              "plugin": "dashboard",
+              "path": "src/plugins/dashboard/public/services/dashboard_content_management/lib/migrate_dashboard_input.test.ts"
+            },
+            {
+              "plugin": "dashboard",
+              "path": "src/plugins/dashboard/public/services/dashboard_content_management/lib/migrate_dashboard_input.test.ts"
+            },
+            {
+              "plugin": "dashboard",
+              "path": "src/plugins/dashboard/public/services/embeddable/embeddable.stub.ts"
+            }
+          ],
           "children": [
             {
               "parentPluginId": "embeddable",
@@ -14852,7 +14889,9 @@
           "parentPluginId": "embeddable",
           "id": "def-public.EmbeddableStart.getEmbeddableFactories",
           "type": "Function",
-          "tags": [],
+          "tags": [
+            "deprecated"
+          ],
           "label": "getEmbeddableFactories",
           "description": [],
           "signature": [
@@ -14915,8 +14954,30 @@
             ">>"
           ],
           "path": "src/plugins/embeddable/public/plugin.tsx",
-          "deprecated": false,
+          "deprecated": true,
           "trackAdoption": false,
+          "references": [
+            {
+              "plugin": "dashboard",
+              "path": "src/plugins/dashboard/public/dashboard_app/top_nav/editor_menu.tsx"
+            },
+            {
+              "plugin": "canvas",
+              "path": "x-pack/plugins/canvas/canvas_plugin_src/renderers/embeddable/embeddable.tsx"
+            },
+            {
+              "plugin": "canvas",
+              "path": "x-pack/plugins/canvas/public/services/kibana/embeddables.ts"
+            },
+            {
+              "plugin": "dashboard",
+              "path": "src/plugins/dashboard/public/services/embeddable/embeddable.stub.ts"
+            },
+            {
+              "plugin": "dashboard",
+              "path": "src/plugins/dashboard/public/services/embeddable/embeddable.stub.ts"
+            }
+          ],
           "children": [],
           "returnComment": []
         },
diff --git a/api_docs/embeddable.mdx b/api_docs/embeddable.mdx
index 2f80903482f49e..85f5365b1c8fac 100644
--- a/api_docs/embeddable.mdx
+++ b/api_docs/embeddable.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/embeddable
 title: "embeddable"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the embeddable plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'embeddable']
 ---
 import embeddableObj from './embeddable.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/kibana-presentation](https://github.com/orgs/elastic/teams/kib
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 573 | 1 | 463 | 8 |
+| 564 | 1 | 456 | 8 |
 
 ## Client
 
diff --git a/api_docs/embeddable_enhanced.mdx b/api_docs/embeddable_enhanced.mdx
index b6c4a626657b0b..05f0a52fe80dea 100644
--- a/api_docs/embeddable_enhanced.mdx
+++ b/api_docs/embeddable_enhanced.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/embeddableEnhanced
 title: "embeddableEnhanced"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the embeddableEnhanced plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'embeddableEnhanced']
 ---
 import embeddableEnhancedObj from './embeddable_enhanced.devdocs.json';
diff --git a/api_docs/encrypted_saved_objects.mdx b/api_docs/encrypted_saved_objects.mdx
index 9955fccd14fff0..1fd6609072a26b 100644
--- a/api_docs/encrypted_saved_objects.mdx
+++ b/api_docs/encrypted_saved_objects.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/encryptedSavedObjects
 title: "encryptedSavedObjects"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the encryptedSavedObjects plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'encryptedSavedObjects']
 ---
 import encryptedSavedObjectsObj from './encrypted_saved_objects.devdocs.json';
diff --git a/api_docs/enterprise_search.mdx b/api_docs/enterprise_search.mdx
index 4dd9f4f3eafa5b..8abc2f966eeaf7 100644
--- a/api_docs/enterprise_search.mdx
+++ b/api_docs/enterprise_search.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/enterpriseSearch
 title: "enterpriseSearch"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the enterpriseSearch plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'enterpriseSearch']
 ---
 import enterpriseSearchObj from './enterprise_search.devdocs.json';
diff --git a/api_docs/es_ui_shared.mdx b/api_docs/es_ui_shared.mdx
index 9fc31cc8dd1d52..df2c2c01b27549 100644
--- a/api_docs/es_ui_shared.mdx
+++ b/api_docs/es_ui_shared.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/esUiShared
 title: "esUiShared"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the esUiShared plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'esUiShared']
 ---
 import esUiSharedObj from './es_ui_shared.devdocs.json';
diff --git a/api_docs/event_annotation.mdx b/api_docs/event_annotation.mdx
index 7c0e973cc27a5e..22449fca252171 100644
--- a/api_docs/event_annotation.mdx
+++ b/api_docs/event_annotation.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/eventAnnotation
 title: "eventAnnotation"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the eventAnnotation plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'eventAnnotation']
 ---
 import eventAnnotationObj from './event_annotation.devdocs.json';
diff --git a/api_docs/event_annotation_listing.mdx b/api_docs/event_annotation_listing.mdx
index ff430d7d2a99ca..60fcf51d06dd43 100644
--- a/api_docs/event_annotation_listing.mdx
+++ b/api_docs/event_annotation_listing.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/eventAnnotationListing
 title: "eventAnnotationListing"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the eventAnnotationListing plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'eventAnnotationListing']
 ---
 import eventAnnotationListingObj from './event_annotation_listing.devdocs.json';
diff --git a/api_docs/event_log.mdx b/api_docs/event_log.mdx
index 7fdb95fa42cb4e..24d7b111398d2c 100644
--- a/api_docs/event_log.mdx
+++ b/api_docs/event_log.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/eventLog
 title: "eventLog"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the eventLog plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'eventLog']
 ---
 import eventLogObj from './event_log.devdocs.json';
diff --git a/api_docs/exploratory_view.mdx b/api_docs/exploratory_view.mdx
index 06907d5023e57a..8cbe392b886579 100644
--- a/api_docs/exploratory_view.mdx
+++ b/api_docs/exploratory_view.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/exploratoryView
 title: "exploratoryView"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the exploratoryView plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'exploratoryView']
 ---
 import exploratoryViewObj from './exploratory_view.devdocs.json';
diff --git a/api_docs/expression_error.mdx b/api_docs/expression_error.mdx
index 9caa4bc5fe4c6e..eed138329673ea 100644
--- a/api_docs/expression_error.mdx
+++ b/api_docs/expression_error.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionError
 title: "expressionError"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionError plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionError']
 ---
 import expressionErrorObj from './expression_error.devdocs.json';
diff --git a/api_docs/expression_gauge.mdx b/api_docs/expression_gauge.mdx
index 36b6311ae7faa9..f0c5d119dd5bff 100644
--- a/api_docs/expression_gauge.mdx
+++ b/api_docs/expression_gauge.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionGauge
 title: "expressionGauge"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionGauge plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionGauge']
 ---
 import expressionGaugeObj from './expression_gauge.devdocs.json';
diff --git a/api_docs/expression_heatmap.mdx b/api_docs/expression_heatmap.mdx
index 140f70583de209..110c1e322ac5db 100644
--- a/api_docs/expression_heatmap.mdx
+++ b/api_docs/expression_heatmap.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionHeatmap
 title: "expressionHeatmap"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionHeatmap plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionHeatmap']
 ---
 import expressionHeatmapObj from './expression_heatmap.devdocs.json';
diff --git a/api_docs/expression_image.mdx b/api_docs/expression_image.mdx
index 6d0463df51c2cb..22501bec29fa05 100644
--- a/api_docs/expression_image.mdx
+++ b/api_docs/expression_image.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionImage
 title: "expressionImage"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionImage plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionImage']
 ---
 import expressionImageObj from './expression_image.devdocs.json';
diff --git a/api_docs/expression_legacy_metric_vis.mdx b/api_docs/expression_legacy_metric_vis.mdx
index 4ac4755a2491e0..f81af9049f2978 100644
--- a/api_docs/expression_legacy_metric_vis.mdx
+++ b/api_docs/expression_legacy_metric_vis.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionLegacyMetricVis
 title: "expressionLegacyMetricVis"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionLegacyMetricVis plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionLegacyMetricVis']
 ---
 import expressionLegacyMetricVisObj from './expression_legacy_metric_vis.devdocs.json';
diff --git a/api_docs/expression_metric.mdx b/api_docs/expression_metric.mdx
index b177ba24403a7b..281878b998edcf 100644
--- a/api_docs/expression_metric.mdx
+++ b/api_docs/expression_metric.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionMetric
 title: "expressionMetric"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionMetric plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionMetric']
 ---
 import expressionMetricObj from './expression_metric.devdocs.json';
diff --git a/api_docs/expression_metric_vis.mdx b/api_docs/expression_metric_vis.mdx
index 916b3ec32dd3ae..5abbf4b7113c04 100644
--- a/api_docs/expression_metric_vis.mdx
+++ b/api_docs/expression_metric_vis.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionMetricVis
 title: "expressionMetricVis"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionMetricVis plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionMetricVis']
 ---
 import expressionMetricVisObj from './expression_metric_vis.devdocs.json';
diff --git a/api_docs/expression_partition_vis.mdx b/api_docs/expression_partition_vis.mdx
index e95acec85247b2..37f472b9e2c6b1 100644
--- a/api_docs/expression_partition_vis.mdx
+++ b/api_docs/expression_partition_vis.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionPartitionVis
 title: "expressionPartitionVis"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionPartitionVis plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionPartitionVis']
 ---
 import expressionPartitionVisObj from './expression_partition_vis.devdocs.json';
diff --git a/api_docs/expression_repeat_image.mdx b/api_docs/expression_repeat_image.mdx
index 87be212eaf0987..74813ef985202e 100644
--- a/api_docs/expression_repeat_image.mdx
+++ b/api_docs/expression_repeat_image.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionRepeatImage
 title: "expressionRepeatImage"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionRepeatImage plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionRepeatImage']
 ---
 import expressionRepeatImageObj from './expression_repeat_image.devdocs.json';
diff --git a/api_docs/expression_reveal_image.mdx b/api_docs/expression_reveal_image.mdx
index 358da93c8b3251..67b1b7291666ea 100644
--- a/api_docs/expression_reveal_image.mdx
+++ b/api_docs/expression_reveal_image.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionRevealImage
 title: "expressionRevealImage"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionRevealImage plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionRevealImage']
 ---
 import expressionRevealImageObj from './expression_reveal_image.devdocs.json';
diff --git a/api_docs/expression_shape.mdx b/api_docs/expression_shape.mdx
index 0c877c394eb603..5319d3ad4a2d19 100644
--- a/api_docs/expression_shape.mdx
+++ b/api_docs/expression_shape.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionShape
 title: "expressionShape"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionShape plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionShape']
 ---
 import expressionShapeObj from './expression_shape.devdocs.json';
diff --git a/api_docs/expression_tagcloud.mdx b/api_docs/expression_tagcloud.mdx
index 82823542a32bc7..672fb55c418333 100644
--- a/api_docs/expression_tagcloud.mdx
+++ b/api_docs/expression_tagcloud.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionTagcloud
 title: "expressionTagcloud"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionTagcloud plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionTagcloud']
 ---
 import expressionTagcloudObj from './expression_tagcloud.devdocs.json';
diff --git a/api_docs/expression_x_y.mdx b/api_docs/expression_x_y.mdx
index 0f2758ff69406f..faeee8e3135e68 100644
--- a/api_docs/expression_x_y.mdx
+++ b/api_docs/expression_x_y.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionXY
 title: "expressionXY"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionXY plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionXY']
 ---
 import expressionXYObj from './expression_x_y.devdocs.json';
diff --git a/api_docs/expressions.mdx b/api_docs/expressions.mdx
index b1fd799c327e21..64ce87255ab96a 100644
--- a/api_docs/expressions.mdx
+++ b/api_docs/expressions.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressions
 title: "expressions"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressions plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressions']
 ---
 import expressionsObj from './expressions.devdocs.json';
diff --git a/api_docs/features.mdx b/api_docs/features.mdx
index 904389d85b6a9a..df2a8b1c9f999d 100644
--- a/api_docs/features.mdx
+++ b/api_docs/features.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/features
 title: "features"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the features plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'features']
 ---
 import featuresObj from './features.devdocs.json';
diff --git a/api_docs/field_formats.mdx b/api_docs/field_formats.mdx
index 20886b7bda8d84..8a44fd70851e7a 100644
--- a/api_docs/field_formats.mdx
+++ b/api_docs/field_formats.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/fieldFormats
 title: "fieldFormats"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the fieldFormats plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'fieldFormats']
 ---
 import fieldFormatsObj from './field_formats.devdocs.json';
diff --git a/api_docs/file_upload.mdx b/api_docs/file_upload.mdx
index b8da4309bd71c2..554c5c4fd0987b 100644
--- a/api_docs/file_upload.mdx
+++ b/api_docs/file_upload.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/fileUpload
 title: "fileUpload"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the fileUpload plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'fileUpload']
 ---
 import fileUploadObj from './file_upload.devdocs.json';
diff --git a/api_docs/files.mdx b/api_docs/files.mdx
index 54cc3e0acbfb9e..d67a8d7a04b0c0 100644
--- a/api_docs/files.mdx
+++ b/api_docs/files.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/files
 title: "files"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the files plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'files']
 ---
 import filesObj from './files.devdocs.json';
diff --git a/api_docs/files_management.mdx b/api_docs/files_management.mdx
index 658c969a859754..378d7265b6b65d 100644
--- a/api_docs/files_management.mdx
+++ b/api_docs/files_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/filesManagement
 title: "filesManagement"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the filesManagement plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'filesManagement']
 ---
 import filesManagementObj from './files_management.devdocs.json';
diff --git a/api_docs/fleet.devdocs.json b/api_docs/fleet.devdocs.json
index 6ccc5f56784a97..6c794a3b912e88 100644
--- a/api_docs/fleet.devdocs.json
+++ b/api_docs/fleet.devdocs.json
@@ -19249,6 +19249,20 @@
             "deprecated": false,
             "trackAdoption": false
           },
+          {
+            "parentPluginId": "fleet",
+            "id": "def-common.AgentPolicy.unprivileged_agents",
+            "type": "number",
+            "tags": [],
+            "label": "unprivileged_agents",
+            "description": [],
+            "signature": [
+              "number | undefined"
+            ],
+            "path": "x-pack/plugins/fleet/common/types/models/agent_policy.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
           {
             "parentPluginId": "fleet",
             "id": "def-common.AgentPolicy.is_protected",
@@ -22713,6 +22727,20 @@
             "path": "x-pack/plugins/fleet/common/types/models/agent_policy.ts",
             "deprecated": false,
             "trackAdoption": false
+          },
+          {
+            "parentPluginId": "fleet",
+            "id": "def-common.NewAgentPolicy.supports_agentless",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "supports_agentless",
+            "description": [],
+            "signature": [
+              "boolean | null | undefined"
+            ],
+            "path": "x-pack/plugins/fleet/common/types/models/agent_policy.ts",
+            "deprecated": false,
+            "trackAdoption": false
           }
         ],
         "initialIsOpen": false
@@ -25636,8 +25664,8 @@
             "pluginId": "fleet",
             "scope": "common",
             "docId": "kibFleetPluginApi",
-            "section": "def-common.GetAgentPoliciesResponseItem",
-            "text": "GetAgentPoliciesResponseItem"
+            "section": "def-common.AgentPolicy",
+            "text": "AgentPolicy"
           },
           ">"
         ],
@@ -26123,8 +26151,8 @@
             "pluginId": "fleet",
             "scope": "common",
             "docId": "kibFleetPluginApi",
-            "section": "def-common.GetAgentPoliciesResponseItem",
-            "text": "GetAgentPoliciesResponseItem"
+            "section": "def-common.AgentPolicy",
+            "text": "AgentPolicy"
           },
           ">"
         ],
@@ -26147,8 +26175,7 @@
             "docId": "kibFleetPluginApi",
             "section": "def-common.AgentPolicy",
             "text": "AgentPolicy"
-          },
-          " & { agents?: number | undefined; }"
+          }
         ],
         "path": "x-pack/plugins/fleet/common/types/rest_spec/agent_policy.ts",
         "deprecated": false,
diff --git a/api_docs/fleet.mdx b/api_docs/fleet.mdx
index 565976b07e9cec..e3341a120f87c7 100644
--- a/api_docs/fleet.mdx
+++ b/api_docs/fleet.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/fleet
 title: "fleet"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the fleet plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'fleet']
 ---
 import fleetObj from './fleet.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/fleet](https://github.com/orgs/elastic/teams/fleet) for questi
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 1300 | 5 | 1179 | 66 |
+| 1302 | 5 | 1181 | 66 |
 
 ## Client
 
diff --git a/api_docs/global_search.mdx b/api_docs/global_search.mdx
index 04072d42c72a54..c182adb5db5968 100644
--- a/api_docs/global_search.mdx
+++ b/api_docs/global_search.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/globalSearch
 title: "globalSearch"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the globalSearch plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'globalSearch']
 ---
 import globalSearchObj from './global_search.devdocs.json';
diff --git a/api_docs/guided_onboarding.mdx b/api_docs/guided_onboarding.mdx
index a2b022670178b9..05d837a8e007bb 100644
--- a/api_docs/guided_onboarding.mdx
+++ b/api_docs/guided_onboarding.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/guidedOnboarding
 title: "guidedOnboarding"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the guidedOnboarding plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'guidedOnboarding']
 ---
 import guidedOnboardingObj from './guided_onboarding.devdocs.json';
diff --git a/api_docs/home.mdx b/api_docs/home.mdx
index 3e534604dc13e1..eacf271d304eee 100644
--- a/api_docs/home.mdx
+++ b/api_docs/home.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/home
 title: "home"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the home plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'home']
 ---
 import homeObj from './home.devdocs.json';
diff --git a/api_docs/image_embeddable.mdx b/api_docs/image_embeddable.mdx
index 9df973212a34b8..e1184c2924c772 100644
--- a/api_docs/image_embeddable.mdx
+++ b/api_docs/image_embeddable.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/imageEmbeddable
 title: "imageEmbeddable"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the imageEmbeddable plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'imageEmbeddable']
 ---
 import imageEmbeddableObj from './image_embeddable.devdocs.json';
diff --git a/api_docs/index_lifecycle_management.mdx b/api_docs/index_lifecycle_management.mdx
index 9208878c79c7bf..ef97045c9ce4f2 100644
--- a/api_docs/index_lifecycle_management.mdx
+++ b/api_docs/index_lifecycle_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/indexLifecycleManagement
 title: "indexLifecycleManagement"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the indexLifecycleManagement plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'indexLifecycleManagement']
 ---
 import indexLifecycleManagementObj from './index_lifecycle_management.devdocs.json';
diff --git a/api_docs/index_management.mdx b/api_docs/index_management.mdx
index ef7b6a3d6f6847..56df6bdbc591a7 100644
--- a/api_docs/index_management.mdx
+++ b/api_docs/index_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/indexManagement
 title: "indexManagement"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the indexManagement plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'indexManagement']
 ---
 import indexManagementObj from './index_management.devdocs.json';
diff --git a/api_docs/infra.mdx b/api_docs/infra.mdx
index 142d9f70eb126b..1ba899d2803792 100644
--- a/api_docs/infra.mdx
+++ b/api_docs/infra.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/infra
 title: "infra"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the infra plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'infra']
 ---
 import infraObj from './infra.devdocs.json';
diff --git a/api_docs/ingest_pipelines.mdx b/api_docs/ingest_pipelines.mdx
index bb6edb2dbbc681..22c482a6d9e0e0 100644
--- a/api_docs/ingest_pipelines.mdx
+++ b/api_docs/ingest_pipelines.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/ingestPipelines
 title: "ingestPipelines"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the ingestPipelines plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'ingestPipelines']
 ---
 import ingestPipelinesObj from './ingest_pipelines.devdocs.json';
diff --git a/api_docs/inspector.mdx b/api_docs/inspector.mdx
index 81ee2077a0ff6f..42bfc4eb3e1f80 100644
--- a/api_docs/inspector.mdx
+++ b/api_docs/inspector.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/inspector
 title: "inspector"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the inspector plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'inspector']
 ---
 import inspectorObj from './inspector.devdocs.json';
diff --git a/api_docs/interactive_setup.mdx b/api_docs/interactive_setup.mdx
index 21c050cca81a22..3fb76abc21a0da 100644
--- a/api_docs/interactive_setup.mdx
+++ b/api_docs/interactive_setup.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/interactiveSetup
 title: "interactiveSetup"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the interactiveSetup plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'interactiveSetup']
 ---
 import interactiveSetupObj from './interactive_setup.devdocs.json';
diff --git a/api_docs/kbn_ace.mdx b/api_docs/kbn_ace.mdx
index 27e5a41474beb7..4749cc1716ef0c 100644
--- a/api_docs/kbn_ace.mdx
+++ b/api_docs/kbn_ace.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ace
 title: "@kbn/ace"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ace plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ace']
 ---
 import kbnAceObj from './kbn_ace.devdocs.json';
diff --git a/api_docs/kbn_actions_types.mdx b/api_docs/kbn_actions_types.mdx
index f52be74d588e21..c27a374d10a7cb 100644
--- a/api_docs/kbn_actions_types.mdx
+++ b/api_docs/kbn_actions_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-actions-types
 title: "@kbn/actions-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/actions-types plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/actions-types']
 ---
 import kbnActionsTypesObj from './kbn_actions_types.devdocs.json';
diff --git a/api_docs/kbn_aiops_components.mdx b/api_docs/kbn_aiops_components.mdx
index 355562e336752d..df3b24bf322ecd 100644
--- a/api_docs/kbn_aiops_components.mdx
+++ b/api_docs/kbn_aiops_components.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-aiops-components
 title: "@kbn/aiops-components"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/aiops-components plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/aiops-components']
 ---
 import kbnAiopsComponentsObj from './kbn_aiops_components.devdocs.json';
diff --git a/api_docs/kbn_aiops_log_pattern_analysis.mdx b/api_docs/kbn_aiops_log_pattern_analysis.mdx
index 638072377c2438..1a148633e77db8 100644
--- a/api_docs/kbn_aiops_log_pattern_analysis.mdx
+++ b/api_docs/kbn_aiops_log_pattern_analysis.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-aiops-log-pattern-analysis
 title: "@kbn/aiops-log-pattern-analysis"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/aiops-log-pattern-analysis plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/aiops-log-pattern-analysis']
 ---
 import kbnAiopsLogPatternAnalysisObj from './kbn_aiops_log_pattern_analysis.devdocs.json';
diff --git a/api_docs/kbn_aiops_log_rate_analysis.mdx b/api_docs/kbn_aiops_log_rate_analysis.mdx
index bd8739ec024095..3d5f55187b0ee0 100644
--- a/api_docs/kbn_aiops_log_rate_analysis.mdx
+++ b/api_docs/kbn_aiops_log_rate_analysis.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-aiops-log-rate-analysis
 title: "@kbn/aiops-log-rate-analysis"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/aiops-log-rate-analysis plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/aiops-log-rate-analysis']
 ---
 import kbnAiopsLogRateAnalysisObj from './kbn_aiops_log_rate_analysis.devdocs.json';
diff --git a/api_docs/kbn_alerting_api_integration_helpers.mdx b/api_docs/kbn_alerting_api_integration_helpers.mdx
index 97e2b2204f3e97..97719e0a2ae9d3 100644
--- a/api_docs/kbn_alerting_api_integration_helpers.mdx
+++ b/api_docs/kbn_alerting_api_integration_helpers.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-alerting-api-integration-helpers
 title: "@kbn/alerting-api-integration-helpers"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/alerting-api-integration-helpers plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/alerting-api-integration-helpers']
 ---
 import kbnAlertingApiIntegrationHelpersObj from './kbn_alerting_api_integration_helpers.devdocs.json';
diff --git a/api_docs/kbn_alerting_state_types.mdx b/api_docs/kbn_alerting_state_types.mdx
index 047c8d5400c715..9c2d45c303fce8 100644
--- a/api_docs/kbn_alerting_state_types.mdx
+++ b/api_docs/kbn_alerting_state_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-alerting-state-types
 title: "@kbn/alerting-state-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/alerting-state-types plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/alerting-state-types']
 ---
 import kbnAlertingStateTypesObj from './kbn_alerting_state_types.devdocs.json';
diff --git a/api_docs/kbn_alerting_types.mdx b/api_docs/kbn_alerting_types.mdx
index 58c544500ea2d4..da0b6206d65ac8 100644
--- a/api_docs/kbn_alerting_types.mdx
+++ b/api_docs/kbn_alerting_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-alerting-types
 title: "@kbn/alerting-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/alerting-types plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/alerting-types']
 ---
 import kbnAlertingTypesObj from './kbn_alerting_types.devdocs.json';
diff --git a/api_docs/kbn_alerts_as_data_utils.mdx b/api_docs/kbn_alerts_as_data_utils.mdx
index 1c430d15fd5f24..7ecf717b211477 100644
--- a/api_docs/kbn_alerts_as_data_utils.mdx
+++ b/api_docs/kbn_alerts_as_data_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-alerts-as-data-utils
 title: "@kbn/alerts-as-data-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/alerts-as-data-utils plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/alerts-as-data-utils']
 ---
 import kbnAlertsAsDataUtilsObj from './kbn_alerts_as_data_utils.devdocs.json';
diff --git a/api_docs/kbn_alerts_ui_shared.mdx b/api_docs/kbn_alerts_ui_shared.mdx
index 9c57fb0c42a21d..29a57a2f9cef60 100644
--- a/api_docs/kbn_alerts_ui_shared.mdx
+++ b/api_docs/kbn_alerts_ui_shared.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-alerts-ui-shared
 title: "@kbn/alerts-ui-shared"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/alerts-ui-shared plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/alerts-ui-shared']
 ---
 import kbnAlertsUiSharedObj from './kbn_alerts_ui_shared.devdocs.json';
diff --git a/api_docs/kbn_analytics.mdx b/api_docs/kbn_analytics.mdx
index 22ea159ed7ca6b..acd6edd3cc6014 100644
--- a/api_docs/kbn_analytics.mdx
+++ b/api_docs/kbn_analytics.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics
 title: "@kbn/analytics"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/analytics plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics']
 ---
 import kbnAnalyticsObj from './kbn_analytics.devdocs.json';
diff --git a/api_docs/kbn_analytics_client.mdx b/api_docs/kbn_analytics_client.mdx
index 8f21b60642264f..2747e708b13092 100644
--- a/api_docs/kbn_analytics_client.mdx
+++ b/api_docs/kbn_analytics_client.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics-client
 title: "@kbn/analytics-client"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/analytics-client plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics-client']
 ---
 import kbnAnalyticsClientObj from './kbn_analytics_client.devdocs.json';
diff --git a/api_docs/kbn_analytics_collection_utils.mdx b/api_docs/kbn_analytics_collection_utils.mdx
index 04e2782354ab50..cfe684830f5b99 100644
--- a/api_docs/kbn_analytics_collection_utils.mdx
+++ b/api_docs/kbn_analytics_collection_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics-collection-utils
 title: "@kbn/analytics-collection-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/analytics-collection-utils plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics-collection-utils']
 ---
 import kbnAnalyticsCollectionUtilsObj from './kbn_analytics_collection_utils.devdocs.json';
diff --git a/api_docs/kbn_analytics_shippers_elastic_v3_browser.mdx b/api_docs/kbn_analytics_shippers_elastic_v3_browser.mdx
index 739d8d3b105cf8..dc69aaaa3395a2 100644
--- a/api_docs/kbn_analytics_shippers_elastic_v3_browser.mdx
+++ b/api_docs/kbn_analytics_shippers_elastic_v3_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics-shippers-elastic-v3-browser
 title: "@kbn/analytics-shippers-elastic-v3-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/analytics-shippers-elastic-v3-browser plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics-shippers-elastic-v3-browser']
 ---
 import kbnAnalyticsShippersElasticV3BrowserObj from './kbn_analytics_shippers_elastic_v3_browser.devdocs.json';
diff --git a/api_docs/kbn_analytics_shippers_elastic_v3_common.mdx b/api_docs/kbn_analytics_shippers_elastic_v3_common.mdx
index 7011c16301bf38..85972604098d35 100644
--- a/api_docs/kbn_analytics_shippers_elastic_v3_common.mdx
+++ b/api_docs/kbn_analytics_shippers_elastic_v3_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics-shippers-elastic-v3-common
 title: "@kbn/analytics-shippers-elastic-v3-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/analytics-shippers-elastic-v3-common plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics-shippers-elastic-v3-common']
 ---
 import kbnAnalyticsShippersElasticV3CommonObj from './kbn_analytics_shippers_elastic_v3_common.devdocs.json';
diff --git a/api_docs/kbn_analytics_shippers_elastic_v3_server.mdx b/api_docs/kbn_analytics_shippers_elastic_v3_server.mdx
index f673a97ae85496..7707410bca8402 100644
--- a/api_docs/kbn_analytics_shippers_elastic_v3_server.mdx
+++ b/api_docs/kbn_analytics_shippers_elastic_v3_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics-shippers-elastic-v3-server
 title: "@kbn/analytics-shippers-elastic-v3-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/analytics-shippers-elastic-v3-server plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics-shippers-elastic-v3-server']
 ---
 import kbnAnalyticsShippersElasticV3ServerObj from './kbn_analytics_shippers_elastic_v3_server.devdocs.json';
diff --git a/api_docs/kbn_analytics_shippers_fullstory.mdx b/api_docs/kbn_analytics_shippers_fullstory.mdx
index 97c1f3ab1b5ee3..572f35d8277815 100644
--- a/api_docs/kbn_analytics_shippers_fullstory.mdx
+++ b/api_docs/kbn_analytics_shippers_fullstory.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics-shippers-fullstory
 title: "@kbn/analytics-shippers-fullstory"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/analytics-shippers-fullstory plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics-shippers-fullstory']
 ---
 import kbnAnalyticsShippersFullstoryObj from './kbn_analytics_shippers_fullstory.devdocs.json';
diff --git a/api_docs/kbn_apm_config_loader.mdx b/api_docs/kbn_apm_config_loader.mdx
index 504b2462befc60..f40e7322cb6600 100644
--- a/api_docs/kbn_apm_config_loader.mdx
+++ b/api_docs/kbn_apm_config_loader.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-apm-config-loader
 title: "@kbn/apm-config-loader"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/apm-config-loader plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/apm-config-loader']
 ---
 import kbnApmConfigLoaderObj from './kbn_apm_config_loader.devdocs.json';
diff --git a/api_docs/kbn_apm_data_view.mdx b/api_docs/kbn_apm_data_view.mdx
index 6d98bf6a2a14e9..a96db00186a017 100644
--- a/api_docs/kbn_apm_data_view.mdx
+++ b/api_docs/kbn_apm_data_view.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-apm-data-view
 title: "@kbn/apm-data-view"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/apm-data-view plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/apm-data-view']
 ---
 import kbnApmDataViewObj from './kbn_apm_data_view.devdocs.json';
diff --git a/api_docs/kbn_apm_synthtrace.devdocs.json b/api_docs/kbn_apm_synthtrace.devdocs.json
index d0025a57d215c4..26ccc25ade7178 100644
--- a/api_docs/kbn_apm_synthtrace.devdocs.json
+++ b/api_docs/kbn_apm_synthtrace.devdocs.json
@@ -142,7 +142,7 @@
             "label": "getDefaultPipeline",
             "description": [],
             "signature": [
-              "(includeSerialization?: boolean) => (base: ",
+              "({ includeSerialization, versionOverride, }?: { includeSerialization?: boolean | undefined; versionOverride?: string | undefined; }) => (base: ",
               "Readable",
               ") => NodeJS.WritableStream"
             ],
@@ -153,17 +153,43 @@
               {
                 "parentPluginId": "@kbn/apm-synthtrace",
                 "id": "def-server.ApmSynthtraceEsClient.getDefaultPipeline.$1",
-                "type": "boolean",
+                "type": "Object",
                 "tags": [],
-                "label": "includeSerialization",
+                "label": "{\n      includeSerialization,\n      versionOverride,\n    }",
                 "description": [],
-                "signature": [
-                  "boolean"
-                ],
                 "path": "packages/kbn-apm-synthtrace/src/lib/apm/client/apm_synthtrace_es_client/index.ts",
                 "deprecated": false,
                 "trackAdoption": false,
-                "isRequired": true
+                "children": [
+                  {
+                    "parentPluginId": "@kbn/apm-synthtrace",
+                    "id": "def-server.ApmSynthtraceEsClient.getDefaultPipeline.$1.includeSerialization",
+                    "type": "CompoundType",
+                    "tags": [],
+                    "label": "includeSerialization",
+                    "description": [],
+                    "signature": [
+                      "boolean | undefined"
+                    ],
+                    "path": "packages/kbn-apm-synthtrace/src/lib/apm/client/apm_synthtrace_es_client/index.ts",
+                    "deprecated": false,
+                    "trackAdoption": false
+                  },
+                  {
+                    "parentPluginId": "@kbn/apm-synthtrace",
+                    "id": "def-server.ApmSynthtraceEsClient.getDefaultPipeline.$1.versionOverride",
+                    "type": "string",
+                    "tags": [],
+                    "label": "versionOverride",
+                    "description": [],
+                    "signature": [
+                      "string | undefined"
+                    ],
+                    "path": "packages/kbn-apm-synthtrace/src/lib/apm/client/apm_synthtrace_es_client/index.ts",
+                    "deprecated": false,
+                    "trackAdoption": false
+                  }
+                ]
               }
             ],
             "returnComment": []
@@ -336,6 +362,71 @@
         ],
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "@kbn/apm-synthtrace",
+        "id": "def-server.AssetsSynthtraceEsClient",
+        "type": "Class",
+        "tags": [],
+        "label": "AssetsSynthtraceEsClient",
+        "description": [],
+        "signature": [
+          {
+            "pluginId": "@kbn/apm-synthtrace",
+            "scope": "server",
+            "docId": "kibKbnApmSynthtracePluginApi",
+            "section": "def-server.AssetsSynthtraceEsClient",
+            "text": "AssetsSynthtraceEsClient"
+          },
+          " extends ",
+          "SynthtraceEsClient",
+          "<",
+          "ServiceAssetDocument",
+          ">"
+        ],
+        "path": "packages/kbn-apm-synthtrace/src/lib/assets/assets_synthtrace_es_client.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/apm-synthtrace",
+            "id": "def-server.AssetsSynthtraceEsClient.Unnamed",
+            "type": "Function",
+            "tags": [],
+            "label": "Constructor",
+            "description": [],
+            "signature": [
+              "any"
+            ],
+            "path": "packages/kbn-apm-synthtrace/src/lib/assets/assets_synthtrace_es_client.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [
+              {
+                "parentPluginId": "@kbn/apm-synthtrace",
+                "id": "def-server.AssetsSynthtraceEsClient.Unnamed.$1",
+                "type": "CompoundType",
+                "tags": [],
+                "label": "options",
+                "description": [],
+                "signature": [
+                  "{ client: ",
+                  "default",
+                  "; logger: ",
+                  "Logger",
+                  "; } & ",
+                  "AssetsSynthtraceEsClientOptions"
+                ],
+                "path": "packages/kbn-apm-synthtrace/src/lib/assets/assets_synthtrace_es_client.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          }
+        ],
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "@kbn/apm-synthtrace",
         "id": "def-server.InfraSynthtraceEsClient",
diff --git a/api_docs/kbn_apm_synthtrace.mdx b/api_docs/kbn_apm_synthtrace.mdx
index 05418059279f8d..6812c080e10833 100644
--- a/api_docs/kbn_apm_synthtrace.mdx
+++ b/api_docs/kbn_apm_synthtrace.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-apm-synthtrace
 title: "@kbn/apm-synthtrace"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/apm-synthtrace plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/apm-synthtrace']
 ---
 import kbnApmSynthtraceObj from './kbn_apm_synthtrace.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/obs-ux-infra_services-team](https://github.com/orgs/elastic/te
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 44 | 0 | 44 | 7 |
+| 49 | 0 | 49 | 8 |
 
 ## Server
 
diff --git a/api_docs/kbn_apm_synthtrace_client.mdx b/api_docs/kbn_apm_synthtrace_client.mdx
index caa4cd14b39f74..1bfb6d7027d1ce 100644
--- a/api_docs/kbn_apm_synthtrace_client.mdx
+++ b/api_docs/kbn_apm_synthtrace_client.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-apm-synthtrace-client
 title: "@kbn/apm-synthtrace-client"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/apm-synthtrace-client plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/apm-synthtrace-client']
 ---
 import kbnApmSynthtraceClientObj from './kbn_apm_synthtrace_client.devdocs.json';
diff --git a/api_docs/kbn_apm_utils.mdx b/api_docs/kbn_apm_utils.mdx
index c8e47128ef8a6b..7791f6a05f1ee2 100644
--- a/api_docs/kbn_apm_utils.mdx
+++ b/api_docs/kbn_apm_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-apm-utils
 title: "@kbn/apm-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/apm-utils plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/apm-utils']
 ---
 import kbnApmUtilsObj from './kbn_apm_utils.devdocs.json';
diff --git a/api_docs/kbn_axe_config.mdx b/api_docs/kbn_axe_config.mdx
index 45871652bfa04a..b3e315e1c3b7ab 100644
--- a/api_docs/kbn_axe_config.mdx
+++ b/api_docs/kbn_axe_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-axe-config
 title: "@kbn/axe-config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/axe-config plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/axe-config']
 ---
 import kbnAxeConfigObj from './kbn_axe_config.devdocs.json';
diff --git a/api_docs/kbn_bfetch_error.mdx b/api_docs/kbn_bfetch_error.mdx
index 649620f5135e46..705bbf3e13e646 100644
--- a/api_docs/kbn_bfetch_error.mdx
+++ b/api_docs/kbn_bfetch_error.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-bfetch-error
 title: "@kbn/bfetch-error"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/bfetch-error plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/bfetch-error']
 ---
 import kbnBfetchErrorObj from './kbn_bfetch_error.devdocs.json';
diff --git a/api_docs/kbn_calculate_auto.mdx b/api_docs/kbn_calculate_auto.mdx
index 1dea9352f47f26..7de2ba5b9facaa 100644
--- a/api_docs/kbn_calculate_auto.mdx
+++ b/api_docs/kbn_calculate_auto.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-calculate-auto
 title: "@kbn/calculate-auto"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/calculate-auto plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/calculate-auto']
 ---
 import kbnCalculateAutoObj from './kbn_calculate_auto.devdocs.json';
diff --git a/api_docs/kbn_calculate_width_from_char_count.mdx b/api_docs/kbn_calculate_width_from_char_count.mdx
index fa2439bbaea1f9..c60a77c0d6501e 100644
--- a/api_docs/kbn_calculate_width_from_char_count.mdx
+++ b/api_docs/kbn_calculate_width_from_char_count.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-calculate-width-from-char-count
 title: "@kbn/calculate-width-from-char-count"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/calculate-width-from-char-count plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/calculate-width-from-char-count']
 ---
 import kbnCalculateWidthFromCharCountObj from './kbn_calculate_width_from_char_count.devdocs.json';
diff --git a/api_docs/kbn_cases_components.mdx b/api_docs/kbn_cases_components.mdx
index c4b952f504d184..2dc43a41f1f15a 100644
--- a/api_docs/kbn_cases_components.mdx
+++ b/api_docs/kbn_cases_components.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-cases-components
 title: "@kbn/cases-components"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/cases-components plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/cases-components']
 ---
 import kbnCasesComponentsObj from './kbn_cases_components.devdocs.json';
diff --git a/api_docs/kbn_cell_actions.devdocs.json b/api_docs/kbn_cell_actions.devdocs.json
index 890540f3905d6f..2e8ff82e452386 100644
--- a/api_docs/kbn_cell_actions.devdocs.json
+++ b/api_docs/kbn_cell_actions.devdocs.json
@@ -19,241 +19,6 @@
   "common": {
     "classes": [],
     "functions": [
-      {
-        "parentPluginId": "@kbn/cell-actions",
-        "id": "def-common.addExistsFilter",
-        "type": "Function",
-        "tags": [],
-        "label": "addExistsFilter",
-        "description": [],
-        "signature": [
-          "({ filterManager, key, negate, dataViewId, }: AddExistsFilterParams) => void"
-        ],
-        "path": "packages/kbn-cell-actions/src/actions/filter/add_filter.ts",
-        "deprecated": false,
-        "trackAdoption": false,
-        "children": [
-          {
-            "parentPluginId": "@kbn/cell-actions",
-            "id": "def-common.addExistsFilter.$1",
-            "type": "Object",
-            "tags": [],
-            "label": "{\n  filterManager,\n  key,\n  negate,\n  dataViewId,\n}",
-            "description": [],
-            "signature": [
-              "AddExistsFilterParams"
-            ],
-            "path": "packages/kbn-cell-actions/src/actions/filter/add_filter.ts",
-            "deprecated": false,
-            "trackAdoption": false,
-            "isRequired": true
-          }
-        ],
-        "returnComment": [],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "@kbn/cell-actions",
-        "id": "def-common.addFilterIn",
-        "type": "Function",
-        "tags": [],
-        "label": "addFilterIn",
-        "description": [],
-        "signature": [
-          "({ filterManager, fieldName, value, dataViewId, }: { filterManager: ",
-          {
-            "pluginId": "data",
-            "scope": "public",
-            "docId": "kibDataQueryPluginApi",
-            "section": "def-public.FilterManager",
-            "text": "FilterManager"
-          },
-          " | undefined; fieldName: string; value: ",
-          "DefaultActionsSupportedValue",
-          "; dataViewId?: string | undefined; }) => void"
-        ],
-        "path": "packages/kbn-cell-actions/src/actions/filter/filter_in.ts",
-        "deprecated": false,
-        "trackAdoption": false,
-        "children": [
-          {
-            "parentPluginId": "@kbn/cell-actions",
-            "id": "def-common.addFilterIn.$1",
-            "type": "Object",
-            "tags": [],
-            "label": "{\n  filterManager,\n  fieldName,\n  value,\n  dataViewId,\n}",
-            "description": [],
-            "path": "packages/kbn-cell-actions/src/actions/filter/filter_in.ts",
-            "deprecated": false,
-            "trackAdoption": false,
-            "children": [
-              {
-                "parentPluginId": "@kbn/cell-actions",
-                "id": "def-common.addFilterIn.$1.filterManager",
-                "type": "Object",
-                "tags": [],
-                "label": "filterManager",
-                "description": [],
-                "signature": [
-                  {
-                    "pluginId": "data",
-                    "scope": "public",
-                    "docId": "kibDataQueryPluginApi",
-                    "section": "def-public.FilterManager",
-                    "text": "FilterManager"
-                  },
-                  " | undefined"
-                ],
-                "path": "packages/kbn-cell-actions/src/actions/filter/filter_in.ts",
-                "deprecated": false,
-                "trackAdoption": false
-              },
-              {
-                "parentPluginId": "@kbn/cell-actions",
-                "id": "def-common.addFilterIn.$1.fieldName",
-                "type": "string",
-                "tags": [],
-                "label": "fieldName",
-                "description": [],
-                "path": "packages/kbn-cell-actions/src/actions/filter/filter_in.ts",
-                "deprecated": false,
-                "trackAdoption": false
-              },
-              {
-                "parentPluginId": "@kbn/cell-actions",
-                "id": "def-common.addFilterIn.$1.value",
-                "type": "CompoundType",
-                "tags": [],
-                "label": "value",
-                "description": [],
-                "signature": [
-                  "string[] | boolean[] | number[]"
-                ],
-                "path": "packages/kbn-cell-actions/src/actions/filter/filter_in.ts",
-                "deprecated": false,
-                "trackAdoption": false
-              },
-              {
-                "parentPluginId": "@kbn/cell-actions",
-                "id": "def-common.addFilterIn.$1.dataViewId",
-                "type": "string",
-                "tags": [],
-                "label": "dataViewId",
-                "description": [],
-                "signature": [
-                  "string | undefined"
-                ],
-                "path": "packages/kbn-cell-actions/src/actions/filter/filter_in.ts",
-                "deprecated": false,
-                "trackAdoption": false
-              }
-            ]
-          }
-        ],
-        "returnComment": [],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "@kbn/cell-actions",
-        "id": "def-common.addFilterOut",
-        "type": "Function",
-        "tags": [],
-        "label": "addFilterOut",
-        "description": [],
-        "signature": [
-          "({ filterManager, fieldName, value, dataViewId, }: { filterManager: ",
-          {
-            "pluginId": "data",
-            "scope": "public",
-            "docId": "kibDataQueryPluginApi",
-            "section": "def-public.FilterManager",
-            "text": "FilterManager"
-          },
-          " | undefined; fieldName: string; value: ",
-          "DefaultActionsSupportedValue",
-          "; dataViewId?: string | undefined; }) => void"
-        ],
-        "path": "packages/kbn-cell-actions/src/actions/filter/filter_out.ts",
-        "deprecated": false,
-        "trackAdoption": false,
-        "children": [
-          {
-            "parentPluginId": "@kbn/cell-actions",
-            "id": "def-common.addFilterOut.$1",
-            "type": "Object",
-            "tags": [],
-            "label": "{\n  filterManager,\n  fieldName,\n  value,\n  dataViewId,\n}",
-            "description": [],
-            "path": "packages/kbn-cell-actions/src/actions/filter/filter_out.ts",
-            "deprecated": false,
-            "trackAdoption": false,
-            "children": [
-              {
-                "parentPluginId": "@kbn/cell-actions",
-                "id": "def-common.addFilterOut.$1.filterManager",
-                "type": "Object",
-                "tags": [],
-                "label": "filterManager",
-                "description": [],
-                "signature": [
-                  {
-                    "pluginId": "data",
-                    "scope": "public",
-                    "docId": "kibDataQueryPluginApi",
-                    "section": "def-public.FilterManager",
-                    "text": "FilterManager"
-                  },
-                  " | undefined"
-                ],
-                "path": "packages/kbn-cell-actions/src/actions/filter/filter_out.ts",
-                "deprecated": false,
-                "trackAdoption": false
-              },
-              {
-                "parentPluginId": "@kbn/cell-actions",
-                "id": "def-common.addFilterOut.$1.fieldName",
-                "type": "string",
-                "tags": [],
-                "label": "fieldName",
-                "description": [],
-                "path": "packages/kbn-cell-actions/src/actions/filter/filter_out.ts",
-                "deprecated": false,
-                "trackAdoption": false
-              },
-              {
-                "parentPluginId": "@kbn/cell-actions",
-                "id": "def-common.addFilterOut.$1.value",
-                "type": "CompoundType",
-                "tags": [],
-                "label": "value",
-                "description": [],
-                "signature": [
-                  "string[] | boolean[] | number[]"
-                ],
-                "path": "packages/kbn-cell-actions/src/actions/filter/filter_out.ts",
-                "deprecated": false,
-                "trackAdoption": false
-              },
-              {
-                "parentPluginId": "@kbn/cell-actions",
-                "id": "def-common.addFilterOut.$1.dataViewId",
-                "type": "string",
-                "tags": [],
-                "label": "dataViewId",
-                "description": [],
-                "signature": [
-                  "string | undefined"
-                ],
-                "path": "packages/kbn-cell-actions/src/actions/filter/filter_out.ts",
-                "deprecated": false,
-                "trackAdoption": false
-              }
-            ]
-          }
-        ],
-        "returnComment": [],
-        "initialIsOpen": false
-      },
       {
         "parentPluginId": "@kbn/cell-actions",
         "id": "def-common.CellActions",
@@ -312,7 +77,13 @@
         "description": [],
         "signature": [
           "({ children, getTriggerCompatibleActions, }: React.PropsWithChildren<",
-          "CellActionsProviderProps",
+          {
+            "pluginId": "@kbn/cell-actions",
+            "scope": "common",
+            "docId": "kibKbnCellActionsPluginApi",
+            "section": "def-common.CellActionsProviderProps",
+            "text": "CellActionsProviderProps"
+          },
           ">) => JSX.Element"
         ],
         "path": "packages/kbn-cell-actions/src/context/cell_actions_context.tsx",
@@ -328,313 +99,22 @@
             "description": [],
             "signature": [
               "React.PropsWithChildren<",
-              "CellActionsProviderProps",
-              ">"
-            ],
-            "path": "packages/kbn-cell-actions/src/context/cell_actions_context.tsx",
-            "deprecated": false,
-            "trackAdoption": false,
-            "isRequired": true
-          }
-        ],
-        "returnComment": [],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "@kbn/cell-actions",
-        "id": "def-common.createCellActionFactory",
-        "type": "Function",
-        "tags": [],
-        "label": "createCellActionFactory",
-        "description": [],
-        "signature": [
-          "<C extends ",
-          {
-            "pluginId": "@kbn/cell-actions",
-            "scope": "common",
-            "docId": "kibKbnCellActionsPluginApi",
-            "section": "def-common.CellAction",
-            "text": "CellAction"
-          },
-          "<",
-          {
-            "pluginId": "@kbn/cell-actions",
-            "scope": "common",
-            "docId": "kibKbnCellActionsPluginApi",
-            "section": "def-common.CellActionExecutionContext",
-            "text": "CellActionExecutionContext"
-          },
-          "> = ",
-          {
-            "pluginId": "@kbn/cell-actions",
-            "scope": "common",
-            "docId": "kibKbnCellActionsPluginApi",
-            "section": "def-common.CellAction",
-            "text": "CellAction"
-          },
-          "<",
-          {
-            "pluginId": "@kbn/cell-actions",
-            "scope": "common",
-            "docId": "kibKbnCellActionsPluginApi",
-            "section": "def-common.CellActionExecutionContext",
-            "text": "CellActionExecutionContext"
-          },
-          ">, P = void>(actionCreator: (params: P) => ",
-          {
-            "pluginId": "@kbn/cell-actions",
-            "scope": "common",
-            "docId": "kibKbnCellActionsPluginApi",
-            "section": "def-common.CellActionTemplate",
-            "text": "CellActionTemplate"
-          },
-          "<C>) => (params: P) => ",
-          {
-            "pluginId": "@kbn/cell-actions",
-            "scope": "common",
-            "docId": "kibKbnCellActionsPluginApi",
-            "section": "def-common.CellActionFactory",
-            "text": "CellActionFactory"
-          },
-          "<C>"
-        ],
-        "path": "packages/kbn-cell-actions/src/actions/factory.ts",
-        "deprecated": false,
-        "trackAdoption": false,
-        "children": [
-          {
-            "parentPluginId": "@kbn/cell-actions",
-            "id": "def-common.createCellActionFactory.$1",
-            "type": "Function",
-            "tags": [],
-            "label": "actionCreator",
-            "description": [],
-            "signature": [
-              "(params: P) => ",
               {
                 "pluginId": "@kbn/cell-actions",
                 "scope": "common",
                 "docId": "kibKbnCellActionsPluginApi",
-                "section": "def-common.CellActionTemplate",
-                "text": "CellActionTemplate"
-              },
-              "<C>"
-            ],
-            "path": "packages/kbn-cell-actions/src/actions/factory.ts",
-            "deprecated": false,
-            "trackAdoption": false,
-            "isRequired": true
-          }
-        ],
-        "returnComment": [],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "@kbn/cell-actions",
-        "id": "def-common.createCopyToClipboardActionFactory",
-        "type": "Function",
-        "tags": [],
-        "label": "createCopyToClipboardActionFactory",
-        "description": [],
-        "signature": [
-          "(params: { notifications: ",
-          {
-            "pluginId": "@kbn/core-notifications-browser",
-            "scope": "common",
-            "docId": "kibKbnCoreNotificationsBrowserPluginApi",
-            "section": "def-common.NotificationsStart",
-            "text": "NotificationsStart"
-          },
-          "; }) => ",
-          {
-            "pluginId": "@kbn/cell-actions",
-            "scope": "common",
-            "docId": "kibKbnCellActionsPluginApi",
-            "section": "def-common.CellActionFactory",
-            "text": "CellActionFactory"
-          },
-          "<",
-          {
-            "pluginId": "@kbn/cell-actions",
-            "scope": "common",
-            "docId": "kibKbnCellActionsPluginApi",
-            "section": "def-common.CellAction",
-            "text": "CellAction"
-          },
-          "<",
-          {
-            "pluginId": "@kbn/cell-actions",
-            "scope": "common",
-            "docId": "kibKbnCellActionsPluginApi",
-            "section": "def-common.CellActionExecutionContext",
-            "text": "CellActionExecutionContext"
-          },
-          ">>"
-        ],
-        "path": "packages/kbn-cell-actions/src/actions/copy_to_clipboard/copy_to_clipboard.ts",
-        "deprecated": false,
-        "trackAdoption": false,
-        "returnComment": [],
-        "children": [
-          {
-            "parentPluginId": "@kbn/cell-actions",
-            "id": "def-common.createCopyToClipboardActionFactory.$1",
-            "type": "Uncategorized",
-            "tags": [],
-            "label": "params",
-            "description": [],
-            "signature": [
-              "P"
-            ],
-            "path": "packages/kbn-cell-actions/src/actions/factory.ts",
-            "deprecated": false,
-            "trackAdoption": false
-          }
-        ],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "@kbn/cell-actions",
-        "id": "def-common.createFilterInActionFactory",
-        "type": "Function",
-        "tags": [],
-        "label": "createFilterInActionFactory",
-        "description": [],
-        "signature": [
-          "(params: { filterManager: ",
-          {
-            "pluginId": "data",
-            "scope": "public",
-            "docId": "kibDataQueryPluginApi",
-            "section": "def-public.FilterManager",
-            "text": "FilterManager"
-          },
-          "; notifications: ",
-          {
-            "pluginId": "@kbn/core-notifications-browser",
-            "scope": "common",
-            "docId": "kibKbnCoreNotificationsBrowserPluginApi",
-            "section": "def-common.NotificationsStart",
-            "text": "NotificationsStart"
-          },
-          "; }) => ",
-          {
-            "pluginId": "@kbn/cell-actions",
-            "scope": "common",
-            "docId": "kibKbnCellActionsPluginApi",
-            "section": "def-common.CellActionFactory",
-            "text": "CellActionFactory"
-          },
-          "<",
-          {
-            "pluginId": "@kbn/cell-actions",
-            "scope": "common",
-            "docId": "kibKbnCellActionsPluginApi",
-            "section": "def-common.CellAction",
-            "text": "CellAction"
-          },
-          "<",
-          {
-            "pluginId": "@kbn/cell-actions",
-            "scope": "common",
-            "docId": "kibKbnCellActionsPluginApi",
-            "section": "def-common.CellActionExecutionContext",
-            "text": "CellActionExecutionContext"
-          },
-          ">>"
-        ],
-        "path": "packages/kbn-cell-actions/src/actions/filter/filter_in.ts",
-        "deprecated": false,
-        "trackAdoption": false,
-        "returnComment": [],
-        "children": [
-          {
-            "parentPluginId": "@kbn/cell-actions",
-            "id": "def-common.createFilterInActionFactory.$1",
-            "type": "Uncategorized",
-            "tags": [],
-            "label": "params",
-            "description": [],
-            "signature": [
-              "P"
-            ],
-            "path": "packages/kbn-cell-actions/src/actions/factory.ts",
-            "deprecated": false,
-            "trackAdoption": false
-          }
-        ],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "@kbn/cell-actions",
-        "id": "def-common.createFilterOutActionFactory",
-        "type": "Function",
-        "tags": [],
-        "label": "createFilterOutActionFactory",
-        "description": [],
-        "signature": [
-          "(params: { filterManager: ",
-          {
-            "pluginId": "data",
-            "scope": "public",
-            "docId": "kibDataQueryPluginApi",
-            "section": "def-public.FilterManager",
-            "text": "FilterManager"
-          },
-          "; notifications: ",
-          {
-            "pluginId": "@kbn/core-notifications-browser",
-            "scope": "common",
-            "docId": "kibKbnCoreNotificationsBrowserPluginApi",
-            "section": "def-common.NotificationsStart",
-            "text": "NotificationsStart"
-          },
-          "; }) => ",
-          {
-            "pluginId": "@kbn/cell-actions",
-            "scope": "common",
-            "docId": "kibKbnCellActionsPluginApi",
-            "section": "def-common.CellActionFactory",
-            "text": "CellActionFactory"
-          },
-          "<",
-          {
-            "pluginId": "@kbn/cell-actions",
-            "scope": "common",
-            "docId": "kibKbnCellActionsPluginApi",
-            "section": "def-common.CellAction",
-            "text": "CellAction"
-          },
-          "<",
-          {
-            "pluginId": "@kbn/cell-actions",
-            "scope": "common",
-            "docId": "kibKbnCellActionsPluginApi",
-            "section": "def-common.CellActionExecutionContext",
-            "text": "CellActionExecutionContext"
-          },
-          ">>"
-        ],
-        "path": "packages/kbn-cell-actions/src/actions/filter/filter_out.ts",
-        "deprecated": false,
-        "trackAdoption": false,
-        "returnComment": [],
-        "children": [
-          {
-            "parentPluginId": "@kbn/cell-actions",
-            "id": "def-common.createFilterOutActionFactory.$1",
-            "type": "Uncategorized",
-            "tags": [],
-            "label": "params",
-            "description": [],
-            "signature": [
-              "P"
+                "section": "def-common.CellActionsProviderProps",
+                "text": "CellActionsProviderProps"
+              },
+              ">"
             ],
-            "path": "packages/kbn-cell-actions/src/actions/factory.ts",
+            "path": "packages/kbn-cell-actions/src/context/cell_actions_context.tsx",
             "deprecated": false,
-            "trackAdoption": false
+            "trackAdoption": false,
+            "isRequired": true
           }
         ],
+        "returnComment": [],
         "initialIsOpen": false
       },
       {
@@ -872,7 +352,13 @@
             "label": "data",
             "description": [],
             "signature": [
-              "CellActionsData",
+              {
+                "pluginId": "@kbn/cell-actions",
+                "scope": "common",
+                "docId": "kibKbnCellActionsPluginApi",
+                "section": "def-common.CellActionsData",
+                "text": "CellActionsData"
+              },
               "[]"
             ],
             "path": "packages/kbn-cell-actions/src/types.ts",
@@ -931,7 +417,7 @@
           },
           "<C>"
         ],
-        "path": "packages/kbn-cell-actions/src/types.ts",
+        "path": "packages/kbn-cell-actions/src/actions/types.ts",
         "deprecated": false,
         "trackAdoption": false,
         "children": [
@@ -945,7 +431,7 @@
             "signature": [
               "any"
             ],
-            "path": "packages/kbn-cell-actions/src/types.ts",
+            "path": "packages/kbn-cell-actions/src/actions/types.ts",
             "deprecated": false,
             "trackAdoption": false
           },
@@ -975,7 +461,7 @@
               },
               "<A>"
             ],
-            "path": "packages/kbn-cell-actions/src/types.ts",
+            "path": "packages/kbn-cell-actions/src/actions/types.ts",
             "deprecated": false,
             "trackAdoption": false,
             "children": [
@@ -997,7 +483,7 @@
                   },
                   "<A>>"
                 ],
-                "path": "packages/kbn-cell-actions/src/types.ts",
+                "path": "packages/kbn-cell-actions/src/actions/types.ts",
                 "deprecated": false,
                 "trackAdoption": false,
                 "isRequired": true
@@ -1008,6 +494,165 @@
         ],
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "@kbn/cell-actions",
+        "id": "def-common.CellActionsData",
+        "type": "Interface",
+        "tags": [],
+        "label": "CellActionsData",
+        "description": [],
+        "path": "packages/kbn-cell-actions/src/types.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/cell-actions",
+            "id": "def-common.CellActionsData.field",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "field",
+            "description": [
+              "\nThe field specification"
+            ],
+            "signature": [
+              {
+                "pluginId": "@kbn/es-query",
+                "scope": "common",
+                "docId": "kibKbnEsQueryPluginApi",
+                "section": "def-common.DataViewFieldBase",
+                "text": "DataViewFieldBase"
+              },
+              " & { count?: number | undefined; conflictDescriptions?: Record<string, string[]> | undefined; format?: ",
+              {
+                "pluginId": "fieldFormats",
+                "scope": "common",
+                "docId": "kibFieldFormatsPluginApi",
+                "section": "def-common.SerializedFieldFormat",
+                "text": "SerializedFieldFormat"
+              },
+              "<{}, ",
+              {
+                "pluginId": "@kbn/utility-types",
+                "scope": "common",
+                "docId": "kibKbnUtilityTypesPluginApi",
+                "section": "def-common.SerializableRecord",
+                "text": "SerializableRecord"
+              },
+              "> | undefined; esTypes?: string[] | undefined; searchable: boolean; aggregatable: boolean; isNull?: boolean | undefined; readFromDocValues?: boolean | undefined; indexed?: boolean | undefined; customLabel?: string | undefined; customDescription?: string | undefined; runtimeField?: ",
+              {
+                "pluginId": "dataViews",
+                "scope": "common",
+                "docId": "kibDataViewsPluginApi",
+                "section": "def-common.RuntimeFieldSpec",
+                "text": "RuntimeFieldSpec"
+              },
+              " | undefined; fixedInterval?: string[] | undefined; timeZone?: string[] | undefined; timeSeriesDimension?: boolean | undefined; timeSeriesMetric?: ",
+              "MappingTimeSeriesMetricType",
+              " | undefined; shortDotsEnable?: boolean | undefined; isMapped?: boolean | undefined; parentName?: string | undefined; defaultFormatter?: string | undefined; }"
+            ],
+            "path": "packages/kbn-cell-actions/src/types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/cell-actions",
+            "id": "def-common.CellActionsData.value",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "value",
+            "description": [
+              "\nCommon set of properties used by most actions."
+            ],
+            "signature": [
+              "string[] | undefined[] | boolean[] | number[] | ",
+              {
+                "pluginId": "@kbn/utility-types",
+                "scope": "common",
+                "docId": "kibKbnUtilityTypesPluginApi",
+                "section": "def-common.Serializable",
+                "text": "Serializable"
+              },
+              " | null[]"
+            ],
+            "path": "packages/kbn-cell-actions/src/types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/cell-actions",
+        "id": "def-common.PartitionedActions",
+        "type": "Interface",
+        "tags": [],
+        "label": "PartitionedActions",
+        "description": [],
+        "path": "packages/kbn-cell-actions/src/types.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/cell-actions",
+            "id": "def-common.PartitionedActions.extraActions",
+            "type": "Array",
+            "tags": [],
+            "label": "extraActions",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/cell-actions",
+                "scope": "common",
+                "docId": "kibKbnCellActionsPluginApi",
+                "section": "def-common.CellAction",
+                "text": "CellAction"
+              },
+              "<",
+              {
+                "pluginId": "@kbn/cell-actions",
+                "scope": "common",
+                "docId": "kibKbnCellActionsPluginApi",
+                "section": "def-common.CellActionExecutionContext",
+                "text": "CellActionExecutionContext"
+              },
+              ">[]"
+            ],
+            "path": "packages/kbn-cell-actions/src/types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/cell-actions",
+            "id": "def-common.PartitionedActions.visibleActions",
+            "type": "Array",
+            "tags": [],
+            "label": "visibleActions",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/cell-actions",
+                "scope": "common",
+                "docId": "kibKbnCellActionsPluginApi",
+                "section": "def-common.CellAction",
+                "text": "CellAction"
+              },
+              "<",
+              {
+                "pluginId": "@kbn/cell-actions",
+                "scope": "common",
+                "docId": "kibKbnCellActionsPluginApi",
+                "section": "def-common.CellActionExecutionContext",
+                "text": "CellActionExecutionContext"
+              },
+              ">[]"
+            ],
+            "path": "packages/kbn-cell-actions/src/types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "@kbn/cell-actions",
         "id": "def-common.UseDataGridColumnsCellActionsProps",
@@ -1154,20 +799,7 @@
         "initialIsOpen": false
       }
     ],
-    "enums": [
-      {
-        "parentPluginId": "@kbn/cell-actions",
-        "id": "def-common.CellActionsMode",
-        "type": "Enum",
-        "tags": [],
-        "label": "CellActionsMode",
-        "description": [],
-        "path": "packages/kbn-cell-actions/src/constants.ts",
-        "deprecated": false,
-        "trackAdoption": false,
-        "initialIsOpen": false
-      }
-    ],
+    "enums": [],
     "misc": [
       {
         "parentPluginId": "@kbn/cell-actions",
@@ -1181,7 +813,7 @@
         "signature": [
           "Partial<C> & { id: string; }"
         ],
-        "path": "packages/kbn-cell-actions/src/types.ts",
+        "path": "packages/kbn-cell-actions/src/actions/types.ts",
         "deprecated": false,
         "trackAdoption": false,
         "initialIsOpen": false
@@ -1218,17 +850,23 @@
         "description": [],
         "signature": [
           "{ data: ",
-          "CellActionsData",
+          {
+            "pluginId": "@kbn/cell-actions",
+            "scope": "common",
+            "docId": "kibKbnCellActionsPluginApi",
+            "section": "def-common.CellActionsData",
+            "text": "CellActionsData"
+          },
           " | ",
-          "CellActionsData",
-          "[]; triggerId: string; mode: ",
           {
             "pluginId": "@kbn/cell-actions",
             "scope": "common",
             "docId": "kibKbnCellActionsPluginApi",
-            "section": "def-common.CellActionsMode",
-            "text": "CellActionsMode"
+            "section": "def-common.CellActionsData",
+            "text": "CellActionsData"
           },
+          "[]; triggerId: string; mode: ",
+          "CellActionsMode",
           "; showActionTooltips?: boolean | undefined; visibleCellActions?: number | undefined; disabledActionTypes?: string[] | undefined; metadata?: Metadata | undefined; className?: string | undefined; } & { children?: React.ReactNode; }"
         ],
         "path": "packages/kbn-cell-actions/src/types.ts",
@@ -1236,6 +874,29 @@
         "trackAdoption": false,
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "@kbn/cell-actions",
+        "id": "def-common.CellActionsProviderProps",
+        "type": "Type",
+        "tags": [],
+        "label": "CellActionsProviderProps",
+        "description": [],
+        "signature": [
+          "{ getTriggerCompatibleActions: (triggerId: string, context: object) => Promise<",
+          {
+            "pluginId": "uiActions",
+            "scope": "public",
+            "docId": "kibUiActionsPluginApi",
+            "section": "def-public.Action",
+            "text": "Action"
+          },
+          "<object>[]>; } & { children?: React.ReactNode; }"
+        ],
+        "path": "packages/kbn-cell-actions/src/types.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "@kbn/cell-actions",
         "id": "def-common.CellActionTemplate",
@@ -1248,9 +909,127 @@
         "signature": [
           "{ [P in Exclude<keyof C, \"id\">]: C[P]; }"
         ],
+        "path": "packages/kbn-cell-actions/src/actions/types.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/cell-actions",
+        "id": "def-common.DefaultActionsSupportedValue",
+        "type": "Type",
+        "tags": [],
+        "label": "DefaultActionsSupportedValue",
+        "description": [],
+        "signature": [
+          "string[] | boolean[] | number[]"
+        ],
+        "path": "packages/kbn-cell-actions/src/actions/types.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/cell-actions",
+        "id": "def-common.GetActions",
+        "type": "Type",
+        "tags": [],
+        "label": "GetActions",
+        "description": [],
+        "signature": [
+          "(context: ",
+          {
+            "pluginId": "@kbn/cell-actions",
+            "scope": "common",
+            "docId": "kibKbnCellActionsPluginApi",
+            "section": "def-common.CellActionCompatibilityContext",
+            "text": "CellActionCompatibilityContext"
+          },
+          "<",
+          {
+            "pluginId": "@kbn/cell-actions",
+            "scope": "common",
+            "docId": "kibKbnCellActionsPluginApi",
+            "section": "def-common.CellActionExecutionContext",
+            "text": "CellActionExecutionContext"
+          },
+          ">) => Promise<",
+          {
+            "pluginId": "@kbn/cell-actions",
+            "scope": "common",
+            "docId": "kibKbnCellActionsPluginApi",
+            "section": "def-common.CellAction",
+            "text": "CellAction"
+          },
+          "<",
+          {
+            "pluginId": "@kbn/cell-actions",
+            "scope": "common",
+            "docId": "kibKbnCellActionsPluginApi",
+            "section": "def-common.CellActionExecutionContext",
+            "text": "CellActionExecutionContext"
+          },
+          ">[]>"
+        ],
         "path": "packages/kbn-cell-actions/src/types.ts",
         "deprecated": false,
         "trackAdoption": false,
+        "returnComment": [],
+        "children": [
+          {
+            "parentPluginId": "@kbn/cell-actions",
+            "id": "def-common.GetActions.$1",
+            "type": "Object",
+            "tags": [],
+            "label": "context",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/cell-actions",
+                "scope": "common",
+                "docId": "kibKbnCellActionsPluginApi",
+                "section": "def-common.CellActionCompatibilityContext",
+                "text": "CellActionCompatibilityContext"
+              },
+              "<",
+              {
+                "pluginId": "@kbn/cell-actions",
+                "scope": "common",
+                "docId": "kibKbnCellActionsPluginApi",
+                "section": "def-common.CellActionExecutionContext",
+                "text": "CellActionExecutionContext"
+              },
+              ">"
+            ],
+            "path": "packages/kbn-cell-actions/src/types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/cell-actions",
+        "id": "def-common.NonNullableSerializable",
+        "type": "Type",
+        "tags": [],
+        "label": "NonNullableSerializable",
+        "description": [],
+        "signature": [
+          "string | number | boolean | ",
+          {
+            "pluginId": "@kbn/utility-types",
+            "scope": "common",
+            "docId": "kibKbnUtilityTypesPluginApi",
+            "section": "def-common.SerializableRecord",
+            "text": "SerializableRecord"
+          },
+          " | ",
+          "SerializableArray"
+        ],
+        "path": "packages/kbn-cell-actions/src/actions/types.ts",
+        "deprecated": false,
+        "trackAdoption": false,
         "initialIsOpen": false
       },
       {
diff --git a/api_docs/kbn_cell_actions.mdx b/api_docs/kbn_cell_actions.mdx
index b62a4b7330e49d..13531714e1d509 100644
--- a/api_docs/kbn_cell_actions.mdx
+++ b/api_docs/kbn_cell_actions.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-cell-actions
 title: "@kbn/cell-actions"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/cell-actions plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/cell-actions']
 ---
 import kbnCellActionsObj from './kbn_cell_actions.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/security-threat-hunting-explore](https://github.com/orgs/elast
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 56 | 1 | 44 | 3 |
+| 44 | 1 | 30 | 1 |
 
 ## Common
 
@@ -31,9 +31,6 @@ Contact [@elastic/security-threat-hunting-explore](https://github.com/orgs/elast
 ### Interfaces
 <DocDefinitionList data={kbnCellActionsObj.common.interfaces}/>
 
-### Enums
-<DocDefinitionList data={kbnCellActionsObj.common.enums}/>
-
 ### Consts, variables and types
 <DocDefinitionList data={kbnCellActionsObj.common.misc}/>
 
diff --git a/api_docs/kbn_chart_expressions_common.mdx b/api_docs/kbn_chart_expressions_common.mdx
index d60b559f97ba1b..89df1fc346e281 100644
--- a/api_docs/kbn_chart_expressions_common.mdx
+++ b/api_docs/kbn_chart_expressions_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-chart-expressions-common
 title: "@kbn/chart-expressions-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/chart-expressions-common plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/chart-expressions-common']
 ---
 import kbnChartExpressionsCommonObj from './kbn_chart_expressions_common.devdocs.json';
diff --git a/api_docs/kbn_chart_icons.mdx b/api_docs/kbn_chart_icons.mdx
index 45c8c62ff2e123..77f5359e8e6fc2 100644
--- a/api_docs/kbn_chart_icons.mdx
+++ b/api_docs/kbn_chart_icons.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-chart-icons
 title: "@kbn/chart-icons"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/chart-icons plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/chart-icons']
 ---
 import kbnChartIconsObj from './kbn_chart_icons.devdocs.json';
diff --git a/api_docs/kbn_ci_stats_core.mdx b/api_docs/kbn_ci_stats_core.mdx
index b828230139dbc2..77eb4aea8ef9bc 100644
--- a/api_docs/kbn_ci_stats_core.mdx
+++ b/api_docs/kbn_ci_stats_core.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ci-stats-core
 title: "@kbn/ci-stats-core"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ci-stats-core plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ci-stats-core']
 ---
 import kbnCiStatsCoreObj from './kbn_ci_stats_core.devdocs.json';
diff --git a/api_docs/kbn_ci_stats_performance_metrics.mdx b/api_docs/kbn_ci_stats_performance_metrics.mdx
index f5184158b6b56b..04c9746c74c368 100644
--- a/api_docs/kbn_ci_stats_performance_metrics.mdx
+++ b/api_docs/kbn_ci_stats_performance_metrics.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ci-stats-performance-metrics
 title: "@kbn/ci-stats-performance-metrics"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ci-stats-performance-metrics plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ci-stats-performance-metrics']
 ---
 import kbnCiStatsPerformanceMetricsObj from './kbn_ci_stats_performance_metrics.devdocs.json';
diff --git a/api_docs/kbn_ci_stats_reporter.mdx b/api_docs/kbn_ci_stats_reporter.mdx
index 47c0e9853fb058..1aa7b1c0ad3165 100644
--- a/api_docs/kbn_ci_stats_reporter.mdx
+++ b/api_docs/kbn_ci_stats_reporter.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ci-stats-reporter
 title: "@kbn/ci-stats-reporter"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ci-stats-reporter plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ci-stats-reporter']
 ---
 import kbnCiStatsReporterObj from './kbn_ci_stats_reporter.devdocs.json';
diff --git a/api_docs/kbn_cli_dev_mode.mdx b/api_docs/kbn_cli_dev_mode.mdx
index 81c59c1d8658e1..27f795f1df6928 100644
--- a/api_docs/kbn_cli_dev_mode.mdx
+++ b/api_docs/kbn_cli_dev_mode.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-cli-dev-mode
 title: "@kbn/cli-dev-mode"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/cli-dev-mode plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/cli-dev-mode']
 ---
 import kbnCliDevModeObj from './kbn_cli_dev_mode.devdocs.json';
diff --git a/api_docs/kbn_code_editor.mdx b/api_docs/kbn_code_editor.mdx
index 78cbf871b1dc11..9703af2ebfbf46 100644
--- a/api_docs/kbn_code_editor.mdx
+++ b/api_docs/kbn_code_editor.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-code-editor
 title: "@kbn/code-editor"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/code-editor plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/code-editor']
 ---
 import kbnCodeEditorObj from './kbn_code_editor.devdocs.json';
diff --git a/api_docs/kbn_code_editor_mock.mdx b/api_docs/kbn_code_editor_mock.mdx
index 82ce6d2ce0201b..28371278bbba9a 100644
--- a/api_docs/kbn_code_editor_mock.mdx
+++ b/api_docs/kbn_code_editor_mock.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-code-editor-mock
 title: "@kbn/code-editor-mock"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/code-editor-mock plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/code-editor-mock']
 ---
 import kbnCodeEditorMockObj from './kbn_code_editor_mock.devdocs.json';
diff --git a/api_docs/kbn_code_owners.mdx b/api_docs/kbn_code_owners.mdx
index 08d5b567e91b07..bffe0fe647ee58 100644
--- a/api_docs/kbn_code_owners.mdx
+++ b/api_docs/kbn_code_owners.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-code-owners
 title: "@kbn/code-owners"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/code-owners plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/code-owners']
 ---
 import kbnCodeOwnersObj from './kbn_code_owners.devdocs.json';
diff --git a/api_docs/kbn_coloring.mdx b/api_docs/kbn_coloring.mdx
index 5ed2f613a869e5..4e076a111bc98a 100644
--- a/api_docs/kbn_coloring.mdx
+++ b/api_docs/kbn_coloring.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-coloring
 title: "@kbn/coloring"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/coloring plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/coloring']
 ---
 import kbnColoringObj from './kbn_coloring.devdocs.json';
diff --git a/api_docs/kbn_config.mdx b/api_docs/kbn_config.mdx
index afaf3fbe4fdb05..ea58470980398b 100644
--- a/api_docs/kbn_config.mdx
+++ b/api_docs/kbn_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-config
 title: "@kbn/config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/config plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/config']
 ---
 import kbnConfigObj from './kbn_config.devdocs.json';
diff --git a/api_docs/kbn_config_mocks.mdx b/api_docs/kbn_config_mocks.mdx
index 007540d8b986f6..f8527d84292505 100644
--- a/api_docs/kbn_config_mocks.mdx
+++ b/api_docs/kbn_config_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-config-mocks
 title: "@kbn/config-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/config-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/config-mocks']
 ---
 import kbnConfigMocksObj from './kbn_config_mocks.devdocs.json';
diff --git a/api_docs/kbn_config_schema.devdocs.json b/api_docs/kbn_config_schema.devdocs.json
index 3df7fa2d9f3115..2c82087ed0c2e2 100644
--- a/api_docs/kbn_config_schema.devdocs.json
+++ b/api_docs/kbn_config_schema.devdocs.json
@@ -2646,7 +2646,7 @@
         "label": "metaFields",
         "description": [],
         "signature": [
-          "{ readonly META_FIELD_X_OAS_REF_ID: \"x-oas-ref-id\"; readonly META_FIELD_X_OAS_OPTIONAL: \"x-oas-optional\"; readonly META_FIELD_X_OAS_DEPRECATED: \"x-oas-deprecated\"; readonly META_FIELD_X_OAS_MAX_LENGTH: \"x-oas-max-length\"; readonly META_FIELD_X_OAS_MIN_LENGTH: \"x-oas-min-length\"; readonly META_FIELD_X_OAS_GET_ADDITIONAL_PROPERTIES: \"x-oas-get-additional-properties\"; }"
+          "{ readonly META_FIELD_X_OAS_ANY: \"x-oas-any-type\"; readonly META_FIELD_X_OAS_REF_ID: \"x-oas-ref-id\"; readonly META_FIELD_X_OAS_OPTIONAL: \"x-oas-optional\"; readonly META_FIELD_X_OAS_DEPRECATED: \"x-oas-deprecated\"; readonly META_FIELD_X_OAS_MAX_LENGTH: \"x-oas-max-length\"; readonly META_FIELD_X_OAS_MIN_LENGTH: \"x-oas-min-length\"; readonly META_FIELD_X_OAS_GET_ADDITIONAL_PROPERTIES: \"x-oas-get-additional-properties\"; }"
         ],
         "path": "packages/kbn-config-schema/index.ts",
         "deprecated": false,
diff --git a/api_docs/kbn_config_schema.mdx b/api_docs/kbn_config_schema.mdx
index bbbe36d4bd85f8..09d5f771086f01 100644
--- a/api_docs/kbn_config_schema.mdx
+++ b/api_docs/kbn_config_schema.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-config-schema
 title: "@kbn/config-schema"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/config-schema plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/config-schema']
 ---
 import kbnConfigSchemaObj from './kbn_config_schema.devdocs.json';
diff --git a/api_docs/kbn_content_management_content_editor.mdx b/api_docs/kbn_content_management_content_editor.mdx
index b9e0d2959be5f1..3bd095bfd22e73 100644
--- a/api_docs/kbn_content_management_content_editor.mdx
+++ b/api_docs/kbn_content_management_content_editor.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-content-management-content-editor
 title: "@kbn/content-management-content-editor"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/content-management-content-editor plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/content-management-content-editor']
 ---
 import kbnContentManagementContentEditorObj from './kbn_content_management_content_editor.devdocs.json';
diff --git a/api_docs/kbn_content_management_tabbed_table_list_view.mdx b/api_docs/kbn_content_management_tabbed_table_list_view.mdx
index bdda37790a9fb2..2dba64e946bf9a 100644
--- a/api_docs/kbn_content_management_tabbed_table_list_view.mdx
+++ b/api_docs/kbn_content_management_tabbed_table_list_view.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-content-management-tabbed-table-list-view
 title: "@kbn/content-management-tabbed-table-list-view"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/content-management-tabbed-table-list-view plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/content-management-tabbed-table-list-view']
 ---
 import kbnContentManagementTabbedTableListViewObj from './kbn_content_management_tabbed_table_list_view.devdocs.json';
diff --git a/api_docs/kbn_content_management_table_list_view.mdx b/api_docs/kbn_content_management_table_list_view.mdx
index f1fb4af0a9b376..af7167c8dd7ef0 100644
--- a/api_docs/kbn_content_management_table_list_view.mdx
+++ b/api_docs/kbn_content_management_table_list_view.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-content-management-table-list-view
 title: "@kbn/content-management-table-list-view"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/content-management-table-list-view plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/content-management-table-list-view']
 ---
 import kbnContentManagementTableListViewObj from './kbn_content_management_table_list_view.devdocs.json';
diff --git a/api_docs/kbn_content_management_table_list_view_common.mdx b/api_docs/kbn_content_management_table_list_view_common.mdx
index 198f3a07288268..7932e441bc6b2b 100644
--- a/api_docs/kbn_content_management_table_list_view_common.mdx
+++ b/api_docs/kbn_content_management_table_list_view_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-content-management-table-list-view-common
 title: "@kbn/content-management-table-list-view-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/content-management-table-list-view-common plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/content-management-table-list-view-common']
 ---
 import kbnContentManagementTableListViewCommonObj from './kbn_content_management_table_list_view_common.devdocs.json';
diff --git a/api_docs/kbn_content_management_table_list_view_table.mdx b/api_docs/kbn_content_management_table_list_view_table.mdx
index 7d9e734fb0c6f0..7b49272a62c400 100644
--- a/api_docs/kbn_content_management_table_list_view_table.mdx
+++ b/api_docs/kbn_content_management_table_list_view_table.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-content-management-table-list-view-table
 title: "@kbn/content-management-table-list-view-table"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/content-management-table-list-view-table plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/content-management-table-list-view-table']
 ---
 import kbnContentManagementTableListViewTableObj from './kbn_content_management_table_list_view_table.devdocs.json';
diff --git a/api_docs/kbn_content_management_utils.mdx b/api_docs/kbn_content_management_utils.mdx
index 67fcab0f2fb1b4..f07085c0fc1eb9 100644
--- a/api_docs/kbn_content_management_utils.mdx
+++ b/api_docs/kbn_content_management_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-content-management-utils
 title: "@kbn/content-management-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/content-management-utils plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/content-management-utils']
 ---
 import kbnContentManagementUtilsObj from './kbn_content_management_utils.devdocs.json';
diff --git a/api_docs/kbn_core_analytics_browser.mdx b/api_docs/kbn_core_analytics_browser.mdx
index 390b3613c52ad6..2446cc5db7b44c 100644
--- a/api_docs/kbn_core_analytics_browser.mdx
+++ b/api_docs/kbn_core_analytics_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-analytics-browser
 title: "@kbn/core-analytics-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-analytics-browser plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-analytics-browser']
 ---
 import kbnCoreAnalyticsBrowserObj from './kbn_core_analytics_browser.devdocs.json';
diff --git a/api_docs/kbn_core_analytics_browser_internal.mdx b/api_docs/kbn_core_analytics_browser_internal.mdx
index 516e770be86448..0094b23ea4631b 100644
--- a/api_docs/kbn_core_analytics_browser_internal.mdx
+++ b/api_docs/kbn_core_analytics_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-analytics-browser-internal
 title: "@kbn/core-analytics-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-analytics-browser-internal plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-analytics-browser-internal']
 ---
 import kbnCoreAnalyticsBrowserInternalObj from './kbn_core_analytics_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_analytics_browser_mocks.mdx b/api_docs/kbn_core_analytics_browser_mocks.mdx
index 1039ca58feeb7e..79e9c41ea1947b 100644
--- a/api_docs/kbn_core_analytics_browser_mocks.mdx
+++ b/api_docs/kbn_core_analytics_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-analytics-browser-mocks
 title: "@kbn/core-analytics-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-analytics-browser-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-analytics-browser-mocks']
 ---
 import kbnCoreAnalyticsBrowserMocksObj from './kbn_core_analytics_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_analytics_server.mdx b/api_docs/kbn_core_analytics_server.mdx
index 09efab12cb2d29..aa683a20848737 100644
--- a/api_docs/kbn_core_analytics_server.mdx
+++ b/api_docs/kbn_core_analytics_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-analytics-server
 title: "@kbn/core-analytics-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-analytics-server plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-analytics-server']
 ---
 import kbnCoreAnalyticsServerObj from './kbn_core_analytics_server.devdocs.json';
diff --git a/api_docs/kbn_core_analytics_server_internal.mdx b/api_docs/kbn_core_analytics_server_internal.mdx
index b94cd5f3f8e0ae..106865235dc65b 100644
--- a/api_docs/kbn_core_analytics_server_internal.mdx
+++ b/api_docs/kbn_core_analytics_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-analytics-server-internal
 title: "@kbn/core-analytics-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-analytics-server-internal plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-analytics-server-internal']
 ---
 import kbnCoreAnalyticsServerInternalObj from './kbn_core_analytics_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_analytics_server_mocks.mdx b/api_docs/kbn_core_analytics_server_mocks.mdx
index 0556a7e806da76..e5cdc2a3bd1ce7 100644
--- a/api_docs/kbn_core_analytics_server_mocks.mdx
+++ b/api_docs/kbn_core_analytics_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-analytics-server-mocks
 title: "@kbn/core-analytics-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-analytics-server-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-analytics-server-mocks']
 ---
 import kbnCoreAnalyticsServerMocksObj from './kbn_core_analytics_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_application_browser.mdx b/api_docs/kbn_core_application_browser.mdx
index a5a3cf6e6f04ff..48546675152722 100644
--- a/api_docs/kbn_core_application_browser.mdx
+++ b/api_docs/kbn_core_application_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-application-browser
 title: "@kbn/core-application-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-application-browser plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-application-browser']
 ---
 import kbnCoreApplicationBrowserObj from './kbn_core_application_browser.devdocs.json';
diff --git a/api_docs/kbn_core_application_browser_internal.mdx b/api_docs/kbn_core_application_browser_internal.mdx
index ef0675c702f15c..f03bf4fc8aae52 100644
--- a/api_docs/kbn_core_application_browser_internal.mdx
+++ b/api_docs/kbn_core_application_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-application-browser-internal
 title: "@kbn/core-application-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-application-browser-internal plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-application-browser-internal']
 ---
 import kbnCoreApplicationBrowserInternalObj from './kbn_core_application_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_application_browser_mocks.mdx b/api_docs/kbn_core_application_browser_mocks.mdx
index 545c07055a738f..9004dedbc5a4ee 100644
--- a/api_docs/kbn_core_application_browser_mocks.mdx
+++ b/api_docs/kbn_core_application_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-application-browser-mocks
 title: "@kbn/core-application-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-application-browser-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-application-browser-mocks']
 ---
 import kbnCoreApplicationBrowserMocksObj from './kbn_core_application_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_application_common.mdx b/api_docs/kbn_core_application_common.mdx
index d1116c9a45086a..7e7c16ae3346cb 100644
--- a/api_docs/kbn_core_application_common.mdx
+++ b/api_docs/kbn_core_application_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-application-common
 title: "@kbn/core-application-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-application-common plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-application-common']
 ---
 import kbnCoreApplicationCommonObj from './kbn_core_application_common.devdocs.json';
diff --git a/api_docs/kbn_core_apps_browser_internal.mdx b/api_docs/kbn_core_apps_browser_internal.mdx
index f269be4656e374..9b19b85e6c579d 100644
--- a/api_docs/kbn_core_apps_browser_internal.mdx
+++ b/api_docs/kbn_core_apps_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-apps-browser-internal
 title: "@kbn/core-apps-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-apps-browser-internal plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-apps-browser-internal']
 ---
 import kbnCoreAppsBrowserInternalObj from './kbn_core_apps_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_apps_browser_mocks.mdx b/api_docs/kbn_core_apps_browser_mocks.mdx
index 851911b746ad51..7ea5f3b7f23e79 100644
--- a/api_docs/kbn_core_apps_browser_mocks.mdx
+++ b/api_docs/kbn_core_apps_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-apps-browser-mocks
 title: "@kbn/core-apps-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-apps-browser-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-apps-browser-mocks']
 ---
 import kbnCoreAppsBrowserMocksObj from './kbn_core_apps_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_apps_server_internal.mdx b/api_docs/kbn_core_apps_server_internal.mdx
index d9c3e43ae9058e..1c82b6007609cd 100644
--- a/api_docs/kbn_core_apps_server_internal.mdx
+++ b/api_docs/kbn_core_apps_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-apps-server-internal
 title: "@kbn/core-apps-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-apps-server-internal plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-apps-server-internal']
 ---
 import kbnCoreAppsServerInternalObj from './kbn_core_apps_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_base_browser_mocks.mdx b/api_docs/kbn_core_base_browser_mocks.mdx
index 66406ea34f7f0f..9f7efc84305e96 100644
--- a/api_docs/kbn_core_base_browser_mocks.mdx
+++ b/api_docs/kbn_core_base_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-base-browser-mocks
 title: "@kbn/core-base-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-base-browser-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-base-browser-mocks']
 ---
 import kbnCoreBaseBrowserMocksObj from './kbn_core_base_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_base_common.mdx b/api_docs/kbn_core_base_common.mdx
index 523dc8fb52a202..802d3b4fc15b7c 100644
--- a/api_docs/kbn_core_base_common.mdx
+++ b/api_docs/kbn_core_base_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-base-common
 title: "@kbn/core-base-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-base-common plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-base-common']
 ---
 import kbnCoreBaseCommonObj from './kbn_core_base_common.devdocs.json';
diff --git a/api_docs/kbn_core_base_server_internal.mdx b/api_docs/kbn_core_base_server_internal.mdx
index 70f177efe6301f..fbf1a1bd912b80 100644
--- a/api_docs/kbn_core_base_server_internal.mdx
+++ b/api_docs/kbn_core_base_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-base-server-internal
 title: "@kbn/core-base-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-base-server-internal plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-base-server-internal']
 ---
 import kbnCoreBaseServerInternalObj from './kbn_core_base_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_base_server_mocks.mdx b/api_docs/kbn_core_base_server_mocks.mdx
index 5befe25252e906..d1780a0b17c616 100644
--- a/api_docs/kbn_core_base_server_mocks.mdx
+++ b/api_docs/kbn_core_base_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-base-server-mocks
 title: "@kbn/core-base-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-base-server-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-base-server-mocks']
 ---
 import kbnCoreBaseServerMocksObj from './kbn_core_base_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_capabilities_browser_mocks.mdx b/api_docs/kbn_core_capabilities_browser_mocks.mdx
index f1d53d7a05f58d..8100a46fd42b98 100644
--- a/api_docs/kbn_core_capabilities_browser_mocks.mdx
+++ b/api_docs/kbn_core_capabilities_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-capabilities-browser-mocks
 title: "@kbn/core-capabilities-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-capabilities-browser-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-capabilities-browser-mocks']
 ---
 import kbnCoreCapabilitiesBrowserMocksObj from './kbn_core_capabilities_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_capabilities_common.mdx b/api_docs/kbn_core_capabilities_common.mdx
index 98f0cd95bdb6be..7a010ddd98565a 100644
--- a/api_docs/kbn_core_capabilities_common.mdx
+++ b/api_docs/kbn_core_capabilities_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-capabilities-common
 title: "@kbn/core-capabilities-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-capabilities-common plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-capabilities-common']
 ---
 import kbnCoreCapabilitiesCommonObj from './kbn_core_capabilities_common.devdocs.json';
diff --git a/api_docs/kbn_core_capabilities_server.mdx b/api_docs/kbn_core_capabilities_server.mdx
index 95291065ce45f2..bbcccff947209a 100644
--- a/api_docs/kbn_core_capabilities_server.mdx
+++ b/api_docs/kbn_core_capabilities_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-capabilities-server
 title: "@kbn/core-capabilities-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-capabilities-server plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-capabilities-server']
 ---
 import kbnCoreCapabilitiesServerObj from './kbn_core_capabilities_server.devdocs.json';
diff --git a/api_docs/kbn_core_capabilities_server_mocks.mdx b/api_docs/kbn_core_capabilities_server_mocks.mdx
index 7a084fc1f8e09c..e703c9a8fcb338 100644
--- a/api_docs/kbn_core_capabilities_server_mocks.mdx
+++ b/api_docs/kbn_core_capabilities_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-capabilities-server-mocks
 title: "@kbn/core-capabilities-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-capabilities-server-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-capabilities-server-mocks']
 ---
 import kbnCoreCapabilitiesServerMocksObj from './kbn_core_capabilities_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_chrome_browser.mdx b/api_docs/kbn_core_chrome_browser.mdx
index 284b0784a37637..2867d64c358057 100644
--- a/api_docs/kbn_core_chrome_browser.mdx
+++ b/api_docs/kbn_core_chrome_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-chrome-browser
 title: "@kbn/core-chrome-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-chrome-browser plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-chrome-browser']
 ---
 import kbnCoreChromeBrowserObj from './kbn_core_chrome_browser.devdocs.json';
diff --git a/api_docs/kbn_core_chrome_browser_mocks.mdx b/api_docs/kbn_core_chrome_browser_mocks.mdx
index 1d6b6ec2a3498d..9348f1d3a841f4 100644
--- a/api_docs/kbn_core_chrome_browser_mocks.mdx
+++ b/api_docs/kbn_core_chrome_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-chrome-browser-mocks
 title: "@kbn/core-chrome-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-chrome-browser-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-chrome-browser-mocks']
 ---
 import kbnCoreChromeBrowserMocksObj from './kbn_core_chrome_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_config_server_internal.mdx b/api_docs/kbn_core_config_server_internal.mdx
index 6b6da0e70fe15b..e985d0d19077a5 100644
--- a/api_docs/kbn_core_config_server_internal.mdx
+++ b/api_docs/kbn_core_config_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-config-server-internal
 title: "@kbn/core-config-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-config-server-internal plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-config-server-internal']
 ---
 import kbnCoreConfigServerInternalObj from './kbn_core_config_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_custom_branding_browser.mdx b/api_docs/kbn_core_custom_branding_browser.mdx
index b745ba9695ca59..fbc53c69eba678 100644
--- a/api_docs/kbn_core_custom_branding_browser.mdx
+++ b/api_docs/kbn_core_custom_branding_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-browser
 title: "@kbn/core-custom-branding-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-custom-branding-browser plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-browser']
 ---
 import kbnCoreCustomBrandingBrowserObj from './kbn_core_custom_branding_browser.devdocs.json';
diff --git a/api_docs/kbn_core_custom_branding_browser_internal.mdx b/api_docs/kbn_core_custom_branding_browser_internal.mdx
index dd7ce22ded0f68..609d5657321fb6 100644
--- a/api_docs/kbn_core_custom_branding_browser_internal.mdx
+++ b/api_docs/kbn_core_custom_branding_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-browser-internal
 title: "@kbn/core-custom-branding-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-custom-branding-browser-internal plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-browser-internal']
 ---
 import kbnCoreCustomBrandingBrowserInternalObj from './kbn_core_custom_branding_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_custom_branding_browser_mocks.mdx b/api_docs/kbn_core_custom_branding_browser_mocks.mdx
index 6f1282da05669f..49ac65d64ca2ca 100644
--- a/api_docs/kbn_core_custom_branding_browser_mocks.mdx
+++ b/api_docs/kbn_core_custom_branding_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-browser-mocks
 title: "@kbn/core-custom-branding-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-custom-branding-browser-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-browser-mocks']
 ---
 import kbnCoreCustomBrandingBrowserMocksObj from './kbn_core_custom_branding_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_custom_branding_common.mdx b/api_docs/kbn_core_custom_branding_common.mdx
index 5a0eb1d1e9828e..d9f8f86be4d258 100644
--- a/api_docs/kbn_core_custom_branding_common.mdx
+++ b/api_docs/kbn_core_custom_branding_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-common
 title: "@kbn/core-custom-branding-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-custom-branding-common plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-common']
 ---
 import kbnCoreCustomBrandingCommonObj from './kbn_core_custom_branding_common.devdocs.json';
diff --git a/api_docs/kbn_core_custom_branding_server.mdx b/api_docs/kbn_core_custom_branding_server.mdx
index 22a2258837a8cb..14983ea7e55aab 100644
--- a/api_docs/kbn_core_custom_branding_server.mdx
+++ b/api_docs/kbn_core_custom_branding_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-server
 title: "@kbn/core-custom-branding-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-custom-branding-server plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-server']
 ---
 import kbnCoreCustomBrandingServerObj from './kbn_core_custom_branding_server.devdocs.json';
diff --git a/api_docs/kbn_core_custom_branding_server_internal.mdx b/api_docs/kbn_core_custom_branding_server_internal.mdx
index 7ed901dcb0e044..95f5e2e3cd99b3 100644
--- a/api_docs/kbn_core_custom_branding_server_internal.mdx
+++ b/api_docs/kbn_core_custom_branding_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-server-internal
 title: "@kbn/core-custom-branding-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-custom-branding-server-internal plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-server-internal']
 ---
 import kbnCoreCustomBrandingServerInternalObj from './kbn_core_custom_branding_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_custom_branding_server_mocks.mdx b/api_docs/kbn_core_custom_branding_server_mocks.mdx
index 43de0b144e4013..e732d5577018be 100644
--- a/api_docs/kbn_core_custom_branding_server_mocks.mdx
+++ b/api_docs/kbn_core_custom_branding_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-server-mocks
 title: "@kbn/core-custom-branding-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-custom-branding-server-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-server-mocks']
 ---
 import kbnCoreCustomBrandingServerMocksObj from './kbn_core_custom_branding_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_deprecations_browser.mdx b/api_docs/kbn_core_deprecations_browser.mdx
index 5fe94635256c06..861aee7858da12 100644
--- a/api_docs/kbn_core_deprecations_browser.mdx
+++ b/api_docs/kbn_core_deprecations_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-browser
 title: "@kbn/core-deprecations-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-deprecations-browser plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-browser']
 ---
 import kbnCoreDeprecationsBrowserObj from './kbn_core_deprecations_browser.devdocs.json';
diff --git a/api_docs/kbn_core_deprecations_browser_internal.mdx b/api_docs/kbn_core_deprecations_browser_internal.mdx
index f61c1857fdf422..433b0b8e610b7a 100644
--- a/api_docs/kbn_core_deprecations_browser_internal.mdx
+++ b/api_docs/kbn_core_deprecations_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-browser-internal
 title: "@kbn/core-deprecations-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-deprecations-browser-internal plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-browser-internal']
 ---
 import kbnCoreDeprecationsBrowserInternalObj from './kbn_core_deprecations_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_deprecations_browser_mocks.mdx b/api_docs/kbn_core_deprecations_browser_mocks.mdx
index 4ec550282062e9..780cf0590a8c96 100644
--- a/api_docs/kbn_core_deprecations_browser_mocks.mdx
+++ b/api_docs/kbn_core_deprecations_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-browser-mocks
 title: "@kbn/core-deprecations-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-deprecations-browser-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-browser-mocks']
 ---
 import kbnCoreDeprecationsBrowserMocksObj from './kbn_core_deprecations_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_deprecations_common.mdx b/api_docs/kbn_core_deprecations_common.mdx
index 58e9c6ff54de2b..12e65a43e0a2cf 100644
--- a/api_docs/kbn_core_deprecations_common.mdx
+++ b/api_docs/kbn_core_deprecations_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-common
 title: "@kbn/core-deprecations-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-deprecations-common plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-common']
 ---
 import kbnCoreDeprecationsCommonObj from './kbn_core_deprecations_common.devdocs.json';
diff --git a/api_docs/kbn_core_deprecations_server.mdx b/api_docs/kbn_core_deprecations_server.mdx
index 45221cb46655ed..8fb96f23a0c6ba 100644
--- a/api_docs/kbn_core_deprecations_server.mdx
+++ b/api_docs/kbn_core_deprecations_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-server
 title: "@kbn/core-deprecations-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-deprecations-server plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-server']
 ---
 import kbnCoreDeprecationsServerObj from './kbn_core_deprecations_server.devdocs.json';
diff --git a/api_docs/kbn_core_deprecations_server_internal.mdx b/api_docs/kbn_core_deprecations_server_internal.mdx
index a90de148273500..de03d7eeb010b4 100644
--- a/api_docs/kbn_core_deprecations_server_internal.mdx
+++ b/api_docs/kbn_core_deprecations_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-server-internal
 title: "@kbn/core-deprecations-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-deprecations-server-internal plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-server-internal']
 ---
 import kbnCoreDeprecationsServerInternalObj from './kbn_core_deprecations_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_deprecations_server_mocks.mdx b/api_docs/kbn_core_deprecations_server_mocks.mdx
index 67188bc7ed692b..91a3020c89a767 100644
--- a/api_docs/kbn_core_deprecations_server_mocks.mdx
+++ b/api_docs/kbn_core_deprecations_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-server-mocks
 title: "@kbn/core-deprecations-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-deprecations-server-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-server-mocks']
 ---
 import kbnCoreDeprecationsServerMocksObj from './kbn_core_deprecations_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_doc_links_browser.mdx b/api_docs/kbn_core_doc_links_browser.mdx
index c0c732a77eb828..f360581170f099 100644
--- a/api_docs/kbn_core_doc_links_browser.mdx
+++ b/api_docs/kbn_core_doc_links_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-doc-links-browser
 title: "@kbn/core-doc-links-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-doc-links-browser plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-doc-links-browser']
 ---
 import kbnCoreDocLinksBrowserObj from './kbn_core_doc_links_browser.devdocs.json';
diff --git a/api_docs/kbn_core_doc_links_browser_mocks.mdx b/api_docs/kbn_core_doc_links_browser_mocks.mdx
index 5d59b4e63994bf..9089009f4ffa17 100644
--- a/api_docs/kbn_core_doc_links_browser_mocks.mdx
+++ b/api_docs/kbn_core_doc_links_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-doc-links-browser-mocks
 title: "@kbn/core-doc-links-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-doc-links-browser-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-doc-links-browser-mocks']
 ---
 import kbnCoreDocLinksBrowserMocksObj from './kbn_core_doc_links_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_doc_links_server.mdx b/api_docs/kbn_core_doc_links_server.mdx
index 87feb21601208b..fd0faf93be812b 100644
--- a/api_docs/kbn_core_doc_links_server.mdx
+++ b/api_docs/kbn_core_doc_links_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-doc-links-server
 title: "@kbn/core-doc-links-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-doc-links-server plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-doc-links-server']
 ---
 import kbnCoreDocLinksServerObj from './kbn_core_doc_links_server.devdocs.json';
diff --git a/api_docs/kbn_core_doc_links_server_mocks.mdx b/api_docs/kbn_core_doc_links_server_mocks.mdx
index 110627c9d497f0..2f2b08a110b06b 100644
--- a/api_docs/kbn_core_doc_links_server_mocks.mdx
+++ b/api_docs/kbn_core_doc_links_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-doc-links-server-mocks
 title: "@kbn/core-doc-links-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-doc-links-server-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-doc-links-server-mocks']
 ---
 import kbnCoreDocLinksServerMocksObj from './kbn_core_doc_links_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_elasticsearch_client_server_internal.mdx b/api_docs/kbn_core_elasticsearch_client_server_internal.mdx
index f2307ac78610ff..49ca693de49e1a 100644
--- a/api_docs/kbn_core_elasticsearch_client_server_internal.mdx
+++ b/api_docs/kbn_core_elasticsearch_client_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-elasticsearch-client-server-internal
 title: "@kbn/core-elasticsearch-client-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-elasticsearch-client-server-internal plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-elasticsearch-client-server-internal']
 ---
 import kbnCoreElasticsearchClientServerInternalObj from './kbn_core_elasticsearch_client_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_elasticsearch_client_server_mocks.mdx b/api_docs/kbn_core_elasticsearch_client_server_mocks.mdx
index a4742f0b146aeb..93ba7503b742f4 100644
--- a/api_docs/kbn_core_elasticsearch_client_server_mocks.mdx
+++ b/api_docs/kbn_core_elasticsearch_client_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-elasticsearch-client-server-mocks
 title: "@kbn/core-elasticsearch-client-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-elasticsearch-client-server-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-elasticsearch-client-server-mocks']
 ---
 import kbnCoreElasticsearchClientServerMocksObj from './kbn_core_elasticsearch_client_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_elasticsearch_server.mdx b/api_docs/kbn_core_elasticsearch_server.mdx
index bbbecdc2b700dc..9b0ec900cc16f6 100644
--- a/api_docs/kbn_core_elasticsearch_server.mdx
+++ b/api_docs/kbn_core_elasticsearch_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-elasticsearch-server
 title: "@kbn/core-elasticsearch-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-elasticsearch-server plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-elasticsearch-server']
 ---
 import kbnCoreElasticsearchServerObj from './kbn_core_elasticsearch_server.devdocs.json';
diff --git a/api_docs/kbn_core_elasticsearch_server_internal.mdx b/api_docs/kbn_core_elasticsearch_server_internal.mdx
index a1d8dfb5dfa5ea..c1d28abb6bec21 100644
--- a/api_docs/kbn_core_elasticsearch_server_internal.mdx
+++ b/api_docs/kbn_core_elasticsearch_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-elasticsearch-server-internal
 title: "@kbn/core-elasticsearch-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-elasticsearch-server-internal plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-elasticsearch-server-internal']
 ---
 import kbnCoreElasticsearchServerInternalObj from './kbn_core_elasticsearch_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_elasticsearch_server_mocks.mdx b/api_docs/kbn_core_elasticsearch_server_mocks.mdx
index 75343b2932aa86..ab96538bd59cca 100644
--- a/api_docs/kbn_core_elasticsearch_server_mocks.mdx
+++ b/api_docs/kbn_core_elasticsearch_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-elasticsearch-server-mocks
 title: "@kbn/core-elasticsearch-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-elasticsearch-server-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-elasticsearch-server-mocks']
 ---
 import kbnCoreElasticsearchServerMocksObj from './kbn_core_elasticsearch_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_environment_server_internal.mdx b/api_docs/kbn_core_environment_server_internal.mdx
index 9c6748418d79c8..fc99e91b8fca00 100644
--- a/api_docs/kbn_core_environment_server_internal.mdx
+++ b/api_docs/kbn_core_environment_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-environment-server-internal
 title: "@kbn/core-environment-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-environment-server-internal plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-environment-server-internal']
 ---
 import kbnCoreEnvironmentServerInternalObj from './kbn_core_environment_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_environment_server_mocks.mdx b/api_docs/kbn_core_environment_server_mocks.mdx
index c5e88e4d8a5d79..a672856ab64735 100644
--- a/api_docs/kbn_core_environment_server_mocks.mdx
+++ b/api_docs/kbn_core_environment_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-environment-server-mocks
 title: "@kbn/core-environment-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-environment-server-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-environment-server-mocks']
 ---
 import kbnCoreEnvironmentServerMocksObj from './kbn_core_environment_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_execution_context_browser.mdx b/api_docs/kbn_core_execution_context_browser.mdx
index 6b3ff46a69ad1b..d62de3ffc2eebf 100644
--- a/api_docs/kbn_core_execution_context_browser.mdx
+++ b/api_docs/kbn_core_execution_context_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-browser
 title: "@kbn/core-execution-context-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-execution-context-browser plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-browser']
 ---
 import kbnCoreExecutionContextBrowserObj from './kbn_core_execution_context_browser.devdocs.json';
diff --git a/api_docs/kbn_core_execution_context_browser_internal.mdx b/api_docs/kbn_core_execution_context_browser_internal.mdx
index bd3fb3d7b93460..0b88e69968aed5 100644
--- a/api_docs/kbn_core_execution_context_browser_internal.mdx
+++ b/api_docs/kbn_core_execution_context_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-browser-internal
 title: "@kbn/core-execution-context-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-execution-context-browser-internal plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-browser-internal']
 ---
 import kbnCoreExecutionContextBrowserInternalObj from './kbn_core_execution_context_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_execution_context_browser_mocks.mdx b/api_docs/kbn_core_execution_context_browser_mocks.mdx
index 1d1df8fbe8740b..39022ba03ab896 100644
--- a/api_docs/kbn_core_execution_context_browser_mocks.mdx
+++ b/api_docs/kbn_core_execution_context_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-browser-mocks
 title: "@kbn/core-execution-context-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-execution-context-browser-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-browser-mocks']
 ---
 import kbnCoreExecutionContextBrowserMocksObj from './kbn_core_execution_context_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_execution_context_common.mdx b/api_docs/kbn_core_execution_context_common.mdx
index bc05b4efc60d8a..7e99482c0487f7 100644
--- a/api_docs/kbn_core_execution_context_common.mdx
+++ b/api_docs/kbn_core_execution_context_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-common
 title: "@kbn/core-execution-context-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-execution-context-common plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-common']
 ---
 import kbnCoreExecutionContextCommonObj from './kbn_core_execution_context_common.devdocs.json';
diff --git a/api_docs/kbn_core_execution_context_server.mdx b/api_docs/kbn_core_execution_context_server.mdx
index 3af3a533c38e27..9765ecd3331443 100644
--- a/api_docs/kbn_core_execution_context_server.mdx
+++ b/api_docs/kbn_core_execution_context_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-server
 title: "@kbn/core-execution-context-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-execution-context-server plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-server']
 ---
 import kbnCoreExecutionContextServerObj from './kbn_core_execution_context_server.devdocs.json';
diff --git a/api_docs/kbn_core_execution_context_server_internal.mdx b/api_docs/kbn_core_execution_context_server_internal.mdx
index 74642173b5b569..e070e7aef7bd2f 100644
--- a/api_docs/kbn_core_execution_context_server_internal.mdx
+++ b/api_docs/kbn_core_execution_context_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-server-internal
 title: "@kbn/core-execution-context-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-execution-context-server-internal plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-server-internal']
 ---
 import kbnCoreExecutionContextServerInternalObj from './kbn_core_execution_context_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_execution_context_server_mocks.mdx b/api_docs/kbn_core_execution_context_server_mocks.mdx
index c9fa04e37ff649..41024eae75194b 100644
--- a/api_docs/kbn_core_execution_context_server_mocks.mdx
+++ b/api_docs/kbn_core_execution_context_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-server-mocks
 title: "@kbn/core-execution-context-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-execution-context-server-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-server-mocks']
 ---
 import kbnCoreExecutionContextServerMocksObj from './kbn_core_execution_context_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_fatal_errors_browser.mdx b/api_docs/kbn_core_fatal_errors_browser.mdx
index 709bad3c9ef994..d02c51dfe7105c 100644
--- a/api_docs/kbn_core_fatal_errors_browser.mdx
+++ b/api_docs/kbn_core_fatal_errors_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-fatal-errors-browser
 title: "@kbn/core-fatal-errors-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-fatal-errors-browser plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-fatal-errors-browser']
 ---
 import kbnCoreFatalErrorsBrowserObj from './kbn_core_fatal_errors_browser.devdocs.json';
diff --git a/api_docs/kbn_core_fatal_errors_browser_mocks.mdx b/api_docs/kbn_core_fatal_errors_browser_mocks.mdx
index ec2a5eb064a7f9..5d1e441cba2d49 100644
--- a/api_docs/kbn_core_fatal_errors_browser_mocks.mdx
+++ b/api_docs/kbn_core_fatal_errors_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-fatal-errors-browser-mocks
 title: "@kbn/core-fatal-errors-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-fatal-errors-browser-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-fatal-errors-browser-mocks']
 ---
 import kbnCoreFatalErrorsBrowserMocksObj from './kbn_core_fatal_errors_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_http_browser.mdx b/api_docs/kbn_core_http_browser.mdx
index 7c667de3869219..96c773cb6b6cdb 100644
--- a/api_docs/kbn_core_http_browser.mdx
+++ b/api_docs/kbn_core_http_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-browser
 title: "@kbn/core-http-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-browser plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-browser']
 ---
 import kbnCoreHttpBrowserObj from './kbn_core_http_browser.devdocs.json';
diff --git a/api_docs/kbn_core_http_browser_internal.mdx b/api_docs/kbn_core_http_browser_internal.mdx
index 086b28a0340d70..26067edffd4808 100644
--- a/api_docs/kbn_core_http_browser_internal.mdx
+++ b/api_docs/kbn_core_http_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-browser-internal
 title: "@kbn/core-http-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-browser-internal plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-browser-internal']
 ---
 import kbnCoreHttpBrowserInternalObj from './kbn_core_http_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_http_browser_mocks.mdx b/api_docs/kbn_core_http_browser_mocks.mdx
index e60c30d9b58679..a72dacc5fbcad1 100644
--- a/api_docs/kbn_core_http_browser_mocks.mdx
+++ b/api_docs/kbn_core_http_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-browser-mocks
 title: "@kbn/core-http-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-browser-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-browser-mocks']
 ---
 import kbnCoreHttpBrowserMocksObj from './kbn_core_http_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_http_common.mdx b/api_docs/kbn_core_http_common.mdx
index 4e41084d85ed68..6e01c889ac7f82 100644
--- a/api_docs/kbn_core_http_common.mdx
+++ b/api_docs/kbn_core_http_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-common
 title: "@kbn/core-http-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-common plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-common']
 ---
 import kbnCoreHttpCommonObj from './kbn_core_http_common.devdocs.json';
diff --git a/api_docs/kbn_core_http_context_server_mocks.mdx b/api_docs/kbn_core_http_context_server_mocks.mdx
index 29bb658986a051..b6ae6bc5ac8b66 100644
--- a/api_docs/kbn_core_http_context_server_mocks.mdx
+++ b/api_docs/kbn_core_http_context_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-context-server-mocks
 title: "@kbn/core-http-context-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-context-server-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-context-server-mocks']
 ---
 import kbnCoreHttpContextServerMocksObj from './kbn_core_http_context_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_http_request_handler_context_server.mdx b/api_docs/kbn_core_http_request_handler_context_server.mdx
index 93c9bc6a42370d..f1a2950e646576 100644
--- a/api_docs/kbn_core_http_request_handler_context_server.mdx
+++ b/api_docs/kbn_core_http_request_handler_context_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-request-handler-context-server
 title: "@kbn/core-http-request-handler-context-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-request-handler-context-server plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-request-handler-context-server']
 ---
 import kbnCoreHttpRequestHandlerContextServerObj from './kbn_core_http_request_handler_context_server.devdocs.json';
diff --git a/api_docs/kbn_core_http_resources_server.mdx b/api_docs/kbn_core_http_resources_server.mdx
index 69b07132e6dc08..b3e3d9f739b12b 100644
--- a/api_docs/kbn_core_http_resources_server.mdx
+++ b/api_docs/kbn_core_http_resources_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-resources-server
 title: "@kbn/core-http-resources-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-resources-server plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-resources-server']
 ---
 import kbnCoreHttpResourcesServerObj from './kbn_core_http_resources_server.devdocs.json';
diff --git a/api_docs/kbn_core_http_resources_server_internal.mdx b/api_docs/kbn_core_http_resources_server_internal.mdx
index bd07407dc8e2bf..3c69dcf2a23b6f 100644
--- a/api_docs/kbn_core_http_resources_server_internal.mdx
+++ b/api_docs/kbn_core_http_resources_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-resources-server-internal
 title: "@kbn/core-http-resources-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-resources-server-internal plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-resources-server-internal']
 ---
 import kbnCoreHttpResourcesServerInternalObj from './kbn_core_http_resources_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_http_resources_server_mocks.mdx b/api_docs/kbn_core_http_resources_server_mocks.mdx
index 69be18716ddbe7..8b29300949f80b 100644
--- a/api_docs/kbn_core_http_resources_server_mocks.mdx
+++ b/api_docs/kbn_core_http_resources_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-resources-server-mocks
 title: "@kbn/core-http-resources-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-resources-server-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-resources-server-mocks']
 ---
 import kbnCoreHttpResourcesServerMocksObj from './kbn_core_http_resources_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_http_router_server_internal.mdx b/api_docs/kbn_core_http_router_server_internal.mdx
index df114b2c609ac9..393eabf9a1c1ce 100644
--- a/api_docs/kbn_core_http_router_server_internal.mdx
+++ b/api_docs/kbn_core_http_router_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-router-server-internal
 title: "@kbn/core-http-router-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-router-server-internal plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-router-server-internal']
 ---
 import kbnCoreHttpRouterServerInternalObj from './kbn_core_http_router_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_http_router_server_mocks.mdx b/api_docs/kbn_core_http_router_server_mocks.mdx
index e04a26dc799abe..375e8091ada97a 100644
--- a/api_docs/kbn_core_http_router_server_mocks.mdx
+++ b/api_docs/kbn_core_http_router_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-router-server-mocks
 title: "@kbn/core-http-router-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-router-server-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-router-server-mocks']
 ---
 import kbnCoreHttpRouterServerMocksObj from './kbn_core_http_router_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_http_server.devdocs.json b/api_docs/kbn_core_http_server.devdocs.json
index 74a728d7294c4d..3e7bc1a1aed149 100644
--- a/api_docs/kbn_core_http_server.devdocs.json
+++ b/api_docs/kbn_core_http_server.devdocs.json
@@ -12522,7 +12522,7 @@
             "tags": [],
             "label": "description",
             "description": [
-              "Human-friendly description of this endpoint"
+              "A short, human-friendly description of this endpoint"
             ],
             "signature": [
               "string | undefined"
@@ -15369,10 +15369,6 @@
                 "plugin": "ml",
                 "path": "x-pack/plugins/ml/server/routes/fields_service.ts"
               },
-              {
-                "plugin": "ml",
-                "path": "x-pack/plugins/ml/server/routes/indices.ts"
-              },
               {
                 "plugin": "ml",
                 "path": "x-pack/plugins/ml/server/routes/anomaly_detectors.ts"
diff --git a/api_docs/kbn_core_http_server.mdx b/api_docs/kbn_core_http_server.mdx
index 1c275ae6b771d4..91ea3849a2247b 100644
--- a/api_docs/kbn_core_http_server.mdx
+++ b/api_docs/kbn_core_http_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-server
 title: "@kbn/core-http-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-server plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-server']
 ---
 import kbnCoreHttpServerObj from './kbn_core_http_server.devdocs.json';
diff --git a/api_docs/kbn_core_http_server_internal.mdx b/api_docs/kbn_core_http_server_internal.mdx
index f380f09c68fdc2..e52acedc9adb85 100644
--- a/api_docs/kbn_core_http_server_internal.mdx
+++ b/api_docs/kbn_core_http_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-server-internal
 title: "@kbn/core-http-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-server-internal plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-server-internal']
 ---
 import kbnCoreHttpServerInternalObj from './kbn_core_http_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_http_server_mocks.mdx b/api_docs/kbn_core_http_server_mocks.mdx
index c4cac44b957876..bc9976dc7040ad 100644
--- a/api_docs/kbn_core_http_server_mocks.mdx
+++ b/api_docs/kbn_core_http_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-server-mocks
 title: "@kbn/core-http-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-server-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-server-mocks']
 ---
 import kbnCoreHttpServerMocksObj from './kbn_core_http_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_i18n_browser.mdx b/api_docs/kbn_core_i18n_browser.mdx
index a5df4593cee146..7dfb69c3dce87a 100644
--- a/api_docs/kbn_core_i18n_browser.mdx
+++ b/api_docs/kbn_core_i18n_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-i18n-browser
 title: "@kbn/core-i18n-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-i18n-browser plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-i18n-browser']
 ---
 import kbnCoreI18nBrowserObj from './kbn_core_i18n_browser.devdocs.json';
diff --git a/api_docs/kbn_core_i18n_browser_mocks.mdx b/api_docs/kbn_core_i18n_browser_mocks.mdx
index 7957b22820633b..9cac837fb652fd 100644
--- a/api_docs/kbn_core_i18n_browser_mocks.mdx
+++ b/api_docs/kbn_core_i18n_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-i18n-browser-mocks
 title: "@kbn/core-i18n-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-i18n-browser-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-i18n-browser-mocks']
 ---
 import kbnCoreI18nBrowserMocksObj from './kbn_core_i18n_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_i18n_server.mdx b/api_docs/kbn_core_i18n_server.mdx
index 3a952ee57a1315..bd9ca7e8057756 100644
--- a/api_docs/kbn_core_i18n_server.mdx
+++ b/api_docs/kbn_core_i18n_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-i18n-server
 title: "@kbn/core-i18n-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-i18n-server plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-i18n-server']
 ---
 import kbnCoreI18nServerObj from './kbn_core_i18n_server.devdocs.json';
diff --git a/api_docs/kbn_core_i18n_server_internal.mdx b/api_docs/kbn_core_i18n_server_internal.mdx
index e32580693f4cc2..e16a914cfacbff 100644
--- a/api_docs/kbn_core_i18n_server_internal.mdx
+++ b/api_docs/kbn_core_i18n_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-i18n-server-internal
 title: "@kbn/core-i18n-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-i18n-server-internal plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-i18n-server-internal']
 ---
 import kbnCoreI18nServerInternalObj from './kbn_core_i18n_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_i18n_server_mocks.mdx b/api_docs/kbn_core_i18n_server_mocks.mdx
index 71eff66fb00057..1252494980935f 100644
--- a/api_docs/kbn_core_i18n_server_mocks.mdx
+++ b/api_docs/kbn_core_i18n_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-i18n-server-mocks
 title: "@kbn/core-i18n-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-i18n-server-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-i18n-server-mocks']
 ---
 import kbnCoreI18nServerMocksObj from './kbn_core_i18n_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_injected_metadata_browser_mocks.mdx b/api_docs/kbn_core_injected_metadata_browser_mocks.mdx
index 0bcd9ec519e7a0..3d236f38917c93 100644
--- a/api_docs/kbn_core_injected_metadata_browser_mocks.mdx
+++ b/api_docs/kbn_core_injected_metadata_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-injected-metadata-browser-mocks
 title: "@kbn/core-injected-metadata-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-injected-metadata-browser-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-injected-metadata-browser-mocks']
 ---
 import kbnCoreInjectedMetadataBrowserMocksObj from './kbn_core_injected_metadata_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_integrations_browser_internal.mdx b/api_docs/kbn_core_integrations_browser_internal.mdx
index 158bff429478ac..723432a5071d6d 100644
--- a/api_docs/kbn_core_integrations_browser_internal.mdx
+++ b/api_docs/kbn_core_integrations_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-integrations-browser-internal
 title: "@kbn/core-integrations-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-integrations-browser-internal plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-integrations-browser-internal']
 ---
 import kbnCoreIntegrationsBrowserInternalObj from './kbn_core_integrations_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_integrations_browser_mocks.mdx b/api_docs/kbn_core_integrations_browser_mocks.mdx
index 7d241333f1f9e8..8b65a0d3aef0d7 100644
--- a/api_docs/kbn_core_integrations_browser_mocks.mdx
+++ b/api_docs/kbn_core_integrations_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-integrations-browser-mocks
 title: "@kbn/core-integrations-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-integrations-browser-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-integrations-browser-mocks']
 ---
 import kbnCoreIntegrationsBrowserMocksObj from './kbn_core_integrations_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_lifecycle_browser.mdx b/api_docs/kbn_core_lifecycle_browser.mdx
index 7071be09ff3895..8bee03b7f87308 100644
--- a/api_docs/kbn_core_lifecycle_browser.mdx
+++ b/api_docs/kbn_core_lifecycle_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-lifecycle-browser
 title: "@kbn/core-lifecycle-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-lifecycle-browser plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-lifecycle-browser']
 ---
 import kbnCoreLifecycleBrowserObj from './kbn_core_lifecycle_browser.devdocs.json';
diff --git a/api_docs/kbn_core_lifecycle_browser_mocks.mdx b/api_docs/kbn_core_lifecycle_browser_mocks.mdx
index bba0ed1f8b13bc..0af64f88bb4e30 100644
--- a/api_docs/kbn_core_lifecycle_browser_mocks.mdx
+++ b/api_docs/kbn_core_lifecycle_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-lifecycle-browser-mocks
 title: "@kbn/core-lifecycle-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-lifecycle-browser-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-lifecycle-browser-mocks']
 ---
 import kbnCoreLifecycleBrowserMocksObj from './kbn_core_lifecycle_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_lifecycle_server.mdx b/api_docs/kbn_core_lifecycle_server.mdx
index 5c666b9423a1d2..5fa8a538ea7573 100644
--- a/api_docs/kbn_core_lifecycle_server.mdx
+++ b/api_docs/kbn_core_lifecycle_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-lifecycle-server
 title: "@kbn/core-lifecycle-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-lifecycle-server plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-lifecycle-server']
 ---
 import kbnCoreLifecycleServerObj from './kbn_core_lifecycle_server.devdocs.json';
diff --git a/api_docs/kbn_core_lifecycle_server_mocks.mdx b/api_docs/kbn_core_lifecycle_server_mocks.mdx
index c00f3b8c6c0b19..85d2a3238eead1 100644
--- a/api_docs/kbn_core_lifecycle_server_mocks.mdx
+++ b/api_docs/kbn_core_lifecycle_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-lifecycle-server-mocks
 title: "@kbn/core-lifecycle-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-lifecycle-server-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-lifecycle-server-mocks']
 ---
 import kbnCoreLifecycleServerMocksObj from './kbn_core_lifecycle_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_logging_browser_mocks.mdx b/api_docs/kbn_core_logging_browser_mocks.mdx
index fa8e3a132ddea7..5e99372fc79e92 100644
--- a/api_docs/kbn_core_logging_browser_mocks.mdx
+++ b/api_docs/kbn_core_logging_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-logging-browser-mocks
 title: "@kbn/core-logging-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-logging-browser-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-logging-browser-mocks']
 ---
 import kbnCoreLoggingBrowserMocksObj from './kbn_core_logging_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_logging_common_internal.mdx b/api_docs/kbn_core_logging_common_internal.mdx
index cb4880a69e9e09..1d500b377d4931 100644
--- a/api_docs/kbn_core_logging_common_internal.mdx
+++ b/api_docs/kbn_core_logging_common_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-logging-common-internal
 title: "@kbn/core-logging-common-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-logging-common-internal plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-logging-common-internal']
 ---
 import kbnCoreLoggingCommonInternalObj from './kbn_core_logging_common_internal.devdocs.json';
diff --git a/api_docs/kbn_core_logging_server.devdocs.json b/api_docs/kbn_core_logging_server.devdocs.json
index 1fa70ad1480c0a..d65947d07dd665 100644
--- a/api_docs/kbn_core_logging_server.devdocs.json
+++ b/api_docs/kbn_core_logging_server.devdocs.json
@@ -516,14 +516,46 @@
             "parentPluginId": "@kbn/core-logging-server",
             "id": "def-common.NumericRollingStrategyConfig.max",
             "type": "number",
-            "tags": [],
+            "tags": [
+              "deprecated"
+            ],
             "label": "max",
             "description": [
-              "\nThe maximum number of files to keep. Once this number is reached, oldest\nfiles will be deleted. Defaults to `7`"
+              "\nThe maximum number of files to keep. Once this number is reached, oldest\nfiles will be deleted. Defaults to `7`\n"
             ],
             "path": "packages/core/logging/core-logging-server/src/appenders/rolling_file.ts",
-            "deprecated": false,
-            "trackAdoption": false
+            "deprecated": true,
+            "trackAdoption": false,
+            "references": [
+              {
+                "plugin": "@kbn/core-logging-server-internal",
+                "path": "packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/strategies/index.ts"
+              },
+              {
+                "plugin": "@kbn/core-logging-server-internal",
+                "path": "packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/retention/create_retention_policy.ts"
+              },
+              {
+                "plugin": "security",
+                "path": "x-pack/plugins/security/server/config.ts"
+              },
+              {
+                "plugin": "@kbn/core-logging-server-internal",
+                "path": "packages/core/logging/core-logging-server-internal/src/appenders/appenders.test.ts"
+              },
+              {
+                "plugin": "@kbn/core-logging-server-internal",
+                "path": "packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/rolling_file_appender.test.ts"
+              },
+              {
+                "plugin": "@kbn/core-logging-server-internal",
+                "path": "packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/retention/create_retention_policy.test.ts"
+              },
+              {
+                "plugin": "@kbn/core-logging-server-internal",
+                "path": "packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/strategies/numeric/numeric_strategy.test.ts"
+              }
+            ]
           }
         ],
         "initialIsOpen": false
@@ -586,6 +618,69 @@
         ],
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "@kbn/core-logging-server",
+        "id": "def-common.RetentionPolicyConfig",
+        "type": "Interface",
+        "tags": [],
+        "label": "RetentionPolicyConfig",
+        "description": [],
+        "path": "packages/core/logging/core-logging-server/src/appenders/rolling_file.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/core-logging-server",
+            "id": "def-common.RetentionPolicyConfig.maxFiles",
+            "type": "number",
+            "tags": [],
+            "label": "maxFiles",
+            "description": [],
+            "signature": [
+              "number | undefined"
+            ],
+            "path": "packages/core/logging/core-logging-server/src/appenders/rolling_file.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/core-logging-server",
+            "id": "def-common.RetentionPolicyConfig.maxAccumulatedFileSize",
+            "type": "Object",
+            "tags": [],
+            "label": "maxAccumulatedFileSize",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/config-schema",
+                "scope": "common",
+                "docId": "kibKbnConfigSchemaPluginApi",
+                "section": "def-common.ByteSizeValue",
+                "text": "ByteSizeValue"
+              },
+              " | undefined"
+            ],
+            "path": "packages/core/logging/core-logging-server/src/appenders/rolling_file.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/core-logging-server",
+            "id": "def-common.RetentionPolicyConfig.removeOlderThan",
+            "type": "Object",
+            "tags": [],
+            "label": "removeOlderThan",
+            "description": [],
+            "signature": [
+              "moment.Duration | undefined"
+            ],
+            "path": "packages/core/logging/core-logging-server/src/appenders/rolling_file.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "@kbn/core-logging-server",
         "id": "def-common.RewriteAppenderConfig",
@@ -775,6 +870,29 @@
             "path": "packages/core/logging/core-logging-server/src/appenders/rolling_file.ts",
             "deprecated": false,
             "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/core-logging-server",
+            "id": "def-common.RollingFileAppenderConfig.retention",
+            "type": "Object",
+            "tags": [],
+            "label": "retention",
+            "description": [
+              "\nThe {@link RetentionPolicy | retention strategy} to use to know which files to keep."
+            ],
+            "signature": [
+              {
+                "pluginId": "@kbn/core-logging-server",
+                "scope": "common",
+                "docId": "kibKbnCoreLoggingServerPluginApi",
+                "section": "def-common.RetentionPolicyConfig",
+                "text": "RetentionPolicyConfig"
+              },
+              " | undefined"
+            ],
+            "path": "packages/core/logging/core-logging-server/src/appenders/rolling_file.ts",
+            "deprecated": false,
+            "trackAdoption": false
           }
         ],
         "initialIsOpen": false
diff --git a/api_docs/kbn_core_logging_server.mdx b/api_docs/kbn_core_logging_server.mdx
index 8b98467aefa5df..5c5666c13e0f72 100644
--- a/api_docs/kbn_core_logging_server.mdx
+++ b/api_docs/kbn_core_logging_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-logging-server
 title: "@kbn/core-logging-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-logging-server plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-logging-server']
 ---
 import kbnCoreLoggingServerObj from './kbn_core_logging_server.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/kibana-core](https://github.com/orgs/elastic/teams/kibana-core
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 56 | 0 | 30 | 0 |
+| 61 | 0 | 34 | 0 |
 
 ## Common
 
diff --git a/api_docs/kbn_core_logging_server_internal.devdocs.json b/api_docs/kbn_core_logging_server_internal.devdocs.json
index a0af84675aefe4..e0f23e8668c976 100644
--- a/api_docs/kbn_core_logging_server_internal.devdocs.json
+++ b/api_docs/kbn_core_logging_server_internal.devdocs.json
@@ -135,7 +135,15 @@
             "section": "def-common.Type",
             "text": "Type"
           },
-          "<Readonly<{} & { type: \"console\"; layout: Readonly<{} & { type: \"json\"; }> | Readonly<{ pattern?: string | undefined; highlight?: boolean | undefined; } & { type: \"pattern\"; }>; }> | Readonly<{} & { type: \"file\"; layout: Readonly<{} & { type: \"json\"; }> | Readonly<{ pattern?: string | undefined; highlight?: boolean | undefined; } & { type: \"pattern\"; }>; fileName: string; }> | Readonly<{} & { type: \"rewrite\"; policy: Readonly<{} & { type: \"meta\"; mode: \"update\" | \"remove\"; properties: Readonly<{ value?: string | number | boolean | null | undefined; } & { path: string; }>[]; }>; appenders: string[]; }> | Readonly<{} & { type: \"rolling-file\"; policy: Readonly<{} & { type: \"size-limit\"; size: ",
+          "<Readonly<{} & { type: \"console\"; layout: Readonly<{} & { type: \"json\"; }> | Readonly<{ pattern?: string | undefined; highlight?: boolean | undefined; } & { type: \"pattern\"; }>; }> | Readonly<{} & { type: \"file\"; layout: Readonly<{} & { type: \"json\"; }> | Readonly<{ pattern?: string | undefined; highlight?: boolean | undefined; } & { type: \"pattern\"; }>; fileName: string; }> | Readonly<{} & { type: \"rewrite\"; policy: Readonly<{} & { type: \"meta\"; mode: \"update\" | \"remove\"; properties: Readonly<{ value?: string | number | boolean | null | undefined; } & { path: string; }>[]; }>; appenders: string[]; }> | Readonly<{ retention?: Readonly<{ maxFiles?: number | undefined; maxAccumulatedFileSize?: ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.ByteSizeValue",
+            "text": "ByteSizeValue"
+          },
+          " | undefined; removeOlderThan?: moment.Duration | undefined; } & {}> | undefined; } & { type: \"rolling-file\"; policy: Readonly<{} & { type: \"size-limit\"; size: ",
           {
             "pluginId": "@kbn/config-schema",
             "scope": "common",
diff --git a/api_docs/kbn_core_logging_server_internal.mdx b/api_docs/kbn_core_logging_server_internal.mdx
index 89813442350670..2d2e1a9b28feb4 100644
--- a/api_docs/kbn_core_logging_server_internal.mdx
+++ b/api_docs/kbn_core_logging_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-logging-server-internal
 title: "@kbn/core-logging-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-logging-server-internal plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-logging-server-internal']
 ---
 import kbnCoreLoggingServerInternalObj from './kbn_core_logging_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_logging_server_mocks.mdx b/api_docs/kbn_core_logging_server_mocks.mdx
index af6eac80fe0d52..0e4b53f9a35153 100644
--- a/api_docs/kbn_core_logging_server_mocks.mdx
+++ b/api_docs/kbn_core_logging_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-logging-server-mocks
 title: "@kbn/core-logging-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-logging-server-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-logging-server-mocks']
 ---
 import kbnCoreLoggingServerMocksObj from './kbn_core_logging_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_metrics_collectors_server_internal.mdx b/api_docs/kbn_core_metrics_collectors_server_internal.mdx
index 36718d3225443a..ff30d636d15bd8 100644
--- a/api_docs/kbn_core_metrics_collectors_server_internal.mdx
+++ b/api_docs/kbn_core_metrics_collectors_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-metrics-collectors-server-internal
 title: "@kbn/core-metrics-collectors-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-metrics-collectors-server-internal plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-metrics-collectors-server-internal']
 ---
 import kbnCoreMetricsCollectorsServerInternalObj from './kbn_core_metrics_collectors_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_metrics_collectors_server_mocks.mdx b/api_docs/kbn_core_metrics_collectors_server_mocks.mdx
index 563da30ebeaf2b..70c99ff192398d 100644
--- a/api_docs/kbn_core_metrics_collectors_server_mocks.mdx
+++ b/api_docs/kbn_core_metrics_collectors_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-metrics-collectors-server-mocks
 title: "@kbn/core-metrics-collectors-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-metrics-collectors-server-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-metrics-collectors-server-mocks']
 ---
 import kbnCoreMetricsCollectorsServerMocksObj from './kbn_core_metrics_collectors_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_metrics_server.mdx b/api_docs/kbn_core_metrics_server.mdx
index ff6e128bba5762..6eae7e4a06f435 100644
--- a/api_docs/kbn_core_metrics_server.mdx
+++ b/api_docs/kbn_core_metrics_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-metrics-server
 title: "@kbn/core-metrics-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-metrics-server plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-metrics-server']
 ---
 import kbnCoreMetricsServerObj from './kbn_core_metrics_server.devdocs.json';
diff --git a/api_docs/kbn_core_metrics_server_internal.mdx b/api_docs/kbn_core_metrics_server_internal.mdx
index d6996a660acbcb..488c0a69841b1f 100644
--- a/api_docs/kbn_core_metrics_server_internal.mdx
+++ b/api_docs/kbn_core_metrics_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-metrics-server-internal
 title: "@kbn/core-metrics-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-metrics-server-internal plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-metrics-server-internal']
 ---
 import kbnCoreMetricsServerInternalObj from './kbn_core_metrics_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_metrics_server_mocks.mdx b/api_docs/kbn_core_metrics_server_mocks.mdx
index 72f7f1e2cdf892..dd26f88aebd5e8 100644
--- a/api_docs/kbn_core_metrics_server_mocks.mdx
+++ b/api_docs/kbn_core_metrics_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-metrics-server-mocks
 title: "@kbn/core-metrics-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-metrics-server-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-metrics-server-mocks']
 ---
 import kbnCoreMetricsServerMocksObj from './kbn_core_metrics_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_mount_utils_browser.mdx b/api_docs/kbn_core_mount_utils_browser.mdx
index 418eeae8874dd3..ba15935ff6ea8b 100644
--- a/api_docs/kbn_core_mount_utils_browser.mdx
+++ b/api_docs/kbn_core_mount_utils_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-mount-utils-browser
 title: "@kbn/core-mount-utils-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-mount-utils-browser plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-mount-utils-browser']
 ---
 import kbnCoreMountUtilsBrowserObj from './kbn_core_mount_utils_browser.devdocs.json';
diff --git a/api_docs/kbn_core_node_server.mdx b/api_docs/kbn_core_node_server.mdx
index 2d997930f420ca..95113ba26f3b5d 100644
--- a/api_docs/kbn_core_node_server.mdx
+++ b/api_docs/kbn_core_node_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-node-server
 title: "@kbn/core-node-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-node-server plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-node-server']
 ---
 import kbnCoreNodeServerObj from './kbn_core_node_server.devdocs.json';
diff --git a/api_docs/kbn_core_node_server_internal.mdx b/api_docs/kbn_core_node_server_internal.mdx
index 57428615957b8a..35545a459cb086 100644
--- a/api_docs/kbn_core_node_server_internal.mdx
+++ b/api_docs/kbn_core_node_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-node-server-internal
 title: "@kbn/core-node-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-node-server-internal plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-node-server-internal']
 ---
 import kbnCoreNodeServerInternalObj from './kbn_core_node_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_node_server_mocks.mdx b/api_docs/kbn_core_node_server_mocks.mdx
index 58dbbd12d718ad..233d97da2d5faa 100644
--- a/api_docs/kbn_core_node_server_mocks.mdx
+++ b/api_docs/kbn_core_node_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-node-server-mocks
 title: "@kbn/core-node-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-node-server-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-node-server-mocks']
 ---
 import kbnCoreNodeServerMocksObj from './kbn_core_node_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_notifications_browser.mdx b/api_docs/kbn_core_notifications_browser.mdx
index 25fce8c4f38fd1..b237842bf418a9 100644
--- a/api_docs/kbn_core_notifications_browser.mdx
+++ b/api_docs/kbn_core_notifications_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-notifications-browser
 title: "@kbn/core-notifications-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-notifications-browser plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-notifications-browser']
 ---
 import kbnCoreNotificationsBrowserObj from './kbn_core_notifications_browser.devdocs.json';
diff --git a/api_docs/kbn_core_notifications_browser_internal.mdx b/api_docs/kbn_core_notifications_browser_internal.mdx
index 0f4d5e46a350d0..756c3e25793d22 100644
--- a/api_docs/kbn_core_notifications_browser_internal.mdx
+++ b/api_docs/kbn_core_notifications_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-notifications-browser-internal
 title: "@kbn/core-notifications-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-notifications-browser-internal plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-notifications-browser-internal']
 ---
 import kbnCoreNotificationsBrowserInternalObj from './kbn_core_notifications_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_notifications_browser_mocks.mdx b/api_docs/kbn_core_notifications_browser_mocks.mdx
index 45600dbea31656..1cd16ae7678147 100644
--- a/api_docs/kbn_core_notifications_browser_mocks.mdx
+++ b/api_docs/kbn_core_notifications_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-notifications-browser-mocks
 title: "@kbn/core-notifications-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-notifications-browser-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-notifications-browser-mocks']
 ---
 import kbnCoreNotificationsBrowserMocksObj from './kbn_core_notifications_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_overlays_browser.mdx b/api_docs/kbn_core_overlays_browser.mdx
index 9ad43cd51fb31b..dd7c0cc638bd30 100644
--- a/api_docs/kbn_core_overlays_browser.mdx
+++ b/api_docs/kbn_core_overlays_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-overlays-browser
 title: "@kbn/core-overlays-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-overlays-browser plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-overlays-browser']
 ---
 import kbnCoreOverlaysBrowserObj from './kbn_core_overlays_browser.devdocs.json';
diff --git a/api_docs/kbn_core_overlays_browser_internal.mdx b/api_docs/kbn_core_overlays_browser_internal.mdx
index 54e69cb4b30532..fcfc34edb6a129 100644
--- a/api_docs/kbn_core_overlays_browser_internal.mdx
+++ b/api_docs/kbn_core_overlays_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-overlays-browser-internal
 title: "@kbn/core-overlays-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-overlays-browser-internal plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-overlays-browser-internal']
 ---
 import kbnCoreOverlaysBrowserInternalObj from './kbn_core_overlays_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_overlays_browser_mocks.mdx b/api_docs/kbn_core_overlays_browser_mocks.mdx
index e85af2c1abefde..fc5c30ca1d21a4 100644
--- a/api_docs/kbn_core_overlays_browser_mocks.mdx
+++ b/api_docs/kbn_core_overlays_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-overlays-browser-mocks
 title: "@kbn/core-overlays-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-overlays-browser-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-overlays-browser-mocks']
 ---
 import kbnCoreOverlaysBrowserMocksObj from './kbn_core_overlays_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_plugins_browser.mdx b/api_docs/kbn_core_plugins_browser.mdx
index 7f6204408a0a95..09c0683245f11e 100644
--- a/api_docs/kbn_core_plugins_browser.mdx
+++ b/api_docs/kbn_core_plugins_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-plugins-browser
 title: "@kbn/core-plugins-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-plugins-browser plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-plugins-browser']
 ---
 import kbnCorePluginsBrowserObj from './kbn_core_plugins_browser.devdocs.json';
diff --git a/api_docs/kbn_core_plugins_browser_mocks.mdx b/api_docs/kbn_core_plugins_browser_mocks.mdx
index ade37cc3113e1e..39ccac8cf6d3e8 100644
--- a/api_docs/kbn_core_plugins_browser_mocks.mdx
+++ b/api_docs/kbn_core_plugins_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-plugins-browser-mocks
 title: "@kbn/core-plugins-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-plugins-browser-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-plugins-browser-mocks']
 ---
 import kbnCorePluginsBrowserMocksObj from './kbn_core_plugins_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_plugins_contracts_browser.mdx b/api_docs/kbn_core_plugins_contracts_browser.mdx
index dd36d5022e0589..e6662e846a796d 100644
--- a/api_docs/kbn_core_plugins_contracts_browser.mdx
+++ b/api_docs/kbn_core_plugins_contracts_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-plugins-contracts-browser
 title: "@kbn/core-plugins-contracts-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-plugins-contracts-browser plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-plugins-contracts-browser']
 ---
 import kbnCorePluginsContractsBrowserObj from './kbn_core_plugins_contracts_browser.devdocs.json';
diff --git a/api_docs/kbn_core_plugins_contracts_server.mdx b/api_docs/kbn_core_plugins_contracts_server.mdx
index 57ce91ae0e4d90..2c46d640776b11 100644
--- a/api_docs/kbn_core_plugins_contracts_server.mdx
+++ b/api_docs/kbn_core_plugins_contracts_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-plugins-contracts-server
 title: "@kbn/core-plugins-contracts-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-plugins-contracts-server plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-plugins-contracts-server']
 ---
 import kbnCorePluginsContractsServerObj from './kbn_core_plugins_contracts_server.devdocs.json';
diff --git a/api_docs/kbn_core_plugins_server.mdx b/api_docs/kbn_core_plugins_server.mdx
index 26c802e93d3120..c9013e1be3f84c 100644
--- a/api_docs/kbn_core_plugins_server.mdx
+++ b/api_docs/kbn_core_plugins_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-plugins-server
 title: "@kbn/core-plugins-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-plugins-server plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-plugins-server']
 ---
 import kbnCorePluginsServerObj from './kbn_core_plugins_server.devdocs.json';
diff --git a/api_docs/kbn_core_plugins_server_mocks.mdx b/api_docs/kbn_core_plugins_server_mocks.mdx
index 63256fcde9daf9..34fc33ea645d30 100644
--- a/api_docs/kbn_core_plugins_server_mocks.mdx
+++ b/api_docs/kbn_core_plugins_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-plugins-server-mocks
 title: "@kbn/core-plugins-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-plugins-server-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-plugins-server-mocks']
 ---
 import kbnCorePluginsServerMocksObj from './kbn_core_plugins_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_preboot_server.mdx b/api_docs/kbn_core_preboot_server.mdx
index 91e9ca68ce61d6..5f9a56656cae23 100644
--- a/api_docs/kbn_core_preboot_server.mdx
+++ b/api_docs/kbn_core_preboot_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-preboot-server
 title: "@kbn/core-preboot-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-preboot-server plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-preboot-server']
 ---
 import kbnCorePrebootServerObj from './kbn_core_preboot_server.devdocs.json';
diff --git a/api_docs/kbn_core_preboot_server_mocks.mdx b/api_docs/kbn_core_preboot_server_mocks.mdx
index 3f3e2c3d33de86..73f4742f6bf38b 100644
--- a/api_docs/kbn_core_preboot_server_mocks.mdx
+++ b/api_docs/kbn_core_preboot_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-preboot-server-mocks
 title: "@kbn/core-preboot-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-preboot-server-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-preboot-server-mocks']
 ---
 import kbnCorePrebootServerMocksObj from './kbn_core_preboot_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_rendering_browser_mocks.mdx b/api_docs/kbn_core_rendering_browser_mocks.mdx
index 12bf72a718b45b..24749a9dc849fe 100644
--- a/api_docs/kbn_core_rendering_browser_mocks.mdx
+++ b/api_docs/kbn_core_rendering_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-rendering-browser-mocks
 title: "@kbn/core-rendering-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-rendering-browser-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-rendering-browser-mocks']
 ---
 import kbnCoreRenderingBrowserMocksObj from './kbn_core_rendering_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_rendering_server_internal.mdx b/api_docs/kbn_core_rendering_server_internal.mdx
index 1be26734e441b2..5c2cc67d6e8c33 100644
--- a/api_docs/kbn_core_rendering_server_internal.mdx
+++ b/api_docs/kbn_core_rendering_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-rendering-server-internal
 title: "@kbn/core-rendering-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-rendering-server-internal plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-rendering-server-internal']
 ---
 import kbnCoreRenderingServerInternalObj from './kbn_core_rendering_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_rendering_server_mocks.mdx b/api_docs/kbn_core_rendering_server_mocks.mdx
index 47eb336e59c5fb..a3d0e350f98605 100644
--- a/api_docs/kbn_core_rendering_server_mocks.mdx
+++ b/api_docs/kbn_core_rendering_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-rendering-server-mocks
 title: "@kbn/core-rendering-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-rendering-server-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-rendering-server-mocks']
 ---
 import kbnCoreRenderingServerMocksObj from './kbn_core_rendering_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_root_server_internal.mdx b/api_docs/kbn_core_root_server_internal.mdx
index 60d21e5d11b1a8..18c6a9915ecf90 100644
--- a/api_docs/kbn_core_root_server_internal.mdx
+++ b/api_docs/kbn_core_root_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-root-server-internal
 title: "@kbn/core-root-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-root-server-internal plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-root-server-internal']
 ---
 import kbnCoreRootServerInternalObj from './kbn_core_root_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_api_browser.mdx b/api_docs/kbn_core_saved_objects_api_browser.mdx
index 8cfb5551e43193..abdff2a84141a9 100644
--- a/api_docs/kbn_core_saved_objects_api_browser.mdx
+++ b/api_docs/kbn_core_saved_objects_api_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-api-browser
 title: "@kbn/core-saved-objects-api-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-api-browser plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-api-browser']
 ---
 import kbnCoreSavedObjectsApiBrowserObj from './kbn_core_saved_objects_api_browser.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_api_server.mdx b/api_docs/kbn_core_saved_objects_api_server.mdx
index bff3e351aacf1e..2e7436cbbc1a84 100644
--- a/api_docs/kbn_core_saved_objects_api_server.mdx
+++ b/api_docs/kbn_core_saved_objects_api_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-api-server
 title: "@kbn/core-saved-objects-api-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-api-server plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-api-server']
 ---
 import kbnCoreSavedObjectsApiServerObj from './kbn_core_saved_objects_api_server.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_api_server_mocks.mdx b/api_docs/kbn_core_saved_objects_api_server_mocks.mdx
index 5b6252a72eb7b8..234a2cbf4fa916 100644
--- a/api_docs/kbn_core_saved_objects_api_server_mocks.mdx
+++ b/api_docs/kbn_core_saved_objects_api_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-api-server-mocks
 title: "@kbn/core-saved-objects-api-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-api-server-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-api-server-mocks']
 ---
 import kbnCoreSavedObjectsApiServerMocksObj from './kbn_core_saved_objects_api_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_base_server_internal.devdocs.json b/api_docs/kbn_core_saved_objects_base_server_internal.devdocs.json
index fccc149d2afbe0..0aa3e7ceaa6a2f 100644
--- a/api_docs/kbn_core_saved_objects_base_server_internal.devdocs.json
+++ b/api_docs/kbn_core_saved_objects_base_server_internal.devdocs.json
@@ -2878,10 +2878,10 @@
           },
           {
             "parentPluginId": "@kbn/core-saved-objects-base-server-internal",
-            "id": "def-common.HASH_TO_VERSION_MAP.ingestagentpolicies0fd93cd11c019b118e93a9157c22057b",
+            "id": "def-common.HASH_TO_VERSION_MAP.ingestagentpolicies0ab9774bc7728d0c0f37d841570f2872",
             "type": "string",
             "tags": [],
-            "label": "'ingest-agent-policies|0fd93cd11c019b118e93a9157c22057b'",
+            "label": "'ingest-agent-policies|0ab9774bc7728d0c0f37d841570f2872'",
             "description": [],
             "path": "packages/core/saved-objects/core-saved-objects-base-server-internal/src/constants.ts",
             "deprecated": false,
diff --git a/api_docs/kbn_core_saved_objects_base_server_internal.mdx b/api_docs/kbn_core_saved_objects_base_server_internal.mdx
index 6e9dfefc016a9b..11c20ee300eb5d 100644
--- a/api_docs/kbn_core_saved_objects_base_server_internal.mdx
+++ b/api_docs/kbn_core_saved_objects_base_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-base-server-internal
 title: "@kbn/core-saved-objects-base-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-base-server-internal plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-base-server-internal']
 ---
 import kbnCoreSavedObjectsBaseServerInternalObj from './kbn_core_saved_objects_base_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_base_server_mocks.mdx b/api_docs/kbn_core_saved_objects_base_server_mocks.mdx
index 46153a7c92c505..691e3b9ffbd1bb 100644
--- a/api_docs/kbn_core_saved_objects_base_server_mocks.mdx
+++ b/api_docs/kbn_core_saved_objects_base_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-base-server-mocks
 title: "@kbn/core-saved-objects-base-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-base-server-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-base-server-mocks']
 ---
 import kbnCoreSavedObjectsBaseServerMocksObj from './kbn_core_saved_objects_base_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_browser.mdx b/api_docs/kbn_core_saved_objects_browser.mdx
index ed96521a7a0fdc..bfeaac141be3dc 100644
--- a/api_docs/kbn_core_saved_objects_browser.mdx
+++ b/api_docs/kbn_core_saved_objects_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-browser
 title: "@kbn/core-saved-objects-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-browser plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-browser']
 ---
 import kbnCoreSavedObjectsBrowserObj from './kbn_core_saved_objects_browser.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_browser_internal.mdx b/api_docs/kbn_core_saved_objects_browser_internal.mdx
index f497c99ebd54d6..c8bb17d5de5ac0 100644
--- a/api_docs/kbn_core_saved_objects_browser_internal.mdx
+++ b/api_docs/kbn_core_saved_objects_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-browser-internal
 title: "@kbn/core-saved-objects-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-browser-internal plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-browser-internal']
 ---
 import kbnCoreSavedObjectsBrowserInternalObj from './kbn_core_saved_objects_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_browser_mocks.mdx b/api_docs/kbn_core_saved_objects_browser_mocks.mdx
index 45446d76e681af..7d56fced62c99c 100644
--- a/api_docs/kbn_core_saved_objects_browser_mocks.mdx
+++ b/api_docs/kbn_core_saved_objects_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-browser-mocks
 title: "@kbn/core-saved-objects-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-browser-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-browser-mocks']
 ---
 import kbnCoreSavedObjectsBrowserMocksObj from './kbn_core_saved_objects_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_common.mdx b/api_docs/kbn_core_saved_objects_common.mdx
index 658758ec98cd88..b7621d09e89097 100644
--- a/api_docs/kbn_core_saved_objects_common.mdx
+++ b/api_docs/kbn_core_saved_objects_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-common
 title: "@kbn/core-saved-objects-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-common plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-common']
 ---
 import kbnCoreSavedObjectsCommonObj from './kbn_core_saved_objects_common.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_import_export_server_internal.mdx b/api_docs/kbn_core_saved_objects_import_export_server_internal.mdx
index a3107684dd170b..78cc4fdcd35416 100644
--- a/api_docs/kbn_core_saved_objects_import_export_server_internal.mdx
+++ b/api_docs/kbn_core_saved_objects_import_export_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-import-export-server-internal
 title: "@kbn/core-saved-objects-import-export-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-import-export-server-internal plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-import-export-server-internal']
 ---
 import kbnCoreSavedObjectsImportExportServerInternalObj from './kbn_core_saved_objects_import_export_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_import_export_server_mocks.mdx b/api_docs/kbn_core_saved_objects_import_export_server_mocks.mdx
index 5ae2533ce628c7..3311c212f2b6ab 100644
--- a/api_docs/kbn_core_saved_objects_import_export_server_mocks.mdx
+++ b/api_docs/kbn_core_saved_objects_import_export_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-import-export-server-mocks
 title: "@kbn/core-saved-objects-import-export-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-import-export-server-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-import-export-server-mocks']
 ---
 import kbnCoreSavedObjectsImportExportServerMocksObj from './kbn_core_saved_objects_import_export_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_migration_server_internal.mdx b/api_docs/kbn_core_saved_objects_migration_server_internal.mdx
index bd4c3e6c84740b..1e8176965549ed 100644
--- a/api_docs/kbn_core_saved_objects_migration_server_internal.mdx
+++ b/api_docs/kbn_core_saved_objects_migration_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-migration-server-internal
 title: "@kbn/core-saved-objects-migration-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-migration-server-internal plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-migration-server-internal']
 ---
 import kbnCoreSavedObjectsMigrationServerInternalObj from './kbn_core_saved_objects_migration_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_migration_server_mocks.mdx b/api_docs/kbn_core_saved_objects_migration_server_mocks.mdx
index a07cf1a5c663b0..f84d235049fd63 100644
--- a/api_docs/kbn_core_saved_objects_migration_server_mocks.mdx
+++ b/api_docs/kbn_core_saved_objects_migration_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-migration-server-mocks
 title: "@kbn/core-saved-objects-migration-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-migration-server-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-migration-server-mocks']
 ---
 import kbnCoreSavedObjectsMigrationServerMocksObj from './kbn_core_saved_objects_migration_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_server.mdx b/api_docs/kbn_core_saved_objects_server.mdx
index 775198e8d9e16e..9c604f43a5da89 100644
--- a/api_docs/kbn_core_saved_objects_server.mdx
+++ b/api_docs/kbn_core_saved_objects_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-server
 title: "@kbn/core-saved-objects-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-server plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-server']
 ---
 import kbnCoreSavedObjectsServerObj from './kbn_core_saved_objects_server.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_server_internal.mdx b/api_docs/kbn_core_saved_objects_server_internal.mdx
index 97718171290bba..ed85946eba0195 100644
--- a/api_docs/kbn_core_saved_objects_server_internal.mdx
+++ b/api_docs/kbn_core_saved_objects_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-server-internal
 title: "@kbn/core-saved-objects-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-server-internal plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-server-internal']
 ---
 import kbnCoreSavedObjectsServerInternalObj from './kbn_core_saved_objects_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_server_mocks.mdx b/api_docs/kbn_core_saved_objects_server_mocks.mdx
index 30aeaf880df635..105909440af972 100644
--- a/api_docs/kbn_core_saved_objects_server_mocks.mdx
+++ b/api_docs/kbn_core_saved_objects_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-server-mocks
 title: "@kbn/core-saved-objects-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-server-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-server-mocks']
 ---
 import kbnCoreSavedObjectsServerMocksObj from './kbn_core_saved_objects_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_utils_server.mdx b/api_docs/kbn_core_saved_objects_utils_server.mdx
index 3e290eadd5335f..dbeed332db436e 100644
--- a/api_docs/kbn_core_saved_objects_utils_server.mdx
+++ b/api_docs/kbn_core_saved_objects_utils_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-utils-server
 title: "@kbn/core-saved-objects-utils-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-utils-server plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-utils-server']
 ---
 import kbnCoreSavedObjectsUtilsServerObj from './kbn_core_saved_objects_utils_server.devdocs.json';
diff --git a/api_docs/kbn_core_security_browser.mdx b/api_docs/kbn_core_security_browser.mdx
index fea553ee4c7291..4c5cc1485c0e09 100644
--- a/api_docs/kbn_core_security_browser.mdx
+++ b/api_docs/kbn_core_security_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-security-browser
 title: "@kbn/core-security-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-security-browser plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-security-browser']
 ---
 import kbnCoreSecurityBrowserObj from './kbn_core_security_browser.devdocs.json';
diff --git a/api_docs/kbn_core_security_browser_internal.mdx b/api_docs/kbn_core_security_browser_internal.mdx
index 6d5253870f398d..8456e3d86770e4 100644
--- a/api_docs/kbn_core_security_browser_internal.mdx
+++ b/api_docs/kbn_core_security_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-security-browser-internal
 title: "@kbn/core-security-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-security-browser-internal plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-security-browser-internal']
 ---
 import kbnCoreSecurityBrowserInternalObj from './kbn_core_security_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_security_browser_mocks.mdx b/api_docs/kbn_core_security_browser_mocks.mdx
index 90e4e92e72c649..8bd6316a03928e 100644
--- a/api_docs/kbn_core_security_browser_mocks.mdx
+++ b/api_docs/kbn_core_security_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-security-browser-mocks
 title: "@kbn/core-security-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-security-browser-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-security-browser-mocks']
 ---
 import kbnCoreSecurityBrowserMocksObj from './kbn_core_security_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_security_common.mdx b/api_docs/kbn_core_security_common.mdx
index e3ac95d15116bd..f4dc8a75bac066 100644
--- a/api_docs/kbn_core_security_common.mdx
+++ b/api_docs/kbn_core_security_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-security-common
 title: "@kbn/core-security-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-security-common plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-security-common']
 ---
 import kbnCoreSecurityCommonObj from './kbn_core_security_common.devdocs.json';
diff --git a/api_docs/kbn_core_security_server.mdx b/api_docs/kbn_core_security_server.mdx
index f822d67bd3c27d..8d038be98d1e6a 100644
--- a/api_docs/kbn_core_security_server.mdx
+++ b/api_docs/kbn_core_security_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-security-server
 title: "@kbn/core-security-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-security-server plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-security-server']
 ---
 import kbnCoreSecurityServerObj from './kbn_core_security_server.devdocs.json';
diff --git a/api_docs/kbn_core_security_server_internal.mdx b/api_docs/kbn_core_security_server_internal.mdx
index 93916c6b37a705..42fb7a79aeaae4 100644
--- a/api_docs/kbn_core_security_server_internal.mdx
+++ b/api_docs/kbn_core_security_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-security-server-internal
 title: "@kbn/core-security-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-security-server-internal plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-security-server-internal']
 ---
 import kbnCoreSecurityServerInternalObj from './kbn_core_security_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_security_server_mocks.mdx b/api_docs/kbn_core_security_server_mocks.mdx
index 4e81859a099a60..35717de3ab3fb4 100644
--- a/api_docs/kbn_core_security_server_mocks.mdx
+++ b/api_docs/kbn_core_security_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-security-server-mocks
 title: "@kbn/core-security-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-security-server-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-security-server-mocks']
 ---
 import kbnCoreSecurityServerMocksObj from './kbn_core_security_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_status_common.mdx b/api_docs/kbn_core_status_common.mdx
index d6894bc522924d..207d4c340b6169 100644
--- a/api_docs/kbn_core_status_common.mdx
+++ b/api_docs/kbn_core_status_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-status-common
 title: "@kbn/core-status-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-status-common plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-status-common']
 ---
 import kbnCoreStatusCommonObj from './kbn_core_status_common.devdocs.json';
diff --git a/api_docs/kbn_core_status_common_internal.mdx b/api_docs/kbn_core_status_common_internal.mdx
index 80366eb669e242..b4beddc9379c62 100644
--- a/api_docs/kbn_core_status_common_internal.mdx
+++ b/api_docs/kbn_core_status_common_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-status-common-internal
 title: "@kbn/core-status-common-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-status-common-internal plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-status-common-internal']
 ---
 import kbnCoreStatusCommonInternalObj from './kbn_core_status_common_internal.devdocs.json';
diff --git a/api_docs/kbn_core_status_server.mdx b/api_docs/kbn_core_status_server.mdx
index ab997b690b3d4a..0ddc7935dfba7f 100644
--- a/api_docs/kbn_core_status_server.mdx
+++ b/api_docs/kbn_core_status_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-status-server
 title: "@kbn/core-status-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-status-server plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-status-server']
 ---
 import kbnCoreStatusServerObj from './kbn_core_status_server.devdocs.json';
diff --git a/api_docs/kbn_core_status_server_internal.mdx b/api_docs/kbn_core_status_server_internal.mdx
index adae7cfe81e23c..d6e5db73abf239 100644
--- a/api_docs/kbn_core_status_server_internal.mdx
+++ b/api_docs/kbn_core_status_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-status-server-internal
 title: "@kbn/core-status-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-status-server-internal plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-status-server-internal']
 ---
 import kbnCoreStatusServerInternalObj from './kbn_core_status_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_status_server_mocks.mdx b/api_docs/kbn_core_status_server_mocks.mdx
index e42291004607fb..083e45da3da916 100644
--- a/api_docs/kbn_core_status_server_mocks.mdx
+++ b/api_docs/kbn_core_status_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-status-server-mocks
 title: "@kbn/core-status-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-status-server-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-status-server-mocks']
 ---
 import kbnCoreStatusServerMocksObj from './kbn_core_status_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_test_helpers_deprecations_getters.mdx b/api_docs/kbn_core_test_helpers_deprecations_getters.mdx
index a3aa65b563a5a3..a805d3c6188acb 100644
--- a/api_docs/kbn_core_test_helpers_deprecations_getters.mdx
+++ b/api_docs/kbn_core_test_helpers_deprecations_getters.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-test-helpers-deprecations-getters
 title: "@kbn/core-test-helpers-deprecations-getters"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-test-helpers-deprecations-getters plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-test-helpers-deprecations-getters']
 ---
 import kbnCoreTestHelpersDeprecationsGettersObj from './kbn_core_test_helpers_deprecations_getters.devdocs.json';
diff --git a/api_docs/kbn_core_test_helpers_http_setup_browser.mdx b/api_docs/kbn_core_test_helpers_http_setup_browser.mdx
index 68dd6cee71bb09..1fbf616329e4af 100644
--- a/api_docs/kbn_core_test_helpers_http_setup_browser.mdx
+++ b/api_docs/kbn_core_test_helpers_http_setup_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-test-helpers-http-setup-browser
 title: "@kbn/core-test-helpers-http-setup-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-test-helpers-http-setup-browser plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-test-helpers-http-setup-browser']
 ---
 import kbnCoreTestHelpersHttpSetupBrowserObj from './kbn_core_test_helpers_http_setup_browser.devdocs.json';
diff --git a/api_docs/kbn_core_test_helpers_kbn_server.mdx b/api_docs/kbn_core_test_helpers_kbn_server.mdx
index 91f3f12052938c..e3bb9fef1814c2 100644
--- a/api_docs/kbn_core_test_helpers_kbn_server.mdx
+++ b/api_docs/kbn_core_test_helpers_kbn_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-test-helpers-kbn-server
 title: "@kbn/core-test-helpers-kbn-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-test-helpers-kbn-server plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-test-helpers-kbn-server']
 ---
 import kbnCoreTestHelpersKbnServerObj from './kbn_core_test_helpers_kbn_server.devdocs.json';
diff --git a/api_docs/kbn_core_test_helpers_model_versions.mdx b/api_docs/kbn_core_test_helpers_model_versions.mdx
index 2cb0927c100c3f..b1cb8a8fa5b953 100644
--- a/api_docs/kbn_core_test_helpers_model_versions.mdx
+++ b/api_docs/kbn_core_test_helpers_model_versions.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-test-helpers-model-versions
 title: "@kbn/core-test-helpers-model-versions"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-test-helpers-model-versions plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-test-helpers-model-versions']
 ---
 import kbnCoreTestHelpersModelVersionsObj from './kbn_core_test_helpers_model_versions.devdocs.json';
diff --git a/api_docs/kbn_core_test_helpers_so_type_serializer.mdx b/api_docs/kbn_core_test_helpers_so_type_serializer.mdx
index ecacd4381559d4..3a507bbdca5bd3 100644
--- a/api_docs/kbn_core_test_helpers_so_type_serializer.mdx
+++ b/api_docs/kbn_core_test_helpers_so_type_serializer.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-test-helpers-so-type-serializer
 title: "@kbn/core-test-helpers-so-type-serializer"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-test-helpers-so-type-serializer plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-test-helpers-so-type-serializer']
 ---
 import kbnCoreTestHelpersSoTypeSerializerObj from './kbn_core_test_helpers_so_type_serializer.devdocs.json';
diff --git a/api_docs/kbn_core_test_helpers_test_utils.mdx b/api_docs/kbn_core_test_helpers_test_utils.mdx
index f443a3ec751fb6..5d35baf0d91ef8 100644
--- a/api_docs/kbn_core_test_helpers_test_utils.mdx
+++ b/api_docs/kbn_core_test_helpers_test_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-test-helpers-test-utils
 title: "@kbn/core-test-helpers-test-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-test-helpers-test-utils plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-test-helpers-test-utils']
 ---
 import kbnCoreTestHelpersTestUtilsObj from './kbn_core_test_helpers_test_utils.devdocs.json';
diff --git a/api_docs/kbn_core_theme_browser.mdx b/api_docs/kbn_core_theme_browser.mdx
index 04e598d8aaa279..f15b699565bb5d 100644
--- a/api_docs/kbn_core_theme_browser.mdx
+++ b/api_docs/kbn_core_theme_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-theme-browser
 title: "@kbn/core-theme-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-theme-browser plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-theme-browser']
 ---
 import kbnCoreThemeBrowserObj from './kbn_core_theme_browser.devdocs.json';
diff --git a/api_docs/kbn_core_theme_browser_mocks.mdx b/api_docs/kbn_core_theme_browser_mocks.mdx
index ed84d8dcac5c99..3e93c778b42006 100644
--- a/api_docs/kbn_core_theme_browser_mocks.mdx
+++ b/api_docs/kbn_core_theme_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-theme-browser-mocks
 title: "@kbn/core-theme-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-theme-browser-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-theme-browser-mocks']
 ---
 import kbnCoreThemeBrowserMocksObj from './kbn_core_theme_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_ui_settings_browser.mdx b/api_docs/kbn_core_ui_settings_browser.mdx
index b901959b636fbd..a29dbefc197316 100644
--- a/api_docs/kbn_core_ui_settings_browser.mdx
+++ b/api_docs/kbn_core_ui_settings_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-browser
 title: "@kbn/core-ui-settings-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-ui-settings-browser plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-browser']
 ---
 import kbnCoreUiSettingsBrowserObj from './kbn_core_ui_settings_browser.devdocs.json';
diff --git a/api_docs/kbn_core_ui_settings_browser_internal.mdx b/api_docs/kbn_core_ui_settings_browser_internal.mdx
index 521e929ad34a78..2099adca23f2af 100644
--- a/api_docs/kbn_core_ui_settings_browser_internal.mdx
+++ b/api_docs/kbn_core_ui_settings_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-browser-internal
 title: "@kbn/core-ui-settings-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-ui-settings-browser-internal plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-browser-internal']
 ---
 import kbnCoreUiSettingsBrowserInternalObj from './kbn_core_ui_settings_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_ui_settings_browser_mocks.mdx b/api_docs/kbn_core_ui_settings_browser_mocks.mdx
index 3223832c86c00a..19b211ee9af59c 100644
--- a/api_docs/kbn_core_ui_settings_browser_mocks.mdx
+++ b/api_docs/kbn_core_ui_settings_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-browser-mocks
 title: "@kbn/core-ui-settings-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-ui-settings-browser-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-browser-mocks']
 ---
 import kbnCoreUiSettingsBrowserMocksObj from './kbn_core_ui_settings_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_ui_settings_common.mdx b/api_docs/kbn_core_ui_settings_common.mdx
index 5f6fabfda96481..ef2d20d572d3cb 100644
--- a/api_docs/kbn_core_ui_settings_common.mdx
+++ b/api_docs/kbn_core_ui_settings_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-common
 title: "@kbn/core-ui-settings-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-ui-settings-common plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-common']
 ---
 import kbnCoreUiSettingsCommonObj from './kbn_core_ui_settings_common.devdocs.json';
diff --git a/api_docs/kbn_core_ui_settings_server.mdx b/api_docs/kbn_core_ui_settings_server.mdx
index bc00a1294bc20d..3ba373403e7a84 100644
--- a/api_docs/kbn_core_ui_settings_server.mdx
+++ b/api_docs/kbn_core_ui_settings_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-server
 title: "@kbn/core-ui-settings-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-ui-settings-server plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-server']
 ---
 import kbnCoreUiSettingsServerObj from './kbn_core_ui_settings_server.devdocs.json';
diff --git a/api_docs/kbn_core_ui_settings_server_internal.mdx b/api_docs/kbn_core_ui_settings_server_internal.mdx
index e3a50f01181b79..bce8371d559d01 100644
--- a/api_docs/kbn_core_ui_settings_server_internal.mdx
+++ b/api_docs/kbn_core_ui_settings_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-server-internal
 title: "@kbn/core-ui-settings-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-ui-settings-server-internal plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-server-internal']
 ---
 import kbnCoreUiSettingsServerInternalObj from './kbn_core_ui_settings_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_ui_settings_server_mocks.mdx b/api_docs/kbn_core_ui_settings_server_mocks.mdx
index 2fabb0ab3056e6..eb1c5c66ecb1dc 100644
--- a/api_docs/kbn_core_ui_settings_server_mocks.mdx
+++ b/api_docs/kbn_core_ui_settings_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-server-mocks
 title: "@kbn/core-ui-settings-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-ui-settings-server-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-server-mocks']
 ---
 import kbnCoreUiSettingsServerMocksObj from './kbn_core_ui_settings_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_usage_data_server.devdocs.json b/api_docs/kbn_core_usage_data_server.devdocs.json
index b2bd17618b373d..58b8adb6f7c82d 100644
--- a/api_docs/kbn_core_usage_data_server.devdocs.json
+++ b/api_docs/kbn_core_usage_data_server.devdocs.json
@@ -127,7 +127,7 @@
             "label": "memory",
             "description": [],
             "signature": [
-              "{ heapTotalBytes: number; heapUsedBytes: number; heapSizeLimit: number; }"
+              "{ arrayBuffersBytes: number; residentSetSizeBytes: number; externalBytes: number; heapTotalBytes: number; heapUsedBytes: number; heapSizeLimit: number; }"
             ],
             "path": "packages/core/usage-data/core-usage-data-server/src/core_usage_data.ts",
             "deprecated": false,
diff --git a/api_docs/kbn_core_usage_data_server.mdx b/api_docs/kbn_core_usage_data_server.mdx
index 1da8755a957307..3659f5fa86859e 100644
--- a/api_docs/kbn_core_usage_data_server.mdx
+++ b/api_docs/kbn_core_usage_data_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-usage-data-server
 title: "@kbn/core-usage-data-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-usage-data-server plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-usage-data-server']
 ---
 import kbnCoreUsageDataServerObj from './kbn_core_usage_data_server.devdocs.json';
diff --git a/api_docs/kbn_core_usage_data_server_internal.mdx b/api_docs/kbn_core_usage_data_server_internal.mdx
index 4c7af548bd0120..be9ebc5eeae8c7 100644
--- a/api_docs/kbn_core_usage_data_server_internal.mdx
+++ b/api_docs/kbn_core_usage_data_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-usage-data-server-internal
 title: "@kbn/core-usage-data-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-usage-data-server-internal plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-usage-data-server-internal']
 ---
 import kbnCoreUsageDataServerInternalObj from './kbn_core_usage_data_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_usage_data_server_mocks.mdx b/api_docs/kbn_core_usage_data_server_mocks.mdx
index f468c07f6f5b2b..d353f4ffd24e49 100644
--- a/api_docs/kbn_core_usage_data_server_mocks.mdx
+++ b/api_docs/kbn_core_usage_data_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-usage-data-server-mocks
 title: "@kbn/core-usage-data-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-usage-data-server-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-usage-data-server-mocks']
 ---
 import kbnCoreUsageDataServerMocksObj from './kbn_core_usage_data_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_user_profile_browser.mdx b/api_docs/kbn_core_user_profile_browser.mdx
index 293d453a4c0a93..bdfd9dcb221cf9 100644
--- a/api_docs/kbn_core_user_profile_browser.mdx
+++ b/api_docs/kbn_core_user_profile_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-user-profile-browser
 title: "@kbn/core-user-profile-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-user-profile-browser plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-user-profile-browser']
 ---
 import kbnCoreUserProfileBrowserObj from './kbn_core_user_profile_browser.devdocs.json';
diff --git a/api_docs/kbn_core_user_profile_browser_internal.mdx b/api_docs/kbn_core_user_profile_browser_internal.mdx
index f9955e6d69480b..7ce0bac9f7045e 100644
--- a/api_docs/kbn_core_user_profile_browser_internal.mdx
+++ b/api_docs/kbn_core_user_profile_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-user-profile-browser-internal
 title: "@kbn/core-user-profile-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-user-profile-browser-internal plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-user-profile-browser-internal']
 ---
 import kbnCoreUserProfileBrowserInternalObj from './kbn_core_user_profile_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_user_profile_browser_mocks.mdx b/api_docs/kbn_core_user_profile_browser_mocks.mdx
index 014759817f97dd..0fb15daf946b9e 100644
--- a/api_docs/kbn_core_user_profile_browser_mocks.mdx
+++ b/api_docs/kbn_core_user_profile_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-user-profile-browser-mocks
 title: "@kbn/core-user-profile-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-user-profile-browser-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-user-profile-browser-mocks']
 ---
 import kbnCoreUserProfileBrowserMocksObj from './kbn_core_user_profile_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_user_profile_common.mdx b/api_docs/kbn_core_user_profile_common.mdx
index 8223dd75ed68e0..20960d566d8e7b 100644
--- a/api_docs/kbn_core_user_profile_common.mdx
+++ b/api_docs/kbn_core_user_profile_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-user-profile-common
 title: "@kbn/core-user-profile-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-user-profile-common plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-user-profile-common']
 ---
 import kbnCoreUserProfileCommonObj from './kbn_core_user_profile_common.devdocs.json';
diff --git a/api_docs/kbn_core_user_profile_server.mdx b/api_docs/kbn_core_user_profile_server.mdx
index a5fa7fd756b6d6..0e430f3fbef18f 100644
--- a/api_docs/kbn_core_user_profile_server.mdx
+++ b/api_docs/kbn_core_user_profile_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-user-profile-server
 title: "@kbn/core-user-profile-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-user-profile-server plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-user-profile-server']
 ---
 import kbnCoreUserProfileServerObj from './kbn_core_user_profile_server.devdocs.json';
diff --git a/api_docs/kbn_core_user_profile_server_internal.mdx b/api_docs/kbn_core_user_profile_server_internal.mdx
index 16640334ae5038..6109976624f34f 100644
--- a/api_docs/kbn_core_user_profile_server_internal.mdx
+++ b/api_docs/kbn_core_user_profile_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-user-profile-server-internal
 title: "@kbn/core-user-profile-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-user-profile-server-internal plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-user-profile-server-internal']
 ---
 import kbnCoreUserProfileServerInternalObj from './kbn_core_user_profile_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_user_profile_server_mocks.mdx b/api_docs/kbn_core_user_profile_server_mocks.mdx
index cc8b820894fed6..2b2dfe9dd4c872 100644
--- a/api_docs/kbn_core_user_profile_server_mocks.mdx
+++ b/api_docs/kbn_core_user_profile_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-user-profile-server-mocks
 title: "@kbn/core-user-profile-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-user-profile-server-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-user-profile-server-mocks']
 ---
 import kbnCoreUserProfileServerMocksObj from './kbn_core_user_profile_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_user_settings_server.mdx b/api_docs/kbn_core_user_settings_server.mdx
index 2bea4cbb475ab3..2df399a5622647 100644
--- a/api_docs/kbn_core_user_settings_server.mdx
+++ b/api_docs/kbn_core_user_settings_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-user-settings-server
 title: "@kbn/core-user-settings-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-user-settings-server plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-user-settings-server']
 ---
 import kbnCoreUserSettingsServerObj from './kbn_core_user_settings_server.devdocs.json';
diff --git a/api_docs/kbn_core_user_settings_server_mocks.mdx b/api_docs/kbn_core_user_settings_server_mocks.mdx
index 4253348adf2a16..ebe2a68b89dda0 100644
--- a/api_docs/kbn_core_user_settings_server_mocks.mdx
+++ b/api_docs/kbn_core_user_settings_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-user-settings-server-mocks
 title: "@kbn/core-user-settings-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-user-settings-server-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-user-settings-server-mocks']
 ---
 import kbnCoreUserSettingsServerMocksObj from './kbn_core_user_settings_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_crypto.mdx b/api_docs/kbn_crypto.mdx
index ee8ca515ae6369..c282fef5e5c06c 100644
--- a/api_docs/kbn_crypto.mdx
+++ b/api_docs/kbn_crypto.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-crypto
 title: "@kbn/crypto"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/crypto plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/crypto']
 ---
 import kbnCryptoObj from './kbn_crypto.devdocs.json';
diff --git a/api_docs/kbn_crypto_browser.mdx b/api_docs/kbn_crypto_browser.mdx
index e4c196f3642148..6af035990eaea3 100644
--- a/api_docs/kbn_crypto_browser.mdx
+++ b/api_docs/kbn_crypto_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-crypto-browser
 title: "@kbn/crypto-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/crypto-browser plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/crypto-browser']
 ---
 import kbnCryptoBrowserObj from './kbn_crypto_browser.devdocs.json';
diff --git a/api_docs/kbn_custom_icons.mdx b/api_docs/kbn_custom_icons.mdx
index 1934481f20189c..4f52ae27d480ec 100644
--- a/api_docs/kbn_custom_icons.mdx
+++ b/api_docs/kbn_custom_icons.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-custom-icons
 title: "@kbn/custom-icons"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/custom-icons plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/custom-icons']
 ---
 import kbnCustomIconsObj from './kbn_custom_icons.devdocs.json';
diff --git a/api_docs/kbn_custom_integrations.mdx b/api_docs/kbn_custom_integrations.mdx
index 93c782565e1953..ddd8357e962277 100644
--- a/api_docs/kbn_custom_integrations.mdx
+++ b/api_docs/kbn_custom_integrations.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-custom-integrations
 title: "@kbn/custom-integrations"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/custom-integrations plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/custom-integrations']
 ---
 import kbnCustomIntegrationsObj from './kbn_custom_integrations.devdocs.json';
diff --git a/api_docs/kbn_cypress_config.mdx b/api_docs/kbn_cypress_config.mdx
index c7b5867db054cc..9c4208ca2f44ab 100644
--- a/api_docs/kbn_cypress_config.mdx
+++ b/api_docs/kbn_cypress_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-cypress-config
 title: "@kbn/cypress-config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/cypress-config plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/cypress-config']
 ---
 import kbnCypressConfigObj from './kbn_cypress_config.devdocs.json';
diff --git a/api_docs/kbn_data_forge.mdx b/api_docs/kbn_data_forge.mdx
index 6661861ca3309c..0bed62a3530e2c 100644
--- a/api_docs/kbn_data_forge.mdx
+++ b/api_docs/kbn_data_forge.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-data-forge
 title: "@kbn/data-forge"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/data-forge plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/data-forge']
 ---
 import kbnDataForgeObj from './kbn_data_forge.devdocs.json';
diff --git a/api_docs/kbn_data_service.mdx b/api_docs/kbn_data_service.mdx
index da59b161118789..5f7324ac776df9 100644
--- a/api_docs/kbn_data_service.mdx
+++ b/api_docs/kbn_data_service.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-data-service
 title: "@kbn/data-service"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/data-service plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/data-service']
 ---
 import kbnDataServiceObj from './kbn_data_service.devdocs.json';
diff --git a/api_docs/kbn_data_stream_adapter.mdx b/api_docs/kbn_data_stream_adapter.mdx
index 85f4cc6b3df418..e15a570a7e4a9f 100644
--- a/api_docs/kbn_data_stream_adapter.mdx
+++ b/api_docs/kbn_data_stream_adapter.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-data-stream-adapter
 title: "@kbn/data-stream-adapter"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/data-stream-adapter plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/data-stream-adapter']
 ---
 import kbnDataStreamAdapterObj from './kbn_data_stream_adapter.devdocs.json';
diff --git a/api_docs/kbn_data_view_utils.mdx b/api_docs/kbn_data_view_utils.mdx
index be97f21de2266f..edb372792f7a8b 100644
--- a/api_docs/kbn_data_view_utils.mdx
+++ b/api_docs/kbn_data_view_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-data-view-utils
 title: "@kbn/data-view-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/data-view-utils plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/data-view-utils']
 ---
 import kbnDataViewUtilsObj from './kbn_data_view_utils.devdocs.json';
diff --git a/api_docs/kbn_datemath.mdx b/api_docs/kbn_datemath.mdx
index 6a85ba8261699f..00cbee4e975293 100644
--- a/api_docs/kbn_datemath.mdx
+++ b/api_docs/kbn_datemath.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-datemath
 title: "@kbn/datemath"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/datemath plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/datemath']
 ---
 import kbnDatemathObj from './kbn_datemath.devdocs.json';
diff --git a/api_docs/kbn_deeplinks_analytics.mdx b/api_docs/kbn_deeplinks_analytics.mdx
index c44d5c5bc9acfc..5fc6436c7e8170 100644
--- a/api_docs/kbn_deeplinks_analytics.mdx
+++ b/api_docs/kbn_deeplinks_analytics.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-deeplinks-analytics
 title: "@kbn/deeplinks-analytics"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/deeplinks-analytics plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/deeplinks-analytics']
 ---
 import kbnDeeplinksAnalyticsObj from './kbn_deeplinks_analytics.devdocs.json';
diff --git a/api_docs/kbn_deeplinks_devtools.mdx b/api_docs/kbn_deeplinks_devtools.mdx
index b82ff7391f4d33..8c56b6f99a6114 100644
--- a/api_docs/kbn_deeplinks_devtools.mdx
+++ b/api_docs/kbn_deeplinks_devtools.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-deeplinks-devtools
 title: "@kbn/deeplinks-devtools"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/deeplinks-devtools plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/deeplinks-devtools']
 ---
 import kbnDeeplinksDevtoolsObj from './kbn_deeplinks_devtools.devdocs.json';
diff --git a/api_docs/kbn_deeplinks_fleet.mdx b/api_docs/kbn_deeplinks_fleet.mdx
index cb67f297f14c3c..1b6a8d0c5d4e92 100644
--- a/api_docs/kbn_deeplinks_fleet.mdx
+++ b/api_docs/kbn_deeplinks_fleet.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-deeplinks-fleet
 title: "@kbn/deeplinks-fleet"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/deeplinks-fleet plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/deeplinks-fleet']
 ---
 import kbnDeeplinksFleetObj from './kbn_deeplinks_fleet.devdocs.json';
diff --git a/api_docs/kbn_deeplinks_management.mdx b/api_docs/kbn_deeplinks_management.mdx
index f3d12f6c2f38ee..76ae6fde16facd 100644
--- a/api_docs/kbn_deeplinks_management.mdx
+++ b/api_docs/kbn_deeplinks_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-deeplinks-management
 title: "@kbn/deeplinks-management"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/deeplinks-management plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/deeplinks-management']
 ---
 import kbnDeeplinksManagementObj from './kbn_deeplinks_management.devdocs.json';
diff --git a/api_docs/kbn_deeplinks_ml.mdx b/api_docs/kbn_deeplinks_ml.mdx
index 71375e0e340d24..3eaa5cc990e870 100644
--- a/api_docs/kbn_deeplinks_ml.mdx
+++ b/api_docs/kbn_deeplinks_ml.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-deeplinks-ml
 title: "@kbn/deeplinks-ml"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/deeplinks-ml plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/deeplinks-ml']
 ---
 import kbnDeeplinksMlObj from './kbn_deeplinks_ml.devdocs.json';
diff --git a/api_docs/kbn_deeplinks_observability.mdx b/api_docs/kbn_deeplinks_observability.mdx
index bef17babdb5ce7..b94db897ad7916 100644
--- a/api_docs/kbn_deeplinks_observability.mdx
+++ b/api_docs/kbn_deeplinks_observability.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-deeplinks-observability
 title: "@kbn/deeplinks-observability"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/deeplinks-observability plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/deeplinks-observability']
 ---
 import kbnDeeplinksObservabilityObj from './kbn_deeplinks_observability.devdocs.json';
diff --git a/api_docs/kbn_deeplinks_search.mdx b/api_docs/kbn_deeplinks_search.mdx
index c4a707aa1b2639..907aa29aaddb4d 100644
--- a/api_docs/kbn_deeplinks_search.mdx
+++ b/api_docs/kbn_deeplinks_search.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-deeplinks-search
 title: "@kbn/deeplinks-search"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/deeplinks-search plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/deeplinks-search']
 ---
 import kbnDeeplinksSearchObj from './kbn_deeplinks_search.devdocs.json';
diff --git a/api_docs/kbn_deeplinks_security.mdx b/api_docs/kbn_deeplinks_security.mdx
index f8b42448773ea6..a8a24ad171c058 100644
--- a/api_docs/kbn_deeplinks_security.mdx
+++ b/api_docs/kbn_deeplinks_security.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-deeplinks-security
 title: "@kbn/deeplinks-security"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/deeplinks-security plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/deeplinks-security']
 ---
 import kbnDeeplinksSecurityObj from './kbn_deeplinks_security.devdocs.json';
diff --git a/api_docs/kbn_deeplinks_shared.mdx b/api_docs/kbn_deeplinks_shared.mdx
index aac62d905e787d..5ae28ab8d4e476 100644
--- a/api_docs/kbn_deeplinks_shared.mdx
+++ b/api_docs/kbn_deeplinks_shared.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-deeplinks-shared
 title: "@kbn/deeplinks-shared"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/deeplinks-shared plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/deeplinks-shared']
 ---
 import kbnDeeplinksSharedObj from './kbn_deeplinks_shared.devdocs.json';
diff --git a/api_docs/kbn_default_nav_analytics.mdx b/api_docs/kbn_default_nav_analytics.mdx
index 4e1422f6607761..f894f258a801ce 100644
--- a/api_docs/kbn_default_nav_analytics.mdx
+++ b/api_docs/kbn_default_nav_analytics.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-default-nav-analytics
 title: "@kbn/default-nav-analytics"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/default-nav-analytics plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/default-nav-analytics']
 ---
 import kbnDefaultNavAnalyticsObj from './kbn_default_nav_analytics.devdocs.json';
diff --git a/api_docs/kbn_default_nav_devtools.mdx b/api_docs/kbn_default_nav_devtools.mdx
index 1255037e3c7344..ed5bd204299acf 100644
--- a/api_docs/kbn_default_nav_devtools.mdx
+++ b/api_docs/kbn_default_nav_devtools.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-default-nav-devtools
 title: "@kbn/default-nav-devtools"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/default-nav-devtools plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/default-nav-devtools']
 ---
 import kbnDefaultNavDevtoolsObj from './kbn_default_nav_devtools.devdocs.json';
diff --git a/api_docs/kbn_default_nav_management.mdx b/api_docs/kbn_default_nav_management.mdx
index cfb352467c5290..efb59b88400df2 100644
--- a/api_docs/kbn_default_nav_management.mdx
+++ b/api_docs/kbn_default_nav_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-default-nav-management
 title: "@kbn/default-nav-management"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/default-nav-management plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/default-nav-management']
 ---
 import kbnDefaultNavManagementObj from './kbn_default_nav_management.devdocs.json';
diff --git a/api_docs/kbn_default_nav_ml.mdx b/api_docs/kbn_default_nav_ml.mdx
index 2a177fd433180b..e4788e20e7e02e 100644
--- a/api_docs/kbn_default_nav_ml.mdx
+++ b/api_docs/kbn_default_nav_ml.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-default-nav-ml
 title: "@kbn/default-nav-ml"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/default-nav-ml plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/default-nav-ml']
 ---
 import kbnDefaultNavMlObj from './kbn_default_nav_ml.devdocs.json';
diff --git a/api_docs/kbn_dev_cli_errors.mdx b/api_docs/kbn_dev_cli_errors.mdx
index b5d4de09efc4d4..44a492f247fc8e 100644
--- a/api_docs/kbn_dev_cli_errors.mdx
+++ b/api_docs/kbn_dev_cli_errors.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-dev-cli-errors
 title: "@kbn/dev-cli-errors"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/dev-cli-errors plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/dev-cli-errors']
 ---
 import kbnDevCliErrorsObj from './kbn_dev_cli_errors.devdocs.json';
diff --git a/api_docs/kbn_dev_cli_runner.mdx b/api_docs/kbn_dev_cli_runner.mdx
index 858efcb781cc6b..97a6604ed0c325 100644
--- a/api_docs/kbn_dev_cli_runner.mdx
+++ b/api_docs/kbn_dev_cli_runner.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-dev-cli-runner
 title: "@kbn/dev-cli-runner"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/dev-cli-runner plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/dev-cli-runner']
 ---
 import kbnDevCliRunnerObj from './kbn_dev_cli_runner.devdocs.json';
diff --git a/api_docs/kbn_dev_proc_runner.mdx b/api_docs/kbn_dev_proc_runner.mdx
index 9f884edc2f3b46..9902f3dfe637a1 100644
--- a/api_docs/kbn_dev_proc_runner.mdx
+++ b/api_docs/kbn_dev_proc_runner.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-dev-proc-runner
 title: "@kbn/dev-proc-runner"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/dev-proc-runner plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/dev-proc-runner']
 ---
 import kbnDevProcRunnerObj from './kbn_dev_proc_runner.devdocs.json';
diff --git a/api_docs/kbn_dev_utils.mdx b/api_docs/kbn_dev_utils.mdx
index fa145b02542091..f5bcb70e4137ab 100644
--- a/api_docs/kbn_dev_utils.mdx
+++ b/api_docs/kbn_dev_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-dev-utils
 title: "@kbn/dev-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/dev-utils plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/dev-utils']
 ---
 import kbnDevUtilsObj from './kbn_dev_utils.devdocs.json';
diff --git a/api_docs/kbn_discover_utils.mdx b/api_docs/kbn_discover_utils.mdx
index 9a6460e6b06217..5fa0a2a67eccb5 100644
--- a/api_docs/kbn_discover_utils.mdx
+++ b/api_docs/kbn_discover_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-discover-utils
 title: "@kbn/discover-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/discover-utils plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/discover-utils']
 ---
 import kbnDiscoverUtilsObj from './kbn_discover_utils.devdocs.json';
diff --git a/api_docs/kbn_doc_links.mdx b/api_docs/kbn_doc_links.mdx
index 2b41c1fd52be05..e53eb90bafa805 100644
--- a/api_docs/kbn_doc_links.mdx
+++ b/api_docs/kbn_doc_links.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-doc-links
 title: "@kbn/doc-links"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/doc-links plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/doc-links']
 ---
 import kbnDocLinksObj from './kbn_doc_links.devdocs.json';
diff --git a/api_docs/kbn_docs_utils.mdx b/api_docs/kbn_docs_utils.mdx
index e72dac1c4f4b23..43e6720e637334 100644
--- a/api_docs/kbn_docs_utils.mdx
+++ b/api_docs/kbn_docs_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-docs-utils
 title: "@kbn/docs-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/docs-utils plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/docs-utils']
 ---
 import kbnDocsUtilsObj from './kbn_docs_utils.devdocs.json';
diff --git a/api_docs/kbn_dom_drag_drop.mdx b/api_docs/kbn_dom_drag_drop.mdx
index 5987b877f4e45c..e9af43ad99a7fe 100644
--- a/api_docs/kbn_dom_drag_drop.mdx
+++ b/api_docs/kbn_dom_drag_drop.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-dom-drag-drop
 title: "@kbn/dom-drag-drop"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/dom-drag-drop plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/dom-drag-drop']
 ---
 import kbnDomDragDropObj from './kbn_dom_drag_drop.devdocs.json';
diff --git a/api_docs/kbn_ebt_tools.mdx b/api_docs/kbn_ebt_tools.mdx
index df23414027d217..e7415841b204f9 100644
--- a/api_docs/kbn_ebt_tools.mdx
+++ b/api_docs/kbn_ebt_tools.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ebt-tools
 title: "@kbn/ebt-tools"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ebt-tools plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ebt-tools']
 ---
 import kbnEbtToolsObj from './kbn_ebt_tools.devdocs.json';
diff --git a/api_docs/kbn_ecs_data_quality_dashboard.mdx b/api_docs/kbn_ecs_data_quality_dashboard.mdx
index bf45e7d61ad6cd..5a69b5b9ec68cf 100644
--- a/api_docs/kbn_ecs_data_quality_dashboard.mdx
+++ b/api_docs/kbn_ecs_data_quality_dashboard.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ecs-data-quality-dashboard
 title: "@kbn/ecs-data-quality-dashboard"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ecs-data-quality-dashboard plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ecs-data-quality-dashboard']
 ---
 import kbnEcsDataQualityDashboardObj from './kbn_ecs_data_quality_dashboard.devdocs.json';
diff --git a/api_docs/kbn_elastic_agent_utils.mdx b/api_docs/kbn_elastic_agent_utils.mdx
index 7fa5ef3f3c9139..26ae935ce022e9 100644
--- a/api_docs/kbn_elastic_agent_utils.mdx
+++ b/api_docs/kbn_elastic_agent_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-elastic-agent-utils
 title: "@kbn/elastic-agent-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/elastic-agent-utils plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/elastic-agent-utils']
 ---
 import kbnElasticAgentUtilsObj from './kbn_elastic_agent_utils.devdocs.json';
diff --git a/api_docs/kbn_elastic_assistant.mdx b/api_docs/kbn_elastic_assistant.mdx
index f783c38853d0ee..d36ab74574f19b 100644
--- a/api_docs/kbn_elastic_assistant.mdx
+++ b/api_docs/kbn_elastic_assistant.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-elastic-assistant
 title: "@kbn/elastic-assistant"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/elastic-assistant plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/elastic-assistant']
 ---
 import kbnElasticAssistantObj from './kbn_elastic_assistant.devdocs.json';
diff --git a/api_docs/kbn_elastic_assistant_common.devdocs.json b/api_docs/kbn_elastic_assistant_common.devdocs.json
index 7ec0c63ca4acd2..d1ac54ba561ffe 100644
--- a/api_docs/kbn_elastic_assistant_common.devdocs.json
+++ b/api_docs/kbn_elastic_assistant_common.devdocs.json
@@ -776,7 +776,7 @@
           "\nInterface for features available to the elastic assistant"
         ],
         "signature": [
-          "{ readonly assistantModelEvaluation: boolean; readonly attackDiscoveryEnabled: boolean; }"
+          "{ readonly assistantModelEvaluation: boolean; }"
         ],
         "path": "x-pack/packages/kbn-elastic-assistant-common/impl/capabilities/index.ts",
         "deprecated": false,
@@ -838,7 +838,7 @@
         "label": "AttackDiscoveryPostResponse",
         "description": [],
         "signature": [
-          "{ connector_id?: string | undefined; attackDiscoveries?: { title: string; alertIds: string[]; detailsMarkdown: string; entitySummaryMarkdown: string; summaryMarkdown: string; mitreAttackTactics?: string[] | undefined; }[] | undefined; replacements?: Zod.objectOutputType<{}, Zod.ZodString, \"strip\"> | undefined; status?: string | undefined; trace_data?: { transactionId?: string | undefined; traceId?: string | undefined; } | undefined; }"
+          "{ connector_id?: string | undefined; alertsContextCount?: number | undefined; attackDiscoveries?: { title: string; alertIds: string[]; detailsMarkdown: string; entitySummaryMarkdown: string; summaryMarkdown: string; mitreAttackTactics?: string[] | undefined; }[] | undefined; replacements?: Zod.objectOutputType<{}, Zod.ZodString, \"strip\"> | undefined; status?: string | undefined; trace_data?: { transactionId?: string | undefined; traceId?: string | undefined; } | undefined; }"
         ],
         "path": "x-pack/packages/kbn-elastic-assistant-common/impl/schemas/attack_discovery/post_attack_discovery_route.gen.ts",
         "deprecated": false,
@@ -1679,7 +1679,7 @@
         "label": "GetCapabilitiesResponse",
         "description": [],
         "signature": [
-          "{ assistantModelEvaluation: boolean; attackDiscoveryEnabled: boolean; }"
+          "{ assistantModelEvaluation: boolean; }"
         ],
         "path": "x-pack/packages/kbn-elastic-assistant-common/impl/schemas/capabilities/get_capabilities_route.gen.ts",
         "deprecated": false,
@@ -2451,7 +2451,7 @@
         "label": "AttackDiscoveryPostResponse",
         "description": [],
         "signature": [
-          "Zod.ZodObject<{ connector_id: Zod.ZodOptional<Zod.ZodString>; attackDiscoveries: Zod.ZodOptional<Zod.ZodArray<Zod.ZodObject<{ alertIds: Zod.ZodArray<Zod.ZodString, \"many\">; detailsMarkdown: Zod.ZodString; entitySummaryMarkdown: Zod.ZodString; mitreAttackTactics: Zod.ZodOptional<Zod.ZodArray<Zod.ZodString, \"many\">>; summaryMarkdown: Zod.ZodString; title: Zod.ZodString; }, \"strip\", Zod.ZodTypeAny, { title: string; alertIds: string[]; detailsMarkdown: string; entitySummaryMarkdown: string; summaryMarkdown: string; mitreAttackTactics?: string[] | undefined; }, { title: string; alertIds: string[]; detailsMarkdown: string; entitySummaryMarkdown: string; summaryMarkdown: string; mitreAttackTactics?: string[] | undefined; }>, \"many\">>; replacements: Zod.ZodOptional<Zod.ZodObject<{}, \"strip\", Zod.ZodString, Zod.objectOutputType<{}, Zod.ZodString, \"strip\">, Zod.objectInputType<{}, Zod.ZodString, \"strip\">>>; status: Zod.ZodOptional<Zod.ZodString>; trace_data: Zod.ZodOptional<Zod.ZodObject<{ transactionId: Zod.ZodOptional<Zod.ZodString>; traceId: Zod.ZodOptional<Zod.ZodString>; }, \"strip\", Zod.ZodTypeAny, { transactionId?: string | undefined; traceId?: string | undefined; }, { transactionId?: string | undefined; traceId?: string | undefined; }>>; }, \"strip\", Zod.ZodTypeAny, { connector_id?: string | undefined; attackDiscoveries?: { title: string; alertIds: string[]; detailsMarkdown: string; entitySummaryMarkdown: string; summaryMarkdown: string; mitreAttackTactics?: string[] | undefined; }[] | undefined; replacements?: Zod.objectOutputType<{}, Zod.ZodString, \"strip\"> | undefined; status?: string | undefined; trace_data?: { transactionId?: string | undefined; traceId?: string | undefined; } | undefined; }, { connector_id?: string | undefined; attackDiscoveries?: { title: string; alertIds: string[]; detailsMarkdown: string; entitySummaryMarkdown: string; summaryMarkdown: string; mitreAttackTactics?: string[] | undefined; }[] | undefined; replacements?: Zod.objectInputType<{}, Zod.ZodString, \"strip\"> | undefined; status?: string | undefined; trace_data?: { transactionId?: string | undefined; traceId?: string | undefined; } | undefined; }>"
+          "Zod.ZodObject<{ connector_id: Zod.ZodOptional<Zod.ZodString>; alertsContextCount: Zod.ZodOptional<Zod.ZodNumber>; attackDiscoveries: Zod.ZodOptional<Zod.ZodArray<Zod.ZodObject<{ alertIds: Zod.ZodArray<Zod.ZodString, \"many\">; detailsMarkdown: Zod.ZodString; entitySummaryMarkdown: Zod.ZodString; mitreAttackTactics: Zod.ZodOptional<Zod.ZodArray<Zod.ZodString, \"many\">>; summaryMarkdown: Zod.ZodString; title: Zod.ZodString; }, \"strip\", Zod.ZodTypeAny, { title: string; alertIds: string[]; detailsMarkdown: string; entitySummaryMarkdown: string; summaryMarkdown: string; mitreAttackTactics?: string[] | undefined; }, { title: string; alertIds: string[]; detailsMarkdown: string; entitySummaryMarkdown: string; summaryMarkdown: string; mitreAttackTactics?: string[] | undefined; }>, \"many\">>; replacements: Zod.ZodOptional<Zod.ZodObject<{}, \"strip\", Zod.ZodString, Zod.objectOutputType<{}, Zod.ZodString, \"strip\">, Zod.objectInputType<{}, Zod.ZodString, \"strip\">>>; status: Zod.ZodOptional<Zod.ZodString>; trace_data: Zod.ZodOptional<Zod.ZodObject<{ transactionId: Zod.ZodOptional<Zod.ZodString>; traceId: Zod.ZodOptional<Zod.ZodString>; }, \"strip\", Zod.ZodTypeAny, { transactionId?: string | undefined; traceId?: string | undefined; }, { transactionId?: string | undefined; traceId?: string | undefined; }>>; }, \"strip\", Zod.ZodTypeAny, { connector_id?: string | undefined; alertsContextCount?: number | undefined; attackDiscoveries?: { title: string; alertIds: string[]; detailsMarkdown: string; entitySummaryMarkdown: string; summaryMarkdown: string; mitreAttackTactics?: string[] | undefined; }[] | undefined; replacements?: Zod.objectOutputType<{}, Zod.ZodString, \"strip\"> | undefined; status?: string | undefined; trace_data?: { transactionId?: string | undefined; traceId?: string | undefined; } | undefined; }, { connector_id?: string | undefined; alertsContextCount?: number | undefined; attackDiscoveries?: { title: string; alertIds: string[]; detailsMarkdown: string; entitySummaryMarkdown: string; summaryMarkdown: string; mitreAttackTactics?: string[] | undefined; }[] | undefined; replacements?: Zod.objectInputType<{}, Zod.ZodString, \"strip\"> | undefined; status?: string | undefined; trace_data?: { transactionId?: string | undefined; traceId?: string | undefined; } | undefined; }>"
         ],
         "path": "x-pack/packages/kbn-elastic-assistant-common/impl/schemas/attack_discovery/post_attack_discovery_route.gen.ts",
         "deprecated": false,
@@ -2798,7 +2798,7 @@
           "\nDefault features available to the elastic assistant"
         ],
         "signature": [
-          "{ readonly assistantModelEvaluation: false; readonly attackDiscoveryEnabled: false; }"
+          "{ readonly assistantModelEvaluation: false; }"
         ],
         "path": "x-pack/packages/kbn-elastic-assistant-common/impl/capabilities/index.ts",
         "deprecated": false,
@@ -3023,7 +3023,7 @@
         "label": "GetCapabilitiesResponse",
         "description": [],
         "signature": [
-          "Zod.ZodObject<{ assistantModelEvaluation: Zod.ZodBoolean; attackDiscoveryEnabled: Zod.ZodBoolean; }, \"strip\", Zod.ZodTypeAny, { assistantModelEvaluation: boolean; attackDiscoveryEnabled: boolean; }, { assistantModelEvaluation: boolean; attackDiscoveryEnabled: boolean; }>"
+          "Zod.ZodObject<{ assistantModelEvaluation: Zod.ZodBoolean; }, \"strip\", Zod.ZodTypeAny, { assistantModelEvaluation: boolean; }, { assistantModelEvaluation: boolean; }>"
         ],
         "path": "x-pack/packages/kbn-elastic-assistant-common/impl/schemas/capabilities/get_capabilities_route.gen.ts",
         "deprecated": false,
diff --git a/api_docs/kbn_elastic_assistant_common.mdx b/api_docs/kbn_elastic_assistant_common.mdx
index 68564211be0974..6ea052035c3195 100644
--- a/api_docs/kbn_elastic_assistant_common.mdx
+++ b/api_docs/kbn_elastic_assistant_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-elastic-assistant-common
 title: "@kbn/elastic-assistant-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/elastic-assistant-common plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/elastic-assistant-common']
 ---
 import kbnElasticAssistantCommonObj from './kbn_elastic_assistant_common.devdocs.json';
diff --git a/api_docs/kbn_es.mdx b/api_docs/kbn_es.mdx
index 4c04657d76e3d7..4850e52458ec92 100644
--- a/api_docs/kbn_es.mdx
+++ b/api_docs/kbn_es.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-es
 title: "@kbn/es"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/es plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/es']
 ---
 import kbnEsObj from './kbn_es.devdocs.json';
diff --git a/api_docs/kbn_es_archiver.mdx b/api_docs/kbn_es_archiver.mdx
index 0172274ac1f354..335202e8bdd1a8 100644
--- a/api_docs/kbn_es_archiver.mdx
+++ b/api_docs/kbn_es_archiver.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-es-archiver
 title: "@kbn/es-archiver"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/es-archiver plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/es-archiver']
 ---
 import kbnEsArchiverObj from './kbn_es_archiver.devdocs.json';
diff --git a/api_docs/kbn_es_errors.mdx b/api_docs/kbn_es_errors.mdx
index 9e4a0c62db92c1..d43f17a1c93550 100644
--- a/api_docs/kbn_es_errors.mdx
+++ b/api_docs/kbn_es_errors.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-es-errors
 title: "@kbn/es-errors"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/es-errors plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/es-errors']
 ---
 import kbnEsErrorsObj from './kbn_es_errors.devdocs.json';
diff --git a/api_docs/kbn_es_query.mdx b/api_docs/kbn_es_query.mdx
index 4c19b964bad33e..d4030fd8d70e74 100644
--- a/api_docs/kbn_es_query.mdx
+++ b/api_docs/kbn_es_query.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-es-query
 title: "@kbn/es-query"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/es-query plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/es-query']
 ---
 import kbnEsQueryObj from './kbn_es_query.devdocs.json';
diff --git a/api_docs/kbn_es_types.mdx b/api_docs/kbn_es_types.mdx
index bf08d8e9f2b166..8b4359b8e1f378 100644
--- a/api_docs/kbn_es_types.mdx
+++ b/api_docs/kbn_es_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-es-types
 title: "@kbn/es-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/es-types plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/es-types']
 ---
 import kbnEsTypesObj from './kbn_es_types.devdocs.json';
diff --git a/api_docs/kbn_eslint_plugin_imports.mdx b/api_docs/kbn_eslint_plugin_imports.mdx
index ca85bf47ca96cf..baa11e34e0d80a 100644
--- a/api_docs/kbn_eslint_plugin_imports.mdx
+++ b/api_docs/kbn_eslint_plugin_imports.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-eslint-plugin-imports
 title: "@kbn/eslint-plugin-imports"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/eslint-plugin-imports plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/eslint-plugin-imports']
 ---
 import kbnEslintPluginImportsObj from './kbn_eslint_plugin_imports.devdocs.json';
diff --git a/api_docs/kbn_esql_ast.mdx b/api_docs/kbn_esql_ast.mdx
index 53abd297b38149..95c8c9bd631f57 100644
--- a/api_docs/kbn_esql_ast.mdx
+++ b/api_docs/kbn_esql_ast.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-esql-ast
 title: "@kbn/esql-ast"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/esql-ast plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/esql-ast']
 ---
 import kbnEsqlAstObj from './kbn_esql_ast.devdocs.json';
diff --git a/api_docs/kbn_esql_utils.devdocs.json b/api_docs/kbn_esql_utils.devdocs.json
index c8468e95b5a46a..095c88e18a505a 100644
--- a/api_docs/kbn_esql_utils.devdocs.json
+++ b/api_docs/kbn_esql_utils.devdocs.json
@@ -404,6 +404,180 @@
         "returnComment": [],
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "@kbn/esql-utils",
+        "id": "def-common.getESQLQueryColumnsRaw",
+        "type": "Function",
+        "tags": [],
+        "label": "getESQLQueryColumnsRaw",
+        "description": [],
+        "signature": [
+          "({\n  esqlQuery,\n  search,\n  signal,\n}: { esqlQuery: string; search: ",
+          {
+            "pluginId": "@kbn/search-types",
+            "scope": "common",
+            "docId": "kibKbnSearchTypesPluginApi",
+            "section": "def-common.ISearchGeneric",
+            "text": "ISearchGeneric"
+          },
+          "; signal?: AbortSignal | undefined; }) => Promise<",
+          {
+            "pluginId": "@kbn/es-types",
+            "scope": "common",
+            "docId": "kibKbnEsTypesPluginApi",
+            "section": "def-common.ESQLColumn",
+            "text": "ESQLColumn"
+          },
+          "[]>"
+        ],
+        "path": "packages/kbn-esql-utils/src/utils/run_query.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/esql-utils",
+            "id": "def-common.getESQLQueryColumnsRaw.$1",
+            "type": "Object",
+            "tags": [],
+            "label": "{\n  esqlQuery,\n  search,\n  signal,\n}",
+            "description": [],
+            "path": "packages/kbn-esql-utils/src/utils/run_query.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [
+              {
+                "parentPluginId": "@kbn/esql-utils",
+                "id": "def-common.getESQLQueryColumnsRaw.$1.esqlQuery",
+                "type": "string",
+                "tags": [],
+                "label": "esqlQuery",
+                "description": [],
+                "path": "packages/kbn-esql-utils/src/utils/run_query.ts",
+                "deprecated": false,
+                "trackAdoption": false
+              },
+              {
+                "parentPluginId": "@kbn/esql-utils",
+                "id": "def-common.getESQLQueryColumnsRaw.$1.search",
+                "type": "Function",
+                "tags": [],
+                "label": "search",
+                "description": [],
+                "signature": [
+                  "<SearchStrategyRequest extends ",
+                  {
+                    "pluginId": "@kbn/search-types",
+                    "scope": "common",
+                    "docId": "kibKbnSearchTypesPluginApi",
+                    "section": "def-common.IKibanaSearchRequest",
+                    "text": "IKibanaSearchRequest"
+                  },
+                  "<any> = ",
+                  {
+                    "pluginId": "@kbn/search-types",
+                    "scope": "common",
+                    "docId": "kibKbnSearchTypesPluginApi",
+                    "section": "def-common.IEsSearchRequest",
+                    "text": "IEsSearchRequest"
+                  },
+                  "<",
+                  {
+                    "pluginId": "@kbn/search-types",
+                    "scope": "common",
+                    "docId": "kibKbnSearchTypesPluginApi",
+                    "section": "def-common.ISearchRequestParams",
+                    "text": "ISearchRequestParams"
+                  },
+                  ">, SearchStrategyResponse extends ",
+                  {
+                    "pluginId": "@kbn/search-types",
+                    "scope": "common",
+                    "docId": "kibKbnSearchTypesPluginApi",
+                    "section": "def-common.IKibanaSearchResponse",
+                    "text": "IKibanaSearchResponse"
+                  },
+                  "<any> = ",
+                  {
+                    "pluginId": "@kbn/search-types",
+                    "scope": "common",
+                    "docId": "kibKbnSearchTypesPluginApi",
+                    "section": "def-common.IEsSearchResponse",
+                    "text": "IEsSearchResponse"
+                  },
+                  "<any>>(request: SearchStrategyRequest, options?: ",
+                  {
+                    "pluginId": "@kbn/search-types",
+                    "scope": "common",
+                    "docId": "kibKbnSearchTypesPluginApi",
+                    "section": "def-common.ISearchOptions",
+                    "text": "ISearchOptions"
+                  },
+                  " | undefined) => ",
+                  "Observable",
+                  "<SearchStrategyResponse>"
+                ],
+                "path": "packages/kbn-esql-utils/src/utils/run_query.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "returnComment": [],
+                "children": [
+                  {
+                    "parentPluginId": "@kbn/esql-utils",
+                    "id": "def-common.getESQLQueryColumnsRaw.$1.search.$1",
+                    "type": "Uncategorized",
+                    "tags": [],
+                    "label": "request",
+                    "description": [],
+                    "signature": [
+                      "SearchStrategyRequest"
+                    ],
+                    "path": "packages/kbn-search-types/src/types.ts",
+                    "deprecated": false,
+                    "trackAdoption": false
+                  },
+                  {
+                    "parentPluginId": "@kbn/esql-utils",
+                    "id": "def-common.getESQLQueryColumnsRaw.$1.search.$2",
+                    "type": "Object",
+                    "tags": [],
+                    "label": "options",
+                    "description": [],
+                    "signature": [
+                      {
+                        "pluginId": "@kbn/search-types",
+                        "scope": "common",
+                        "docId": "kibKbnSearchTypesPluginApi",
+                        "section": "def-common.ISearchOptions",
+                        "text": "ISearchOptions"
+                      },
+                      " | undefined"
+                    ],
+                    "path": "packages/kbn-search-types/src/types.ts",
+                    "deprecated": false,
+                    "trackAdoption": false
+                  }
+                ]
+              },
+              {
+                "parentPluginId": "@kbn/esql-utils",
+                "id": "def-common.getESQLQueryColumnsRaw.$1.signal",
+                "type": "Object",
+                "tags": [],
+                "label": "signal",
+                "description": [],
+                "signature": [
+                  "AbortSignal | undefined"
+                ],
+                "path": "packages/kbn-esql-utils/src/utils/run_query.ts",
+                "deprecated": false,
+                "trackAdoption": false
+              }
+            ]
+          }
+        ],
+        "returnComment": [],
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "@kbn/esql-utils",
         "id": "def-common.getESQLWithSafeLimit",
diff --git a/api_docs/kbn_esql_utils.mdx b/api_docs/kbn_esql_utils.mdx
index b0068228f73ab0..afbac129e9b987 100644
--- a/api_docs/kbn_esql_utils.mdx
+++ b/api_docs/kbn_esql_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-esql-utils
 title: "@kbn/esql-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/esql-utils plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/esql-utils']
 ---
 import kbnEsqlUtilsObj from './kbn_esql_utils.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/kibana-esql](https://github.com/orgs/elastic/teams/kibana-esql
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 36 | 0 | 34 | 0 |
+| 43 | 0 | 41 | 0 |
 
 ## Common
 
diff --git a/api_docs/kbn_esql_validation_autocomplete.devdocs.json b/api_docs/kbn_esql_validation_autocomplete.devdocs.json
index fc9229883fba6e..84d035dfd8766f 100644
--- a/api_docs/kbn_esql_validation_autocomplete.devdocs.json
+++ b/api_docs/kbn_esql_validation_autocomplete.devdocs.json
@@ -384,7 +384,7 @@
         "label": "getAllFunctions",
         "description": [],
         "signature": [
-          "(options: { type: \"grouping\" | \"agg\" | \"builtin\" | \"eval\" | (\"grouping\" | \"agg\" | \"builtin\" | \"eval\")[]; } | undefined) => ",
+          "(options: { type: \"agg\" | \"builtin\" | \"eval\" | (\"agg\" | \"builtin\" | \"eval\")[]; } | undefined) => ",
           {
             "pluginId": "@kbn/esql-validation-autocomplete",
             "scope": "common",
@@ -417,7 +417,7 @@
                 "label": "type",
                 "description": [],
                 "signature": [
-                  "\"grouping\" | \"agg\" | \"builtin\" | \"eval\" | (\"grouping\" | \"agg\" | \"builtin\" | \"eval\")[]"
+                  "\"agg\" | \"builtin\" | \"eval\" | (\"agg\" | \"builtin\" | \"eval\")[]"
                 ],
                 "path": "packages/kbn-esql-validation-autocomplete/src/shared/helpers.ts",
                 "deprecated": false,
@@ -1497,7 +1497,9 @@
             "section": "def-common.ESQLSingleAstItem",
             "text": "ESQLSingleAstItem"
           },
-          ", argDef: { name: string; type: string; optional?: boolean | undefined; noNestingFunctions?: boolean | undefined; supportsWildcard?: boolean | undefined; constantOnly?: boolean | undefined; literalOptions?: string[] | undefined; literalSuggestions?: string[] | undefined; } | { name: string; type: string; optional?: boolean | undefined; innerType?: string | undefined; values?: string[] | undefined; valueDescriptions?: string[] | undefined; constantOnly?: boolean | undefined; wildcards?: boolean | undefined; }, references: ",
+          ", argDef: { name: string; type: ",
+          "FunctionParameterType",
+          "; optional?: boolean | undefined; noNestingFunctions?: boolean | undefined; supportsWildcard?: boolean | undefined; constantOnly?: boolean | undefined; literalOptions?: string[] | undefined; literalSuggestions?: string[] | undefined; } | { name: string; type: string; optional?: boolean | undefined; innerType?: string | undefined; values?: string[] | undefined; valueDescriptions?: string[] | undefined; constantOnly?: boolean | undefined; wildcards?: boolean | undefined; }, references: ",
           "ReferenceMaps",
           ", parentCommand: string | undefined, nameHit: string | undefined) => boolean | undefined"
         ],
@@ -1534,7 +1536,9 @@
             "label": "argDef",
             "description": [],
             "signature": [
-              "{ name: string; type: string; optional?: boolean | undefined; noNestingFunctions?: boolean | undefined; supportsWildcard?: boolean | undefined; constantOnly?: boolean | undefined; literalOptions?: string[] | undefined; literalSuggestions?: string[] | undefined; } | { name: string; type: string; optional?: boolean | undefined; innerType?: string | undefined; values?: string[] | undefined; valueDescriptions?: string[] | undefined; constantOnly?: boolean | undefined; wildcards?: boolean | undefined; }"
+              "{ name: string; type: ",
+              "FunctionParameterType",
+              "; optional?: boolean | undefined; noNestingFunctions?: boolean | undefined; supportsWildcard?: boolean | undefined; constantOnly?: boolean | undefined; literalOptions?: string[] | undefined; literalSuggestions?: string[] | undefined; } | { name: string; type: string; optional?: boolean | undefined; innerType?: string | undefined; values?: string[] | undefined; valueDescriptions?: string[] | undefined; constantOnly?: boolean | undefined; wildcards?: boolean | undefined; }"
             ],
             "path": "packages/kbn-esql-validation-autocomplete/src/shared/helpers.ts",
             "deprecated": false,
@@ -3149,7 +3153,7 @@
             "label": "type",
             "description": [],
             "signature": [
-              "\"grouping\" | \"agg\" | \"builtin\" | \"eval\""
+              "\"agg\" | \"builtin\" | \"eval\""
             ],
             "path": "packages/kbn-esql-validation-autocomplete/src/definitions/types.ts",
             "deprecated": false,
@@ -3241,7 +3245,11 @@
             "label": "signatures",
             "description": [],
             "signature": [
-              "{ params: { name: string; type: string; optional?: boolean | undefined; noNestingFunctions?: boolean | undefined; supportsWildcard?: boolean | undefined; constantOnly?: boolean | undefined; literalOptions?: string[] | undefined; literalSuggestions?: string[] | undefined; }[]; minParams?: number | undefined; returnType: string; examples?: string[] | undefined; }[]"
+              "{ params: { name: string; type: ",
+              "FunctionParameterType",
+              "; optional?: boolean | undefined; noNestingFunctions?: boolean | undefined; supportsWildcard?: boolean | undefined; constantOnly?: boolean | undefined; literalOptions?: string[] | undefined; literalSuggestions?: string[] | undefined; }[]; minParams?: number | undefined; returnType: ",
+              "FunctionReturnType",
+              "; examples?: string[] | undefined; }[]"
             ],
             "path": "packages/kbn-esql-validation-autocomplete/src/definitions/types.ts",
             "deprecated": false,
diff --git a/api_docs/kbn_esql_validation_autocomplete.mdx b/api_docs/kbn_esql_validation_autocomplete.mdx
index 8bfb894e34295c..0cb3b5f84ed8b2 100644
--- a/api_docs/kbn_esql_validation_autocomplete.mdx
+++ b/api_docs/kbn_esql_validation_autocomplete.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-esql-validation-autocomplete
 title: "@kbn/esql-validation-autocomplete"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/esql-validation-autocomplete plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/esql-validation-autocomplete']
 ---
 import kbnEsqlValidationAutocompleteObj from './kbn_esql_validation_autocomplete.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/kibana-esql](https://github.com/orgs/elastic/teams/kibana-esql
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 194 | 0 | 184 | 8 |
+| 194 | 0 | 184 | 10 |
 
 ## Common
 
diff --git a/api_docs/kbn_event_annotation_common.mdx b/api_docs/kbn_event_annotation_common.mdx
index 4274cb07349c58..b719c2a145503e 100644
--- a/api_docs/kbn_event_annotation_common.mdx
+++ b/api_docs/kbn_event_annotation_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-event-annotation-common
 title: "@kbn/event-annotation-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/event-annotation-common plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/event-annotation-common']
 ---
 import kbnEventAnnotationCommonObj from './kbn_event_annotation_common.devdocs.json';
diff --git a/api_docs/kbn_event_annotation_components.mdx b/api_docs/kbn_event_annotation_components.mdx
index bba225b3b91133..841bc905c6ed93 100644
--- a/api_docs/kbn_event_annotation_components.mdx
+++ b/api_docs/kbn_event_annotation_components.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-event-annotation-components
 title: "@kbn/event-annotation-components"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/event-annotation-components plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/event-annotation-components']
 ---
 import kbnEventAnnotationComponentsObj from './kbn_event_annotation_components.devdocs.json';
diff --git a/api_docs/kbn_expandable_flyout.mdx b/api_docs/kbn_expandable_flyout.mdx
index 714e799fef65d7..e98013c2d01500 100644
--- a/api_docs/kbn_expandable_flyout.mdx
+++ b/api_docs/kbn_expandable_flyout.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-expandable-flyout
 title: "@kbn/expandable-flyout"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/expandable-flyout plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/expandable-flyout']
 ---
 import kbnExpandableFlyoutObj from './kbn_expandable_flyout.devdocs.json';
diff --git a/api_docs/kbn_field_types.mdx b/api_docs/kbn_field_types.mdx
index d48043e6247213..9539e20b62b2cf 100644
--- a/api_docs/kbn_field_types.mdx
+++ b/api_docs/kbn_field_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-field-types
 title: "@kbn/field-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/field-types plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/field-types']
 ---
 import kbnFieldTypesObj from './kbn_field_types.devdocs.json';
diff --git a/api_docs/kbn_field_utils.devdocs.json b/api_docs/kbn_field_utils.devdocs.json
index 157c6b0aeaef48..6ffd8029c74228 100644
--- a/api_docs/kbn_field_utils.devdocs.json
+++ b/api_docs/kbn_field_utils.devdocs.json
@@ -19,6 +19,64 @@
   "common": {
     "classes": [],
     "functions": [
+      {
+        "parentPluginId": "@kbn/field-utils",
+        "id": "def-common.comboBoxFieldOptionMatcher",
+        "type": "Function",
+        "tags": [],
+        "label": "comboBoxFieldOptionMatcher",
+        "description": [
+          "\nAdapts fieldNameWildcardMatcher to combobox props."
+        ],
+        "signature": [
+          "({ option: { name, label }, searchValue, }: { option: { name?: string | undefined; label: string; }; searchValue: string; }) => boolean"
+        ],
+        "path": "packages/kbn-field-utils/src/utils/field_name_wildcard_matcher.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/field-utils",
+            "id": "def-common.comboBoxFieldOptionMatcher.$1",
+            "type": "Object",
+            "tags": [],
+            "label": "{\n  option: { name, label },\n  searchValue,\n}",
+            "description": [],
+            "path": "packages/kbn-field-utils/src/utils/field_name_wildcard_matcher.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [
+              {
+                "parentPluginId": "@kbn/field-utils",
+                "id": "def-common.comboBoxFieldOptionMatcher.$1.option",
+                "type": "Object",
+                "tags": [],
+                "label": "option",
+                "description": [],
+                "signature": [
+                  "{ name?: string | undefined; label: string; }"
+                ],
+                "path": "packages/kbn-field-utils/src/utils/field_name_wildcard_matcher.ts",
+                "deprecated": false,
+                "trackAdoption": false
+              },
+              {
+                "parentPluginId": "@kbn/field-utils",
+                "id": "def-common.comboBoxFieldOptionMatcher.$1.searchValue",
+                "type": "string",
+                "tags": [],
+                "label": "searchValue",
+                "description": [],
+                "path": "packages/kbn-field-utils/src/utils/field_name_wildcard_matcher.ts",
+                "deprecated": false,
+                "trackAdoption": false
+              }
+            ]
+          }
+        ],
+        "returnComment": [],
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "@kbn/field-utils",
         "id": "def-common.FieldDescription",
diff --git a/api_docs/kbn_field_utils.mdx b/api_docs/kbn_field_utils.mdx
index 19033e6ed8232d..cdf0cc5f299baf 100644
--- a/api_docs/kbn_field_utils.mdx
+++ b/api_docs/kbn_field_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-field-utils
 title: "@kbn/field-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/field-utils plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/field-utils']
 ---
 import kbnFieldUtilsObj from './kbn_field_utils.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/kibana-data-discovery](https://github.com/orgs/elastic/teams/k
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 50 | 0 | 42 | 1 |
+| 54 | 0 | 45 | 1 |
 
 ## Common
 
diff --git a/api_docs/kbn_find_used_node_modules.mdx b/api_docs/kbn_find_used_node_modules.mdx
index 4fe930e065ddfb..bd78d8bd8410b1 100644
--- a/api_docs/kbn_find_used_node_modules.mdx
+++ b/api_docs/kbn_find_used_node_modules.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-find-used-node-modules
 title: "@kbn/find-used-node-modules"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/find-used-node-modules plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/find-used-node-modules']
 ---
 import kbnFindUsedNodeModulesObj from './kbn_find_used_node_modules.devdocs.json';
diff --git a/api_docs/kbn_formatters.mdx b/api_docs/kbn_formatters.mdx
index 974150a3002504..df87df5332017d 100644
--- a/api_docs/kbn_formatters.mdx
+++ b/api_docs/kbn_formatters.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-formatters
 title: "@kbn/formatters"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/formatters plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/formatters']
 ---
 import kbnFormattersObj from './kbn_formatters.devdocs.json';
diff --git a/api_docs/kbn_ftr_common_functional_services.mdx b/api_docs/kbn_ftr_common_functional_services.mdx
index 52a2f4632ac70a..0ffe7b36f3d8b3 100644
--- a/api_docs/kbn_ftr_common_functional_services.mdx
+++ b/api_docs/kbn_ftr_common_functional_services.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ftr-common-functional-services
 title: "@kbn/ftr-common-functional-services"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ftr-common-functional-services plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ftr-common-functional-services']
 ---
 import kbnFtrCommonFunctionalServicesObj from './kbn_ftr_common_functional_services.devdocs.json';
diff --git a/api_docs/kbn_ftr_common_functional_ui_services.mdx b/api_docs/kbn_ftr_common_functional_ui_services.mdx
index 2a566f77d39c2a..bca55eed686bd9 100644
--- a/api_docs/kbn_ftr_common_functional_ui_services.mdx
+++ b/api_docs/kbn_ftr_common_functional_ui_services.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ftr-common-functional-ui-services
 title: "@kbn/ftr-common-functional-ui-services"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ftr-common-functional-ui-services plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ftr-common-functional-ui-services']
 ---
 import kbnFtrCommonFunctionalUiServicesObj from './kbn_ftr_common_functional_ui_services.devdocs.json';
diff --git a/api_docs/kbn_generate.mdx b/api_docs/kbn_generate.mdx
index 3d8c56b5792683..571c79c3bb1641 100644
--- a/api_docs/kbn_generate.mdx
+++ b/api_docs/kbn_generate.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-generate
 title: "@kbn/generate"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/generate plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/generate']
 ---
 import kbnGenerateObj from './kbn_generate.devdocs.json';
diff --git a/api_docs/kbn_generate_console_definitions.mdx b/api_docs/kbn_generate_console_definitions.mdx
index 8017604180b56f..f2aceea0233fc1 100644
--- a/api_docs/kbn_generate_console_definitions.mdx
+++ b/api_docs/kbn_generate_console_definitions.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-generate-console-definitions
 title: "@kbn/generate-console-definitions"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/generate-console-definitions plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/generate-console-definitions']
 ---
 import kbnGenerateConsoleDefinitionsObj from './kbn_generate_console_definitions.devdocs.json';
diff --git a/api_docs/kbn_generate_csv.mdx b/api_docs/kbn_generate_csv.mdx
index ee81a66c7b3971..5af85fca0bc809 100644
--- a/api_docs/kbn_generate_csv.mdx
+++ b/api_docs/kbn_generate_csv.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-generate-csv
 title: "@kbn/generate-csv"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/generate-csv plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/generate-csv']
 ---
 import kbnGenerateCsvObj from './kbn_generate_csv.devdocs.json';
diff --git a/api_docs/kbn_guided_onboarding.mdx b/api_docs/kbn_guided_onboarding.mdx
index ba7e307c03eb43..f6c5a7e75a10b9 100644
--- a/api_docs/kbn_guided_onboarding.mdx
+++ b/api_docs/kbn_guided_onboarding.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-guided-onboarding
 title: "@kbn/guided-onboarding"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/guided-onboarding plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/guided-onboarding']
 ---
 import kbnGuidedOnboardingObj from './kbn_guided_onboarding.devdocs.json';
diff --git a/api_docs/kbn_handlebars.mdx b/api_docs/kbn_handlebars.mdx
index 134c64a9559e52..8df4c4d90a6064 100644
--- a/api_docs/kbn_handlebars.mdx
+++ b/api_docs/kbn_handlebars.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-handlebars
 title: "@kbn/handlebars"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/handlebars plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/handlebars']
 ---
 import kbnHandlebarsObj from './kbn_handlebars.devdocs.json';
diff --git a/api_docs/kbn_hapi_mocks.mdx b/api_docs/kbn_hapi_mocks.mdx
index d123da471048ca..bf345fe96f9d45 100644
--- a/api_docs/kbn_hapi_mocks.mdx
+++ b/api_docs/kbn_hapi_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-hapi-mocks
 title: "@kbn/hapi-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/hapi-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/hapi-mocks']
 ---
 import kbnHapiMocksObj from './kbn_hapi_mocks.devdocs.json';
diff --git a/api_docs/kbn_health_gateway_server.mdx b/api_docs/kbn_health_gateway_server.mdx
index ab29833bf040d1..34b6400fd5f051 100644
--- a/api_docs/kbn_health_gateway_server.mdx
+++ b/api_docs/kbn_health_gateway_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-health-gateway-server
 title: "@kbn/health-gateway-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/health-gateway-server plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/health-gateway-server']
 ---
 import kbnHealthGatewayServerObj from './kbn_health_gateway_server.devdocs.json';
diff --git a/api_docs/kbn_home_sample_data_card.mdx b/api_docs/kbn_home_sample_data_card.mdx
index 43755d81745dee..34d808a4f921cc 100644
--- a/api_docs/kbn_home_sample_data_card.mdx
+++ b/api_docs/kbn_home_sample_data_card.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-home-sample-data-card
 title: "@kbn/home-sample-data-card"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/home-sample-data-card plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/home-sample-data-card']
 ---
 import kbnHomeSampleDataCardObj from './kbn_home_sample_data_card.devdocs.json';
diff --git a/api_docs/kbn_home_sample_data_tab.mdx b/api_docs/kbn_home_sample_data_tab.mdx
index 32d5eaaaa1bd11..012f5f5a518fd1 100644
--- a/api_docs/kbn_home_sample_data_tab.mdx
+++ b/api_docs/kbn_home_sample_data_tab.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-home-sample-data-tab
 title: "@kbn/home-sample-data-tab"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/home-sample-data-tab plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/home-sample-data-tab']
 ---
 import kbnHomeSampleDataTabObj from './kbn_home_sample_data_tab.devdocs.json';
diff --git a/api_docs/kbn_i18n.mdx b/api_docs/kbn_i18n.mdx
index 217fb53ff73683..1e38aa299fa1e6 100644
--- a/api_docs/kbn_i18n.mdx
+++ b/api_docs/kbn_i18n.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-i18n
 title: "@kbn/i18n"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/i18n plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/i18n']
 ---
 import kbnI18nObj from './kbn_i18n.devdocs.json';
diff --git a/api_docs/kbn_i18n_react.mdx b/api_docs/kbn_i18n_react.mdx
index e6ad55496248df..b39840096dad46 100644
--- a/api_docs/kbn_i18n_react.mdx
+++ b/api_docs/kbn_i18n_react.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-i18n-react
 title: "@kbn/i18n-react"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/i18n-react plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/i18n-react']
 ---
 import kbnI18nReactObj from './kbn_i18n_react.devdocs.json';
diff --git a/api_docs/kbn_import_resolver.mdx b/api_docs/kbn_import_resolver.mdx
index e2743ce6694379..df88eedf3949ed 100644
--- a/api_docs/kbn_import_resolver.mdx
+++ b/api_docs/kbn_import_resolver.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-import-resolver
 title: "@kbn/import-resolver"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/import-resolver plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/import-resolver']
 ---
 import kbnImportResolverObj from './kbn_import_resolver.devdocs.json';
diff --git a/api_docs/kbn_index_management.mdx b/api_docs/kbn_index_management.mdx
index 8438f1095f70b5..ca9bf7df061bad 100644
--- a/api_docs/kbn_index_management.mdx
+++ b/api_docs/kbn_index_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-index-management
 title: "@kbn/index-management"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/index-management plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/index-management']
 ---
 import kbnIndexManagementObj from './kbn_index_management.devdocs.json';
diff --git a/api_docs/kbn_inference_integration_flyout.mdx b/api_docs/kbn_inference_integration_flyout.mdx
index 999af2b0296d1e..ed414157eebe9b 100644
--- a/api_docs/kbn_inference_integration_flyout.mdx
+++ b/api_docs/kbn_inference_integration_flyout.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-inference_integration_flyout
 title: "@kbn/inference_integration_flyout"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/inference_integration_flyout plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/inference_integration_flyout']
 ---
 import kbnInferenceIntegrationFlyoutObj from './kbn_inference_integration_flyout.devdocs.json';
diff --git a/api_docs/kbn_infra_forge.mdx b/api_docs/kbn_infra_forge.mdx
index b085079f884816..0a2805ca42f6fc 100644
--- a/api_docs/kbn_infra_forge.mdx
+++ b/api_docs/kbn_infra_forge.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-infra-forge
 title: "@kbn/infra-forge"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/infra-forge plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/infra-forge']
 ---
 import kbnInfraForgeObj from './kbn_infra_forge.devdocs.json';
diff --git a/api_docs/kbn_interpreter.mdx b/api_docs/kbn_interpreter.mdx
index a775986c7d53eb..f1fbda749e4d44 100644
--- a/api_docs/kbn_interpreter.mdx
+++ b/api_docs/kbn_interpreter.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-interpreter
 title: "@kbn/interpreter"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/interpreter plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/interpreter']
 ---
 import kbnInterpreterObj from './kbn_interpreter.devdocs.json';
diff --git a/api_docs/kbn_io_ts_utils.mdx b/api_docs/kbn_io_ts_utils.mdx
index 2b03e86f0830da..250343e45f3e15 100644
--- a/api_docs/kbn_io_ts_utils.mdx
+++ b/api_docs/kbn_io_ts_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-io-ts-utils
 title: "@kbn/io-ts-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/io-ts-utils plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/io-ts-utils']
 ---
 import kbnIoTsUtilsObj from './kbn_io_ts_utils.devdocs.json';
diff --git a/api_docs/kbn_ipynb.mdx b/api_docs/kbn_ipynb.mdx
index 7482626030ea6c..e70428e89118fb 100644
--- a/api_docs/kbn_ipynb.mdx
+++ b/api_docs/kbn_ipynb.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ipynb
 title: "@kbn/ipynb"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ipynb plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ipynb']
 ---
 import kbnIpynbObj from './kbn_ipynb.devdocs.json';
diff --git a/api_docs/kbn_jest_serializers.mdx b/api_docs/kbn_jest_serializers.mdx
index c2195c032ec2e4..298616f35643df 100644
--- a/api_docs/kbn_jest_serializers.mdx
+++ b/api_docs/kbn_jest_serializers.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-jest-serializers
 title: "@kbn/jest-serializers"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/jest-serializers plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/jest-serializers']
 ---
 import kbnJestSerializersObj from './kbn_jest_serializers.devdocs.json';
diff --git a/api_docs/kbn_journeys.mdx b/api_docs/kbn_journeys.mdx
index 70bede53ceeed4..5c8bd84d0bdad7 100644
--- a/api_docs/kbn_journeys.mdx
+++ b/api_docs/kbn_journeys.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-journeys
 title: "@kbn/journeys"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/journeys plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/journeys']
 ---
 import kbnJourneysObj from './kbn_journeys.devdocs.json';
diff --git a/api_docs/kbn_json_ast.mdx b/api_docs/kbn_json_ast.mdx
index 39db67150f5b67..9b6165220d6aec 100644
--- a/api_docs/kbn_json_ast.mdx
+++ b/api_docs/kbn_json_ast.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-json-ast
 title: "@kbn/json-ast"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/json-ast plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/json-ast']
 ---
 import kbnJsonAstObj from './kbn_json_ast.devdocs.json';
diff --git a/api_docs/kbn_kibana_manifest_schema.mdx b/api_docs/kbn_kibana_manifest_schema.mdx
index f7129239854a86..0af9a61477036c 100644
--- a/api_docs/kbn_kibana_manifest_schema.mdx
+++ b/api_docs/kbn_kibana_manifest_schema.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-kibana-manifest-schema
 title: "@kbn/kibana-manifest-schema"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/kibana-manifest-schema plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/kibana-manifest-schema']
 ---
 import kbnKibanaManifestSchemaObj from './kbn_kibana_manifest_schema.devdocs.json';
diff --git a/api_docs/kbn_language_documentation_popover.mdx b/api_docs/kbn_language_documentation_popover.mdx
index 4c32c332b51904..50971ac1f2f08e 100644
--- a/api_docs/kbn_language_documentation_popover.mdx
+++ b/api_docs/kbn_language_documentation_popover.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-language-documentation-popover
 title: "@kbn/language-documentation-popover"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/language-documentation-popover plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/language-documentation-popover']
 ---
 import kbnLanguageDocumentationPopoverObj from './kbn_language_documentation_popover.devdocs.json';
diff --git a/api_docs/kbn_lens_embeddable_utils.mdx b/api_docs/kbn_lens_embeddable_utils.mdx
index 007f047532bf62..816eaa5bde7e4d 100644
--- a/api_docs/kbn_lens_embeddable_utils.mdx
+++ b/api_docs/kbn_lens_embeddable_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-lens-embeddable-utils
 title: "@kbn/lens-embeddable-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/lens-embeddable-utils plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/lens-embeddable-utils']
 ---
 import kbnLensEmbeddableUtilsObj from './kbn_lens_embeddable_utils.devdocs.json';
diff --git a/api_docs/kbn_lens_formula_docs.mdx b/api_docs/kbn_lens_formula_docs.mdx
index b48938bd65d6a4..05847a988a784f 100644
--- a/api_docs/kbn_lens_formula_docs.mdx
+++ b/api_docs/kbn_lens_formula_docs.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-lens-formula-docs
 title: "@kbn/lens-formula-docs"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/lens-formula-docs plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/lens-formula-docs']
 ---
 import kbnLensFormulaDocsObj from './kbn_lens_formula_docs.devdocs.json';
diff --git a/api_docs/kbn_logging.mdx b/api_docs/kbn_logging.mdx
index 07863ac75898c4..11608cef196420 100644
--- a/api_docs/kbn_logging.mdx
+++ b/api_docs/kbn_logging.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-logging
 title: "@kbn/logging"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/logging plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/logging']
 ---
 import kbnLoggingObj from './kbn_logging.devdocs.json';
diff --git a/api_docs/kbn_logging_mocks.mdx b/api_docs/kbn_logging_mocks.mdx
index 521da338535ad8..cac5a50f9a2397 100644
--- a/api_docs/kbn_logging_mocks.mdx
+++ b/api_docs/kbn_logging_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-logging-mocks
 title: "@kbn/logging-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/logging-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/logging-mocks']
 ---
 import kbnLoggingMocksObj from './kbn_logging_mocks.devdocs.json';
diff --git a/api_docs/kbn_managed_content_badge.mdx b/api_docs/kbn_managed_content_badge.mdx
index edca248e8febf8..fe794f81e3e5c4 100644
--- a/api_docs/kbn_managed_content_badge.mdx
+++ b/api_docs/kbn_managed_content_badge.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-managed-content-badge
 title: "@kbn/managed-content-badge"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/managed-content-badge plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/managed-content-badge']
 ---
 import kbnManagedContentBadgeObj from './kbn_managed_content_badge.devdocs.json';
diff --git a/api_docs/kbn_managed_vscode_config.mdx b/api_docs/kbn_managed_vscode_config.mdx
index 04a0809b83a8af..1ab255f1e87fd0 100644
--- a/api_docs/kbn_managed_vscode_config.mdx
+++ b/api_docs/kbn_managed_vscode_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-managed-vscode-config
 title: "@kbn/managed-vscode-config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/managed-vscode-config plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/managed-vscode-config']
 ---
 import kbnManagedVscodeConfigObj from './kbn_managed_vscode_config.devdocs.json';
diff --git a/api_docs/kbn_management_cards_navigation.mdx b/api_docs/kbn_management_cards_navigation.mdx
index 05b4f4de0765fd..068e634dca41de 100644
--- a/api_docs/kbn_management_cards_navigation.mdx
+++ b/api_docs/kbn_management_cards_navigation.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-management-cards-navigation
 title: "@kbn/management-cards-navigation"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/management-cards-navigation plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/management-cards-navigation']
 ---
 import kbnManagementCardsNavigationObj from './kbn_management_cards_navigation.devdocs.json';
diff --git a/api_docs/kbn_management_settings_application.mdx b/api_docs/kbn_management_settings_application.mdx
index a3174dfc9a58cc..0f98b7220df927 100644
--- a/api_docs/kbn_management_settings_application.mdx
+++ b/api_docs/kbn_management_settings_application.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-management-settings-application
 title: "@kbn/management-settings-application"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/management-settings-application plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/management-settings-application']
 ---
 import kbnManagementSettingsApplicationObj from './kbn_management_settings_application.devdocs.json';
diff --git a/api_docs/kbn_management_settings_components_field_category.mdx b/api_docs/kbn_management_settings_components_field_category.mdx
index ee1634f9d9047e..f9588131c1ef11 100644
--- a/api_docs/kbn_management_settings_components_field_category.mdx
+++ b/api_docs/kbn_management_settings_components_field_category.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-management-settings-components-field-category
 title: "@kbn/management-settings-components-field-category"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/management-settings-components-field-category plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/management-settings-components-field-category']
 ---
 import kbnManagementSettingsComponentsFieldCategoryObj from './kbn_management_settings_components_field_category.devdocs.json';
diff --git a/api_docs/kbn_management_settings_components_field_input.mdx b/api_docs/kbn_management_settings_components_field_input.mdx
index d3b17bee5d9af3..1cf99282980039 100644
--- a/api_docs/kbn_management_settings_components_field_input.mdx
+++ b/api_docs/kbn_management_settings_components_field_input.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-management-settings-components-field-input
 title: "@kbn/management-settings-components-field-input"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/management-settings-components-field-input plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/management-settings-components-field-input']
 ---
 import kbnManagementSettingsComponentsFieldInputObj from './kbn_management_settings_components_field_input.devdocs.json';
diff --git a/api_docs/kbn_management_settings_components_field_row.mdx b/api_docs/kbn_management_settings_components_field_row.mdx
index ebf7c1a15d28f7..6776f3591ca137 100644
--- a/api_docs/kbn_management_settings_components_field_row.mdx
+++ b/api_docs/kbn_management_settings_components_field_row.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-management-settings-components-field-row
 title: "@kbn/management-settings-components-field-row"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/management-settings-components-field-row plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/management-settings-components-field-row']
 ---
 import kbnManagementSettingsComponentsFieldRowObj from './kbn_management_settings_components_field_row.devdocs.json';
diff --git a/api_docs/kbn_management_settings_components_form.mdx b/api_docs/kbn_management_settings_components_form.mdx
index 924060f1d7883a..701366e69d66d7 100644
--- a/api_docs/kbn_management_settings_components_form.mdx
+++ b/api_docs/kbn_management_settings_components_form.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-management-settings-components-form
 title: "@kbn/management-settings-components-form"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/management-settings-components-form plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/management-settings-components-form']
 ---
 import kbnManagementSettingsComponentsFormObj from './kbn_management_settings_components_form.devdocs.json';
diff --git a/api_docs/kbn_management_settings_field_definition.mdx b/api_docs/kbn_management_settings_field_definition.mdx
index fd0247b754e2c0..49b396a2017ff7 100644
--- a/api_docs/kbn_management_settings_field_definition.mdx
+++ b/api_docs/kbn_management_settings_field_definition.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-management-settings-field-definition
 title: "@kbn/management-settings-field-definition"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/management-settings-field-definition plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/management-settings-field-definition']
 ---
 import kbnManagementSettingsFieldDefinitionObj from './kbn_management_settings_field_definition.devdocs.json';
diff --git a/api_docs/kbn_management_settings_ids.devdocs.json b/api_docs/kbn_management_settings_ids.devdocs.json
index c8f7feb0d22149..4495e0bc68ae0c 100644
--- a/api_docs/kbn_management_settings_ids.devdocs.json
+++ b/api_docs/kbn_management_settings_ids.devdocs.json
@@ -1162,6 +1162,21 @@
         "trackAdoption": false,
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "@kbn/management-settings-ids",
+        "id": "def-common.OBSERVABILITY_APM_ENABLE_MULTI_SIGNAL",
+        "type": "string",
+        "tags": [],
+        "label": "OBSERVABILITY_APM_ENABLE_MULTI_SIGNAL",
+        "description": [],
+        "signature": [
+          "\"observability:apmEnableMultiSignal\""
+        ],
+        "path": "packages/kbn-management/settings/setting_ids/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "@kbn/management-settings-ids",
         "id": "def-common.OBSERVABILITY_APM_ENABLE_PROFILING_INTEGRATION_ID",
diff --git a/api_docs/kbn_management_settings_ids.mdx b/api_docs/kbn_management_settings_ids.mdx
index d634e0dd0b0b22..ecabec04c27742 100644
--- a/api_docs/kbn_management_settings_ids.mdx
+++ b/api_docs/kbn_management_settings_ids.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-management-settings-ids
 title: "@kbn/management-settings-ids"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/management-settings-ids plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/management-settings-ids']
 ---
 import kbnManagementSettingsIdsObj from './kbn_management_settings_ids.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/appex-sharedux @elastic/kibana-management](https://github.com/
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 137 | 0 | 134 | 0 |
+| 138 | 0 | 135 | 0 |
 
 ## Common
 
diff --git a/api_docs/kbn_management_settings_section_registry.mdx b/api_docs/kbn_management_settings_section_registry.mdx
index eb94baf88647e2..c3427e15f390af 100644
--- a/api_docs/kbn_management_settings_section_registry.mdx
+++ b/api_docs/kbn_management_settings_section_registry.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-management-settings-section-registry
 title: "@kbn/management-settings-section-registry"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/management-settings-section-registry plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/management-settings-section-registry']
 ---
 import kbnManagementSettingsSectionRegistryObj from './kbn_management_settings_section_registry.devdocs.json';
diff --git a/api_docs/kbn_management_settings_types.mdx b/api_docs/kbn_management_settings_types.mdx
index 7083722d173305..6ff538bb75cebb 100644
--- a/api_docs/kbn_management_settings_types.mdx
+++ b/api_docs/kbn_management_settings_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-management-settings-types
 title: "@kbn/management-settings-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/management-settings-types plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/management-settings-types']
 ---
 import kbnManagementSettingsTypesObj from './kbn_management_settings_types.devdocs.json';
diff --git a/api_docs/kbn_management_settings_utilities.mdx b/api_docs/kbn_management_settings_utilities.mdx
index 3d0813557f2fea..5c77182dde9a6e 100644
--- a/api_docs/kbn_management_settings_utilities.mdx
+++ b/api_docs/kbn_management_settings_utilities.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-management-settings-utilities
 title: "@kbn/management-settings-utilities"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/management-settings-utilities plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/management-settings-utilities']
 ---
 import kbnManagementSettingsUtilitiesObj from './kbn_management_settings_utilities.devdocs.json';
diff --git a/api_docs/kbn_management_storybook_config.mdx b/api_docs/kbn_management_storybook_config.mdx
index d7911002d978d1..5ed55573da06b5 100644
--- a/api_docs/kbn_management_storybook_config.mdx
+++ b/api_docs/kbn_management_storybook_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-management-storybook-config
 title: "@kbn/management-storybook-config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/management-storybook-config plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/management-storybook-config']
 ---
 import kbnManagementStorybookConfigObj from './kbn_management_storybook_config.devdocs.json';
diff --git a/api_docs/kbn_mapbox_gl.mdx b/api_docs/kbn_mapbox_gl.mdx
index 794daff86be13f..fcb5346052ef99 100644
--- a/api_docs/kbn_mapbox_gl.mdx
+++ b/api_docs/kbn_mapbox_gl.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-mapbox-gl
 title: "@kbn/mapbox-gl"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/mapbox-gl plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/mapbox-gl']
 ---
 import kbnMapboxGlObj from './kbn_mapbox_gl.devdocs.json';
diff --git a/api_docs/kbn_maps_vector_tile_utils.mdx b/api_docs/kbn_maps_vector_tile_utils.mdx
index d8d7339cf5e787..8e19cf40cdf6b8 100644
--- a/api_docs/kbn_maps_vector_tile_utils.mdx
+++ b/api_docs/kbn_maps_vector_tile_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-maps-vector-tile-utils
 title: "@kbn/maps-vector-tile-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/maps-vector-tile-utils plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/maps-vector-tile-utils']
 ---
 import kbnMapsVectorTileUtilsObj from './kbn_maps_vector_tile_utils.devdocs.json';
diff --git a/api_docs/kbn_ml_agg_utils.mdx b/api_docs/kbn_ml_agg_utils.mdx
index a932eb64c2e394..6f93dff55bbe2e 100644
--- a/api_docs/kbn_ml_agg_utils.mdx
+++ b/api_docs/kbn_ml_agg_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-agg-utils
 title: "@kbn/ml-agg-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-agg-utils plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-agg-utils']
 ---
 import kbnMlAggUtilsObj from './kbn_ml_agg_utils.devdocs.json';
diff --git a/api_docs/kbn_ml_anomaly_utils.mdx b/api_docs/kbn_ml_anomaly_utils.mdx
index 9c52d95815276c..a78f1b5819800a 100644
--- a/api_docs/kbn_ml_anomaly_utils.mdx
+++ b/api_docs/kbn_ml_anomaly_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-anomaly-utils
 title: "@kbn/ml-anomaly-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-anomaly-utils plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-anomaly-utils']
 ---
 import kbnMlAnomalyUtilsObj from './kbn_ml_anomaly_utils.devdocs.json';
diff --git a/api_docs/kbn_ml_cancellable_search.mdx b/api_docs/kbn_ml_cancellable_search.mdx
index e71fa8c778bcc9..06e0e17631700c 100644
--- a/api_docs/kbn_ml_cancellable_search.mdx
+++ b/api_docs/kbn_ml_cancellable_search.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-cancellable-search
 title: "@kbn/ml-cancellable-search"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-cancellable-search plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-cancellable-search']
 ---
 import kbnMlCancellableSearchObj from './kbn_ml_cancellable_search.devdocs.json';
diff --git a/api_docs/kbn_ml_category_validator.mdx b/api_docs/kbn_ml_category_validator.mdx
index 8772b9bacff3c6..054801d5f0df86 100644
--- a/api_docs/kbn_ml_category_validator.mdx
+++ b/api_docs/kbn_ml_category_validator.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-category-validator
 title: "@kbn/ml-category-validator"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-category-validator plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-category-validator']
 ---
 import kbnMlCategoryValidatorObj from './kbn_ml_category_validator.devdocs.json';
diff --git a/api_docs/kbn_ml_chi2test.mdx b/api_docs/kbn_ml_chi2test.mdx
index 50bf4f49cff32a..4efbcff937f7ec 100644
--- a/api_docs/kbn_ml_chi2test.mdx
+++ b/api_docs/kbn_ml_chi2test.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-chi2test
 title: "@kbn/ml-chi2test"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-chi2test plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-chi2test']
 ---
 import kbnMlChi2testObj from './kbn_ml_chi2test.devdocs.json';
diff --git a/api_docs/kbn_ml_data_frame_analytics_utils.mdx b/api_docs/kbn_ml_data_frame_analytics_utils.mdx
index 2754cf1e03fa85..7ab7b725738de6 100644
--- a/api_docs/kbn_ml_data_frame_analytics_utils.mdx
+++ b/api_docs/kbn_ml_data_frame_analytics_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-data-frame-analytics-utils
 title: "@kbn/ml-data-frame-analytics-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-data-frame-analytics-utils plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-data-frame-analytics-utils']
 ---
 import kbnMlDataFrameAnalyticsUtilsObj from './kbn_ml_data_frame_analytics_utils.devdocs.json';
diff --git a/api_docs/kbn_ml_data_grid.mdx b/api_docs/kbn_ml_data_grid.mdx
index f4ee1cb631afd5..2abec14bb797c0 100644
--- a/api_docs/kbn_ml_data_grid.mdx
+++ b/api_docs/kbn_ml_data_grid.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-data-grid
 title: "@kbn/ml-data-grid"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-data-grid plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-data-grid']
 ---
 import kbnMlDataGridObj from './kbn_ml_data_grid.devdocs.json';
diff --git a/api_docs/kbn_ml_date_picker.mdx b/api_docs/kbn_ml_date_picker.mdx
index a223f2ff3b58e5..0f7369c393678d 100644
--- a/api_docs/kbn_ml_date_picker.mdx
+++ b/api_docs/kbn_ml_date_picker.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-date-picker
 title: "@kbn/ml-date-picker"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-date-picker plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-date-picker']
 ---
 import kbnMlDatePickerObj from './kbn_ml_date_picker.devdocs.json';
diff --git a/api_docs/kbn_ml_date_utils.mdx b/api_docs/kbn_ml_date_utils.mdx
index 99445b4aab055e..a35fee5e5810a5 100644
--- a/api_docs/kbn_ml_date_utils.mdx
+++ b/api_docs/kbn_ml_date_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-date-utils
 title: "@kbn/ml-date-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-date-utils plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-date-utils']
 ---
 import kbnMlDateUtilsObj from './kbn_ml_date_utils.devdocs.json';
diff --git a/api_docs/kbn_ml_error_utils.mdx b/api_docs/kbn_ml_error_utils.mdx
index 887ef8539beb11..22552f7a83ad0a 100644
--- a/api_docs/kbn_ml_error_utils.mdx
+++ b/api_docs/kbn_ml_error_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-error-utils
 title: "@kbn/ml-error-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-error-utils plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-error-utils']
 ---
 import kbnMlErrorUtilsObj from './kbn_ml_error_utils.devdocs.json';
diff --git a/api_docs/kbn_ml_in_memory_table.mdx b/api_docs/kbn_ml_in_memory_table.mdx
index f404ae663ddce2..04dab818de4e1a 100644
--- a/api_docs/kbn_ml_in_memory_table.mdx
+++ b/api_docs/kbn_ml_in_memory_table.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-in-memory-table
 title: "@kbn/ml-in-memory-table"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-in-memory-table plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-in-memory-table']
 ---
 import kbnMlInMemoryTableObj from './kbn_ml_in_memory_table.devdocs.json';
diff --git a/api_docs/kbn_ml_is_defined.mdx b/api_docs/kbn_ml_is_defined.mdx
index 255fd276703b6e..6fe0f4851f5072 100644
--- a/api_docs/kbn_ml_is_defined.mdx
+++ b/api_docs/kbn_ml_is_defined.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-is-defined
 title: "@kbn/ml-is-defined"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-is-defined plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-is-defined']
 ---
 import kbnMlIsDefinedObj from './kbn_ml_is_defined.devdocs.json';
diff --git a/api_docs/kbn_ml_is_populated_object.mdx b/api_docs/kbn_ml_is_populated_object.mdx
index 2b31a682c035ed..8de01253f66549 100644
--- a/api_docs/kbn_ml_is_populated_object.mdx
+++ b/api_docs/kbn_ml_is_populated_object.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-is-populated-object
 title: "@kbn/ml-is-populated-object"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-is-populated-object plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-is-populated-object']
 ---
 import kbnMlIsPopulatedObjectObj from './kbn_ml_is_populated_object.devdocs.json';
diff --git a/api_docs/kbn_ml_kibana_theme.mdx b/api_docs/kbn_ml_kibana_theme.mdx
index e221dd4ad7f7dc..40caba79cd8b76 100644
--- a/api_docs/kbn_ml_kibana_theme.mdx
+++ b/api_docs/kbn_ml_kibana_theme.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-kibana-theme
 title: "@kbn/ml-kibana-theme"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-kibana-theme plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-kibana-theme']
 ---
 import kbnMlKibanaThemeObj from './kbn_ml_kibana_theme.devdocs.json';
diff --git a/api_docs/kbn_ml_local_storage.mdx b/api_docs/kbn_ml_local_storage.mdx
index 5b7310bf3cd476..113ea8c1b160c7 100644
--- a/api_docs/kbn_ml_local_storage.mdx
+++ b/api_docs/kbn_ml_local_storage.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-local-storage
 title: "@kbn/ml-local-storage"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-local-storage plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-local-storage']
 ---
 import kbnMlLocalStorageObj from './kbn_ml_local_storage.devdocs.json';
diff --git a/api_docs/kbn_ml_nested_property.mdx b/api_docs/kbn_ml_nested_property.mdx
index b8eb222ffa0ca0..e4cb879d654f12 100644
--- a/api_docs/kbn_ml_nested_property.mdx
+++ b/api_docs/kbn_ml_nested_property.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-nested-property
 title: "@kbn/ml-nested-property"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-nested-property plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-nested-property']
 ---
 import kbnMlNestedPropertyObj from './kbn_ml_nested_property.devdocs.json';
diff --git a/api_docs/kbn_ml_number_utils.mdx b/api_docs/kbn_ml_number_utils.mdx
index eb85af6221bed3..f95b12fbf3c861 100644
--- a/api_docs/kbn_ml_number_utils.mdx
+++ b/api_docs/kbn_ml_number_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-number-utils
 title: "@kbn/ml-number-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-number-utils plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-number-utils']
 ---
 import kbnMlNumberUtilsObj from './kbn_ml_number_utils.devdocs.json';
diff --git a/api_docs/kbn_ml_query_utils.mdx b/api_docs/kbn_ml_query_utils.mdx
index 46a9d2ed0d6753..3e3c3d0baadc06 100644
--- a/api_docs/kbn_ml_query_utils.mdx
+++ b/api_docs/kbn_ml_query_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-query-utils
 title: "@kbn/ml-query-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-query-utils plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-query-utils']
 ---
 import kbnMlQueryUtilsObj from './kbn_ml_query_utils.devdocs.json';
diff --git a/api_docs/kbn_ml_random_sampler_utils.mdx b/api_docs/kbn_ml_random_sampler_utils.mdx
index 369f2ea1ab16e0..1b17fff3a5aab0 100644
--- a/api_docs/kbn_ml_random_sampler_utils.mdx
+++ b/api_docs/kbn_ml_random_sampler_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-random-sampler-utils
 title: "@kbn/ml-random-sampler-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-random-sampler-utils plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-random-sampler-utils']
 ---
 import kbnMlRandomSamplerUtilsObj from './kbn_ml_random_sampler_utils.devdocs.json';
diff --git a/api_docs/kbn_ml_route_utils.mdx b/api_docs/kbn_ml_route_utils.mdx
index 97171eb7ddad27..aa1b41d253bd33 100644
--- a/api_docs/kbn_ml_route_utils.mdx
+++ b/api_docs/kbn_ml_route_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-route-utils
 title: "@kbn/ml-route-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-route-utils plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-route-utils']
 ---
 import kbnMlRouteUtilsObj from './kbn_ml_route_utils.devdocs.json';
diff --git a/api_docs/kbn_ml_runtime_field_utils.mdx b/api_docs/kbn_ml_runtime_field_utils.mdx
index bcb0bbfd1dbd30..e45696fd4511b9 100644
--- a/api_docs/kbn_ml_runtime_field_utils.mdx
+++ b/api_docs/kbn_ml_runtime_field_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-runtime-field-utils
 title: "@kbn/ml-runtime-field-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-runtime-field-utils plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-runtime-field-utils']
 ---
 import kbnMlRuntimeFieldUtilsObj from './kbn_ml_runtime_field_utils.devdocs.json';
diff --git a/api_docs/kbn_ml_string_hash.mdx b/api_docs/kbn_ml_string_hash.mdx
index b9502c70e0b2d7..958d080ef80b84 100644
--- a/api_docs/kbn_ml_string_hash.mdx
+++ b/api_docs/kbn_ml_string_hash.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-string-hash
 title: "@kbn/ml-string-hash"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-string-hash plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-string-hash']
 ---
 import kbnMlStringHashObj from './kbn_ml_string_hash.devdocs.json';
diff --git a/api_docs/kbn_ml_time_buckets.mdx b/api_docs/kbn_ml_time_buckets.mdx
index 1eb3af665d872c..da6009015a033d 100644
--- a/api_docs/kbn_ml_time_buckets.mdx
+++ b/api_docs/kbn_ml_time_buckets.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-time-buckets
 title: "@kbn/ml-time-buckets"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-time-buckets plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-time-buckets']
 ---
 import kbnMlTimeBucketsObj from './kbn_ml_time_buckets.devdocs.json';
diff --git a/api_docs/kbn_ml_trained_models_utils.mdx b/api_docs/kbn_ml_trained_models_utils.mdx
index 0ac9c1e2feeb86..f62e582ef0f02d 100644
--- a/api_docs/kbn_ml_trained_models_utils.mdx
+++ b/api_docs/kbn_ml_trained_models_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-trained-models-utils
 title: "@kbn/ml-trained-models-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-trained-models-utils plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-trained-models-utils']
 ---
 import kbnMlTrainedModelsUtilsObj from './kbn_ml_trained_models_utils.devdocs.json';
diff --git a/api_docs/kbn_ml_ui_actions.mdx b/api_docs/kbn_ml_ui_actions.mdx
index 9fc0c07fd73a72..94e1d943f60aff 100644
--- a/api_docs/kbn_ml_ui_actions.mdx
+++ b/api_docs/kbn_ml_ui_actions.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-ui-actions
 title: "@kbn/ml-ui-actions"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-ui-actions plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-ui-actions']
 ---
 import kbnMlUiActionsObj from './kbn_ml_ui_actions.devdocs.json';
diff --git a/api_docs/kbn_ml_url_state.mdx b/api_docs/kbn_ml_url_state.mdx
index e855a50880ab49..0d9d8032ec225e 100644
--- a/api_docs/kbn_ml_url_state.mdx
+++ b/api_docs/kbn_ml_url_state.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-url-state
 title: "@kbn/ml-url-state"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-url-state plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-url-state']
 ---
 import kbnMlUrlStateObj from './kbn_ml_url_state.devdocs.json';
diff --git a/api_docs/kbn_mock_idp_utils.mdx b/api_docs/kbn_mock_idp_utils.mdx
index 69e43f7294bbb6..76a817073878db 100644
--- a/api_docs/kbn_mock_idp_utils.mdx
+++ b/api_docs/kbn_mock_idp_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-mock-idp-utils
 title: "@kbn/mock-idp-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/mock-idp-utils plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/mock-idp-utils']
 ---
 import kbnMockIdpUtilsObj from './kbn_mock_idp_utils.devdocs.json';
diff --git a/api_docs/kbn_monaco.mdx b/api_docs/kbn_monaco.mdx
index 9f27c78cdc1065..547572b10fc753 100644
--- a/api_docs/kbn_monaco.mdx
+++ b/api_docs/kbn_monaco.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-monaco
 title: "@kbn/monaco"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/monaco plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/monaco']
 ---
 import kbnMonacoObj from './kbn_monaco.devdocs.json';
diff --git a/api_docs/kbn_object_versioning.mdx b/api_docs/kbn_object_versioning.mdx
index 7f6cf3e8ba7bbd..9f787e8838386b 100644
--- a/api_docs/kbn_object_versioning.mdx
+++ b/api_docs/kbn_object_versioning.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-object-versioning
 title: "@kbn/object-versioning"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/object-versioning plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/object-versioning']
 ---
 import kbnObjectVersioningObj from './kbn_object_versioning.devdocs.json';
diff --git a/api_docs/kbn_observability_alert_details.devdocs.json b/api_docs/kbn_observability_alert_details.devdocs.json
index d88ae9dc210990..f5de812cee8b54 100644
--- a/api_docs/kbn_observability_alert_details.devdocs.json
+++ b/api_docs/kbn_observability_alert_details.devdocs.json
@@ -126,7 +126,7 @@
         "label": "AlertThresholdTimeRangeRect",
         "description": [],
         "signature": [
-          "({ alertStarted, color, id, threshold }: Props) => JSX.Element"
+          "({ color, id, threshold }: Props) => JSX.Element"
         ],
         "path": "x-pack/packages/observability/alert_details/src/components/alert_threshold_time_range_rect.tsx",
         "deprecated": false,
@@ -137,7 +137,7 @@
             "id": "def-common.AlertThresholdTimeRangeRect.$1",
             "type": "Object",
             "tags": [],
-            "label": "{ alertStarted, color, id, threshold }",
+            "label": "{ color, id, threshold }",
             "description": [],
             "signature": [
               "Props"
diff --git a/api_docs/kbn_observability_alert_details.mdx b/api_docs/kbn_observability_alert_details.mdx
index 54d5b15fc81259..9b66eda1d633e8 100644
--- a/api_docs/kbn_observability_alert_details.mdx
+++ b/api_docs/kbn_observability_alert_details.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-observability-alert-details
 title: "@kbn/observability-alert-details"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/observability-alert-details plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/observability-alert-details']
 ---
 import kbnObservabilityAlertDetailsObj from './kbn_observability_alert_details.devdocs.json';
diff --git a/api_docs/kbn_observability_alerting_test_data.mdx b/api_docs/kbn_observability_alerting_test_data.mdx
index 9c06593288d50a..7a7342c4d54921 100644
--- a/api_docs/kbn_observability_alerting_test_data.mdx
+++ b/api_docs/kbn_observability_alerting_test_data.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-observability-alerting-test-data
 title: "@kbn/observability-alerting-test-data"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/observability-alerting-test-data plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/observability-alerting-test-data']
 ---
 import kbnObservabilityAlertingTestDataObj from './kbn_observability_alerting_test_data.devdocs.json';
diff --git a/api_docs/kbn_observability_get_padded_alert_time_range_util.mdx b/api_docs/kbn_observability_get_padded_alert_time_range_util.mdx
index 6c8fedabb6751d..b1d889655ddaf6 100644
--- a/api_docs/kbn_observability_get_padded_alert_time_range_util.mdx
+++ b/api_docs/kbn_observability_get_padded_alert_time_range_util.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-observability-get-padded-alert-time-range-util
 title: "@kbn/observability-get-padded-alert-time-range-util"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/observability-get-padded-alert-time-range-util plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/observability-get-padded-alert-time-range-util']
 ---
 import kbnObservabilityGetPaddedAlertTimeRangeUtilObj from './kbn_observability_get_padded_alert_time_range_util.devdocs.json';
diff --git a/api_docs/kbn_openapi_bundler.devdocs.json b/api_docs/kbn_openapi_bundler.devdocs.json
index bfb8dad96559b8..08edc2847eb069 100644
--- a/api_docs/kbn_openapi_bundler.devdocs.json
+++ b/api_docs/kbn_openapi_bundler.devdocs.json
@@ -27,7 +27,7 @@
         "label": "bundle",
         "description": [],
         "signature": [
-          "(config: ",
+          "({ sourceGlob, outputFilePath, specInfo, }: ",
           {
             "pluginId": "@kbn/openapi-bundler",
             "scope": "common",
@@ -46,7 +46,7 @@
             "id": "def-common.bundle.$1",
             "type": "Object",
             "tags": [],
-            "label": "config",
+            "label": "{\n  sourceGlob,\n  outputFilePath = 'bundled-{version}.schema.yaml',\n  specInfo,\n}",
             "description": [],
             "signature": [
               {
@@ -81,10 +81,10 @@
         "children": [
           {
             "parentPluginId": "@kbn/openapi-bundler",
-            "id": "def-common.BundlerConfig.rootDir",
+            "id": "def-common.BundlerConfig.sourceGlob",
             "type": "string",
             "tags": [],
-            "label": "rootDir",
+            "label": "sourceGlob",
             "description": [],
             "path": "packages/kbn-openapi-bundler/src/openapi_bundler.ts",
             "deprecated": false,
@@ -92,10 +92,10 @@
           },
           {
             "parentPluginId": "@kbn/openapi-bundler",
-            "id": "def-common.BundlerConfig.sourceGlob",
+            "id": "def-common.BundlerConfig.outputFilePath",
             "type": "string",
             "tags": [],
-            "label": "sourceGlob",
+            "label": "outputFilePath",
             "description": [],
             "path": "packages/kbn-openapi-bundler/src/openapi_bundler.ts",
             "deprecated": false,
@@ -103,11 +103,16 @@
           },
           {
             "parentPluginId": "@kbn/openapi-bundler",
-            "id": "def-common.BundlerConfig.outputFilePath",
-            "type": "string",
+            "id": "def-common.BundlerConfig.specInfo",
+            "type": "Object",
             "tags": [],
-            "label": "outputFilePath",
+            "label": "specInfo",
             "description": [],
+            "signature": [
+              "Omit<Partial<",
+              "OpenAPIV3",
+              ".InfoObject>, \"version\"> | undefined"
+            ],
             "path": "packages/kbn-openapi-bundler/src/openapi_bundler.ts",
             "deprecated": false,
             "trackAdoption": false
diff --git a/api_docs/kbn_openapi_bundler.mdx b/api_docs/kbn_openapi_bundler.mdx
index d6e1457b992271..ad28637d088d3f 100644
--- a/api_docs/kbn_openapi_bundler.mdx
+++ b/api_docs/kbn_openapi_bundler.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-openapi-bundler
 title: "@kbn/openapi-bundler"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/openapi-bundler plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/openapi-bundler']
 ---
 import kbnOpenapiBundlerObj from './kbn_openapi_bundler.devdocs.json';
diff --git a/api_docs/kbn_openapi_generator.mdx b/api_docs/kbn_openapi_generator.mdx
index ed4a77142fea5b..b67edcfa34d1f2 100644
--- a/api_docs/kbn_openapi_generator.mdx
+++ b/api_docs/kbn_openapi_generator.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-openapi-generator
 title: "@kbn/openapi-generator"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/openapi-generator plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/openapi-generator']
 ---
 import kbnOpenapiGeneratorObj from './kbn_openapi_generator.devdocs.json';
diff --git a/api_docs/kbn_optimizer.mdx b/api_docs/kbn_optimizer.mdx
index 7e8e155e411f56..325b7eac2aa4e6 100644
--- a/api_docs/kbn_optimizer.mdx
+++ b/api_docs/kbn_optimizer.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-optimizer
 title: "@kbn/optimizer"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/optimizer plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/optimizer']
 ---
 import kbnOptimizerObj from './kbn_optimizer.devdocs.json';
diff --git a/api_docs/kbn_optimizer_webpack_helpers.mdx b/api_docs/kbn_optimizer_webpack_helpers.mdx
index 9137a9f34603e6..12537896a3a0a4 100644
--- a/api_docs/kbn_optimizer_webpack_helpers.mdx
+++ b/api_docs/kbn_optimizer_webpack_helpers.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-optimizer-webpack-helpers
 title: "@kbn/optimizer-webpack-helpers"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/optimizer-webpack-helpers plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/optimizer-webpack-helpers']
 ---
 import kbnOptimizerWebpackHelpersObj from './kbn_optimizer_webpack_helpers.devdocs.json';
diff --git a/api_docs/kbn_osquery_io_ts_types.mdx b/api_docs/kbn_osquery_io_ts_types.mdx
index 0ad82ff60f0f2d..e9d8a39fa11018 100644
--- a/api_docs/kbn_osquery_io_ts_types.mdx
+++ b/api_docs/kbn_osquery_io_ts_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-osquery-io-ts-types
 title: "@kbn/osquery-io-ts-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/osquery-io-ts-types plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/osquery-io-ts-types']
 ---
 import kbnOsqueryIoTsTypesObj from './kbn_osquery_io_ts_types.devdocs.json';
diff --git a/api_docs/kbn_panel_loader.mdx b/api_docs/kbn_panel_loader.mdx
index b0ccc90b7d427d..a862e9c8438f48 100644
--- a/api_docs/kbn_panel_loader.mdx
+++ b/api_docs/kbn_panel_loader.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-panel-loader
 title: "@kbn/panel-loader"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/panel-loader plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/panel-loader']
 ---
 import kbnPanelLoaderObj from './kbn_panel_loader.devdocs.json';
diff --git a/api_docs/kbn_performance_testing_dataset_extractor.mdx b/api_docs/kbn_performance_testing_dataset_extractor.mdx
index 345fa7d54e341d..eb99a72481d652 100644
--- a/api_docs/kbn_performance_testing_dataset_extractor.mdx
+++ b/api_docs/kbn_performance_testing_dataset_extractor.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-performance-testing-dataset-extractor
 title: "@kbn/performance-testing-dataset-extractor"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/performance-testing-dataset-extractor plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/performance-testing-dataset-extractor']
 ---
 import kbnPerformanceTestingDatasetExtractorObj from './kbn_performance_testing_dataset_extractor.devdocs.json';
diff --git a/api_docs/kbn_plugin_check.mdx b/api_docs/kbn_plugin_check.mdx
index 9b7bab241c6cce..9a90328bd6e073 100644
--- a/api_docs/kbn_plugin_check.mdx
+++ b/api_docs/kbn_plugin_check.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-plugin-check
 title: "@kbn/plugin-check"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/plugin-check plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/plugin-check']
 ---
 import kbnPluginCheckObj from './kbn_plugin_check.devdocs.json';
diff --git a/api_docs/kbn_plugin_generator.mdx b/api_docs/kbn_plugin_generator.mdx
index 85eac6e43a470e..fbd4d9c044c516 100644
--- a/api_docs/kbn_plugin_generator.mdx
+++ b/api_docs/kbn_plugin_generator.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-plugin-generator
 title: "@kbn/plugin-generator"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/plugin-generator plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/plugin-generator']
 ---
 import kbnPluginGeneratorObj from './kbn_plugin_generator.devdocs.json';
diff --git a/api_docs/kbn_plugin_helpers.mdx b/api_docs/kbn_plugin_helpers.mdx
index cd29d893f8f828..c841b3cdc8ebba 100644
--- a/api_docs/kbn_plugin_helpers.mdx
+++ b/api_docs/kbn_plugin_helpers.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-plugin-helpers
 title: "@kbn/plugin-helpers"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/plugin-helpers plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/plugin-helpers']
 ---
 import kbnPluginHelpersObj from './kbn_plugin_helpers.devdocs.json';
diff --git a/api_docs/kbn_presentation_containers.mdx b/api_docs/kbn_presentation_containers.mdx
index b3fc85d73c2c50..3ffc979243db60 100644
--- a/api_docs/kbn_presentation_containers.mdx
+++ b/api_docs/kbn_presentation_containers.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-presentation-containers
 title: "@kbn/presentation-containers"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/presentation-containers plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/presentation-containers']
 ---
 import kbnPresentationContainersObj from './kbn_presentation_containers.devdocs.json';
diff --git a/api_docs/kbn_presentation_publishing.mdx b/api_docs/kbn_presentation_publishing.mdx
index 4dec9be274a472..ef72f91adf3a25 100644
--- a/api_docs/kbn_presentation_publishing.mdx
+++ b/api_docs/kbn_presentation_publishing.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-presentation-publishing
 title: "@kbn/presentation-publishing"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/presentation-publishing plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/presentation-publishing']
 ---
 import kbnPresentationPublishingObj from './kbn_presentation_publishing.devdocs.json';
diff --git a/api_docs/kbn_profiling_utils.mdx b/api_docs/kbn_profiling_utils.mdx
index 13ecd3645eb815..0625eaa39e593e 100644
--- a/api_docs/kbn_profiling_utils.mdx
+++ b/api_docs/kbn_profiling_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-profiling-utils
 title: "@kbn/profiling-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/profiling-utils plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/profiling-utils']
 ---
 import kbnProfilingUtilsObj from './kbn_profiling_utils.devdocs.json';
diff --git a/api_docs/kbn_random_sampling.mdx b/api_docs/kbn_random_sampling.mdx
index 98de4cff644f7c..3b055aea99b815 100644
--- a/api_docs/kbn_random_sampling.mdx
+++ b/api_docs/kbn_random_sampling.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-random-sampling
 title: "@kbn/random-sampling"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/random-sampling plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/random-sampling']
 ---
 import kbnRandomSamplingObj from './kbn_random_sampling.devdocs.json';
diff --git a/api_docs/kbn_react_field.mdx b/api_docs/kbn_react_field.mdx
index 9ea6345045c369..70592cb300b039 100644
--- a/api_docs/kbn_react_field.mdx
+++ b/api_docs/kbn_react_field.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-react-field
 title: "@kbn/react-field"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/react-field plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/react-field']
 ---
 import kbnReactFieldObj from './kbn_react_field.devdocs.json';
diff --git a/api_docs/kbn_react_hooks.mdx b/api_docs/kbn_react_hooks.mdx
index d26febe62c660f..1b9fa2ea8df2ae 100644
--- a/api_docs/kbn_react_hooks.mdx
+++ b/api_docs/kbn_react_hooks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-react-hooks
 title: "@kbn/react-hooks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/react-hooks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/react-hooks']
 ---
 import kbnReactHooksObj from './kbn_react_hooks.devdocs.json';
diff --git a/api_docs/kbn_react_kibana_context_common.mdx b/api_docs/kbn_react_kibana_context_common.mdx
index ad6b96c26a7f49..84225190f9f180 100644
--- a/api_docs/kbn_react_kibana_context_common.mdx
+++ b/api_docs/kbn_react_kibana_context_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-react-kibana-context-common
 title: "@kbn/react-kibana-context-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/react-kibana-context-common plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/react-kibana-context-common']
 ---
 import kbnReactKibanaContextCommonObj from './kbn_react_kibana_context_common.devdocs.json';
diff --git a/api_docs/kbn_react_kibana_context_render.mdx b/api_docs/kbn_react_kibana_context_render.mdx
index f90b1fbc4fa63f..c76e62b93aa824 100644
--- a/api_docs/kbn_react_kibana_context_render.mdx
+++ b/api_docs/kbn_react_kibana_context_render.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-react-kibana-context-render
 title: "@kbn/react-kibana-context-render"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/react-kibana-context-render plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/react-kibana-context-render']
 ---
 import kbnReactKibanaContextRenderObj from './kbn_react_kibana_context_render.devdocs.json';
diff --git a/api_docs/kbn_react_kibana_context_root.mdx b/api_docs/kbn_react_kibana_context_root.mdx
index 3dea8690b91550..57c1593077f8fb 100644
--- a/api_docs/kbn_react_kibana_context_root.mdx
+++ b/api_docs/kbn_react_kibana_context_root.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-react-kibana-context-root
 title: "@kbn/react-kibana-context-root"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/react-kibana-context-root plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/react-kibana-context-root']
 ---
 import kbnReactKibanaContextRootObj from './kbn_react_kibana_context_root.devdocs.json';
diff --git a/api_docs/kbn_react_kibana_context_styled.mdx b/api_docs/kbn_react_kibana_context_styled.mdx
index 9069f465ce8014..a6a75a658f9294 100644
--- a/api_docs/kbn_react_kibana_context_styled.mdx
+++ b/api_docs/kbn_react_kibana_context_styled.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-react-kibana-context-styled
 title: "@kbn/react-kibana-context-styled"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/react-kibana-context-styled plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/react-kibana-context-styled']
 ---
 import kbnReactKibanaContextStyledObj from './kbn_react_kibana_context_styled.devdocs.json';
diff --git a/api_docs/kbn_react_kibana_context_theme.mdx b/api_docs/kbn_react_kibana_context_theme.mdx
index 94f62672908d20..bc8e26c4f1c49d 100644
--- a/api_docs/kbn_react_kibana_context_theme.mdx
+++ b/api_docs/kbn_react_kibana_context_theme.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-react-kibana-context-theme
 title: "@kbn/react-kibana-context-theme"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/react-kibana-context-theme plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/react-kibana-context-theme']
 ---
 import kbnReactKibanaContextThemeObj from './kbn_react_kibana_context_theme.devdocs.json';
diff --git a/api_docs/kbn_react_kibana_mount.mdx b/api_docs/kbn_react_kibana_mount.mdx
index a2ea40a6355c27..3f1696cbf7578d 100644
--- a/api_docs/kbn_react_kibana_mount.mdx
+++ b/api_docs/kbn_react_kibana_mount.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-react-kibana-mount
 title: "@kbn/react-kibana-mount"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/react-kibana-mount plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/react-kibana-mount']
 ---
 import kbnReactKibanaMountObj from './kbn_react_kibana_mount.devdocs.json';
diff --git a/api_docs/kbn_repo_file_maps.mdx b/api_docs/kbn_repo_file_maps.mdx
index 98ba6cc49d148f..b00d3b6b866e51 100644
--- a/api_docs/kbn_repo_file_maps.mdx
+++ b/api_docs/kbn_repo_file_maps.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-repo-file-maps
 title: "@kbn/repo-file-maps"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/repo-file-maps plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/repo-file-maps']
 ---
 import kbnRepoFileMapsObj from './kbn_repo_file_maps.devdocs.json';
diff --git a/api_docs/kbn_repo_linter.mdx b/api_docs/kbn_repo_linter.mdx
index 0375c41d9ae294..b8bada774c8a35 100644
--- a/api_docs/kbn_repo_linter.mdx
+++ b/api_docs/kbn_repo_linter.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-repo-linter
 title: "@kbn/repo-linter"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/repo-linter plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/repo-linter']
 ---
 import kbnRepoLinterObj from './kbn_repo_linter.devdocs.json';
diff --git a/api_docs/kbn_repo_path.mdx b/api_docs/kbn_repo_path.mdx
index 7e4b1913c3f154..6d3d8577792738 100644
--- a/api_docs/kbn_repo_path.mdx
+++ b/api_docs/kbn_repo_path.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-repo-path
 title: "@kbn/repo-path"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/repo-path plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/repo-path']
 ---
 import kbnRepoPathObj from './kbn_repo_path.devdocs.json';
diff --git a/api_docs/kbn_repo_source_classifier.mdx b/api_docs/kbn_repo_source_classifier.mdx
index 823e14a3dfdb61..3e3759534dba74 100644
--- a/api_docs/kbn_repo_source_classifier.mdx
+++ b/api_docs/kbn_repo_source_classifier.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-repo-source-classifier
 title: "@kbn/repo-source-classifier"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/repo-source-classifier plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/repo-source-classifier']
 ---
 import kbnRepoSourceClassifierObj from './kbn_repo_source_classifier.devdocs.json';
diff --git a/api_docs/kbn_reporting_common.mdx b/api_docs/kbn_reporting_common.mdx
index 74340eacdf4a45..ad17109c37605d 100644
--- a/api_docs/kbn_reporting_common.mdx
+++ b/api_docs/kbn_reporting_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-reporting-common
 title: "@kbn/reporting-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/reporting-common plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/reporting-common']
 ---
 import kbnReportingCommonObj from './kbn_reporting_common.devdocs.json';
diff --git a/api_docs/kbn_reporting_csv_share_panel.mdx b/api_docs/kbn_reporting_csv_share_panel.mdx
index 1bc51b4b0e8637..5a5d5a3509b70b 100644
--- a/api_docs/kbn_reporting_csv_share_panel.mdx
+++ b/api_docs/kbn_reporting_csv_share_panel.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-reporting-csv-share-panel
 title: "@kbn/reporting-csv-share-panel"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/reporting-csv-share-panel plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/reporting-csv-share-panel']
 ---
 import kbnReportingCsvSharePanelObj from './kbn_reporting_csv_share_panel.devdocs.json';
diff --git a/api_docs/kbn_reporting_export_types_csv.mdx b/api_docs/kbn_reporting_export_types_csv.mdx
index 4de21e053b32bb..ba70c0267c1ea5 100644
--- a/api_docs/kbn_reporting_export_types_csv.mdx
+++ b/api_docs/kbn_reporting_export_types_csv.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-reporting-export-types-csv
 title: "@kbn/reporting-export-types-csv"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/reporting-export-types-csv plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/reporting-export-types-csv']
 ---
 import kbnReportingExportTypesCsvObj from './kbn_reporting_export_types_csv.devdocs.json';
diff --git a/api_docs/kbn_reporting_export_types_csv_common.mdx b/api_docs/kbn_reporting_export_types_csv_common.mdx
index 9885030fe69984..37b0ea5e95cc3c 100644
--- a/api_docs/kbn_reporting_export_types_csv_common.mdx
+++ b/api_docs/kbn_reporting_export_types_csv_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-reporting-export-types-csv-common
 title: "@kbn/reporting-export-types-csv-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/reporting-export-types-csv-common plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/reporting-export-types-csv-common']
 ---
 import kbnReportingExportTypesCsvCommonObj from './kbn_reporting_export_types_csv_common.devdocs.json';
diff --git a/api_docs/kbn_reporting_export_types_pdf.mdx b/api_docs/kbn_reporting_export_types_pdf.mdx
index 7f8e80578ee9d0..63ac8855c89d64 100644
--- a/api_docs/kbn_reporting_export_types_pdf.mdx
+++ b/api_docs/kbn_reporting_export_types_pdf.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-reporting-export-types-pdf
 title: "@kbn/reporting-export-types-pdf"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/reporting-export-types-pdf plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/reporting-export-types-pdf']
 ---
 import kbnReportingExportTypesPdfObj from './kbn_reporting_export_types_pdf.devdocs.json';
diff --git a/api_docs/kbn_reporting_export_types_pdf_common.mdx b/api_docs/kbn_reporting_export_types_pdf_common.mdx
index 2efea333c74cab..d1cb374532ae55 100644
--- a/api_docs/kbn_reporting_export_types_pdf_common.mdx
+++ b/api_docs/kbn_reporting_export_types_pdf_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-reporting-export-types-pdf-common
 title: "@kbn/reporting-export-types-pdf-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/reporting-export-types-pdf-common plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/reporting-export-types-pdf-common']
 ---
 import kbnReportingExportTypesPdfCommonObj from './kbn_reporting_export_types_pdf_common.devdocs.json';
diff --git a/api_docs/kbn_reporting_export_types_png.mdx b/api_docs/kbn_reporting_export_types_png.mdx
index f24cb9dab3eabc..a6ae2526301fca 100644
--- a/api_docs/kbn_reporting_export_types_png.mdx
+++ b/api_docs/kbn_reporting_export_types_png.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-reporting-export-types-png
 title: "@kbn/reporting-export-types-png"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/reporting-export-types-png plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/reporting-export-types-png']
 ---
 import kbnReportingExportTypesPngObj from './kbn_reporting_export_types_png.devdocs.json';
diff --git a/api_docs/kbn_reporting_export_types_png_common.mdx b/api_docs/kbn_reporting_export_types_png_common.mdx
index bfb253907b700e..19cffa8eaa6a14 100644
--- a/api_docs/kbn_reporting_export_types_png_common.mdx
+++ b/api_docs/kbn_reporting_export_types_png_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-reporting-export-types-png-common
 title: "@kbn/reporting-export-types-png-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/reporting-export-types-png-common plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/reporting-export-types-png-common']
 ---
 import kbnReportingExportTypesPngCommonObj from './kbn_reporting_export_types_png_common.devdocs.json';
diff --git a/api_docs/kbn_reporting_mocks_server.mdx b/api_docs/kbn_reporting_mocks_server.mdx
index bc332f1fe7c520..2632c9b6035fca 100644
--- a/api_docs/kbn_reporting_mocks_server.mdx
+++ b/api_docs/kbn_reporting_mocks_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-reporting-mocks-server
 title: "@kbn/reporting-mocks-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/reporting-mocks-server plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/reporting-mocks-server']
 ---
 import kbnReportingMocksServerObj from './kbn_reporting_mocks_server.devdocs.json';
diff --git a/api_docs/kbn_reporting_public.mdx b/api_docs/kbn_reporting_public.mdx
index 916ce1f4841b59..4ea7d08b27fc13 100644
--- a/api_docs/kbn_reporting_public.mdx
+++ b/api_docs/kbn_reporting_public.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-reporting-public
 title: "@kbn/reporting-public"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/reporting-public plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/reporting-public']
 ---
 import kbnReportingPublicObj from './kbn_reporting_public.devdocs.json';
diff --git a/api_docs/kbn_reporting_server.mdx b/api_docs/kbn_reporting_server.mdx
index 3118a8b2afca61..7bb6101852bd1b 100644
--- a/api_docs/kbn_reporting_server.mdx
+++ b/api_docs/kbn_reporting_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-reporting-server
 title: "@kbn/reporting-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/reporting-server plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/reporting-server']
 ---
 import kbnReportingServerObj from './kbn_reporting_server.devdocs.json';
diff --git a/api_docs/kbn_resizable_layout.mdx b/api_docs/kbn_resizable_layout.mdx
index d6aadeda2c8ac1..c8f5189925df7c 100644
--- a/api_docs/kbn_resizable_layout.mdx
+++ b/api_docs/kbn_resizable_layout.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-resizable-layout
 title: "@kbn/resizable-layout"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/resizable-layout plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/resizable-layout']
 ---
 import kbnResizableLayoutObj from './kbn_resizable_layout.devdocs.json';
diff --git a/api_docs/kbn_rison.mdx b/api_docs/kbn_rison.mdx
index 464526a5d585ed..354d8b82655979 100644
--- a/api_docs/kbn_rison.mdx
+++ b/api_docs/kbn_rison.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-rison
 title: "@kbn/rison"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/rison plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/rison']
 ---
 import kbnRisonObj from './kbn_rison.devdocs.json';
diff --git a/api_docs/kbn_router_to_openapispec.mdx b/api_docs/kbn_router_to_openapispec.mdx
index c9c179cc082a22..fc364048100253 100644
--- a/api_docs/kbn_router_to_openapispec.mdx
+++ b/api_docs/kbn_router_to_openapispec.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-router-to-openapispec
 title: "@kbn/router-to-openapispec"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/router-to-openapispec plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/router-to-openapispec']
 ---
 import kbnRouterToOpenapispecObj from './kbn_router_to_openapispec.devdocs.json';
diff --git a/api_docs/kbn_router_utils.mdx b/api_docs/kbn_router_utils.mdx
index a5bed2ba74d1cb..914aca0d13c7a7 100644
--- a/api_docs/kbn_router_utils.mdx
+++ b/api_docs/kbn_router_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-router-utils
 title: "@kbn/router-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/router-utils plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/router-utils']
 ---
 import kbnRouterUtilsObj from './kbn_router_utils.devdocs.json';
diff --git a/api_docs/kbn_rrule.mdx b/api_docs/kbn_rrule.mdx
index 84827fa2d7b2e6..dfdbe03991fe5b 100644
--- a/api_docs/kbn_rrule.mdx
+++ b/api_docs/kbn_rrule.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-rrule
 title: "@kbn/rrule"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/rrule plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/rrule']
 ---
 import kbnRruleObj from './kbn_rrule.devdocs.json';
diff --git a/api_docs/kbn_rule_data_utils.mdx b/api_docs/kbn_rule_data_utils.mdx
index e42a4f1735fb56..9577e97fdc3d00 100644
--- a/api_docs/kbn_rule_data_utils.mdx
+++ b/api_docs/kbn_rule_data_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-rule-data-utils
 title: "@kbn/rule-data-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/rule-data-utils plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/rule-data-utils']
 ---
 import kbnRuleDataUtilsObj from './kbn_rule_data_utils.devdocs.json';
diff --git a/api_docs/kbn_saved_objects_settings.mdx b/api_docs/kbn_saved_objects_settings.mdx
index 81309db618a095..8bfbfd9ab895dd 100644
--- a/api_docs/kbn_saved_objects_settings.mdx
+++ b/api_docs/kbn_saved_objects_settings.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-saved-objects-settings
 title: "@kbn/saved-objects-settings"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/saved-objects-settings plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/saved-objects-settings']
 ---
 import kbnSavedObjectsSettingsObj from './kbn_saved_objects_settings.devdocs.json';
diff --git a/api_docs/kbn_search_api_panels.mdx b/api_docs/kbn_search_api_panels.mdx
index c8e3132345b6a9..85340fc5f4368a 100644
--- a/api_docs/kbn_search_api_panels.mdx
+++ b/api_docs/kbn_search_api_panels.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-search-api-panels
 title: "@kbn/search-api-panels"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/search-api-panels plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/search-api-panels']
 ---
 import kbnSearchApiPanelsObj from './kbn_search_api_panels.devdocs.json';
diff --git a/api_docs/kbn_search_connectors.devdocs.json b/api_docs/kbn_search_connectors.devdocs.json
index 749d43677edb94..06416d03aa67e1 100644
--- a/api_docs/kbn_search_connectors.devdocs.json
+++ b/api_docs/kbn_search_connectors.devdocs.json
@@ -33829,10 +33829,10 @@
                 "children": [
                   {
                     "parentPluginId": "@kbn/search-connectors",
-                    "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.tenant_id",
+                    "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.notion_secret_key",
                     "type": "Object",
                     "tags": [],
-                    "label": "tenant_id",
+                    "label": "notion_secret_key",
                     "description": [],
                     "path": "packages/kbn-search-connectors/types/native_connectors.ts",
                     "deprecated": false,
@@ -33840,7 +33840,7 @@
                     "children": [
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.tenant_id.default_value",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.notion_secret_key.default_value",
                         "type": "Uncategorized",
                         "tags": [],
                         "label": "default_value",
@@ -33854,7 +33854,7 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.tenant_id.depends_on",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.notion_secret_key.depends_on",
                         "type": "Array",
                         "tags": [],
                         "label": "depends_on",
@@ -33868,7 +33868,7 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.tenant_id.display",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.notion_secret_key.display",
                         "type": "string",
                         "tags": [],
                         "label": "display",
@@ -33889,7 +33889,7 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.tenant_id.label",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.notion_secret_key.label",
                         "type": "string",
                         "tags": [],
                         "label": "label",
@@ -33900,7 +33900,7 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.tenant_id.options",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.notion_secret_key.options",
                         "type": "Array",
                         "tags": [],
                         "label": "options",
@@ -33914,7 +33914,7 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.tenant_id.order",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.notion_secret_key.order",
                         "type": "number",
                         "tags": [],
                         "label": "order",
@@ -33925,7 +33925,7 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.tenant_id.required",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.notion_secret_key.required",
                         "type": "boolean",
                         "tags": [],
                         "label": "required",
@@ -33939,13 +33939,13 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.tenant_id.sensitive",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.notion_secret_key.sensitive",
                         "type": "boolean",
                         "tags": [],
                         "label": "sensitive",
                         "description": [],
                         "signature": [
-                          "false"
+                          "true"
                         ],
                         "path": "packages/kbn-search-connectors/types/native_connectors.ts",
                         "deprecated": false,
@@ -33953,7 +33953,7 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.tenant_id.tooltip",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.notion_secret_key.tooltip",
                         "type": "Uncategorized",
                         "tags": [],
                         "label": "tooltip",
@@ -33967,7 +33967,7 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.tenant_id.type",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.notion_secret_key.type",
                         "type": "string",
                         "tags": [],
                         "label": "type",
@@ -33988,7 +33988,7 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.tenant_id.ui_restrictions",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.notion_secret_key.ui_restrictions",
                         "type": "Array",
                         "tags": [],
                         "label": "ui_restrictions",
@@ -34002,7 +34002,7 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.tenant_id.validations",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.notion_secret_key.validations",
                         "type": "Array",
                         "tags": [],
                         "label": "validations",
@@ -34016,7 +34016,7 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.tenant_id.value",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.notion_secret_key.value",
                         "type": "string",
                         "tags": [],
                         "label": "value",
@@ -34029,10 +34029,10 @@
                   },
                   {
                     "parentPluginId": "@kbn/search-connectors",
-                    "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.client_id",
+                    "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.databases",
                     "type": "Object",
                     "tags": [],
-                    "label": "client_id",
+                    "label": "databases",
                     "description": [],
                     "path": "packages/kbn-search-connectors/types/native_connectors.ts",
                     "deprecated": false,
@@ -34040,21 +34040,18 @@
                     "children": [
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.client_id.default_value",
-                        "type": "Uncategorized",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.databases.default_value",
+                        "type": "string",
                         "tags": [],
                         "label": "default_value",
                         "description": [],
-                        "signature": [
-                          "null"
-                        ],
                         "path": "packages/kbn-search-connectors/types/native_connectors.ts",
                         "deprecated": false,
                         "trackAdoption": false
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.client_id.depends_on",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.databases.depends_on",
                         "type": "Array",
                         "tags": [],
                         "label": "depends_on",
@@ -34068,7 +34065,7 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.client_id.display",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.databases.display",
                         "type": "string",
                         "tags": [],
                         "label": "display",
@@ -34089,7 +34086,7 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.client_id.label",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.databases.label",
                         "type": "string",
                         "tags": [],
                         "label": "label",
@@ -34100,7 +34097,7 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.client_id.options",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.databases.options",
                         "type": "Array",
                         "tags": [],
                         "label": "options",
@@ -34114,7 +34111,7 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.client_id.order",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.databases.order",
                         "type": "number",
                         "tags": [],
                         "label": "order",
@@ -34125,7 +34122,7 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.client_id.required",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.databases.required",
                         "type": "boolean",
                         "tags": [],
                         "label": "required",
@@ -34139,7 +34136,7 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.client_id.sensitive",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.databases.sensitive",
                         "type": "boolean",
                         "tags": [],
                         "label": "sensitive",
@@ -34153,21 +34150,18 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.client_id.tooltip",
-                        "type": "Uncategorized",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.databases.tooltip",
+                        "type": "string",
                         "tags": [],
                         "label": "tooltip",
                         "description": [],
-                        "signature": [
-                          "null"
-                        ],
                         "path": "packages/kbn-search-connectors/types/native_connectors.ts",
                         "deprecated": false,
                         "trackAdoption": false
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.client_id.type",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.databases.type",
                         "type": "string",
                         "tags": [],
                         "label": "type",
@@ -34180,7 +34174,7 @@
                             "section": "def-common.FieldType",
                             "text": "FieldType"
                           },
-                          ".STRING"
+                          ".LIST"
                         ],
                         "path": "packages/kbn-search-connectors/types/native_connectors.ts",
                         "deprecated": false,
@@ -34188,7 +34182,7 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.client_id.ui_restrictions",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.databases.ui_restrictions",
                         "type": "Array",
                         "tags": [],
                         "label": "ui_restrictions",
@@ -34202,7 +34196,7 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.client_id.validations",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.databases.validations",
                         "type": "Array",
                         "tags": [],
                         "label": "validations",
@@ -34216,7 +34210,7 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.client_id.value",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.databases.value",
                         "type": "string",
                         "tags": [],
                         "label": "value",
@@ -34229,10 +34223,10 @@
                   },
                   {
                     "parentPluginId": "@kbn/search-connectors",
-                    "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.secret_value",
+                    "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.pages",
                     "type": "Object",
                     "tags": [],
-                    "label": "secret_value",
+                    "label": "pages",
                     "description": [],
                     "path": "packages/kbn-search-connectors/types/native_connectors.ts",
                     "deprecated": false,
@@ -34240,21 +34234,18 @@
                     "children": [
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.secret_value.default_value",
-                        "type": "Uncategorized",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.pages.default_value",
+                        "type": "string",
                         "tags": [],
                         "label": "default_value",
                         "description": [],
-                        "signature": [
-                          "null"
-                        ],
                         "path": "packages/kbn-search-connectors/types/native_connectors.ts",
                         "deprecated": false,
                         "trackAdoption": false
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.secret_value.depends_on",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.pages.depends_on",
                         "type": "Array",
                         "tags": [],
                         "label": "depends_on",
@@ -34268,7 +34259,7 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.secret_value.display",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.pages.display",
                         "type": "string",
                         "tags": [],
                         "label": "display",
@@ -34289,7 +34280,7 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.secret_value.label",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.pages.label",
                         "type": "string",
                         "tags": [],
                         "label": "label",
@@ -34300,7 +34291,7 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.secret_value.options",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.pages.options",
                         "type": "Array",
                         "tags": [],
                         "label": "options",
@@ -34314,7 +34305,7 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.secret_value.order",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.pages.order",
                         "type": "number",
                         "tags": [],
                         "label": "order",
@@ -34325,7 +34316,7 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.secret_value.required",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.pages.required",
                         "type": "boolean",
                         "tags": [],
                         "label": "required",
@@ -34339,13 +34330,13 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.secret_value.sensitive",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.pages.sensitive",
                         "type": "boolean",
                         "tags": [],
                         "label": "sensitive",
                         "description": [],
                         "signature": [
-                          "true"
+                          "false"
                         ],
                         "path": "packages/kbn-search-connectors/types/native_connectors.ts",
                         "deprecated": false,
@@ -34353,21 +34344,18 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.secret_value.tooltip",
-                        "type": "Uncategorized",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.pages.tooltip",
+                        "type": "string",
                         "tags": [],
                         "label": "tooltip",
                         "description": [],
-                        "signature": [
-                          "null"
-                        ],
                         "path": "packages/kbn-search-connectors/types/native_connectors.ts",
                         "deprecated": false,
                         "trackAdoption": false
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.secret_value.type",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.pages.type",
                         "type": "string",
                         "tags": [],
                         "label": "type",
@@ -34380,7 +34368,7 @@
                             "section": "def-common.FieldType",
                             "text": "FieldType"
                           },
-                          ".STRING"
+                          ".LIST"
                         ],
                         "path": "packages/kbn-search-connectors/types/native_connectors.ts",
                         "deprecated": false,
@@ -34388,7 +34376,7 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.secret_value.ui_restrictions",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.pages.ui_restrictions",
                         "type": "Array",
                         "tags": [],
                         "label": "ui_restrictions",
@@ -34402,7 +34390,7 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.secret_value.validations",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.pages.validations",
                         "type": "Array",
                         "tags": [],
                         "label": "validations",
@@ -34416,7 +34404,7 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.secret_value.value",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.pages.value",
                         "type": "string",
                         "tags": [],
                         "label": "value",
@@ -34429,10 +34417,10 @@
                   },
                   {
                     "parentPluginId": "@kbn/search-connectors",
-                    "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.username",
+                    "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.index_comments",
                     "type": "Object",
                     "tags": [],
-                    "label": "username",
+                    "label": "index_comments",
                     "description": [],
                     "path": "packages/kbn-search-connectors/types/native_connectors.ts",
                     "deprecated": false,
@@ -34440,7 +34428,7 @@
                     "children": [
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.username.default_value",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.index_comments.default_value",
                         "type": "Uncategorized",
                         "tags": [],
                         "label": "default_value",
@@ -34454,7 +34442,7 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.username.depends_on",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.index_comments.depends_on",
                         "type": "Array",
                         "tags": [],
                         "label": "depends_on",
@@ -34468,7 +34456,7 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.username.display",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.index_comments.display",
                         "type": "string",
                         "tags": [],
                         "label": "display",
@@ -34481,7 +34469,7 @@
                             "section": "def-common.DisplayType",
                             "text": "DisplayType"
                           },
-                          ".TEXTBOX"
+                          ".TOGGLE"
                         ],
                         "path": "packages/kbn-search-connectors/types/native_connectors.ts",
                         "deprecated": false,
@@ -34489,7 +34477,7 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.username.label",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.index_comments.label",
                         "type": "string",
                         "tags": [],
                         "label": "label",
@@ -34500,7 +34488,7 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.username.options",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.index_comments.options",
                         "type": "Array",
                         "tags": [],
                         "label": "options",
@@ -34514,7 +34502,7 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.username.order",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.index_comments.order",
                         "type": "number",
                         "tags": [],
                         "label": "order",
@@ -34525,7 +34513,7 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.username.required",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.index_comments.required",
                         "type": "boolean",
                         "tags": [],
                         "label": "required",
@@ -34539,7 +34527,7 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.username.sensitive",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.index_comments.sensitive",
                         "type": "boolean",
                         "tags": [],
                         "label": "sensitive",
@@ -34553,21 +34541,18 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.username.tooltip",
-                        "type": "Uncategorized",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.index_comments.tooltip",
+                        "type": "string",
                         "tags": [],
                         "label": "tooltip",
                         "description": [],
-                        "signature": [
-                          "null"
-                        ],
                         "path": "packages/kbn-search-connectors/types/native_connectors.ts",
                         "deprecated": false,
                         "trackAdoption": false
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.username.type",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.index_comments.type",
                         "type": "string",
                         "tags": [],
                         "label": "type",
@@ -34580,7 +34565,7 @@
                             "section": "def-common.FieldType",
                             "text": "FieldType"
                           },
-                          ".STRING"
+                          ".BOOLEAN"
                         ],
                         "path": "packages/kbn-search-connectors/types/native_connectors.ts",
                         "deprecated": false,
@@ -34588,7 +34573,7 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.username.ui_restrictions",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.index_comments.ui_restrictions",
                         "type": "Array",
                         "tags": [],
                         "label": "ui_restrictions",
@@ -34602,7 +34587,7 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.username.validations",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.index_comments.validations",
                         "type": "Array",
                         "tags": [],
                         "label": "validations",
@@ -34616,11 +34601,14 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.username.value",
-                        "type": "string",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.index_comments.value",
+                        "type": "boolean",
                         "tags": [],
                         "label": "value",
                         "description": [],
+                        "signature": [
+                          "false"
+                        ],
                         "path": "packages/kbn-search-connectors/types/native_connectors.ts",
                         "deprecated": false,
                         "trackAdoption": false
@@ -34629,10 +34617,10 @@
                   },
                   {
                     "parentPluginId": "@kbn/search-connectors",
-                    "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.password",
+                    "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.concurrent_downloads",
                     "type": "Object",
                     "tags": [],
-                    "label": "password",
+                    "label": "concurrent_downloads",
                     "description": [],
                     "path": "packages/kbn-search-connectors/types/native_connectors.ts",
                     "deprecated": false,
@@ -34640,21 +34628,18 @@
                     "children": [
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.password.default_value",
-                        "type": "Uncategorized",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.concurrent_downloads.default_value",
+                        "type": "number",
                         "tags": [],
                         "label": "default_value",
                         "description": [],
-                        "signature": [
-                          "null"
-                        ],
                         "path": "packages/kbn-search-connectors/types/native_connectors.ts",
                         "deprecated": false,
                         "trackAdoption": false
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.password.depends_on",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.concurrent_downloads.depends_on",
                         "type": "Array",
                         "tags": [],
                         "label": "depends_on",
@@ -34668,7 +34653,7 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.password.display",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.concurrent_downloads.display",
                         "type": "string",
                         "tags": [],
                         "label": "display",
@@ -34681,7 +34666,7 @@
                             "section": "def-common.DisplayType",
                             "text": "DisplayType"
                           },
-                          ".TEXTBOX"
+                          ".NUMERIC"
                         ],
                         "path": "packages/kbn-search-connectors/types/native_connectors.ts",
                         "deprecated": false,
@@ -34689,7 +34674,7 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.password.label",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.concurrent_downloads.label",
                         "type": "string",
                         "tags": [],
                         "label": "label",
@@ -34700,7 +34685,7 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.password.options",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.concurrent_downloads.options",
                         "type": "Array",
                         "tags": [],
                         "label": "options",
@@ -34714,7 +34699,7 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.password.order",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.concurrent_downloads.order",
                         "type": "number",
                         "tags": [],
                         "label": "order",
@@ -34725,13 +34710,13 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.password.required",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.concurrent_downloads.required",
                         "type": "boolean",
                         "tags": [],
                         "label": "required",
                         "description": [],
                         "signature": [
-                          "true"
+                          "false"
                         ],
                         "path": "packages/kbn-search-connectors/types/native_connectors.ts",
                         "deprecated": false,
@@ -34739,13 +34724,13 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.password.sensitive",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.concurrent_downloads.sensitive",
                         "type": "boolean",
                         "tags": [],
                         "label": "sensitive",
                         "description": [],
                         "signature": [
-                          "true"
+                          "false"
                         ],
                         "path": "packages/kbn-search-connectors/types/native_connectors.ts",
                         "deprecated": false,
@@ -34753,7 +34738,7 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.password.tooltip",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.concurrent_downloads.tooltip",
                         "type": "Uncategorized",
                         "tags": [],
                         "label": "tooltip",
@@ -34767,7 +34752,7 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.password.type",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.concurrent_downloads.type",
                         "type": "string",
                         "tags": [],
                         "label": "type",
@@ -34780,7 +34765,7 @@
                             "section": "def-common.FieldType",
                             "text": "FieldType"
                           },
-                          ".STRING"
+                          ".INTEGER"
                         ],
                         "path": "packages/kbn-search-connectors/types/native_connectors.ts",
                         "deprecated": false,
@@ -34788,13 +34773,13 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.password.ui_restrictions",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.concurrent_downloads.ui_restrictions",
                         "type": "Array",
                         "tags": [],
                         "label": "ui_restrictions",
                         "description": [],
                         "signature": [
-                          "never[]"
+                          "string[]"
                         ],
                         "path": "packages/kbn-search-connectors/types/native_connectors.ts",
                         "deprecated": false,
@@ -34802,7 +34787,7 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.password.validations",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.concurrent_downloads.validations",
                         "type": "Array",
                         "tags": [],
                         "label": "validations",
@@ -34816,7 +34801,7 @@
                       },
                       {
                         "parentPluginId": "@kbn/search-connectors",
-                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.password.value",
+                        "id": "def-common.NATIVE_CONNECTOR_DEFINITIONS.notion.configuration.concurrent_downloads.value",
                         "type": "string",
                         "tags": [],
                         "label": "value",
diff --git a/api_docs/kbn_search_connectors.mdx b/api_docs/kbn_search_connectors.mdx
index 0ca394bfb10722..ef4f1e82d3d49f 100644
--- a/api_docs/kbn_search_connectors.mdx
+++ b/api_docs/kbn_search_connectors.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-search-connectors
 title: "@kbn/search-connectors"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/search-connectors plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/search-connectors']
 ---
 import kbnSearchConnectorsObj from './kbn_search_connectors.devdocs.json';
diff --git a/api_docs/kbn_search_errors.mdx b/api_docs/kbn_search_errors.mdx
index 5eb3f550ed4344..31a1c9c8d9e06f 100644
--- a/api_docs/kbn_search_errors.mdx
+++ b/api_docs/kbn_search_errors.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-search-errors
 title: "@kbn/search-errors"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/search-errors plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/search-errors']
 ---
 import kbnSearchErrorsObj from './kbn_search_errors.devdocs.json';
diff --git a/api_docs/kbn_search_index_documents.mdx b/api_docs/kbn_search_index_documents.mdx
index 50169e907ffcd2..cf58e393e2a86a 100644
--- a/api_docs/kbn_search_index_documents.mdx
+++ b/api_docs/kbn_search_index_documents.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-search-index-documents
 title: "@kbn/search-index-documents"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/search-index-documents plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/search-index-documents']
 ---
 import kbnSearchIndexDocumentsObj from './kbn_search_index_documents.devdocs.json';
diff --git a/api_docs/kbn_search_response_warnings.mdx b/api_docs/kbn_search_response_warnings.mdx
index 8548eb53e26010..3ef6ae4f137047 100644
--- a/api_docs/kbn_search_response_warnings.mdx
+++ b/api_docs/kbn_search_response_warnings.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-search-response-warnings
 title: "@kbn/search-response-warnings"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/search-response-warnings plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/search-response-warnings']
 ---
 import kbnSearchResponseWarningsObj from './kbn_search_response_warnings.devdocs.json';
diff --git a/api_docs/kbn_search_types.mdx b/api_docs/kbn_search_types.mdx
index 48f8bffab99b32..a0d78067a8cbdd 100644
--- a/api_docs/kbn_search_types.mdx
+++ b/api_docs/kbn_search_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-search-types
 title: "@kbn/search-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/search-types plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/search-types']
 ---
 import kbnSearchTypesObj from './kbn_search_types.devdocs.json';
diff --git a/api_docs/kbn_security_hardening.mdx b/api_docs/kbn_security_hardening.mdx
index 7e76ad875b6c50..4d96ef7f8b84fb 100644
--- a/api_docs/kbn_security_hardening.mdx
+++ b/api_docs/kbn_security_hardening.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-security-hardening
 title: "@kbn/security-hardening"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/security-hardening plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/security-hardening']
 ---
 import kbnSecurityHardeningObj from './kbn_security_hardening.devdocs.json';
diff --git a/api_docs/kbn_security_plugin_types_common.devdocs.json b/api_docs/kbn_security_plugin_types_common.devdocs.json
index 03dd3d9b580708..804df8e1e3d13d 100644
--- a/api_docs/kbn_security_plugin_types_common.devdocs.json
+++ b/api_docs/kbn_security_plugin_types_common.devdocs.json
@@ -275,7 +275,15 @@
             "label": "elasticsearch",
             "description": [],
             "signature": [
-              "{ cluster: string[]; indices: ",
+              "{ cluster: string[]; remote_cluster?: ",
+              {
+                "pluginId": "@kbn/security-plugin-types-common",
+                "scope": "common",
+                "docId": "kibKbnSecurityPluginTypesCommonPluginApi",
+                "section": "def-common.RoleRemoteClusterPrivilege",
+                "text": "RoleRemoteClusterPrivilege"
+              },
+              "[] | undefined; indices: ",
               {
                 "pluginId": "@kbn/security-plugin-types-common",
                 "scope": "common",
@@ -523,6 +531,48 @@
         ],
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "@kbn/security-plugin-types-common",
+        "id": "def-common.RoleRemoteClusterPrivilege",
+        "type": "Interface",
+        "tags": [],
+        "label": "RoleRemoteClusterPrivilege",
+        "description": [],
+        "path": "x-pack/packages/security/plugin_types_common/src/authorization/role.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/security-plugin-types-common",
+            "id": "def-common.RoleRemoteClusterPrivilege.clusters",
+            "type": "Array",
+            "tags": [],
+            "label": "clusters",
+            "description": [],
+            "signature": [
+              "string[]"
+            ],
+            "path": "x-pack/packages/security/plugin_types_common/src/authorization/role.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/security-plugin-types-common",
+            "id": "def-common.RoleRemoteClusterPrivilege.privileges",
+            "type": "Array",
+            "tags": [],
+            "label": "privileges",
+            "description": [],
+            "signature": [
+              "string[]"
+            ],
+            "path": "x-pack/packages/security/plugin_types_common/src/authorization/role.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "@kbn/security-plugin-types-common",
         "id": "def-common.RoleRemoteIndexPrivilege",
@@ -838,6 +888,19 @@
             "deprecated": false,
             "trackAdoption": false
           },
+          {
+            "parentPluginId": "@kbn/security-plugin-types-common",
+            "id": "def-common.SecurityLicenseFeatures.allowRemoteClusterPrivileges",
+            "type": "boolean",
+            "tags": [],
+            "label": "allowRemoteClusterPrivileges",
+            "description": [
+              "\nIndicates whether we allow users to define remote cluster privileges in roles."
+            ],
+            "path": "x-pack/packages/security/plugin_types_common/src/licensing/license_features.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
           {
             "parentPluginId": "@kbn/security-plugin-types-common",
             "id": "def-common.SecurityLicenseFeatures.allowRbac",
diff --git a/api_docs/kbn_security_plugin_types_common.mdx b/api_docs/kbn_security_plugin_types_common.mdx
index 5afeea0349d871..14167f3ddc51c0 100644
--- a/api_docs/kbn_security_plugin_types_common.mdx
+++ b/api_docs/kbn_security_plugin_types_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-security-plugin-types-common
 title: "@kbn/security-plugin-types-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/security-plugin-types-common plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/security-plugin-types-common']
 ---
 import kbnSecurityPluginTypesCommonObj from './kbn_security_plugin_types_common.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/kibana-security](https://github.com/orgs/elastic/teams/kibana-
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 84 | 0 | 37 | 0 |
+| 88 | 0 | 40 | 0 |
 
 ## Common
 
diff --git a/api_docs/kbn_security_plugin_types_public.mdx b/api_docs/kbn_security_plugin_types_public.mdx
index 63e8b979e24be4..cb98061481fb94 100644
--- a/api_docs/kbn_security_plugin_types_public.mdx
+++ b/api_docs/kbn_security_plugin_types_public.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-security-plugin-types-public
 title: "@kbn/security-plugin-types-public"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/security-plugin-types-public plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/security-plugin-types-public']
 ---
 import kbnSecurityPluginTypesPublicObj from './kbn_security_plugin_types_public.devdocs.json';
diff --git a/api_docs/kbn_security_plugin_types_server.devdocs.json b/api_docs/kbn_security_plugin_types_server.devdocs.json
index 080ad518cc2d43..f01c8ccff6b474 100644
--- a/api_docs/kbn_security_plugin_types_server.devdocs.json
+++ b/api_docs/kbn_security_plugin_types_server.devdocs.json
@@ -110,7 +110,7 @@
             "section": "def-common.Type",
             "text": "Type"
           },
-          "<Record<string, Readonly<{} & { kibana: Readonly<{ base?: string[] | undefined; feature?: Record<string, string[]> | undefined; } & { spaces: string[] | \"*\"[]; }>[]; elasticsearch: Readonly<{ cluster?: string[] | undefined; indices?: Readonly<{ query?: string | undefined; field_security?: Record<\"grant\" | \"except\", string[]> | undefined; allow_restricted_indices?: boolean | undefined; } & { names: string[]; privileges: string[]; }>[] | undefined; remote_indices?: Readonly<{ query?: string | undefined; field_security?: Record<\"grant\" | \"except\", string[]> | undefined; allow_restricted_indices?: boolean | undefined; } & { names: string[]; privileges: string[]; clusters: string[]; }>[] | undefined; run_as?: string[] | undefined; } & {}>; }>>>; }>"
+          "<Record<string, Readonly<{} & { kibana: Readonly<{ base?: string[] | undefined; feature?: Record<string, string[]> | undefined; } & { spaces: string[] | \"*\"[]; }>[]; elasticsearch: Readonly<{ cluster?: string[] | undefined; indices?: Readonly<{ query?: string | undefined; field_security?: Record<\"grant\" | \"except\", string[]> | undefined; allow_restricted_indices?: boolean | undefined; } & { names: string[]; privileges: string[]; }>[] | undefined; remote_cluster?: Readonly<{} & { privileges: string[]; clusters: string[]; }>[] | undefined; remote_indices?: Readonly<{ query?: string | undefined; field_security?: Record<\"grant\" | \"except\", string[]> | undefined; allow_restricted_indices?: boolean | undefined; } & { names: string[]; privileges: string[]; clusters: string[]; }>[] | undefined; run_as?: string[] | undefined; } & {}>; }>>>; }>"
         ],
         "path": "x-pack/packages/security/plugin_types_server/src/authentication/api_keys/api_keys.ts",
         "deprecated": false,
@@ -590,7 +590,7 @@
                 "section": "def-common.KibanaRequest",
                 "text": "KibanaRequest"
               },
-              "<unknown, unknown, unknown, any>, createParams: Readonly<{ type?: \"rest\" | undefined; metadata?: Readonly<{} & {}> | undefined; expiration?: string | undefined; } & { name: string; role_descriptors: Record<string, Readonly<{} & {}>>; }> | Readonly<{ type?: \"rest\" | undefined; metadata?: Readonly<{} & {}> | undefined; expiration?: string | undefined; } & { name: string; kibana_role_descriptors: Record<string, Readonly<{} & { kibana: Readonly<{ base?: string[] | undefined; feature?: Record<string, string[]> | undefined; } & { spaces: string[] | \"*\"[]; }>[]; elasticsearch: Readonly<{ cluster?: string[] | undefined; indices?: Readonly<{ query?: string | undefined; field_security?: Record<\"grant\" | \"except\", string[]> | undefined; allow_restricted_indices?: boolean | undefined; } & { names: string[]; privileges: string[]; }>[] | undefined; remote_indices?: Readonly<{ query?: string | undefined; field_security?: Record<\"grant\" | \"except\", string[]> | undefined; allow_restricted_indices?: boolean | undefined; } & { names: string[]; privileges: string[]; clusters: string[]; }>[] | undefined; run_as?: string[] | undefined; } & {}>; }>>; }>) => Promise<",
+              "<unknown, unknown, unknown, any>, createParams: Readonly<{ type?: \"rest\" | undefined; metadata?: Readonly<{} & {}> | undefined; expiration?: string | undefined; } & { name: string; role_descriptors: Record<string, Readonly<{} & {}>>; }> | Readonly<{ type?: \"rest\" | undefined; metadata?: Readonly<{} & {}> | undefined; expiration?: string | undefined; } & { name: string; kibana_role_descriptors: Record<string, Readonly<{} & { kibana: Readonly<{ base?: string[] | undefined; feature?: Record<string, string[]> | undefined; } & { spaces: string[] | \"*\"[]; }>[]; elasticsearch: Readonly<{ cluster?: string[] | undefined; indices?: Readonly<{ query?: string | undefined; field_security?: Record<\"grant\" | \"except\", string[]> | undefined; allow_restricted_indices?: boolean | undefined; } & { names: string[]; privileges: string[]; }>[] | undefined; remote_cluster?: Readonly<{} & { privileges: string[]; clusters: string[]; }>[] | undefined; remote_indices?: Readonly<{ query?: string | undefined; field_security?: Record<\"grant\" | \"except\", string[]> | undefined; allow_restricted_indices?: boolean | undefined; } & { names: string[]; privileges: string[]; clusters: string[]; }>[] | undefined; run_as?: string[] | undefined; } & {}>; }>>; }>) => Promise<",
               {
                 "pluginId": "@kbn/security-plugin-types-server",
                 "scope": "server",
@@ -638,7 +638,7 @@
                   "Create operation parameters."
                 ],
                 "signature": [
-                  "Readonly<{ type?: \"rest\" | undefined; metadata?: Readonly<{} & {}> | undefined; expiration?: string | undefined; } & { name: string; role_descriptors: Record<string, Readonly<{} & {}>>; }> | Readonly<{ type?: \"rest\" | undefined; metadata?: Readonly<{} & {}> | undefined; expiration?: string | undefined; } & { name: string; kibana_role_descriptors: Record<string, Readonly<{} & { kibana: Readonly<{ base?: string[] | undefined; feature?: Record<string, string[]> | undefined; } & { spaces: string[] | \"*\"[]; }>[]; elasticsearch: Readonly<{ cluster?: string[] | undefined; indices?: Readonly<{ query?: string | undefined; field_security?: Record<\"grant\" | \"except\", string[]> | undefined; allow_restricted_indices?: boolean | undefined; } & { names: string[]; privileges: string[]; }>[] | undefined; remote_indices?: Readonly<{ query?: string | undefined; field_security?: Record<\"grant\" | \"except\", string[]> | undefined; allow_restricted_indices?: boolean | undefined; } & { names: string[]; privileges: string[]; clusters: string[]; }>[] | undefined; run_as?: string[] | undefined; } & {}>; }>>; }>"
+                  "Readonly<{ type?: \"rest\" | undefined; metadata?: Readonly<{} & {}> | undefined; expiration?: string | undefined; } & { name: string; role_descriptors: Record<string, Readonly<{} & {}>>; }> | Readonly<{ type?: \"rest\" | undefined; metadata?: Readonly<{} & {}> | undefined; expiration?: string | undefined; } & { name: string; kibana_role_descriptors: Record<string, Readonly<{} & { kibana: Readonly<{ base?: string[] | undefined; feature?: Record<string, string[]> | undefined; } & { spaces: string[] | \"*\"[]; }>[]; elasticsearch: Readonly<{ cluster?: string[] | undefined; indices?: Readonly<{ query?: string | undefined; field_security?: Record<\"grant\" | \"except\", string[]> | undefined; allow_restricted_indices?: boolean | undefined; } & { names: string[]; privileges: string[]; }>[] | undefined; remote_cluster?: Readonly<{} & { privileges: string[]; clusters: string[]; }>[] | undefined; remote_indices?: Readonly<{ query?: string | undefined; field_security?: Record<\"grant\" | \"except\", string[]> | undefined; allow_restricted_indices?: boolean | undefined; } & { names: string[]; privileges: string[]; clusters: string[]; }>[] | undefined; run_as?: string[] | undefined; } & {}>; }>>; }>"
                 ],
                 "path": "x-pack/packages/security/plugin_types_server/src/authentication/api_keys/api_keys.ts",
                 "deprecated": false,
@@ -3832,7 +3832,7 @@
         "label": "CreateAPIKeyParams",
         "description": [],
         "signature": [
-          "Readonly<{ type?: \"rest\" | undefined; metadata?: Readonly<{} & {}> | undefined; expiration?: string | undefined; } & { name: string; role_descriptors: Record<string, Readonly<{} & {}>>; }> | Readonly<{ type?: \"rest\" | undefined; metadata?: Readonly<{} & {}> | undefined; expiration?: string | undefined; } & { name: string; kibana_role_descriptors: Record<string, Readonly<{} & { kibana: Readonly<{ base?: string[] | undefined; feature?: Record<string, string[]> | undefined; } & { spaces: string[] | \"*\"[]; }>[]; elasticsearch: Readonly<{ cluster?: string[] | undefined; indices?: Readonly<{ query?: string | undefined; field_security?: Record<\"grant\" | \"except\", string[]> | undefined; allow_restricted_indices?: boolean | undefined; } & { names: string[]; privileges: string[]; }>[] | undefined; remote_indices?: Readonly<{ query?: string | undefined; field_security?: Record<\"grant\" | \"except\", string[]> | undefined; allow_restricted_indices?: boolean | undefined; } & { names: string[]; privileges: string[]; clusters: string[]; }>[] | undefined; run_as?: string[] | undefined; } & {}>; }>>; }> | Readonly<{ metadata?: Readonly<{} & {}> | undefined; expiration?: string | undefined; } & { type: \"cross_cluster\"; name: string; access: Readonly<{ search?: Readonly<{} & { names: string[]; }>[] | undefined; replication?: Readonly<{} & { names: string[]; }>[] | undefined; } & {}>; }>"
+          "Readonly<{ type?: \"rest\" | undefined; metadata?: Readonly<{} & {}> | undefined; expiration?: string | undefined; } & { name: string; role_descriptors: Record<string, Readonly<{} & {}>>; }> | Readonly<{ type?: \"rest\" | undefined; metadata?: Readonly<{} & {}> | undefined; expiration?: string | undefined; } & { name: string; kibana_role_descriptors: Record<string, Readonly<{} & { kibana: Readonly<{ base?: string[] | undefined; feature?: Record<string, string[]> | undefined; } & { spaces: string[] | \"*\"[]; }>[]; elasticsearch: Readonly<{ cluster?: string[] | undefined; indices?: Readonly<{ query?: string | undefined; field_security?: Record<\"grant\" | \"except\", string[]> | undefined; allow_restricted_indices?: boolean | undefined; } & { names: string[]; privileges: string[]; }>[] | undefined; remote_cluster?: Readonly<{} & { privileges: string[]; clusters: string[]; }>[] | undefined; remote_indices?: Readonly<{ query?: string | undefined; field_security?: Record<\"grant\" | \"except\", string[]> | undefined; allow_restricted_indices?: boolean | undefined; } & { names: string[]; privileges: string[]; clusters: string[]; }>[] | undefined; run_as?: string[] | undefined; } & {}>; }>>; }> | Readonly<{ metadata?: Readonly<{} & {}> | undefined; expiration?: string | undefined; } & { type: \"cross_cluster\"; name: string; access: Readonly<{ search?: Readonly<{} & { names: string[]; }>[] | undefined; replication?: Readonly<{} & { names: string[]; }>[] | undefined; } & {}>; }>"
         ],
         "path": "x-pack/packages/security/plugin_types_server/src/authentication/api_keys/api_keys.ts",
         "deprecated": false,
@@ -3894,7 +3894,7 @@
         "label": "CreateRestAPIKeyWithKibanaPrivilegesParams",
         "description": [],
         "signature": [
-          "{ readonly type?: \"rest\" | undefined; readonly metadata?: Readonly<{} & {}> | undefined; readonly expiration?: string | undefined; readonly name: string; readonly kibana_role_descriptors: Record<string, Readonly<{} & { kibana: Readonly<{ base?: string[] | undefined; feature?: Record<string, string[]> | undefined; } & { spaces: string[] | \"*\"[]; }>[]; elasticsearch: Readonly<{ cluster?: string[] | undefined; indices?: Readonly<{ query?: string | undefined; field_security?: Record<\"grant\" | \"except\", string[]> | undefined; allow_restricted_indices?: boolean | undefined; } & { names: string[]; privileges: string[]; }>[] | undefined; remote_indices?: Readonly<{ query?: string | undefined; field_security?: Record<\"grant\" | \"except\", string[]> | undefined; allow_restricted_indices?: boolean | undefined; } & { names: string[]; privileges: string[]; clusters: string[]; }>[] | undefined; run_as?: string[] | undefined; } & {}>; }>>; }"
+          "{ readonly type?: \"rest\" | undefined; readonly metadata?: Readonly<{} & {}> | undefined; readonly expiration?: string | undefined; readonly name: string; readonly kibana_role_descriptors: Record<string, Readonly<{} & { kibana: Readonly<{ base?: string[] | undefined; feature?: Record<string, string[]> | undefined; } & { spaces: string[] | \"*\"[]; }>[]; elasticsearch: Readonly<{ cluster?: string[] | undefined; indices?: Readonly<{ query?: string | undefined; field_security?: Record<\"grant\" | \"except\", string[]> | undefined; allow_restricted_indices?: boolean | undefined; } & { names: string[]; privileges: string[]; }>[] | undefined; remote_cluster?: Readonly<{} & { privileges: string[]; clusters: string[]; }>[] | undefined; remote_indices?: Readonly<{ query?: string | undefined; field_security?: Record<\"grant\" | \"except\", string[]> | undefined; allow_restricted_indices?: boolean | undefined; } & { names: string[]; privileges: string[]; clusters: string[]; }>[] | undefined; run_as?: string[] | undefined; } & {}>; }>>; }"
         ],
         "path": "x-pack/packages/security/plugin_types_server/src/authentication/api_keys/api_keys.ts",
         "deprecated": false,
@@ -3909,7 +3909,7 @@
         "label": "ElasticsearchPrivilegesType",
         "description": [],
         "signature": [
-          "{ readonly cluster?: string[] | undefined; readonly indices?: Readonly<{ query?: string | undefined; field_security?: Record<\"grant\" | \"except\", string[]> | undefined; allow_restricted_indices?: boolean | undefined; } & { names: string[]; privileges: string[]; }>[] | undefined; readonly remote_indices?: Readonly<{ query?: string | undefined; field_security?: Record<\"grant\" | \"except\", string[]> | undefined; allow_restricted_indices?: boolean | undefined; } & { names: string[]; privileges: string[]; clusters: string[]; }>[] | undefined; readonly run_as?: string[] | undefined; }"
+          "{ readonly cluster?: string[] | undefined; readonly indices?: Readonly<{ query?: string | undefined; field_security?: Record<\"grant\" | \"except\", string[]> | undefined; allow_restricted_indices?: boolean | undefined; } & { names: string[]; privileges: string[]; }>[] | undefined; readonly remote_cluster?: Readonly<{} & { privileges: string[]; clusters: string[]; }>[] | undefined; readonly remote_indices?: Readonly<{ query?: string | undefined; field_security?: Record<\"grant\" | \"except\", string[]> | undefined; allow_restricted_indices?: boolean | undefined; } & { names: string[]; privileges: string[]; clusters: string[]; }>[] | undefined; readonly run_as?: string[] | undefined; }"
         ],
         "path": "x-pack/packages/security/plugin_types_server/src/authorization/role_schema.ts",
         "deprecated": false,
@@ -4090,7 +4090,15 @@
             "section": "def-common.Type",
             "text": "Type"
           },
-          "<string[] | undefined>; indices: ",
+          "<string[] | undefined>; remote_cluster: ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.Type",
+            "text": "Type"
+          },
+          "<Readonly<{} & { privileges: string[]; clusters: string[]; }>[] | undefined>; indices: ",
           {
             "pluginId": "@kbn/config-schema",
             "scope": "common",
diff --git a/api_docs/kbn_security_plugin_types_server.mdx b/api_docs/kbn_security_plugin_types_server.mdx
index 339a98b8bf81c1..3c60a7e297cee0 100644
--- a/api_docs/kbn_security_plugin_types_server.mdx
+++ b/api_docs/kbn_security_plugin_types_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-security-plugin-types-server
 title: "@kbn/security-plugin-types-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/security-plugin-types-server plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/security-plugin-types-server']
 ---
 import kbnSecurityPluginTypesServerObj from './kbn_security_plugin_types_server.devdocs.json';
diff --git a/api_docs/kbn_security_solution_features.mdx b/api_docs/kbn_security_solution_features.mdx
index ac0c92f25cdec1..b608f1dd5534cd 100644
--- a/api_docs/kbn_security_solution_features.mdx
+++ b/api_docs/kbn_security_solution_features.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-security-solution-features
 title: "@kbn/security-solution-features"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/security-solution-features plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/security-solution-features']
 ---
 import kbnSecuritySolutionFeaturesObj from './kbn_security_solution_features.devdocs.json';
diff --git a/api_docs/kbn_security_solution_navigation.mdx b/api_docs/kbn_security_solution_navigation.mdx
index 1302db6211250f..a1d48d1d12f0d3 100644
--- a/api_docs/kbn_security_solution_navigation.mdx
+++ b/api_docs/kbn_security_solution_navigation.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-security-solution-navigation
 title: "@kbn/security-solution-navigation"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/security-solution-navigation plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/security-solution-navigation']
 ---
 import kbnSecuritySolutionNavigationObj from './kbn_security_solution_navigation.devdocs.json';
diff --git a/api_docs/kbn_security_solution_side_nav.devdocs.json b/api_docs/kbn_security_solution_side_nav.devdocs.json
index 2cbc8f1d67732a..56cf77078e4b49 100644
--- a/api_docs/kbn_security_solution_side_nav.devdocs.json
+++ b/api_docs/kbn_security_solution_side_nav.devdocs.json
@@ -429,6 +429,22 @@
             "path": "x-pack/packages/security-solution/side_nav/src/solution_side_nav.tsx",
             "deprecated": false,
             "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/security-solution-side-nav",
+            "id": "def-common.SolutionSideNavProps.onMount",
+            "type": "Function",
+            "tags": [],
+            "label": "onMount",
+            "description": [],
+            "signature": [
+              "(() => void) | undefined"
+            ],
+            "path": "x-pack/packages/security-solution/side_nav/src/solution_side_nav.tsx",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [],
+            "returnComment": []
           }
         ],
         "initialIsOpen": false
diff --git a/api_docs/kbn_security_solution_side_nav.mdx b/api_docs/kbn_security_solution_side_nav.mdx
index 3766dfb8693d2a..d3656f98c22a95 100644
--- a/api_docs/kbn_security_solution_side_nav.mdx
+++ b/api_docs/kbn_security_solution_side_nav.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-security-solution-side-nav
 title: "@kbn/security-solution-side-nav"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/security-solution-side-nav plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/security-solution-side-nav']
 ---
 import kbnSecuritySolutionSideNavObj from './kbn_security_solution_side_nav.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/security-threat-hunting-explore](https://github.com/orgs/elast
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 29 | 0 | 23 | 0 |
+| 30 | 0 | 24 | 0 |
 
 ## Common
 
diff --git a/api_docs/kbn_security_solution_storybook_config.mdx b/api_docs/kbn_security_solution_storybook_config.mdx
index 6b2659f5d49cbc..c8fc2b77aafabe 100644
--- a/api_docs/kbn_security_solution_storybook_config.mdx
+++ b/api_docs/kbn_security_solution_storybook_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-security-solution-storybook-config
 title: "@kbn/security-solution-storybook-config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/security-solution-storybook-config plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/security-solution-storybook-config']
 ---
 import kbnSecuritySolutionStorybookConfigObj from './kbn_security_solution_storybook_config.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_autocomplete.mdx b/api_docs/kbn_securitysolution_autocomplete.mdx
index 641fd5bbc79c23..eae95747806aa7 100644
--- a/api_docs/kbn_securitysolution_autocomplete.mdx
+++ b/api_docs/kbn_securitysolution_autocomplete.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-autocomplete
 title: "@kbn/securitysolution-autocomplete"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-autocomplete plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-autocomplete']
 ---
 import kbnSecuritysolutionAutocompleteObj from './kbn_securitysolution_autocomplete.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_data_table.mdx b/api_docs/kbn_securitysolution_data_table.mdx
index f95ccacea611ad..67a59fce02a5fe 100644
--- a/api_docs/kbn_securitysolution_data_table.mdx
+++ b/api_docs/kbn_securitysolution_data_table.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-data-table
 title: "@kbn/securitysolution-data-table"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-data-table plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-data-table']
 ---
 import kbnSecuritysolutionDataTableObj from './kbn_securitysolution_data_table.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_ecs.mdx b/api_docs/kbn_securitysolution_ecs.mdx
index df312406fd1727..6be9dd1f9e2c08 100644
--- a/api_docs/kbn_securitysolution_ecs.mdx
+++ b/api_docs/kbn_securitysolution_ecs.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-ecs
 title: "@kbn/securitysolution-ecs"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-ecs plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-ecs']
 ---
 import kbnSecuritysolutionEcsObj from './kbn_securitysolution_ecs.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_es_utils.mdx b/api_docs/kbn_securitysolution_es_utils.mdx
index bd9e26e320bb65..fda225c0b8f02b 100644
--- a/api_docs/kbn_securitysolution_es_utils.mdx
+++ b/api_docs/kbn_securitysolution_es_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-es-utils
 title: "@kbn/securitysolution-es-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-es-utils plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-es-utils']
 ---
 import kbnSecuritysolutionEsUtilsObj from './kbn_securitysolution_es_utils.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_exception_list_components.mdx b/api_docs/kbn_securitysolution_exception_list_components.mdx
index 6b778079b9fe9d..041726721bc2a9 100644
--- a/api_docs/kbn_securitysolution_exception_list_components.mdx
+++ b/api_docs/kbn_securitysolution_exception_list_components.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-exception-list-components
 title: "@kbn/securitysolution-exception-list-components"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-exception-list-components plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-exception-list-components']
 ---
 import kbnSecuritysolutionExceptionListComponentsObj from './kbn_securitysolution_exception_list_components.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_grouping.mdx b/api_docs/kbn_securitysolution_grouping.mdx
index 6a538d1f2cb572..fccb5d796fd04f 100644
--- a/api_docs/kbn_securitysolution_grouping.mdx
+++ b/api_docs/kbn_securitysolution_grouping.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-grouping
 title: "@kbn/securitysolution-grouping"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-grouping plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-grouping']
 ---
 import kbnSecuritysolutionGroupingObj from './kbn_securitysolution_grouping.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_hook_utils.mdx b/api_docs/kbn_securitysolution_hook_utils.mdx
index cc61238ade4fdb..635d56121aa361 100644
--- a/api_docs/kbn_securitysolution_hook_utils.mdx
+++ b/api_docs/kbn_securitysolution_hook_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-hook-utils
 title: "@kbn/securitysolution-hook-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-hook-utils plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-hook-utils']
 ---
 import kbnSecuritysolutionHookUtilsObj from './kbn_securitysolution_hook_utils.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_io_ts_alerting_types.mdx b/api_docs/kbn_securitysolution_io_ts_alerting_types.mdx
index 85e4dc7904f79f..c0b32039c5e9c9 100644
--- a/api_docs/kbn_securitysolution_io_ts_alerting_types.mdx
+++ b/api_docs/kbn_securitysolution_io_ts_alerting_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-io-ts-alerting-types
 title: "@kbn/securitysolution-io-ts-alerting-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-io-ts-alerting-types plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-io-ts-alerting-types']
 ---
 import kbnSecuritysolutionIoTsAlertingTypesObj from './kbn_securitysolution_io_ts_alerting_types.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_io_ts_list_types.mdx b/api_docs/kbn_securitysolution_io_ts_list_types.mdx
index 1024019d1cf436..ba837073214e41 100644
--- a/api_docs/kbn_securitysolution_io_ts_list_types.mdx
+++ b/api_docs/kbn_securitysolution_io_ts_list_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-io-ts-list-types
 title: "@kbn/securitysolution-io-ts-list-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-io-ts-list-types plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-io-ts-list-types']
 ---
 import kbnSecuritysolutionIoTsListTypesObj from './kbn_securitysolution_io_ts_list_types.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_io_ts_types.mdx b/api_docs/kbn_securitysolution_io_ts_types.mdx
index 4e9695976d7ca5..2c41386cc9b70b 100644
--- a/api_docs/kbn_securitysolution_io_ts_types.mdx
+++ b/api_docs/kbn_securitysolution_io_ts_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-io-ts-types
 title: "@kbn/securitysolution-io-ts-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-io-ts-types plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-io-ts-types']
 ---
 import kbnSecuritysolutionIoTsTypesObj from './kbn_securitysolution_io_ts_types.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_io_ts_utils.mdx b/api_docs/kbn_securitysolution_io_ts_utils.mdx
index 32b5789ea83b0d..be219d81b12a0b 100644
--- a/api_docs/kbn_securitysolution_io_ts_utils.mdx
+++ b/api_docs/kbn_securitysolution_io_ts_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-io-ts-utils
 title: "@kbn/securitysolution-io-ts-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-io-ts-utils plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-io-ts-utils']
 ---
 import kbnSecuritysolutionIoTsUtilsObj from './kbn_securitysolution_io_ts_utils.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_list_api.mdx b/api_docs/kbn_securitysolution_list_api.mdx
index 07a6a94cf971ca..6efa2071f71eab 100644
--- a/api_docs/kbn_securitysolution_list_api.mdx
+++ b/api_docs/kbn_securitysolution_list_api.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-list-api
 title: "@kbn/securitysolution-list-api"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-list-api plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-list-api']
 ---
 import kbnSecuritysolutionListApiObj from './kbn_securitysolution_list_api.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_list_constants.mdx b/api_docs/kbn_securitysolution_list_constants.mdx
index 5e1539e30ca02c..74fc0f9e06a70b 100644
--- a/api_docs/kbn_securitysolution_list_constants.mdx
+++ b/api_docs/kbn_securitysolution_list_constants.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-list-constants
 title: "@kbn/securitysolution-list-constants"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-list-constants plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-list-constants']
 ---
 import kbnSecuritysolutionListConstantsObj from './kbn_securitysolution_list_constants.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_list_hooks.mdx b/api_docs/kbn_securitysolution_list_hooks.mdx
index 060c725a25bc3e..58860f6e73baf5 100644
--- a/api_docs/kbn_securitysolution_list_hooks.mdx
+++ b/api_docs/kbn_securitysolution_list_hooks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-list-hooks
 title: "@kbn/securitysolution-list-hooks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-list-hooks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-list-hooks']
 ---
 import kbnSecuritysolutionListHooksObj from './kbn_securitysolution_list_hooks.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_list_utils.mdx b/api_docs/kbn_securitysolution_list_utils.mdx
index 03ddadac37d1a8..721ed246006198 100644
--- a/api_docs/kbn_securitysolution_list_utils.mdx
+++ b/api_docs/kbn_securitysolution_list_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-list-utils
 title: "@kbn/securitysolution-list-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-list-utils plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-list-utils']
 ---
 import kbnSecuritysolutionListUtilsObj from './kbn_securitysolution_list_utils.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_rules.mdx b/api_docs/kbn_securitysolution_rules.mdx
index ffd714fde546a0..a4dd7d5c6f9784 100644
--- a/api_docs/kbn_securitysolution_rules.mdx
+++ b/api_docs/kbn_securitysolution_rules.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-rules
 title: "@kbn/securitysolution-rules"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-rules plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-rules']
 ---
 import kbnSecuritysolutionRulesObj from './kbn_securitysolution_rules.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_t_grid.mdx b/api_docs/kbn_securitysolution_t_grid.mdx
index b199411056cbc9..30f3b9103e4a32 100644
--- a/api_docs/kbn_securitysolution_t_grid.mdx
+++ b/api_docs/kbn_securitysolution_t_grid.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-t-grid
 title: "@kbn/securitysolution-t-grid"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-t-grid plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-t-grid']
 ---
 import kbnSecuritysolutionTGridObj from './kbn_securitysolution_t_grid.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_utils.mdx b/api_docs/kbn_securitysolution_utils.mdx
index 435859641dfb92..87e7f7996f7dc4 100644
--- a/api_docs/kbn_securitysolution_utils.mdx
+++ b/api_docs/kbn_securitysolution_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-utils
 title: "@kbn/securitysolution-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-utils plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-utils']
 ---
 import kbnSecuritysolutionUtilsObj from './kbn_securitysolution_utils.devdocs.json';
diff --git a/api_docs/kbn_server_http_tools.mdx b/api_docs/kbn_server_http_tools.mdx
index 37a167ac7950eb..3664edd7b629f0 100644
--- a/api_docs/kbn_server_http_tools.mdx
+++ b/api_docs/kbn_server_http_tools.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-server-http-tools
 title: "@kbn/server-http-tools"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/server-http-tools plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/server-http-tools']
 ---
 import kbnServerHttpToolsObj from './kbn_server_http_tools.devdocs.json';
diff --git a/api_docs/kbn_server_route_repository.mdx b/api_docs/kbn_server_route_repository.mdx
index ab2e32279b308e..32ef52d49a75ab 100644
--- a/api_docs/kbn_server_route_repository.mdx
+++ b/api_docs/kbn_server_route_repository.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-server-route-repository
 title: "@kbn/server-route-repository"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/server-route-repository plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/server-route-repository']
 ---
 import kbnServerRouteRepositoryObj from './kbn_server_route_repository.devdocs.json';
diff --git a/api_docs/kbn_serverless_common_settings.mdx b/api_docs/kbn_serverless_common_settings.mdx
index a5a51b3895e851..857e4454a0055c 100644
--- a/api_docs/kbn_serverless_common_settings.mdx
+++ b/api_docs/kbn_serverless_common_settings.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-serverless-common-settings
 title: "@kbn/serverless-common-settings"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/serverless-common-settings plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/serverless-common-settings']
 ---
 import kbnServerlessCommonSettingsObj from './kbn_serverless_common_settings.devdocs.json';
diff --git a/api_docs/kbn_serverless_observability_settings.mdx b/api_docs/kbn_serverless_observability_settings.mdx
index 67e289f36d643a..a62b4ceae942b0 100644
--- a/api_docs/kbn_serverless_observability_settings.mdx
+++ b/api_docs/kbn_serverless_observability_settings.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-serverless-observability-settings
 title: "@kbn/serverless-observability-settings"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/serverless-observability-settings plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/serverless-observability-settings']
 ---
 import kbnServerlessObservabilitySettingsObj from './kbn_serverless_observability_settings.devdocs.json';
diff --git a/api_docs/kbn_serverless_project_switcher.mdx b/api_docs/kbn_serverless_project_switcher.mdx
index 843e02c840a4ca..ff7555d34ad185 100644
--- a/api_docs/kbn_serverless_project_switcher.mdx
+++ b/api_docs/kbn_serverless_project_switcher.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-serverless-project-switcher
 title: "@kbn/serverless-project-switcher"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/serverless-project-switcher plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/serverless-project-switcher']
 ---
 import kbnServerlessProjectSwitcherObj from './kbn_serverless_project_switcher.devdocs.json';
diff --git a/api_docs/kbn_serverless_search_settings.mdx b/api_docs/kbn_serverless_search_settings.mdx
index a191f674515945..82d6d015f65f89 100644
--- a/api_docs/kbn_serverless_search_settings.mdx
+++ b/api_docs/kbn_serverless_search_settings.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-serverless-search-settings
 title: "@kbn/serverless-search-settings"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/serverless-search-settings plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/serverless-search-settings']
 ---
 import kbnServerlessSearchSettingsObj from './kbn_serverless_search_settings.devdocs.json';
diff --git a/api_docs/kbn_serverless_security_settings.mdx b/api_docs/kbn_serverless_security_settings.mdx
index 22d77cca319b9a..6453f121dfc737 100644
--- a/api_docs/kbn_serverless_security_settings.mdx
+++ b/api_docs/kbn_serverless_security_settings.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-serverless-security-settings
 title: "@kbn/serverless-security-settings"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/serverless-security-settings plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/serverless-security-settings']
 ---
 import kbnServerlessSecuritySettingsObj from './kbn_serverless_security_settings.devdocs.json';
diff --git a/api_docs/kbn_serverless_storybook_config.mdx b/api_docs/kbn_serverless_storybook_config.mdx
index c14cb5b455815d..23ec307ab68e4c 100644
--- a/api_docs/kbn_serverless_storybook_config.mdx
+++ b/api_docs/kbn_serverless_storybook_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-serverless-storybook-config
 title: "@kbn/serverless-storybook-config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/serverless-storybook-config plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/serverless-storybook-config']
 ---
 import kbnServerlessStorybookConfigObj from './kbn_serverless_storybook_config.devdocs.json';
diff --git a/api_docs/kbn_shared_svg.mdx b/api_docs/kbn_shared_svg.mdx
index c5e929535005f3..db2d8727e1ea45 100644
--- a/api_docs/kbn_shared_svg.mdx
+++ b/api_docs/kbn_shared_svg.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-svg
 title: "@kbn/shared-svg"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-svg plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-svg']
 ---
 import kbnSharedSvgObj from './kbn_shared_svg.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_avatar_solution.mdx b/api_docs/kbn_shared_ux_avatar_solution.mdx
index 744e7354ef7d99..1f1dc42aba621d 100644
--- a/api_docs/kbn_shared_ux_avatar_solution.mdx
+++ b/api_docs/kbn_shared_ux_avatar_solution.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-avatar-solution
 title: "@kbn/shared-ux-avatar-solution"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-avatar-solution plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-avatar-solution']
 ---
 import kbnSharedUxAvatarSolutionObj from './kbn_shared_ux_avatar_solution.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_button_exit_full_screen.mdx b/api_docs/kbn_shared_ux_button_exit_full_screen.mdx
index 9d912fb9fbcf9d..83f1d1719c665a 100644
--- a/api_docs/kbn_shared_ux_button_exit_full_screen.mdx
+++ b/api_docs/kbn_shared_ux_button_exit_full_screen.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-button-exit-full-screen
 title: "@kbn/shared-ux-button-exit-full-screen"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-button-exit-full-screen plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-button-exit-full-screen']
 ---
 import kbnSharedUxButtonExitFullScreenObj from './kbn_shared_ux_button_exit_full_screen.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_button_toolbar.mdx b/api_docs/kbn_shared_ux_button_toolbar.mdx
index 3efcfe40c82d30..a8bae1afbac1b4 100644
--- a/api_docs/kbn_shared_ux_button_toolbar.mdx
+++ b/api_docs/kbn_shared_ux_button_toolbar.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-button-toolbar
 title: "@kbn/shared-ux-button-toolbar"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-button-toolbar plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-button-toolbar']
 ---
 import kbnSharedUxButtonToolbarObj from './kbn_shared_ux_button_toolbar.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_card_no_data.mdx b/api_docs/kbn_shared_ux_card_no_data.mdx
index 3422e38df9cff2..ee66dc505708ac 100644
--- a/api_docs/kbn_shared_ux_card_no_data.mdx
+++ b/api_docs/kbn_shared_ux_card_no_data.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-card-no-data
 title: "@kbn/shared-ux-card-no-data"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-card-no-data plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-card-no-data']
 ---
 import kbnSharedUxCardNoDataObj from './kbn_shared_ux_card_no_data.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_card_no_data_mocks.mdx b/api_docs/kbn_shared_ux_card_no_data_mocks.mdx
index 5cd79c606ae1d2..8a9ffe0c8d0f98 100644
--- a/api_docs/kbn_shared_ux_card_no_data_mocks.mdx
+++ b/api_docs/kbn_shared_ux_card_no_data_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-card-no-data-mocks
 title: "@kbn/shared-ux-card-no-data-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-card-no-data-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-card-no-data-mocks']
 ---
 import kbnSharedUxCardNoDataMocksObj from './kbn_shared_ux_card_no_data_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_chrome_navigation.mdx b/api_docs/kbn_shared_ux_chrome_navigation.mdx
index 50ea9e344adb72..1aead5cf0847de 100644
--- a/api_docs/kbn_shared_ux_chrome_navigation.mdx
+++ b/api_docs/kbn_shared_ux_chrome_navigation.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-chrome-navigation
 title: "@kbn/shared-ux-chrome-navigation"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-chrome-navigation plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-chrome-navigation']
 ---
 import kbnSharedUxChromeNavigationObj from './kbn_shared_ux_chrome_navigation.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_error_boundary.mdx b/api_docs/kbn_shared_ux_error_boundary.mdx
index b48672c6b00a20..eeb7cb5c5d30b0 100644
--- a/api_docs/kbn_shared_ux_error_boundary.mdx
+++ b/api_docs/kbn_shared_ux_error_boundary.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-error-boundary
 title: "@kbn/shared-ux-error-boundary"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-error-boundary plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-error-boundary']
 ---
 import kbnSharedUxErrorBoundaryObj from './kbn_shared_ux_error_boundary.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_file_context.mdx b/api_docs/kbn_shared_ux_file_context.mdx
index 3ac94054af166e..e87b55459dffc1 100644
--- a/api_docs/kbn_shared_ux_file_context.mdx
+++ b/api_docs/kbn_shared_ux_file_context.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-context
 title: "@kbn/shared-ux-file-context"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-file-context plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-context']
 ---
 import kbnSharedUxFileContextObj from './kbn_shared_ux_file_context.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_file_image.mdx b/api_docs/kbn_shared_ux_file_image.mdx
index ae12ba9e73f59d..ceaca723391577 100644
--- a/api_docs/kbn_shared_ux_file_image.mdx
+++ b/api_docs/kbn_shared_ux_file_image.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-image
 title: "@kbn/shared-ux-file-image"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-file-image plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-image']
 ---
 import kbnSharedUxFileImageObj from './kbn_shared_ux_file_image.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_file_image_mocks.mdx b/api_docs/kbn_shared_ux_file_image_mocks.mdx
index a93bee1149bed5..7b204019a5cdd7 100644
--- a/api_docs/kbn_shared_ux_file_image_mocks.mdx
+++ b/api_docs/kbn_shared_ux_file_image_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-image-mocks
 title: "@kbn/shared-ux-file-image-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-file-image-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-image-mocks']
 ---
 import kbnSharedUxFileImageMocksObj from './kbn_shared_ux_file_image_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_file_mocks.mdx b/api_docs/kbn_shared_ux_file_mocks.mdx
index de8282fc50e4e3..0d4d53dfc40966 100644
--- a/api_docs/kbn_shared_ux_file_mocks.mdx
+++ b/api_docs/kbn_shared_ux_file_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-mocks
 title: "@kbn/shared-ux-file-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-file-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-mocks']
 ---
 import kbnSharedUxFileMocksObj from './kbn_shared_ux_file_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_file_picker.mdx b/api_docs/kbn_shared_ux_file_picker.mdx
index 15c02ace7a9d8d..509c20b898315b 100644
--- a/api_docs/kbn_shared_ux_file_picker.mdx
+++ b/api_docs/kbn_shared_ux_file_picker.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-picker
 title: "@kbn/shared-ux-file-picker"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-file-picker plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-picker']
 ---
 import kbnSharedUxFilePickerObj from './kbn_shared_ux_file_picker.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_file_types.mdx b/api_docs/kbn_shared_ux_file_types.mdx
index 9629ca3c2323ba..cf7eb980eae8f8 100644
--- a/api_docs/kbn_shared_ux_file_types.mdx
+++ b/api_docs/kbn_shared_ux_file_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-types
 title: "@kbn/shared-ux-file-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-file-types plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-types']
 ---
 import kbnSharedUxFileTypesObj from './kbn_shared_ux_file_types.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_file_upload.mdx b/api_docs/kbn_shared_ux_file_upload.mdx
index a3b54f849fd063..3d3283556e4385 100644
--- a/api_docs/kbn_shared_ux_file_upload.mdx
+++ b/api_docs/kbn_shared_ux_file_upload.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-upload
 title: "@kbn/shared-ux-file-upload"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-file-upload plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-upload']
 ---
 import kbnSharedUxFileUploadObj from './kbn_shared_ux_file_upload.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_file_util.mdx b/api_docs/kbn_shared_ux_file_util.mdx
index 652cc70868fd7f..7f1afd45e7f7a3 100644
--- a/api_docs/kbn_shared_ux_file_util.mdx
+++ b/api_docs/kbn_shared_ux_file_util.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-util
 title: "@kbn/shared-ux-file-util"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-file-util plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-util']
 ---
 import kbnSharedUxFileUtilObj from './kbn_shared_ux_file_util.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_link_redirect_app.mdx b/api_docs/kbn_shared_ux_link_redirect_app.mdx
index a4b997552a8622..9fd52a35d3fce0 100644
--- a/api_docs/kbn_shared_ux_link_redirect_app.mdx
+++ b/api_docs/kbn_shared_ux_link_redirect_app.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-link-redirect-app
 title: "@kbn/shared-ux-link-redirect-app"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-link-redirect-app plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-link-redirect-app']
 ---
 import kbnSharedUxLinkRedirectAppObj from './kbn_shared_ux_link_redirect_app.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_link_redirect_app_mocks.mdx b/api_docs/kbn_shared_ux_link_redirect_app_mocks.mdx
index 5ac1515b51accc..d80492c073aa35 100644
--- a/api_docs/kbn_shared_ux_link_redirect_app_mocks.mdx
+++ b/api_docs/kbn_shared_ux_link_redirect_app_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-link-redirect-app-mocks
 title: "@kbn/shared-ux-link-redirect-app-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-link-redirect-app-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-link-redirect-app-mocks']
 ---
 import kbnSharedUxLinkRedirectAppMocksObj from './kbn_shared_ux_link_redirect_app_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_markdown.mdx b/api_docs/kbn_shared_ux_markdown.mdx
index 8ea762feb49b54..2895b8c83e5529 100644
--- a/api_docs/kbn_shared_ux_markdown.mdx
+++ b/api_docs/kbn_shared_ux_markdown.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-markdown
 title: "@kbn/shared-ux-markdown"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-markdown plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-markdown']
 ---
 import kbnSharedUxMarkdownObj from './kbn_shared_ux_markdown.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_markdown_mocks.mdx b/api_docs/kbn_shared_ux_markdown_mocks.mdx
index c9f9c1a82c9c16..1d5c3aa723e792 100644
--- a/api_docs/kbn_shared_ux_markdown_mocks.mdx
+++ b/api_docs/kbn_shared_ux_markdown_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-markdown-mocks
 title: "@kbn/shared-ux-markdown-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-markdown-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-markdown-mocks']
 ---
 import kbnSharedUxMarkdownMocksObj from './kbn_shared_ux_markdown_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_analytics_no_data.mdx b/api_docs/kbn_shared_ux_page_analytics_no_data.mdx
index faeae7ab7c82dc..4a9419f56e8cde 100644
--- a/api_docs/kbn_shared_ux_page_analytics_no_data.mdx
+++ b/api_docs/kbn_shared_ux_page_analytics_no_data.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-analytics-no-data
 title: "@kbn/shared-ux-page-analytics-no-data"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-analytics-no-data plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-analytics-no-data']
 ---
 import kbnSharedUxPageAnalyticsNoDataObj from './kbn_shared_ux_page_analytics_no_data.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_analytics_no_data_mocks.mdx b/api_docs/kbn_shared_ux_page_analytics_no_data_mocks.mdx
index caed77829bd3bd..0c00b28cfdc755 100644
--- a/api_docs/kbn_shared_ux_page_analytics_no_data_mocks.mdx
+++ b/api_docs/kbn_shared_ux_page_analytics_no_data_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-analytics-no-data-mocks
 title: "@kbn/shared-ux-page-analytics-no-data-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-analytics-no-data-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-analytics-no-data-mocks']
 ---
 import kbnSharedUxPageAnalyticsNoDataMocksObj from './kbn_shared_ux_page_analytics_no_data_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_kibana_no_data.mdx b/api_docs/kbn_shared_ux_page_kibana_no_data.mdx
index 6c41aa2999ef72..8a0a7b0c4ce5d0 100644
--- a/api_docs/kbn_shared_ux_page_kibana_no_data.mdx
+++ b/api_docs/kbn_shared_ux_page_kibana_no_data.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-kibana-no-data
 title: "@kbn/shared-ux-page-kibana-no-data"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-kibana-no-data plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-kibana-no-data']
 ---
 import kbnSharedUxPageKibanaNoDataObj from './kbn_shared_ux_page_kibana_no_data.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_kibana_no_data_mocks.mdx b/api_docs/kbn_shared_ux_page_kibana_no_data_mocks.mdx
index f968e0c134af7d..c69b1597665b34 100644
--- a/api_docs/kbn_shared_ux_page_kibana_no_data_mocks.mdx
+++ b/api_docs/kbn_shared_ux_page_kibana_no_data_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-kibana-no-data-mocks
 title: "@kbn/shared-ux-page-kibana-no-data-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-kibana-no-data-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-kibana-no-data-mocks']
 ---
 import kbnSharedUxPageKibanaNoDataMocksObj from './kbn_shared_ux_page_kibana_no_data_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_kibana_template.mdx b/api_docs/kbn_shared_ux_page_kibana_template.mdx
index c864bd17ca6457..484644f30e5eb5 100644
--- a/api_docs/kbn_shared_ux_page_kibana_template.mdx
+++ b/api_docs/kbn_shared_ux_page_kibana_template.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-kibana-template
 title: "@kbn/shared-ux-page-kibana-template"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-kibana-template plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-kibana-template']
 ---
 import kbnSharedUxPageKibanaTemplateObj from './kbn_shared_ux_page_kibana_template.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_kibana_template_mocks.mdx b/api_docs/kbn_shared_ux_page_kibana_template_mocks.mdx
index b812ad076221bc..6b355aa26dabf3 100644
--- a/api_docs/kbn_shared_ux_page_kibana_template_mocks.mdx
+++ b/api_docs/kbn_shared_ux_page_kibana_template_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-kibana-template-mocks
 title: "@kbn/shared-ux-page-kibana-template-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-kibana-template-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-kibana-template-mocks']
 ---
 import kbnSharedUxPageKibanaTemplateMocksObj from './kbn_shared_ux_page_kibana_template_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_no_data.mdx b/api_docs/kbn_shared_ux_page_no_data.mdx
index cffc580407a2d1..ba7d2f3f4a9aee 100644
--- a/api_docs/kbn_shared_ux_page_no_data.mdx
+++ b/api_docs/kbn_shared_ux_page_no_data.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-no-data
 title: "@kbn/shared-ux-page-no-data"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-no-data plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-no-data']
 ---
 import kbnSharedUxPageNoDataObj from './kbn_shared_ux_page_no_data.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_no_data_config.mdx b/api_docs/kbn_shared_ux_page_no_data_config.mdx
index 6739b1bc842580..0d11aba1f34f7c 100644
--- a/api_docs/kbn_shared_ux_page_no_data_config.mdx
+++ b/api_docs/kbn_shared_ux_page_no_data_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-no-data-config
 title: "@kbn/shared-ux-page-no-data-config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-no-data-config plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-no-data-config']
 ---
 import kbnSharedUxPageNoDataConfigObj from './kbn_shared_ux_page_no_data_config.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_no_data_config_mocks.mdx b/api_docs/kbn_shared_ux_page_no_data_config_mocks.mdx
index fca0931e7daa64..fc1cc0a7b8df42 100644
--- a/api_docs/kbn_shared_ux_page_no_data_config_mocks.mdx
+++ b/api_docs/kbn_shared_ux_page_no_data_config_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-no-data-config-mocks
 title: "@kbn/shared-ux-page-no-data-config-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-no-data-config-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-no-data-config-mocks']
 ---
 import kbnSharedUxPageNoDataConfigMocksObj from './kbn_shared_ux_page_no_data_config_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_no_data_mocks.mdx b/api_docs/kbn_shared_ux_page_no_data_mocks.mdx
index a9f98d95008f14..313aff53f9ea28 100644
--- a/api_docs/kbn_shared_ux_page_no_data_mocks.mdx
+++ b/api_docs/kbn_shared_ux_page_no_data_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-no-data-mocks
 title: "@kbn/shared-ux-page-no-data-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-no-data-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-no-data-mocks']
 ---
 import kbnSharedUxPageNoDataMocksObj from './kbn_shared_ux_page_no_data_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_solution_nav.mdx b/api_docs/kbn_shared_ux_page_solution_nav.mdx
index 1be70f1b987495..b294329d93acb4 100644
--- a/api_docs/kbn_shared_ux_page_solution_nav.mdx
+++ b/api_docs/kbn_shared_ux_page_solution_nav.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-solution-nav
 title: "@kbn/shared-ux-page-solution-nav"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-solution-nav plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-solution-nav']
 ---
 import kbnSharedUxPageSolutionNavObj from './kbn_shared_ux_page_solution_nav.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_prompt_no_data_views.mdx b/api_docs/kbn_shared_ux_prompt_no_data_views.mdx
index 7f6c7bc5eaf6e3..ce872f710b5433 100644
--- a/api_docs/kbn_shared_ux_prompt_no_data_views.mdx
+++ b/api_docs/kbn_shared_ux_prompt_no_data_views.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-prompt-no-data-views
 title: "@kbn/shared-ux-prompt-no-data-views"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-prompt-no-data-views plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-prompt-no-data-views']
 ---
 import kbnSharedUxPromptNoDataViewsObj from './kbn_shared_ux_prompt_no_data_views.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_prompt_no_data_views_mocks.mdx b/api_docs/kbn_shared_ux_prompt_no_data_views_mocks.mdx
index 54f602363bfb2f..f18c516b300558 100644
--- a/api_docs/kbn_shared_ux_prompt_no_data_views_mocks.mdx
+++ b/api_docs/kbn_shared_ux_prompt_no_data_views_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-prompt-no-data-views-mocks
 title: "@kbn/shared-ux-prompt-no-data-views-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-prompt-no-data-views-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-prompt-no-data-views-mocks']
 ---
 import kbnSharedUxPromptNoDataViewsMocksObj from './kbn_shared_ux_prompt_no_data_views_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_prompt_not_found.mdx b/api_docs/kbn_shared_ux_prompt_not_found.mdx
index a956538538b657..0a13f874bc92aa 100644
--- a/api_docs/kbn_shared_ux_prompt_not_found.mdx
+++ b/api_docs/kbn_shared_ux_prompt_not_found.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-prompt-not-found
 title: "@kbn/shared-ux-prompt-not-found"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-prompt-not-found plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-prompt-not-found']
 ---
 import kbnSharedUxPromptNotFoundObj from './kbn_shared_ux_prompt_not_found.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_router.mdx b/api_docs/kbn_shared_ux_router.mdx
index 01760d99894b70..b87679063225d1 100644
--- a/api_docs/kbn_shared_ux_router.mdx
+++ b/api_docs/kbn_shared_ux_router.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-router
 title: "@kbn/shared-ux-router"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-router plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-router']
 ---
 import kbnSharedUxRouterObj from './kbn_shared_ux_router.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_router_mocks.mdx b/api_docs/kbn_shared_ux_router_mocks.mdx
index 6e04c7604e5746..6617bd3d2cacdf 100644
--- a/api_docs/kbn_shared_ux_router_mocks.mdx
+++ b/api_docs/kbn_shared_ux_router_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-router-mocks
 title: "@kbn/shared-ux-router-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-router-mocks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-router-mocks']
 ---
 import kbnSharedUxRouterMocksObj from './kbn_shared_ux_router_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_storybook_config.mdx b/api_docs/kbn_shared_ux_storybook_config.mdx
index d30dc474b1f8d2..b8408f7c87e46e 100644
--- a/api_docs/kbn_shared_ux_storybook_config.mdx
+++ b/api_docs/kbn_shared_ux_storybook_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-storybook-config
 title: "@kbn/shared-ux-storybook-config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-storybook-config plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-storybook-config']
 ---
 import kbnSharedUxStorybookConfigObj from './kbn_shared_ux_storybook_config.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_storybook_mock.mdx b/api_docs/kbn_shared_ux_storybook_mock.mdx
index 5bd95ffe04e8d4..781738a0cebc1d 100644
--- a/api_docs/kbn_shared_ux_storybook_mock.mdx
+++ b/api_docs/kbn_shared_ux_storybook_mock.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-storybook-mock
 title: "@kbn/shared-ux-storybook-mock"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-storybook-mock plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-storybook-mock']
 ---
 import kbnSharedUxStorybookMockObj from './kbn_shared_ux_storybook_mock.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_tabbed_modal.mdx b/api_docs/kbn_shared_ux_tabbed_modal.mdx
index 8656d78746289b..6431408fe6019f 100644
--- a/api_docs/kbn_shared_ux_tabbed_modal.mdx
+++ b/api_docs/kbn_shared_ux_tabbed_modal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-tabbed-modal
 title: "@kbn/shared-ux-tabbed-modal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-tabbed-modal plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-tabbed-modal']
 ---
 import kbnSharedUxTabbedModalObj from './kbn_shared_ux_tabbed_modal.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_utility.mdx b/api_docs/kbn_shared_ux_utility.mdx
index 46f11055f54508..d41afe001fb0f6 100644
--- a/api_docs/kbn_shared_ux_utility.mdx
+++ b/api_docs/kbn_shared_ux_utility.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-utility
 title: "@kbn/shared-ux-utility"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-utility plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-utility']
 ---
 import kbnSharedUxUtilityObj from './kbn_shared_ux_utility.devdocs.json';
diff --git a/api_docs/kbn_slo_schema.devdocs.json b/api_docs/kbn_slo_schema.devdocs.json
index 2b81a8b0f23dd9..1df8c767cf1b37 100644
--- a/api_docs/kbn_slo_schema.devdocs.json
+++ b/api_docs/kbn_slo_schema.devdocs.json
@@ -850,7 +850,7 @@
         "label": "FindSLOGroupsResponse",
         "description": [],
         "signature": [
-          "{ page: number; perPage: number; total: number; results: { group: string; groupBy: string; summary: { total: number; worst: { sliValue: number; status: string; slo: { id: string; instanceId: string; name: string; }; }; violated: number; healthy: number; degrading: number; noData: number; }; }[]; }"
+          "{ page: number; perPage: number; total: number; results: { group: string; groupBy: \"status\" | \"_index\" | \"ungrouped\" | \"slo.tags\" | \"slo.indicator.type\"; summary: { total: number; worst: { sliValue: number; status: string; slo: { id: string; instanceId: string; name: string; }; }; violated: number; healthy: number; degrading: number; noData: number; }; }[]; }"
         ],
         "path": "x-pack/packages/kbn-slo-schema/src/rest_specs/routes/find_group.ts",
         "deprecated": false,
@@ -5120,8 +5120,18 @@
           "<{ group: ",
           "StringC",
           "; groupBy: ",
-          "StringC",
-          "; summary: ",
+          "UnionC",
+          "<[",
+          "LiteralC",
+          "<\"ungrouped\">, ",
+          "LiteralC",
+          "<\"slo.tags\">, ",
+          "LiteralC",
+          "<\"status\">, ",
+          "LiteralC",
+          "<\"slo.indicator.type\">, ",
+          "LiteralC",
+          "<\"_index\">]>; summary: ",
           "TypeC",
           "<{ total: ",
           "NumberC",
@@ -15413,8 +15423,18 @@
           "<{ group: ",
           "StringC",
           "; groupBy: ",
-          "StringC",
-          "; summary: ",
+          "UnionC",
+          "<[",
+          "LiteralC",
+          "<\"ungrouped\">, ",
+          "LiteralC",
+          "<\"slo.tags\">, ",
+          "LiteralC",
+          "<\"status\">, ",
+          "LiteralC",
+          "<\"slo.indicator.type\">, ",
+          "LiteralC",
+          "<\"_index\">]>; summary: ",
           "TypeC",
           "<{ total: ",
           "NumberC",
diff --git a/api_docs/kbn_slo_schema.mdx b/api_docs/kbn_slo_schema.mdx
index bc09568d7794fc..2ecb76710bef5f 100644
--- a/api_docs/kbn_slo_schema.mdx
+++ b/api_docs/kbn_slo_schema.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-slo-schema
 title: "@kbn/slo-schema"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/slo-schema plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/slo-schema']
 ---
 import kbnSloSchemaObj from './kbn_slo_schema.devdocs.json';
diff --git a/api_docs/kbn_solution_nav_es.mdx b/api_docs/kbn_solution_nav_es.mdx
index ffdd80a5095b95..cb7a594cc876b0 100644
--- a/api_docs/kbn_solution_nav_es.mdx
+++ b/api_docs/kbn_solution_nav_es.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-solution-nav-es
 title: "@kbn/solution-nav-es"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/solution-nav-es plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/solution-nav-es']
 ---
 import kbnSolutionNavEsObj from './kbn_solution_nav_es.devdocs.json';
diff --git a/api_docs/kbn_solution_nav_oblt.mdx b/api_docs/kbn_solution_nav_oblt.mdx
index c55e9aade46ca2..df275986149029 100644
--- a/api_docs/kbn_solution_nav_oblt.mdx
+++ b/api_docs/kbn_solution_nav_oblt.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-solution-nav-oblt
 title: "@kbn/solution-nav-oblt"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/solution-nav-oblt plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/solution-nav-oblt']
 ---
 import kbnSolutionNavObltObj from './kbn_solution_nav_oblt.devdocs.json';
diff --git a/api_docs/kbn_some_dev_log.mdx b/api_docs/kbn_some_dev_log.mdx
index 16405d6506ec70..fd52f920a47164 100644
--- a/api_docs/kbn_some_dev_log.mdx
+++ b/api_docs/kbn_some_dev_log.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-some-dev-log
 title: "@kbn/some-dev-log"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/some-dev-log plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/some-dev-log']
 ---
 import kbnSomeDevLogObj from './kbn_some_dev_log.devdocs.json';
diff --git a/api_docs/kbn_sort_predicates.mdx b/api_docs/kbn_sort_predicates.mdx
index 949f02026184f7..5709a91f0020dc 100644
--- a/api_docs/kbn_sort_predicates.mdx
+++ b/api_docs/kbn_sort_predicates.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-sort-predicates
 title: "@kbn/sort-predicates"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/sort-predicates plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/sort-predicates']
 ---
 import kbnSortPredicatesObj from './kbn_sort_predicates.devdocs.json';
diff --git a/api_docs/kbn_std.mdx b/api_docs/kbn_std.mdx
index 0028af6458444e..68aac30f6ef509 100644
--- a/api_docs/kbn_std.mdx
+++ b/api_docs/kbn_std.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-std
 title: "@kbn/std"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/std plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/std']
 ---
 import kbnStdObj from './kbn_std.devdocs.json';
diff --git a/api_docs/kbn_stdio_dev_helpers.mdx b/api_docs/kbn_stdio_dev_helpers.mdx
index 30567572c8d5e6..d3c11909bc8a89 100644
--- a/api_docs/kbn_stdio_dev_helpers.mdx
+++ b/api_docs/kbn_stdio_dev_helpers.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-stdio-dev-helpers
 title: "@kbn/stdio-dev-helpers"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/stdio-dev-helpers plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/stdio-dev-helpers']
 ---
 import kbnStdioDevHelpersObj from './kbn_stdio_dev_helpers.devdocs.json';
diff --git a/api_docs/kbn_storybook.mdx b/api_docs/kbn_storybook.mdx
index 3ff597004c22aa..983754c6abccb3 100644
--- a/api_docs/kbn_storybook.mdx
+++ b/api_docs/kbn_storybook.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-storybook
 title: "@kbn/storybook"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/storybook plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/storybook']
 ---
 import kbnStorybookObj from './kbn_storybook.devdocs.json';
diff --git a/api_docs/kbn_telemetry_tools.mdx b/api_docs/kbn_telemetry_tools.mdx
index 4a590cd971ab7f..98beb0819b6954 100644
--- a/api_docs/kbn_telemetry_tools.mdx
+++ b/api_docs/kbn_telemetry_tools.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-telemetry-tools
 title: "@kbn/telemetry-tools"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/telemetry-tools plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/telemetry-tools']
 ---
 import kbnTelemetryToolsObj from './kbn_telemetry_tools.devdocs.json';
diff --git a/api_docs/kbn_test.mdx b/api_docs/kbn_test.mdx
index b754fc72666092..ac7abd4e3dd1a1 100644
--- a/api_docs/kbn_test.mdx
+++ b/api_docs/kbn_test.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-test
 title: "@kbn/test"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/test plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/test']
 ---
 import kbnTestObj from './kbn_test.devdocs.json';
diff --git a/api_docs/kbn_test_eui_helpers.mdx b/api_docs/kbn_test_eui_helpers.mdx
index a6e0f69e31cb9a..0a2d91997f585e 100644
--- a/api_docs/kbn_test_eui_helpers.mdx
+++ b/api_docs/kbn_test_eui_helpers.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-test-eui-helpers
 title: "@kbn/test-eui-helpers"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/test-eui-helpers plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/test-eui-helpers']
 ---
 import kbnTestEuiHelpersObj from './kbn_test_eui_helpers.devdocs.json';
diff --git a/api_docs/kbn_test_jest_helpers.mdx b/api_docs/kbn_test_jest_helpers.mdx
index ea9322d8ac157e..5c7ee351daf487 100644
--- a/api_docs/kbn_test_jest_helpers.mdx
+++ b/api_docs/kbn_test_jest_helpers.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-test-jest-helpers
 title: "@kbn/test-jest-helpers"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/test-jest-helpers plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/test-jest-helpers']
 ---
 import kbnTestJestHelpersObj from './kbn_test_jest_helpers.devdocs.json';
diff --git a/api_docs/kbn_test_subj_selector.mdx b/api_docs/kbn_test_subj_selector.mdx
index 6ba8f710130349..e8752ee30b9253 100644
--- a/api_docs/kbn_test_subj_selector.mdx
+++ b/api_docs/kbn_test_subj_selector.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-test-subj-selector
 title: "@kbn/test-subj-selector"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/test-subj-selector plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/test-subj-selector']
 ---
 import kbnTestSubjSelectorObj from './kbn_test_subj_selector.devdocs.json';
diff --git a/api_docs/kbn_text_based_editor.mdx b/api_docs/kbn_text_based_editor.mdx
index 0f15b4bede9d46..52f9877a9409ec 100644
--- a/api_docs/kbn_text_based_editor.mdx
+++ b/api_docs/kbn_text_based_editor.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-text-based-editor
 title: "@kbn/text-based-editor"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/text-based-editor plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/text-based-editor']
 ---
 import kbnTextBasedEditorObj from './kbn_text_based_editor.devdocs.json';
diff --git a/api_docs/kbn_timerange.mdx b/api_docs/kbn_timerange.mdx
index f02719f0ef05fe..e84f941d9bc6da 100644
--- a/api_docs/kbn_timerange.mdx
+++ b/api_docs/kbn_timerange.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-timerange
 title: "@kbn/timerange"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/timerange plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/timerange']
 ---
 import kbnTimerangeObj from './kbn_timerange.devdocs.json';
diff --git a/api_docs/kbn_tooling_log.mdx b/api_docs/kbn_tooling_log.mdx
index 8a9c68e540b3cf..3a88cd192c4e8f 100644
--- a/api_docs/kbn_tooling_log.mdx
+++ b/api_docs/kbn_tooling_log.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-tooling-log
 title: "@kbn/tooling-log"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/tooling-log plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/tooling-log']
 ---
 import kbnToolingLogObj from './kbn_tooling_log.devdocs.json';
diff --git a/api_docs/kbn_triggers_actions_ui_types.mdx b/api_docs/kbn_triggers_actions_ui_types.mdx
index aff7155cf62419..47996c5199d0ab 100644
--- a/api_docs/kbn_triggers_actions_ui_types.mdx
+++ b/api_docs/kbn_triggers_actions_ui_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-triggers-actions-ui-types
 title: "@kbn/triggers-actions-ui-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/triggers-actions-ui-types plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/triggers-actions-ui-types']
 ---
 import kbnTriggersActionsUiTypesObj from './kbn_triggers_actions_ui_types.devdocs.json';
diff --git a/api_docs/kbn_ts_projects.mdx b/api_docs/kbn_ts_projects.mdx
index 5d2403bf7c3609..dd3d451f2e73ab 100644
--- a/api_docs/kbn_ts_projects.mdx
+++ b/api_docs/kbn_ts_projects.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ts-projects
 title: "@kbn/ts-projects"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ts-projects plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ts-projects']
 ---
 import kbnTsProjectsObj from './kbn_ts_projects.devdocs.json';
diff --git a/api_docs/kbn_typed_react_router_config.mdx b/api_docs/kbn_typed_react_router_config.mdx
index 1779f7edd81d15..308c7cef7c71d2 100644
--- a/api_docs/kbn_typed_react_router_config.mdx
+++ b/api_docs/kbn_typed_react_router_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-typed-react-router-config
 title: "@kbn/typed-react-router-config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/typed-react-router-config plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/typed-react-router-config']
 ---
 import kbnTypedReactRouterConfigObj from './kbn_typed_react_router_config.devdocs.json';
diff --git a/api_docs/kbn_ui_actions_browser.mdx b/api_docs/kbn_ui_actions_browser.mdx
index 58a24631f8daa3..0685469f8405da 100644
--- a/api_docs/kbn_ui_actions_browser.mdx
+++ b/api_docs/kbn_ui_actions_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ui-actions-browser
 title: "@kbn/ui-actions-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ui-actions-browser plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ui-actions-browser']
 ---
 import kbnUiActionsBrowserObj from './kbn_ui_actions_browser.devdocs.json';
diff --git a/api_docs/kbn_ui_shared_deps_src.mdx b/api_docs/kbn_ui_shared_deps_src.mdx
index 0c00262e0aea12..d39c7d994efc64 100644
--- a/api_docs/kbn_ui_shared_deps_src.mdx
+++ b/api_docs/kbn_ui_shared_deps_src.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ui-shared-deps-src
 title: "@kbn/ui-shared-deps-src"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ui-shared-deps-src plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ui-shared-deps-src']
 ---
 import kbnUiSharedDepsSrcObj from './kbn_ui_shared_deps_src.devdocs.json';
diff --git a/api_docs/kbn_ui_theme.mdx b/api_docs/kbn_ui_theme.mdx
index c990c29d013eb7..eb70acf1811137 100644
--- a/api_docs/kbn_ui_theme.mdx
+++ b/api_docs/kbn_ui_theme.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ui-theme
 title: "@kbn/ui-theme"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ui-theme plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ui-theme']
 ---
 import kbnUiThemeObj from './kbn_ui_theme.devdocs.json';
diff --git a/api_docs/kbn_unified_data_table.mdx b/api_docs/kbn_unified_data_table.mdx
index f98d0089826d79..1ed3d6d2fffb86 100644
--- a/api_docs/kbn_unified_data_table.mdx
+++ b/api_docs/kbn_unified_data_table.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-unified-data-table
 title: "@kbn/unified-data-table"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/unified-data-table plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/unified-data-table']
 ---
 import kbnUnifiedDataTableObj from './kbn_unified_data_table.devdocs.json';
diff --git a/api_docs/kbn_unified_doc_viewer.mdx b/api_docs/kbn_unified_doc_viewer.mdx
index 9cf47290f0857a..8f074750a75e85 100644
--- a/api_docs/kbn_unified_doc_viewer.mdx
+++ b/api_docs/kbn_unified_doc_viewer.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-unified-doc-viewer
 title: "@kbn/unified-doc-viewer"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/unified-doc-viewer plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/unified-doc-viewer']
 ---
 import kbnUnifiedDocViewerObj from './kbn_unified_doc_viewer.devdocs.json';
diff --git a/api_docs/kbn_unified_field_list.mdx b/api_docs/kbn_unified_field_list.mdx
index d214ce32cc9c63..2fc7d15e859404 100644
--- a/api_docs/kbn_unified_field_list.mdx
+++ b/api_docs/kbn_unified_field_list.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-unified-field-list
 title: "@kbn/unified-field-list"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/unified-field-list plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/unified-field-list']
 ---
 import kbnUnifiedFieldListObj from './kbn_unified_field_list.devdocs.json';
diff --git a/api_docs/kbn_unsaved_changes_badge.mdx b/api_docs/kbn_unsaved_changes_badge.mdx
index f37aeca4496115..0e2303d26f7a87 100644
--- a/api_docs/kbn_unsaved_changes_badge.mdx
+++ b/api_docs/kbn_unsaved_changes_badge.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-unsaved-changes-badge
 title: "@kbn/unsaved-changes-badge"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/unsaved-changes-badge plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/unsaved-changes-badge']
 ---
 import kbnUnsavedChangesBadgeObj from './kbn_unsaved_changes_badge.devdocs.json';
diff --git a/api_docs/kbn_use_tracked_promise.mdx b/api_docs/kbn_use_tracked_promise.mdx
index 9e7234224bf447..f3b0e620743f9c 100644
--- a/api_docs/kbn_use_tracked_promise.mdx
+++ b/api_docs/kbn_use_tracked_promise.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-use-tracked-promise
 title: "@kbn/use-tracked-promise"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/use-tracked-promise plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/use-tracked-promise']
 ---
 import kbnUseTrackedPromiseObj from './kbn_use_tracked_promise.devdocs.json';
diff --git a/api_docs/kbn_user_profile_components.mdx b/api_docs/kbn_user_profile_components.mdx
index ae12b7eb537f0d..b88773cca93077 100644
--- a/api_docs/kbn_user_profile_components.mdx
+++ b/api_docs/kbn_user_profile_components.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-user-profile-components
 title: "@kbn/user-profile-components"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/user-profile-components plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/user-profile-components']
 ---
 import kbnUserProfileComponentsObj from './kbn_user_profile_components.devdocs.json';
diff --git a/api_docs/kbn_utility_types.mdx b/api_docs/kbn_utility_types.mdx
index 540aebf8a97a5c..affc33ab6e1066 100644
--- a/api_docs/kbn_utility_types.mdx
+++ b/api_docs/kbn_utility_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-utility-types
 title: "@kbn/utility-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/utility-types plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/utility-types']
 ---
 import kbnUtilityTypesObj from './kbn_utility_types.devdocs.json';
diff --git a/api_docs/kbn_utility_types_jest.mdx b/api_docs/kbn_utility_types_jest.mdx
index 66fa4bc2ce8719..ebe78f7f4430ae 100644
--- a/api_docs/kbn_utility_types_jest.mdx
+++ b/api_docs/kbn_utility_types_jest.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-utility-types-jest
 title: "@kbn/utility-types-jest"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/utility-types-jest plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/utility-types-jest']
 ---
 import kbnUtilityTypesJestObj from './kbn_utility_types_jest.devdocs.json';
diff --git a/api_docs/kbn_utils.mdx b/api_docs/kbn_utils.mdx
index 7190ff432ac1d0..6307a8d9017d2e 100644
--- a/api_docs/kbn_utils.mdx
+++ b/api_docs/kbn_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-utils
 title: "@kbn/utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/utils plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/utils']
 ---
 import kbnUtilsObj from './kbn_utils.devdocs.json';
diff --git a/api_docs/kbn_visualization_ui_components.mdx b/api_docs/kbn_visualization_ui_components.mdx
index 35ed6c05c0836d..308527607bf127 100644
--- a/api_docs/kbn_visualization_ui_components.mdx
+++ b/api_docs/kbn_visualization_ui_components.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-visualization-ui-components
 title: "@kbn/visualization-ui-components"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/visualization-ui-components plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/visualization-ui-components']
 ---
 import kbnVisualizationUiComponentsObj from './kbn_visualization_ui_components.devdocs.json';
diff --git a/api_docs/kbn_visualization_utils.mdx b/api_docs/kbn_visualization_utils.mdx
index e49d818026c387..c96f5b9f362694 100644
--- a/api_docs/kbn_visualization_utils.mdx
+++ b/api_docs/kbn_visualization_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-visualization-utils
 title: "@kbn/visualization-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/visualization-utils plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/visualization-utils']
 ---
 import kbnVisualizationUtilsObj from './kbn_visualization_utils.devdocs.json';
diff --git a/api_docs/kbn_xstate_utils.mdx b/api_docs/kbn_xstate_utils.mdx
index 70c36db92992be..5a8dd34e5ab25d 100644
--- a/api_docs/kbn_xstate_utils.mdx
+++ b/api_docs/kbn_xstate_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-xstate-utils
 title: "@kbn/xstate-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/xstate-utils plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/xstate-utils']
 ---
 import kbnXstateUtilsObj from './kbn_xstate_utils.devdocs.json';
diff --git a/api_docs/kbn_yarn_lock_validator.mdx b/api_docs/kbn_yarn_lock_validator.mdx
index f368499e095438..68731c1dbe89fe 100644
--- a/api_docs/kbn_yarn_lock_validator.mdx
+++ b/api_docs/kbn_yarn_lock_validator.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-yarn-lock-validator
 title: "@kbn/yarn-lock-validator"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/yarn-lock-validator plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/yarn-lock-validator']
 ---
 import kbnYarnLockValidatorObj from './kbn_yarn_lock_validator.devdocs.json';
diff --git a/api_docs/kbn_zod_helpers.mdx b/api_docs/kbn_zod_helpers.mdx
index ccec2efed99da7..c1164c76393b9b 100644
--- a/api_docs/kbn_zod_helpers.mdx
+++ b/api_docs/kbn_zod_helpers.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-zod-helpers
 title: "@kbn/zod-helpers"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/zod-helpers plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/zod-helpers']
 ---
 import kbnZodHelpersObj from './kbn_zod_helpers.devdocs.json';
diff --git a/api_docs/kibana_overview.mdx b/api_docs/kibana_overview.mdx
index f6f3836adf6bbe..f05c5b6d3e72df 100644
--- a/api_docs/kibana_overview.mdx
+++ b/api_docs/kibana_overview.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kibanaOverview
 title: "kibanaOverview"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the kibanaOverview plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'kibanaOverview']
 ---
 import kibanaOverviewObj from './kibana_overview.devdocs.json';
diff --git a/api_docs/kibana_react.devdocs.json b/api_docs/kibana_react.devdocs.json
index 7ecaec8ae26f65..fb67fa4907473e 100644
--- a/api_docs/kibana_react.devdocs.json
+++ b/api_docs/kibana_react.devdocs.json
@@ -511,34 +511,6 @@
         "deprecated": true,
         "trackAdoption": false,
         "references": [
-          {
-            "plugin": "devTools",
-            "path": "src/plugins/dev_tools/public/application.tsx"
-          },
-          {
-            "plugin": "devTools",
-            "path": "src/plugins/dev_tools/public/application.tsx"
-          },
-          {
-            "plugin": "devTools",
-            "path": "src/plugins/dev_tools/public/application.tsx"
-          },
-          {
-            "plugin": "console",
-            "path": "src/plugins/console/public/shared_imports.ts"
-          },
-          {
-            "plugin": "crossClusterReplication",
-            "path": "x-pack/plugins/cross_cluster_replication/public/shared_imports.ts"
-          },
-          {
-            "plugin": "grokdebugger",
-            "path": "x-pack/plugins/grokdebugger/public/shared_imports.ts"
-          },
-          {
-            "plugin": "ingestPipelines",
-            "path": "x-pack/plugins/ingest_pipelines/public/shared_imports.ts"
-          },
           {
             "plugin": "infra",
             "path": "x-pack/plugins/observability_solution/infra/public/apps/common_providers.tsx"
@@ -551,38 +523,6 @@
             "plugin": "infra",
             "path": "x-pack/plugins/observability_solution/infra/public/apps/common_providers.tsx"
           },
-          {
-            "plugin": "painlessLab",
-            "path": "x-pack/plugins/painless_lab/public/shared_imports.ts"
-          },
-          {
-            "plugin": "painlessLab",
-            "path": "x-pack/plugins/painless_lab/public/application/index.tsx"
-          },
-          {
-            "plugin": "painlessLab",
-            "path": "x-pack/plugins/painless_lab/public/application/index.tsx"
-          },
-          {
-            "plugin": "painlessLab",
-            "path": "x-pack/plugins/painless_lab/public/application/index.tsx"
-          },
-          {
-            "plugin": "searchprofiler",
-            "path": "x-pack/plugins/searchprofiler/public/shared_imports.ts"
-          },
-          {
-            "plugin": "searchprofiler",
-            "path": "x-pack/plugins/searchprofiler/public/application/index.tsx"
-          },
-          {
-            "plugin": "searchprofiler",
-            "path": "x-pack/plugins/searchprofiler/public/application/index.tsx"
-          },
-          {
-            "plugin": "searchprofiler",
-            "path": "x-pack/plugins/searchprofiler/public/application/index.tsx"
-          },
           {
             "plugin": "metricsDataAccess",
             "path": "x-pack/plugins/observability_solution/metrics_data_access/public/apps/common_providers.tsx"
@@ -1083,38 +1023,6 @@
           {
             "plugin": "observabilityShared",
             "path": "x-pack/plugins/observability_solution/observability_shared/public/components/header_menu/header_menu_portal.tsx"
-          },
-          {
-            "plugin": "console",
-            "path": "src/plugins/console/public/shared_imports.ts"
-          },
-          {
-            "plugin": "console",
-            "path": "src/plugins/console/public/application/hooks/use_send_current_request/use_send_current_request.ts"
-          },
-          {
-            "plugin": "console",
-            "path": "src/plugins/console/public/application/hooks/use_send_current_request/use_send_current_request.ts"
-          },
-          {
-            "plugin": "runtimeFields",
-            "path": "x-pack/plugins/runtime_fields/public/shared_imports.ts"
-          },
-          {
-            "plugin": "runtimeFields",
-            "path": "x-pack/plugins/runtime_fields/public/load_editor.tsx"
-          },
-          {
-            "plugin": "runtimeFields",
-            "path": "x-pack/plugins/runtime_fields/public/load_editor.tsx"
-          },
-          {
-            "plugin": "indexManagement",
-            "path": "x-pack/plugins/index_management/public/application/components/component_templates/component_template_wizard/component_template_datastreams_rollover/use_datastreams_rollover.tsx"
-          },
-          {
-            "plugin": "indexManagement",
-            "path": "x-pack/plugins/index_management/public/application/components/component_templates/component_template_wizard/component_template_datastreams_rollover/use_datastreams_rollover.tsx"
           }
         ],
         "children": [
diff --git a/api_docs/kibana_react.mdx b/api_docs/kibana_react.mdx
index fd5ae16e93647a..3a62a214e68d0a 100644
--- a/api_docs/kibana_react.mdx
+++ b/api_docs/kibana_react.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kibanaReact
 title: "kibanaReact"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the kibanaReact plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'kibanaReact']
 ---
 import kibanaReactObj from './kibana_react.devdocs.json';
diff --git a/api_docs/kibana_utils.mdx b/api_docs/kibana_utils.mdx
index d833ed1b4753d2..cfd5df799f0322 100644
--- a/api_docs/kibana_utils.mdx
+++ b/api_docs/kibana_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kibanaUtils
 title: "kibanaUtils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the kibanaUtils plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'kibanaUtils']
 ---
 import kibanaUtilsObj from './kibana_utils.devdocs.json';
diff --git a/api_docs/kubernetes_security.mdx b/api_docs/kubernetes_security.mdx
index 1507d84cf07762..28c6fc42e1ee96 100644
--- a/api_docs/kubernetes_security.mdx
+++ b/api_docs/kubernetes_security.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kubernetesSecurity
 title: "kubernetesSecurity"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the kubernetesSecurity plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'kubernetesSecurity']
 ---
 import kubernetesSecurityObj from './kubernetes_security.devdocs.json';
diff --git a/api_docs/lens.mdx b/api_docs/lens.mdx
index 046cee9bacbbca..694f938bcaf694 100644
--- a/api_docs/lens.mdx
+++ b/api_docs/lens.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/lens
 title: "lens"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the lens plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'lens']
 ---
 import lensObj from './lens.devdocs.json';
diff --git a/api_docs/license_api_guard.mdx b/api_docs/license_api_guard.mdx
index d8477b45a31aed..3ada9303f2d341 100644
--- a/api_docs/license_api_guard.mdx
+++ b/api_docs/license_api_guard.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/licenseApiGuard
 title: "licenseApiGuard"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the licenseApiGuard plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'licenseApiGuard']
 ---
 import licenseApiGuardObj from './license_api_guard.devdocs.json';
diff --git a/api_docs/license_management.mdx b/api_docs/license_management.mdx
index 992e108882ccd6..03a36e3401e78c 100644
--- a/api_docs/license_management.mdx
+++ b/api_docs/license_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/licenseManagement
 title: "licenseManagement"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the licenseManagement plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'licenseManagement']
 ---
 import licenseManagementObj from './license_management.devdocs.json';
diff --git a/api_docs/licensing.mdx b/api_docs/licensing.mdx
index c754936160d91e..10edf9b39fccf4 100644
--- a/api_docs/licensing.mdx
+++ b/api_docs/licensing.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/licensing
 title: "licensing"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the licensing plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'licensing']
 ---
 import licensingObj from './licensing.devdocs.json';
diff --git a/api_docs/links.mdx b/api_docs/links.mdx
index 397b3dd856db71..f32bbcf0b9bf2e 100644
--- a/api_docs/links.mdx
+++ b/api_docs/links.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/links
 title: "links"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the links plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'links']
 ---
 import linksObj from './links.devdocs.json';
diff --git a/api_docs/lists.mdx b/api_docs/lists.mdx
index d2325683856989..00c88bbdec2136 100644
--- a/api_docs/lists.mdx
+++ b/api_docs/lists.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/lists
 title: "lists"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the lists plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'lists']
 ---
 import listsObj from './lists.devdocs.json';
diff --git a/api_docs/logs_data_access.devdocs.json b/api_docs/logs_data_access.devdocs.json
new file mode 100644
index 00000000000000..b874e0f36010e2
--- /dev/null
+++ b/api_docs/logs_data_access.devdocs.json
@@ -0,0 +1,63 @@
+{
+  "id": "logsDataAccess",
+  "client": {
+    "classes": [],
+    "functions": [],
+    "interfaces": [],
+    "enums": [],
+    "misc": [],
+    "objects": []
+  },
+  "server": {
+    "classes": [],
+    "functions": [],
+    "interfaces": [],
+    "enums": [],
+    "misc": [],
+    "objects": [],
+    "setup": {
+      "parentPluginId": "logsDataAccess",
+      "id": "def-server.LogsDataAccessPluginSetup",
+      "type": "Type",
+      "tags": [],
+      "label": "LogsDataAccessPluginSetup",
+      "description": [],
+      "signature": [
+        "void"
+      ],
+      "path": "x-pack/plugins/observability_solution/logs_data_access/server/plugin.ts",
+      "deprecated": false,
+      "trackAdoption": false,
+      "lifecycle": "setup",
+      "initialIsOpen": true
+    },
+    "start": {
+      "parentPluginId": "logsDataAccess",
+      "id": "def-server.LogsDataAccessPluginStart",
+      "type": "Type",
+      "tags": [],
+      "label": "LogsDataAccessPluginStart",
+      "description": [],
+      "signature": [
+        "{ services: { getLogsRatesService: ({ esClient, identifyingMetadata, serviceNames, timeFrom, timeTo, }: ",
+        "LogsRatesServiceParams",
+        ") => Promise<",
+        "LogsRatesServiceReturnType",
+        ">; }; }"
+      ],
+      "path": "x-pack/plugins/observability_solution/logs_data_access/server/plugin.ts",
+      "deprecated": false,
+      "trackAdoption": false,
+      "lifecycle": "start",
+      "initialIsOpen": true
+    }
+  },
+  "common": {
+    "classes": [],
+    "functions": [],
+    "interfaces": [],
+    "enums": [],
+    "misc": [],
+    "objects": []
+  }
+}
\ No newline at end of file
diff --git a/api_docs/logs_data_access.mdx b/api_docs/logs_data_access.mdx
new file mode 100644
index 00000000000000..b73c3a19f0ef24
--- /dev/null
+++ b/api_docs/logs_data_access.mdx
@@ -0,0 +1,33 @@
+---
+####
+#### This document is auto-generated and is meant to be viewed inside our experimental, new docs system.
+#### Reach out in #docs-engineering for more info.
+####
+id: kibLogsDataAccessPluginApi
+slug: /kibana-dev-docs/api/logsDataAccess
+title: "logsDataAccess"
+image: https://source.unsplash.com/400x175/?github
+description: API docs for the logsDataAccess plugin
+date: 2024-05-13
+tags: ['contributor', 'dev', 'apidocs', 'kibana', 'logsDataAccess']
+---
+import logsDataAccessObj from './logs_data_access.devdocs.json';
+
+
+
+Contact [@elastic/obs-ux-logs-team](https://github.com/orgs/elastic/teams/obs-ux-logs-team) for questions regarding this plugin.
+
+**Code health stats**
+
+| Public API count  | Any count | Items lacking comments | Missing exports |
+|-------------------|-----------|------------------------|-----------------|
+| 2 | 0 | 2 | 2 |
+
+## Server
+
+### Setup
+<DocDefinitionList data={[logsDataAccessObj.server.setup]}/>
+
+### Start
+<DocDefinitionList data={[logsDataAccessObj.server.start]}/>
+
diff --git a/api_docs/logs_explorer.mdx b/api_docs/logs_explorer.mdx
index 2eaacecfeb3210..aa3ac50b2808bc 100644
--- a/api_docs/logs_explorer.mdx
+++ b/api_docs/logs_explorer.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/logsExplorer
 title: "logsExplorer"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the logsExplorer plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'logsExplorer']
 ---
 import logsExplorerObj from './logs_explorer.devdocs.json';
diff --git a/api_docs/logs_shared.mdx b/api_docs/logs_shared.mdx
index bdf0476decc5ce..07862e35c2ee4b 100644
--- a/api_docs/logs_shared.mdx
+++ b/api_docs/logs_shared.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/logsShared
 title: "logsShared"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the logsShared plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'logsShared']
 ---
 import logsSharedObj from './logs_shared.devdocs.json';
diff --git a/api_docs/management.mdx b/api_docs/management.mdx
index da966e66eb854c..79053c3b3e6042 100644
--- a/api_docs/management.mdx
+++ b/api_docs/management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/management
 title: "management"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the management plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'management']
 ---
 import managementObj from './management.devdocs.json';
diff --git a/api_docs/maps.devdocs.json b/api_docs/maps.devdocs.json
index dc828b0c0a133a..f10d07d9b6d91f 100644
--- a/api_docs/maps.devdocs.json
+++ b/api_docs/maps.devdocs.json
@@ -1930,6 +1930,83 @@
         ],
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "maps",
+        "id": "def-public.CreateLayerDescriptorParams",
+        "type": "Interface",
+        "tags": [],
+        "label": "CreateLayerDescriptorParams",
+        "description": [],
+        "path": "x-pack/plugins/maps/public/classes/sources/es_search_source/create_layer_descriptor.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "maps",
+            "id": "def-public.CreateLayerDescriptorParams.indexPatternId",
+            "type": "string",
+            "tags": [],
+            "label": "indexPatternId",
+            "description": [],
+            "path": "x-pack/plugins/maps/public/classes/sources/es_search_source/create_layer_descriptor.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "maps",
+            "id": "def-public.CreateLayerDescriptorParams.geoFieldName",
+            "type": "string",
+            "tags": [],
+            "label": "geoFieldName",
+            "description": [],
+            "path": "x-pack/plugins/maps/public/classes/sources/es_search_source/create_layer_descriptor.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "maps",
+            "id": "def-public.CreateLayerDescriptorParams.geoFieldType",
+            "type": "Enum",
+            "tags": [],
+            "label": "geoFieldType",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "maps",
+                "scope": "common",
+                "docId": "kibMapsPluginApi",
+                "section": "def-common.ES_GEO_FIELD_TYPE",
+                "text": "ES_GEO_FIELD_TYPE"
+              }
+            ],
+            "path": "x-pack/plugins/maps/public/classes/sources/es_search_source/create_layer_descriptor.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "maps",
+            "id": "def-public.CreateLayerDescriptorParams.query",
+            "type": "Object",
+            "tags": [],
+            "label": "query",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/es-query",
+                "scope": "common",
+                "docId": "kibKbnEsQueryPluginApi",
+                "section": "def-common.Query",
+                "text": "Query"
+              },
+              " | undefined"
+            ],
+            "path": "x-pack/plugins/maps/public/classes/sources/es_search_source/create_layer_descriptor.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "maps",
         "id": "def-public.EMSTermJoinConfig",
@@ -4583,7 +4660,13 @@
               "text": "LayerDescriptor"
             },
             " | null>; createESSearchSourceLayerDescriptor: (params: ",
-            "CreateLayerDescriptorParams",
+            {
+              "pluginId": "maps",
+              "scope": "public",
+              "docId": "kibMapsPluginApi",
+              "section": "def-public.CreateLayerDescriptorParams",
+              "text": "CreateLayerDescriptorParams"
+            },
             ") => Promise<",
             {
               "pluginId": "maps",
diff --git a/api_docs/maps.mdx b/api_docs/maps.mdx
index d43c59cf94f9af..885b2bd4229797 100644
--- a/api_docs/maps.mdx
+++ b/api_docs/maps.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/maps
 title: "maps"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the maps plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'maps']
 ---
 import mapsObj from './maps.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/kibana-gis](https://github.com/orgs/elastic/teams/kibana-gis)
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 281 | 0 | 276 | 32 |
+| 286 | 0 | 281 | 31 |
 
 ## Client
 
diff --git a/api_docs/maps_ems.mdx b/api_docs/maps_ems.mdx
index 24dca7a4983488..d4a15097798d91 100644
--- a/api_docs/maps_ems.mdx
+++ b/api_docs/maps_ems.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/mapsEms
 title: "mapsEms"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the mapsEms plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'mapsEms']
 ---
 import mapsEmsObj from './maps_ems.devdocs.json';
diff --git a/api_docs/metrics_data_access.mdx b/api_docs/metrics_data_access.mdx
index 82666d05729e4a..ae83f29a638a33 100644
--- a/api_docs/metrics_data_access.mdx
+++ b/api_docs/metrics_data_access.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/metricsDataAccess
 title: "metricsDataAccess"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the metricsDataAccess plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'metricsDataAccess']
 ---
 import metricsDataAccessObj from './metrics_data_access.devdocs.json';
diff --git a/api_docs/ml.devdocs.json b/api_docs/ml.devdocs.json
index af39bef85acdfd..1d2c5b4093da31 100644
--- a/api_docs/ml.devdocs.json
+++ b/api_docs/ml.devdocs.json
@@ -1056,6 +1056,14 @@
             "text": "PublishesPanelTitle"
           },
           " & { setPanelTitle: (newTitle: string | undefined) => void; setHidePanelTitle: (hide: boolean | undefined) => void; } & ",
+          {
+            "pluginId": "@kbn/presentation-publishing",
+            "scope": "common",
+            "docId": "kibKbnPresentationPublishingPluginApi",
+            "section": "def-common.HasEditCapabilities",
+            "text": "HasEditCapabilities"
+          },
+          " & ",
           "AnomalySwimLaneComponentApi"
         ],
         "path": "x-pack/plugins/ml/public/embeddables/anomaly_swimlane/types.ts",
@@ -1117,6 +1125,66 @@
         "deprecated": false,
         "trackAdoption": false,
         "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "ml",
+        "id": "def-public.TrainedModelConfigResponse",
+        "type": "Type",
+        "tags": [],
+        "label": "TrainedModelConfigResponse",
+        "description": [],
+        "signature": [
+          "MlTrainedModelConfig",
+          " & { pipelines?: Record<string, ",
+          "PipelineDefinition",
+          "> | null | undefined; origin_job_exists?: boolean | undefined; metadata?: ({ analytics_config: ",
+          {
+            "pluginId": "@kbn/ml-data-frame-analytics-utils",
+            "scope": "common",
+            "docId": "kibKbnMlDataFrameAnalyticsUtilsPluginApi",
+            "section": "def-common.DataFrameAnalyticsConfig",
+            "text": "DataFrameAnalyticsConfig"
+          },
+          "; input: unknown; total_feature_importance?: ",
+          {
+            "pluginId": "@kbn/ml-data-frame-analytics-utils",
+            "scope": "common",
+            "docId": "kibKbnMlDataFrameAnalyticsUtilsPluginApi",
+            "section": "def-common.TotalFeatureImportance",
+            "text": "TotalFeatureImportance"
+          },
+          "[] | undefined; feature_importance_baseline?: ",
+          {
+            "pluginId": "@kbn/ml-data-frame-analytics-utils",
+            "scope": "common",
+            "docId": "kibKbnMlDataFrameAnalyticsUtilsPluginApi",
+            "section": "def-common.FeatureImportanceBaseline",
+            "text": "FeatureImportanceBaseline"
+          },
+          " | undefined; model_aliases?: string[] | undefined; } & Record<string, unknown>) | undefined; model_id: string; model_type: ",
+          {
+            "pluginId": "@kbn/ml-trained-models-utils",
+            "scope": "common",
+            "docId": "kibKbnMlTrainedModelsUtilsPluginApi",
+            "section": "def-common.TrainedModelType",
+            "text": "TrainedModelType"
+          },
+          "; tags: string[]; version: string; inference_config?: Record<string, any> | undefined; indices?: Record<string, ",
+          "IndicesIndexState",
+          " | null>[] | undefined; hasInferenceServices?: boolean | undefined; inference_apis?: ",
+          {
+            "pluginId": "@kbn/ml-trained-models-utils",
+            "scope": "common",
+            "docId": "kibKbnMlTrainedModelsUtilsPluginApi",
+            "section": "def-common.InferenceAPIConfigResponse",
+            "text": "InferenceAPIConfigResponse"
+          },
+          "[] | undefined; }"
+        ],
+        "path": "x-pack/plugins/ml/common/types/trained_models.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
       }
     ],
     "objects": [
@@ -1230,7 +1298,7 @@
         "MlHasPrivilegesResponse",
         ">; checkMlCapabilities(): Promise<",
         "MlCapabilitiesResponse",
-        ">; checkIndicesExists({ indices }: { indices: string[]; }): Promise<Record<string, { exists: boolean; }>>; getFieldCaps({ index, fields }: { index: string; fields: string[]; }): Promise<any>; recognizeIndex({ indexPatternTitle, filter, }: { indexPatternTitle: string; filter?: string[] | undefined; }): Promise<",
+        ">; checkIndicesExists({ indices }: { indices: string[]; }): Promise<Record<string, { exists: boolean; }>>; recognizeIndex({ indexPatternTitle, filter, }: { indexPatternTitle: string; filter?: string[] | undefined; }): Promise<",
         "RecognizeResult",
         "[]>; listDataRecognizerModules(filter?: string[] | undefined): Promise<any>; getDataRecognizerModule({ moduleId, filter }: { moduleId: string; filter?: string[] | undefined; }): Promise<",
         "Module",
diff --git a/api_docs/ml.mdx b/api_docs/ml.mdx
index edaa5ccffd7c54..b258277057ac6c 100644
--- a/api_docs/ml.mdx
+++ b/api_docs/ml.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/ml
 title: "ml"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the ml plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'ml']
 ---
 import mlObj from './ml.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/ml-ui](https://github.com/orgs/elastic/teams/ml-ui) for questi
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 153 | 3 | 66 | 100 |
+| 154 | 3 | 67 | 101 |
 
 ## Client
 
diff --git a/api_docs/mock_idp_plugin.mdx b/api_docs/mock_idp_plugin.mdx
index b2b2c0b9be4d32..96a110f433b63f 100644
--- a/api_docs/mock_idp_plugin.mdx
+++ b/api_docs/mock_idp_plugin.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/mockIdpPlugin
 title: "mockIdpPlugin"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the mockIdpPlugin plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'mockIdpPlugin']
 ---
 import mockIdpPluginObj from './mock_idp_plugin.devdocs.json';
diff --git a/api_docs/monitoring.mdx b/api_docs/monitoring.mdx
index 41a2027b427b4d..540b800ef9cb89 100644
--- a/api_docs/monitoring.mdx
+++ b/api_docs/monitoring.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/monitoring
 title: "monitoring"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the monitoring plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'monitoring']
 ---
 import monitoringObj from './monitoring.devdocs.json';
diff --git a/api_docs/monitoring_collection.mdx b/api_docs/monitoring_collection.mdx
index 76267b13568a94..f6b9fce4e54f27 100644
--- a/api_docs/monitoring_collection.mdx
+++ b/api_docs/monitoring_collection.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/monitoringCollection
 title: "monitoringCollection"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the monitoringCollection plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'monitoringCollection']
 ---
 import monitoringCollectionObj from './monitoring_collection.devdocs.json';
diff --git a/api_docs/navigation.mdx b/api_docs/navigation.mdx
index 6d31d405e26763..02a3d1c8cafef9 100644
--- a/api_docs/navigation.mdx
+++ b/api_docs/navigation.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/navigation
 title: "navigation"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the navigation plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'navigation']
 ---
 import navigationObj from './navigation.devdocs.json';
diff --git a/api_docs/newsfeed.mdx b/api_docs/newsfeed.mdx
index d062507b38d097..e039c1339aad93 100644
--- a/api_docs/newsfeed.mdx
+++ b/api_docs/newsfeed.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/newsfeed
 title: "newsfeed"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the newsfeed plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'newsfeed']
 ---
 import newsfeedObj from './newsfeed.devdocs.json';
diff --git a/api_docs/no_data_page.mdx b/api_docs/no_data_page.mdx
index c07fd5b69a264b..f1a48d34e812e3 100644
--- a/api_docs/no_data_page.mdx
+++ b/api_docs/no_data_page.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/noDataPage
 title: "noDataPage"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the noDataPage plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'noDataPage']
 ---
 import noDataPageObj from './no_data_page.devdocs.json';
diff --git a/api_docs/notifications.mdx b/api_docs/notifications.mdx
index 6d3c1602695d0c..79516a80d8a22a 100644
--- a/api_docs/notifications.mdx
+++ b/api_docs/notifications.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/notifications
 title: "notifications"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the notifications plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'notifications']
 ---
 import notificationsObj from './notifications.devdocs.json';
diff --git a/api_docs/observability.devdocs.json b/api_docs/observability.devdocs.json
index e218f0509a3f4e..901185fee6b366 100644
--- a/api_docs/observability.devdocs.json
+++ b/api_docs/observability.devdocs.json
@@ -10605,6 +10605,118 @@
               }
             ]
           },
+          {
+            "parentPluginId": "observability",
+            "id": "def-server.uiSettings.apmEnableMultiSignal",
+            "type": "Object",
+            "tags": [],
+            "label": "[apmEnableMultiSignal]",
+            "description": [],
+            "path": "x-pack/plugins/observability_solution/observability/server/ui_settings.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [
+              {
+                "parentPluginId": "observability",
+                "id": "def-server.uiSettings.apmEnableMultiSignal.category",
+                "type": "Array",
+                "tags": [],
+                "label": "category",
+                "description": [],
+                "signature": [
+                  "string[]"
+                ],
+                "path": "x-pack/plugins/observability_solution/observability/server/ui_settings.ts",
+                "deprecated": false,
+                "trackAdoption": false
+              },
+              {
+                "parentPluginId": "observability",
+                "id": "def-server.uiSettings.apmEnableMultiSignal.name",
+                "type": "string",
+                "tags": [],
+                "label": "name",
+                "description": [],
+                "path": "x-pack/plugins/observability_solution/observability/server/ui_settings.ts",
+                "deprecated": false,
+                "trackAdoption": false
+              },
+              {
+                "parentPluginId": "observability",
+                "id": "def-server.uiSettings.apmEnableMultiSignal.description",
+                "type": "string",
+                "tags": [],
+                "label": "description",
+                "description": [],
+                "path": "x-pack/plugins/observability_solution/observability/server/ui_settings.ts",
+                "deprecated": false,
+                "trackAdoption": false
+              },
+              {
+                "parentPluginId": "observability",
+                "id": "def-server.uiSettings.apmEnableMultiSignal.schema",
+                "type": "Object",
+                "tags": [],
+                "label": "schema",
+                "description": [],
+                "signature": [
+                  {
+                    "pluginId": "@kbn/config-schema",
+                    "scope": "common",
+                    "docId": "kibKbnConfigSchemaPluginApi",
+                    "section": "def-common.Type",
+                    "text": "Type"
+                  },
+                  "<boolean>"
+                ],
+                "path": "x-pack/plugins/observability_solution/observability/server/ui_settings.ts",
+                "deprecated": false,
+                "trackAdoption": false
+              },
+              {
+                "parentPluginId": "observability",
+                "id": "def-server.uiSettings.apmEnableMultiSignal.value",
+                "type": "boolean",
+                "tags": [],
+                "label": "value",
+                "description": [],
+                "signature": [
+                  "false"
+                ],
+                "path": "x-pack/plugins/observability_solution/observability/server/ui_settings.ts",
+                "deprecated": false,
+                "trackAdoption": false
+              },
+              {
+                "parentPluginId": "observability",
+                "id": "def-server.uiSettings.apmEnableMultiSignal.requiresPageReload",
+                "type": "boolean",
+                "tags": [],
+                "label": "requiresPageReload",
+                "description": [],
+                "signature": [
+                  "true"
+                ],
+                "path": "x-pack/plugins/observability_solution/observability/server/ui_settings.ts",
+                "deprecated": false,
+                "trackAdoption": false
+              },
+              {
+                "parentPluginId": "observability",
+                "id": "def-server.uiSettings.apmEnableMultiSignal.type",
+                "type": "string",
+                "tags": [],
+                "label": "type",
+                "description": [],
+                "signature": [
+                  "\"boolean\""
+                ],
+                "path": "x-pack/plugins/observability_solution/observability/server/ui_settings.ts",
+                "deprecated": false,
+                "trackAdoption": false
+              }
+            ]
+          },
           {
             "parentPluginId": "observability",
             "id": "def-server.uiSettings.apmEnableServiceInventoryTableSearchBar",
diff --git a/api_docs/observability.mdx b/api_docs/observability.mdx
index 66b1efa3f377cf..7f931381c22168 100644
--- a/api_docs/observability.mdx
+++ b/api_docs/observability.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/observability
 title: "observability"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the observability plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'observability']
 ---
 import observabilityObj from './observability.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/obs-ux-management-team](https://github.com/orgs/elastic/teams/
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 679 | 2 | 670 | 15 |
+| 687 | 2 | 678 | 15 |
 
 ## Client
 
diff --git a/api_docs/observability_a_i_assistant.devdocs.json b/api_docs/observability_a_i_assistant.devdocs.json
index c486b0a6cfbe96..f2e981c27e2929 100644
--- a/api_docs/observability_a_i_assistant.devdocs.json
+++ b/api_docs/observability_a_i_assistant.devdocs.json
@@ -6484,12 +6484,12 @@
                 "label": "meta",
                 "description": [],
                 "signature": [
-                  "ErrorMetaAttributes[T] | undefined"
+                  "ErrorMetaAttributes[T]"
                 ],
                 "path": "x-pack/plugins/observability_solution/observability_ai_assistant/common/conversation_complete.ts",
                 "deprecated": false,
                 "trackAdoption": false,
-                "isRequired": false
+                "isRequired": true
               }
             ],
             "returnComment": []
diff --git a/api_docs/observability_a_i_assistant.mdx b/api_docs/observability_a_i_assistant.mdx
index 57ef4d4bbc0dae..e09e9147e9d2ad 100644
--- a/api_docs/observability_a_i_assistant.mdx
+++ b/api_docs/observability_a_i_assistant.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/observabilityAIAssistant
 title: "observabilityAIAssistant"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the observabilityAIAssistant plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'observabilityAIAssistant']
 ---
 import observabilityAIAssistantObj from './observability_a_i_assistant.devdocs.json';
diff --git a/api_docs/observability_a_i_assistant_app.mdx b/api_docs/observability_a_i_assistant_app.mdx
index a3dd697e64e2db..6c1f649052be84 100644
--- a/api_docs/observability_a_i_assistant_app.mdx
+++ b/api_docs/observability_a_i_assistant_app.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/observabilityAIAssistantApp
 title: "observabilityAIAssistantApp"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the observabilityAIAssistantApp plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'observabilityAIAssistantApp']
 ---
 import observabilityAIAssistantAppObj from './observability_a_i_assistant_app.devdocs.json';
diff --git a/api_docs/observability_ai_assistant_management.mdx b/api_docs/observability_ai_assistant_management.mdx
index e465044da0b540..fab8f45fa48926 100644
--- a/api_docs/observability_ai_assistant_management.mdx
+++ b/api_docs/observability_ai_assistant_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/observabilityAiAssistantManagement
 title: "observabilityAiAssistantManagement"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the observabilityAiAssistantManagement plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'observabilityAiAssistantManagement']
 ---
 import observabilityAiAssistantManagementObj from './observability_ai_assistant_management.devdocs.json';
diff --git a/api_docs/observability_logs_explorer.mdx b/api_docs/observability_logs_explorer.mdx
index b46e53712ade4a..e8f69858473ca6 100644
--- a/api_docs/observability_logs_explorer.mdx
+++ b/api_docs/observability_logs_explorer.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/observabilityLogsExplorer
 title: "observabilityLogsExplorer"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the observabilityLogsExplorer plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'observabilityLogsExplorer']
 ---
 import observabilityLogsExplorerObj from './observability_logs_explorer.devdocs.json';
diff --git a/api_docs/observability_onboarding.mdx b/api_docs/observability_onboarding.mdx
index 14ee93cf35cb3c..c614dea32cfc45 100644
--- a/api_docs/observability_onboarding.mdx
+++ b/api_docs/observability_onboarding.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/observabilityOnboarding
 title: "observabilityOnboarding"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the observabilityOnboarding plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'observabilityOnboarding']
 ---
 import observabilityOnboardingObj from './observability_onboarding.devdocs.json';
diff --git a/api_docs/observability_shared.mdx b/api_docs/observability_shared.mdx
index 6abe52b5fdfe66..535e1643e9627a 100644
--- a/api_docs/observability_shared.mdx
+++ b/api_docs/observability_shared.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/observabilityShared
 title: "observabilityShared"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the observabilityShared plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'observabilityShared']
 ---
 import observabilitySharedObj from './observability_shared.devdocs.json';
diff --git a/api_docs/osquery.devdocs.json b/api_docs/osquery.devdocs.json
index 25200d49eec762..2d09d029c0772f 100644
--- a/api_docs/osquery.devdocs.json
+++ b/api_docs/osquery.devdocs.json
@@ -301,7 +301,7 @@
           "label": "createActionService",
           "description": [],
           "signature": [
-            "{ create: (params: { agent_ids?: string[] | undefined; agent_all?: boolean | undefined; agent_platforms?: string[] | undefined; agent_policy_ids?: string[] | undefined; query?: string | undefined; queries?: { id: string; query: string; ecs_mapping: { [x: string]: { field?: string | undefined; value?: string | string[] | undefined; }; } | undefined; version: string | undefined; platform: string | undefined; removed: boolean | undefined; snapshot: boolean | undefined; }[] | undefined; saved_query_id?: string | undefined; timeout?: number | undefined; ecs_mapping?: { [x: string]: { field?: string | undefined; value?: string | string[] | undefined; }; } | undefined; pack_id?: string | undefined; alert_ids?: string[] | undefined; case_ids?: string[] | undefined; event_ids?: string[] | undefined; metadata?: object | undefined; }, alertData?: OutputOf<SetOptional<{ readonly \"ecs.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.risk_score\": { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.author\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.description\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.enabled\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.from\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.interval\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.license\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.note\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.references\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.rule_name_override\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.to\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.type\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.severity\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.docs_count\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.terms.field\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.suppression.terms.value\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.system_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_status_updated_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_user\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"@timestamp\": { readonly type: \"date\"; readonly required: true; readonly array: false; }; readonly \"event.action\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_type_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.consumer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.execution.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.instance.id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.category\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.name\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.producer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.revision\": { readonly type: \"long\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.status\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.space_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: true; }; readonly \"event.kind\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.action_group\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.case_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.consecutive_matches\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.duration.us\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping\": { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping_history\": { readonly type: \"boolean\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.last_detected\": { readonly type: \"date\"; readonly required: false; readonly array: false; }; readonly \"kibana.alert.maintenance_window_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; readonly multi_fields: ",
+            "{ create: (params: { agent_ids?: string[] | undefined; agent_all?: boolean | undefined; agent_platforms?: string[] | undefined; agent_policy_ids?: string[] | undefined; query?: string | undefined; queries?: { id: string; query: string; ecs_mapping: { [x: string]: { field?: string | undefined; value?: string | string[] | undefined; }; } | undefined; version: string | undefined; platform: string | undefined; removed: boolean | undefined; snapshot: boolean | undefined; }[] | undefined; saved_query_id?: string | undefined; timeout?: number | undefined; ecs_mapping?: { [x: string]: { field?: string | undefined; value?: string | string[] | undefined; }; } | undefined; pack_id?: string | undefined; alert_ids?: string[] | undefined; case_ids?: string[] | undefined; event_ids?: string[] | undefined; metadata?: object | undefined; }, alertData?: (OutputOf<SetOptional<{ readonly \"ecs.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.risk_score\": { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.author\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.description\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.enabled\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.from\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.interval\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.license\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.note\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.references\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.rule_name_override\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.to\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.type\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.severity\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.docs_count\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.terms.field\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.suppression.terms.value\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.system_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_status_updated_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_user\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"@timestamp\": { readonly type: \"date\"; readonly required: true; readonly array: false; }; readonly \"event.action\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_type_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.consumer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.execution.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.instance.id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.category\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.name\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.producer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.revision\": { readonly type: \"long\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.status\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.space_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: true; }; readonly \"event.kind\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.action_group\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.case_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.consecutive_matches\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.duration.us\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping\": { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping_history\": { readonly type: \"boolean\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.last_detected\": { readonly type: \"date\"; readonly required: false; readonly array: false; }; readonly \"kibana.alert.maintenance_window_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; readonly multi_fields: ",
             {
               "pluginId": "@kbn/alerts-as-data-utils",
               "scope": "common",
@@ -309,7 +309,7 @@
               "section": "def-common.MultiField",
               "text": "MultiField"
             },
-            "[]; }; readonly \"kibana.alert.rule.execution.timestamp\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.parameters\": { readonly array: false; readonly type: \"flattened\"; readonly ignore_above: 4096; readonly required: false; }; readonly \"kibana.alert.rule.tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.time_range\": { readonly type: \"date_range\"; readonly format: \"epoch_millis||strict_date_optional_time\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.url\": { readonly type: \"keyword\"; readonly array: false; readonly index: false; readonly required: false; readonly ignore_above: 2048; }; readonly \"kibana.alert.workflow_assignee_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.workflow_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.version\": { readonly type: \"version\"; readonly array: false; readonly required: false; }; }>> | undefined) => Promise<{ response: { action_id: string; '@timestamp': string; expiration: string; type: string; input_type: string; alert_ids: string[] | undefined; event_ids: string[] | undefined; case_ids: string[] | undefined; agent_ids: string[] | undefined; agent_all: boolean | undefined; agent_platforms: string[] | undefined; agent_policy_ids: string[] | undefined; agents: string[]; user_id: string | undefined; metadata: object | undefined; pack_id: string | undefined; pack_name: string | undefined; pack_prebuilt: boolean | undefined; queries: ",
+            "[]; }; readonly \"kibana.alert.rule.execution.timestamp\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.parameters\": { readonly array: false; readonly type: \"flattened\"; readonly ignore_above: 4096; readonly required: false; }; readonly \"kibana.alert.rule.tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.time_range\": { readonly type: \"date_range\"; readonly format: \"epoch_millis||strict_date_optional_time\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.url\": { readonly type: \"keyword\"; readonly array: false; readonly index: false; readonly required: false; readonly ignore_above: 2048; }; readonly \"kibana.alert.workflow_assignee_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.workflow_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.version\": { readonly type: \"version\"; readonly array: false; readonly required: false; }; }>> & { _index: string; }) | undefined) => Promise<{ response: { action_id: string; '@timestamp': string; expiration: string; type: string; input_type: string; alert_ids: string[] | undefined; event_ids: string[] | undefined; case_ids: string[] | undefined; agent_ids: string[] | undefined; agent_all: boolean | undefined; agent_platforms: string[] | undefined; agent_policy_ids: string[] | undefined; agents: string[]; user_id: string | undefined; metadata: object | undefined; pack_id: string | undefined; pack_name: string | undefined; pack_prebuilt: boolean | undefined; queries: ",
             "Dictionary",
             "<any>[]; }; fleetActionsCount: number; }>; stop: () => void; }"
           ],
diff --git a/api_docs/osquery.mdx b/api_docs/osquery.mdx
index ecaa6803dfdb21..0f26daca0f9592 100644
--- a/api_docs/osquery.mdx
+++ b/api_docs/osquery.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/osquery
 title: "osquery"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the osquery plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'osquery']
 ---
 import osqueryObj from './osquery.devdocs.json';
diff --git a/api_docs/painless_lab.mdx b/api_docs/painless_lab.mdx
index acd87b4ee5482f..e07eced4ed2c66 100644
--- a/api_docs/painless_lab.mdx
+++ b/api_docs/painless_lab.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/painlessLab
 title: "painlessLab"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the painlessLab plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'painlessLab']
 ---
 import painlessLabObj from './painless_lab.devdocs.json';
diff --git a/api_docs/plugin_directory.mdx b/api_docs/plugin_directory.mdx
index 4fe422ca9cfcf6..6d12646670f06d 100644
--- a/api_docs/plugin_directory.mdx
+++ b/api_docs/plugin_directory.mdx
@@ -7,7 +7,7 @@ id: kibDevDocsPluginDirectory
 slug: /kibana-dev-docs/api-meta/plugin-api-directory
 title: Directory
 description: Directory of public APIs available through plugins or packages.
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana']
 ---
 
@@ -15,13 +15,13 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 
 | Count | Plugins or Packages with a <br /> public API | Number of teams |
 |--------------|----------|------------------------|
-| 794 | 682 | 42 |
+| 795 | 683 | 42 |
 
 ### Public API health stats
 
 | API Count | Any Count | Missing comments | Missing exports |
 |--------------|----------|-----------------|--------|
-| 48111 | 241 | 36699 | 1850 |
+| 48140 | 241 | 36727 | 1855 |
 
 ## Plugin Directory
 
@@ -31,8 +31,8 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibAdvancedSettingsPluginApi" text="advancedSettings"/> | [@elastic/appex-sharedux @elastic/kibana-management](https://github.com/orgs/elastic/teams/appex-sharedux ) | - | 2 | 0 | 2 | 0 |
 | <DocLink id="kibAiAssistantManagementSelectionPluginApi" text="aiAssistantManagementSelection"/> | [@elastic/obs-knowledge-team](https://github.com/orgs/elastic/teams/obs-knowledge-team) | - | 4 | 0 | 4 | 1 |
 | <DocLink id="kibAiopsPluginApi" text="aiops"/> | [@elastic/ml-ui](https://github.com/orgs/elastic/teams/ml-ui) | AIOps plugin maintained by ML team. | 67 | 0 | 4 | 1 |
-| <DocLink id="kibAlertingPluginApi" text="alerting"/> | [@elastic/response-ops](https://github.com/orgs/elastic/teams/response-ops) | - | 862 | 1 | 830 | 54 |
-| <DocLink id="kibApmPluginApi" text="apm"/> | [@elastic/obs-ux-infra_services-team](https://github.com/orgs/elastic/teams/obs-ux-infra_services-team) | The user interface for Elastic APM | 29 | 0 | 29 | 122 |
+| <DocLink id="kibAlertingPluginApi" text="alerting"/> | [@elastic/response-ops](https://github.com/orgs/elastic/teams/response-ops) | - | 865 | 1 | 833 | 54 |
+| <DocLink id="kibApmPluginApi" text="apm"/> | [@elastic/obs-ux-infra_services-team](https://github.com/orgs/elastic/teams/obs-ux-infra_services-team) | The user interface for Elastic APM | 29 | 0 | 29 | 123 |
 | <DocLink id="kibApmDataAccessPluginApi" text="apmDataAccess"/> | [@elastic/obs-knowledge-team](https://github.com/orgs/elastic/teams/obs-knowledge-team) | - | 9 | 0 | 9 | 0 |
 | <DocLink id="kibAssetManagerPluginApi" text="assetManager"/> | [@elastic/obs-knowledge-team](https://github.com/orgs/elastic/teams/obs-knowledge-team) | Asset manager plugin for entity assets (inventory, topology, etc) | 9 | 0 | 9 | 2 |
 | <DocLink id="kibAssetsDataAccessPluginApi" text="assetsDataAccess"/> | [@elastic/obs-knowledge-team](https://github.com/orgs/elastic/teams/obs-knowledge-team) | - | 2 | 0 | 2 | 0 |
@@ -57,12 +57,12 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibCustomIntegrationsPluginApi" text="customIntegrations"/> | [@elastic/fleet](https://github.com/orgs/elastic/teams/fleet) | Add custom data integrations so they can be displayed in the Fleet integrations app | 271 | 0 | 252 | 1 |
 | <DocLink id="kibDashboardPluginApi" text="dashboard"/> | [@elastic/kibana-presentation](https://github.com/orgs/elastic/teams/kibana-presentation) | Adds the Dashboard app to Kibana | 116 | 0 | 113 | 13 |
 | <DocLink id="kibDashboardEnhancedPluginApi" text="dashboardEnhanced"/> | [@elastic/kibana-presentation](https://github.com/orgs/elastic/teams/kibana-presentation) | - | 54 | 0 | 51 | 0 |
-| <DocLink id="kibDataPluginApi" text="data"/> | [@elastic/kibana-visualizations](https://github.com/orgs/elastic/teams/kibana-visualizations) | Data services are useful for searching and querying data from Elasticsearch. Helpful utilities include: a re-usable react query bar, KQL autocomplete, async search, Data Views (Index Patterns) and field formatters. | 3186 | 31 | 2575 | 23 |
+| <DocLink id="kibDataPluginApi" text="data"/> | [@elastic/kibana-visualizations](https://github.com/orgs/elastic/teams/kibana-visualizations) | Data services are useful for searching and querying data from Elasticsearch. Helpful utilities include: a re-usable react query bar, KQL autocomplete, async search, Data Views (Index Patterns) and field formatters. | 3182 | 31 | 2575 | 23 |
 | <DocLink id="kibDataViewEditorPluginApi" text="dataViewEditor"/> | [@elastic/kibana-data-discovery](https://github.com/orgs/elastic/teams/kibana-data-discovery) | This plugin provides the ability to create data views via a modal flyout inside Kibana apps | 35 | 0 | 25 | 5 |
 | <DocLink id="kibDataViewFieldEditorPluginApi" text="dataViewFieldEditor"/> | [@elastic/kibana-data-discovery](https://github.com/orgs/elastic/teams/kibana-data-discovery) | Reusable data view field editor across Kibana | 72 | 0 | 33 | 0 |
 | <DocLink id="kibDataViewManagementPluginApi" text="dataViewManagement"/> | [@elastic/kibana-data-discovery](https://github.com/orgs/elastic/teams/kibana-data-discovery) | Data view management app | 2 | 0 | 2 | 0 |
 | <DocLink id="kibDataViewsPluginApi" text="dataViews"/> | [@elastic/kibana-data-discovery](https://github.com/orgs/elastic/teams/kibana-data-discovery) | Data services are useful for searching and querying data from Elasticsearch. Helpful utilities include: a re-usable react query bar, KQL autocomplete, async search, Data Views (Index Patterns) and field formatters. | 1069 | 0 | 369 | 4 |
-| <DocLink id="kibDataVisualizerPluginApi" text="dataVisualizer"/> | [@elastic/ml-ui](https://github.com/orgs/elastic/teams/ml-ui) | The Data Visualizer tools help you understand your data, by analyzing the metrics and fields in a log file or an existing Elasticsearch index. | 31 | 3 | 25 | 3 |
+| <DocLink id="kibDataVisualizerPluginApi" text="dataVisualizer"/> | [@elastic/ml-ui](https://github.com/orgs/elastic/teams/ml-ui) | The Data Visualizer tools help you understand your data, by analyzing the metrics and fields in a log file or an existing Elasticsearch index. | 31 | 3 | 25 | 4 |
 | <DocLink id="kibDatasetQualityPluginApi" text="datasetQuality"/> | [@elastic/obs-ux-logs-team](https://github.com/orgs/elastic/teams/obs-ux-logs-team) | This plugin introduces the concept of dataset quality, where users can easily get an overview on the datasets they have. | 10 | 0 | 10 | 5 |
 | <DocLink id="kibDevToolsPluginApi" text="devTools"/> | [@elastic/kibana-management](https://github.com/orgs/elastic/teams/kibana-management) | - | 15 | 0 | 9 | 2 |
 | <DocLink id="kibDiscoverPluginApi" text="discover"/> | [@elastic/kibana-data-discovery](https://github.com/orgs/elastic/teams/kibana-data-discovery) | This plugin contains the Discover application and the saved search embeddable. | 148 | 0 | 101 | 27 |
@@ -70,7 +70,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibDiscoverSharedPluginApi" text="discoverShared"/> | [@elastic/kibana-data-discovery](https://github.com/orgs/elastic/teams/kibana-data-discovery) | A stateful layer to register shared features and provide an access point to discover without a direct dependency | 16 | 0 | 15 | 2 |
 | <DocLink id="kibEcsDataQualityDashboardPluginApi" text="ecsDataQualityDashboard"/> | [@elastic/security-threat-hunting-explore](https://github.com/orgs/elastic/teams/security-threat-hunting-explore) | APIs used to assess the quality of data in Elasticsearch indexes | 2 | 0 | 0 | 0 |
 | <DocLink id="kibElasticAssistantPluginApi" text="elasticAssistant"/> | [@elastic/security-generative-ai](https://github.com/orgs/elastic/teams/security-generative-ai) | Server APIs for the Elastic AI Assistant | 45 | 0 | 31 | 0 |
-| <DocLink id="kibEmbeddablePluginApi" text="embeddable"/> | [@elastic/kibana-presentation](https://github.com/orgs/elastic/teams/kibana-presentation) | Adds embeddables service to Kibana | 573 | 1 | 463 | 8 |
+| <DocLink id="kibEmbeddablePluginApi" text="embeddable"/> | [@elastic/kibana-presentation](https://github.com/orgs/elastic/teams/kibana-presentation) | Adds embeddables service to Kibana | 564 | 1 | 456 | 8 |
 | <DocLink id="kibEmbeddableEnhancedPluginApi" text="embeddableEnhanced"/> | [@elastic/kibana-presentation](https://github.com/orgs/elastic/teams/kibana-presentation) | Extends embeddable plugin with more functionality | 19 | 0 | 19 | 2 |
 | <DocLink id="kibEncryptedSavedObjectsPluginApi" text="encryptedSavedObjects"/> | [@elastic/kibana-security](https://github.com/orgs/elastic/teams/kibana-security) | This plugin provides encryption and decryption utilities for saved objects containing sensitive information. | 53 | 0 | 46 | 1 |
 | <DocLink id="kibEnterpriseSearchPluginApi" text="enterpriseSearch"/> | [@elastic/enterprise-search-frontend](https://github.com/orgs/elastic/teams/enterprise-search-frontend) | Adds dashboards for discovering and managing Enterprise Search products. | 5 | 0 | 5 | 0 |
@@ -98,7 +98,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibFileUploadPluginApi" text="fileUpload"/> | [@elastic/kibana-gis](https://github.com/orgs/elastic/teams/kibana-gis) | The file upload plugin contains components and services for uploading a file, analyzing its data, and then importing the data into an Elasticsearch index. Supported file types include CSV, TSV, newline-delimited JSON and GeoJSON. | 84 | 0 | 84 | 8 |
 | <DocLink id="kibFilesPluginApi" text="files"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | File upload, download, sharing, and serving over HTTP implementation in Kibana. | 240 | 0 | 24 | 9 |
 | <DocLink id="kibFilesManagementPluginApi" text="filesManagement"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | Simple UI for managing files in Kibana | 2 | 0 | 2 | 0 |
-| <DocLink id="kibFleetPluginApi" text="fleet"/> | [@elastic/fleet](https://github.com/orgs/elastic/teams/fleet) | - | 1300 | 5 | 1179 | 66 |
+| <DocLink id="kibFleetPluginApi" text="fleet"/> | [@elastic/fleet](https://github.com/orgs/elastic/teams/fleet) | - | 1302 | 5 | 1181 | 66 |
 | ftrApis | [@elastic/kibana-core](https://github.com/orgs/elastic/teams/kibana-core) | - | 0 | 0 | 0 | 0 |
 | <DocLink id="kibGlobalSearchPluginApi" text="globalSearch"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 72 | 0 | 14 | 5 |
 | globalSearchBar | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 0 | 0 | 0 | 0 |
@@ -126,14 +126,15 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibLicensingPluginApi" text="licensing"/> | [@elastic/kibana-core](https://github.com/orgs/elastic/teams/kibana-core) | - | 117 | 0 | 42 | 10 |
 | <DocLink id="kibLinksPluginApi" text="links"/> | [@elastic/kibana-presentation](https://github.com/orgs/elastic/teams/kibana-presentation) | A dashboard panel for creating links to dashboards or external links. | 57 | 0 | 57 | 6 |
 | <DocLink id="kibListsPluginApi" text="lists"/> | [@elastic/security-detection-engine](https://github.com/orgs/elastic/teams/security-detection-engine) | - | 226 | 0 | 97 | 52 |
+| <DocLink id="kibLogsDataAccessPluginApi" text="logsDataAccess"/> | [@elastic/obs-ux-logs-team](https://github.com/orgs/elastic/teams/obs-ux-logs-team) | - | 2 | 0 | 2 | 2 |
 | <DocLink id="kibLogsExplorerPluginApi" text="logsExplorer"/> | [@elastic/obs-ux-logs-team](https://github.com/orgs/elastic/teams/obs-ux-logs-team) | This plugin provides a LogsExplorer component using the Discover customization framework, offering several affordances specifically designed for log consumption. | 117 | 4 | 117 | 22 |
 | <DocLink id="kibLogsSharedPluginApi" text="logsShared"/> | [@elastic/obs-ux-logs-team](https://github.com/orgs/elastic/teams/obs-ux-logs-team) | Exposes the shared components and APIs to access and visualize logs. | 303 | 0 | 277 | 32 |
 | logstash | [@elastic/logstash](https://github.com/orgs/elastic/teams/logstash) | - | 0 | 0 | 0 | 0 |
 | <DocLink id="kibManagementPluginApi" text="management"/> | [@elastic/kibana-management](https://github.com/orgs/elastic/teams/kibana-management) | - | 44 | 0 | 44 | 7 |
-| <DocLink id="kibMapsPluginApi" text="maps"/> | [@elastic/kibana-gis](https://github.com/orgs/elastic/teams/kibana-gis) | - | 281 | 0 | 276 | 32 |
+| <DocLink id="kibMapsPluginApi" text="maps"/> | [@elastic/kibana-gis](https://github.com/orgs/elastic/teams/kibana-gis) | - | 286 | 0 | 281 | 31 |
 | <DocLink id="kibMapsEmsPluginApi" text="mapsEms"/> | [@elastic/kibana-gis](https://github.com/orgs/elastic/teams/kibana-gis) | - | 60 | 0 | 60 | 0 |
 | <DocLink id="kibMetricsDataAccessPluginApi" text="metricsDataAccess"/> | [@elastic/obs-knowledge-team](https://github.com/orgs/elastic/teams/obs-knowledge-team) | Exposes utilities for accessing metrics data | 104 | 8 | 104 | 6 |
-| <DocLink id="kibMlPluginApi" text="ml"/> | [@elastic/ml-ui](https://github.com/orgs/elastic/teams/ml-ui) | This plugin provides access to the machine learning features provided by Elastic. | 153 | 3 | 66 | 100 |
+| <DocLink id="kibMlPluginApi" text="ml"/> | [@elastic/ml-ui](https://github.com/orgs/elastic/teams/ml-ui) | This plugin provides access to the machine learning features provided by Elastic. | 154 | 3 | 67 | 101 |
 | <DocLink id="kibMockIdpPluginPluginApi" text="mockIdpPlugin"/> | [@elastic/kibana-security](https://github.com/orgs/elastic/teams/kibana-security) | - | 2 | 0 | 2 | 0 |
 | <DocLink id="kibMonitoringPluginApi" text="monitoring"/> | [@elastic/obs-ux-infra_services-team](https://github.com/orgs/elastic/teams/obs-ux-infra_services-team) | - | 15 | 3 | 13 | 1 |
 | <DocLink id="kibMonitoringCollectionPluginApi" text="monitoringCollection"/> | [@elastic/obs-ux-infra_services-team](https://github.com/orgs/elastic/teams/obs-ux-infra_services-team) | - | 9 | 0 | 9 | 0 |
@@ -141,7 +142,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibNewsfeedPluginApi" text="newsfeed"/> | [@elastic/kibana-core](https://github.com/orgs/elastic/teams/kibana-core) | - | 17 | 0 | 17 | 0 |
 | <DocLink id="kibNoDataPagePluginApi" text="noDataPage"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 3 | 0 | 3 | 0 |
 | <DocLink id="kibNotificationsPluginApi" text="notifications"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 2 | 0 | 2 | 1 |
-| <DocLink id="kibObservabilityPluginApi" text="observability"/> | [@elastic/obs-ux-management-team](https://github.com/orgs/elastic/teams/obs-ux-management-team) | - | 679 | 2 | 670 | 15 |
+| <DocLink id="kibObservabilityPluginApi" text="observability"/> | [@elastic/obs-ux-management-team](https://github.com/orgs/elastic/teams/obs-ux-management-team) | - | 687 | 2 | 678 | 15 |
 | <DocLink id="kibObservabilityAIAssistantPluginApi" text="observabilityAIAssistant"/> | [@elastic/obs-ai-assistant](https://github.com/orgs/elastic/teams/obs-ai-assistant) | - | 253 | 1 | 251 | 26 |
 | <DocLink id="kibObservabilityAIAssistantAppPluginApi" text="observabilityAIAssistantApp"/> | [@elastic/obs-ai-assistant](https://github.com/orgs/elastic/teams/obs-ai-assistant) | - | 2 | 0 | 2 | 0 |
 | <DocLink id="kibObservabilityAiAssistantManagementPluginApi" text="observabilityAiAssistantManagement"/> | [@elastic/obs-ai-assistant](https://github.com/orgs/elastic/teams/obs-ai-assistant) | - | 2 | 0 | 2 | 0 |
@@ -171,7 +172,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibSearchNotebooksPluginApi" text="searchNotebooks"/> | [@elastic/enterprise-search-frontend](https://github.com/orgs/elastic/teams/enterprise-search-frontend) | Plugin to provide access to and rendering of python notebooks for use in the persistent developer console. | 6 | 0 | 6 | 0 |
 | <DocLink id="kibSearchPlaygroundPluginApi" text="searchPlayground"/> | [@elastic/enterprise-search-frontend](https://github.com/orgs/elastic/teams/enterprise-search-frontend) | - | 18 | 0 | 10 | 1 |
 | searchprofiler | [@elastic/kibana-management](https://github.com/orgs/elastic/teams/kibana-management) | - | 0 | 0 | 0 | 0 |
-| <DocLink id="kibSecurityPluginApi" text="security"/> | [@elastic/kibana-security](https://github.com/orgs/elastic/teams/kibana-security) | This plugin provides authentication and authorization features, and exposes functionality to understand the capabilities of the currently authenticated user. | 407 | 0 | 201 | 2 |
+| <DocLink id="kibSecurityPluginApi" text="security"/> | [@elastic/kibana-security](https://github.com/orgs/elastic/teams/kibana-security) | This plugin provides authentication and authorization features, and exposes functionality to understand the capabilities of the currently authenticated user. | 413 | 0 | 205 | 2 |
 | <DocLink id="kibSecuritySolutionPluginApi" text="securitySolution"/> | [@elastic/security-solution](https://github.com/orgs/elastic/teams/security-solution) | - | 190 | 0 | 120 | 36 |
 | <DocLink id="kibSecuritySolutionEssPluginApi" text="securitySolutionEss"/> | [@elastic/security-solution](https://github.com/orgs/elastic/teams/security-solution) | ESS customizations for Security Solution. | 6 | 0 | 6 | 0 |
 | <DocLink id="kibSecuritySolutionServerlessPluginApi" text="securitySolutionServerless"/> | [@elastic/security-solution](https://github.com/orgs/elastic/teams/security-solution) | Serverless customizations for security. | 7 | 0 | 7 | 0 |
@@ -247,7 +248,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibKbnAnalyticsShippersFullstoryPluginApi" text="@kbn/analytics-shippers-fullstory"/> | [@elastic/kibana-core](https://github.com/orgs/elastic/teams/kibana-core) | - | 22 | 0 | 1 | 0 |
 | <DocLink id="kibKbnApmConfigLoaderPluginApi" text="@kbn/apm-config-loader"/> | [@elastic/kibana-core](https://github.com/orgs/elastic/teams/kibana-core) | - | 18 | 0 | 18 | 0 |
 | <DocLink id="kibKbnApmDataViewPluginApi" text="@kbn/apm-data-view"/> | [@elastic/obs-ux-infra_services-team](https://github.com/orgs/elastic/teams/obs-ux-infra_services-team) | - | 4 | 0 | 4 | 0 |
-| <DocLink id="kibKbnApmSynthtracePluginApi" text="@kbn/apm-synthtrace"/> | [@elastic/obs-ux-infra_services-team](https://github.com/orgs/elastic/teams/obs-ux-infra_services-team) | - | 44 | 0 | 44 | 7 |
+| <DocLink id="kibKbnApmSynthtracePluginApi" text="@kbn/apm-synthtrace"/> | [@elastic/obs-ux-infra_services-team](https://github.com/orgs/elastic/teams/obs-ux-infra_services-team) | - | 49 | 0 | 49 | 8 |
 | <DocLink id="kibKbnApmSynthtraceClientPluginApi" text="@kbn/apm-synthtrace-client"/> | [@elastic/obs-ux-infra_services-team](https://github.com/orgs/elastic/teams/obs-ux-infra_services-team) | - | 191 | 0 | 191 | 28 |
 | <DocLink id="kibKbnApmUtilsPluginApi" text="@kbn/apm-utils"/> | [@elastic/obs-ux-infra_services-team](https://github.com/orgs/elastic/teams/obs-ux-infra_services-team) | - | 11 | 0 | 11 | 0 |
 | <DocLink id="kibKbnAxeConfigPluginApi" text="@kbn/axe-config"/> | [@elastic/kibana-qa](https://github.com/orgs/elastic/teams/kibana-qa) | - | 12 | 0 | 12 | 0 |
@@ -255,7 +256,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibKbnCalculateAutoPluginApi" text="@kbn/calculate-auto"/> | [@elastic/obs-ux-management-team](https://github.com/orgs/elastic/teams/obs-ux-management-team) | - | 10 | 0 | 10 | 0 |
 | <DocLink id="kibKbnCalculateWidthFromCharCountPluginApi" text="@kbn/calculate-width-from-char-count"/> | [@elastic/kibana-visualizations](https://github.com/orgs/elastic/teams/kibana-visualizations) | - | 7 | 0 | 7 | 1 |
 | <DocLink id="kibKbnCasesComponentsPluginApi" text="@kbn/cases-components"/> | [@elastic/response-ops](https://github.com/orgs/elastic/teams/response-ops) | - | 19 | 0 | 16 | 0 |
-| <DocLink id="kibKbnCellActionsPluginApi" text="@kbn/cell-actions"/> | [@elastic/security-threat-hunting-explore](https://github.com/orgs/elastic/teams/security-threat-hunting-explore) | - | 56 | 1 | 44 | 3 |
+| <DocLink id="kibKbnCellActionsPluginApi" text="@kbn/cell-actions"/> | [@elastic/security-threat-hunting-explore](https://github.com/orgs/elastic/teams/security-threat-hunting-explore) | - | 44 | 1 | 30 | 1 |
 | <DocLink id="kibKbnChartExpressionsCommonPluginApi" text="@kbn/chart-expressions-common"/> | [@elastic/kibana-visualizations](https://github.com/orgs/elastic/teams/kibana-visualizations) | - | 23 | 0 | 19 | 0 |
 | <DocLink id="kibKbnChartIconsPluginApi" text="@kbn/chart-icons"/> | [@elastic/kibana-visualizations](https://github.com/orgs/elastic/teams/kibana-visualizations) | - | 84 | 0 | 84 | 0 |
 | <DocLink id="kibKbnCiStatsCorePluginApi" text="@kbn/ci-stats-core"/> | [@elastic/kibana-operations](https://github.com/orgs/elastic/teams/kibana-operations) | - | 7 | 0 | 2 | 0 |
@@ -361,7 +362,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibKbnCoreLifecycleServerMocksPluginApi" text="@kbn/core-lifecycle-server-mocks"/> | [@elastic/kibana-core](https://github.com/orgs/elastic/teams/kibana-core) | - | 9 | 0 | 9 | 0 |
 | <DocLink id="kibKbnCoreLoggingBrowserMocksPluginApi" text="@kbn/core-logging-browser-mocks"/> | [@elastic/kibana-core](https://github.com/orgs/elastic/teams/kibana-core) | - | 4 | 0 | 4 | 0 |
 | <DocLink id="kibKbnCoreLoggingCommonInternalPluginApi" text="@kbn/core-logging-common-internal"/> | [@elastic/kibana-core](https://github.com/orgs/elastic/teams/kibana-core) | - | 38 | 0 | 31 | 0 |
-| <DocLink id="kibKbnCoreLoggingServerPluginApi" text="@kbn/core-logging-server"/> | [@elastic/kibana-core](https://github.com/orgs/elastic/teams/kibana-core) | - | 56 | 0 | 30 | 0 |
+| <DocLink id="kibKbnCoreLoggingServerPluginApi" text="@kbn/core-logging-server"/> | [@elastic/kibana-core](https://github.com/orgs/elastic/teams/kibana-core) | - | 61 | 0 | 34 | 0 |
 | <DocLink id="kibKbnCoreLoggingServerInternalPluginApi" text="@kbn/core-logging-server-internal"/> | [@elastic/kibana-core](https://github.com/orgs/elastic/teams/kibana-core) | - | 9 | 0 | 5 | 2 |
 | <DocLink id="kibKbnCoreLoggingServerMocksPluginApi" text="@kbn/core-logging-server-mocks"/> | [@elastic/kibana-core](https://github.com/orgs/elastic/teams/kibana-core) | - | 13 | 0 | 13 | 0 |
 | <DocLink id="kibKbnCoreMetricsCollectorsServerInternalPluginApi" text="@kbn/core-metrics-collectors-server-internal"/> | [@elastic/kibana-core](https://github.com/orgs/elastic/teams/kibana-core) | - | 29 | 0 | 25 | 0 |
@@ -490,13 +491,13 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibKbnEsTypesPluginApi" text="@kbn/es-types"/> | [@elastic/kibana-core](https://github.com/orgs/elastic/teams/kibana-core) | - | 26 | 0 | 26 | 1 |
 | <DocLink id="kibKbnEslintPluginImportsPluginApi" text="@kbn/eslint-plugin-imports"/> | [@elastic/kibana-operations](https://github.com/orgs/elastic/teams/kibana-operations) | - | 2 | 0 | 1 | 0 |
 | <DocLink id="kibKbnEsqlAstPluginApi" text="@kbn/esql-ast"/> | [@elastic/kibana-esql](https://github.com/orgs/elastic/teams/kibana-esql) | - | 63 | 1 | 63 | 6 |
-| <DocLink id="kibKbnEsqlUtilsPluginApi" text="@kbn/esql-utils"/> | [@elastic/kibana-esql](https://github.com/orgs/elastic/teams/kibana-esql) | - | 36 | 0 | 34 | 0 |
-| <DocLink id="kibKbnEsqlValidationAutocompletePluginApi" text="@kbn/esql-validation-autocomplete"/> | [@elastic/kibana-esql](https://github.com/orgs/elastic/teams/kibana-esql) | - | 194 | 0 | 184 | 8 |
+| <DocLink id="kibKbnEsqlUtilsPluginApi" text="@kbn/esql-utils"/> | [@elastic/kibana-esql](https://github.com/orgs/elastic/teams/kibana-esql) | - | 43 | 0 | 41 | 0 |
+| <DocLink id="kibKbnEsqlValidationAutocompletePluginApi" text="@kbn/esql-validation-autocomplete"/> | [@elastic/kibana-esql](https://github.com/orgs/elastic/teams/kibana-esql) | - | 194 | 0 | 184 | 10 |
 | <DocLink id="kibKbnEventAnnotationCommonPluginApi" text="@kbn/event-annotation-common"/> | [@elastic/kibana-visualizations](https://github.com/orgs/elastic/teams/kibana-visualizations) | - | 39 | 0 | 39 | 0 |
 | <DocLink id="kibKbnEventAnnotationComponentsPluginApi" text="@kbn/event-annotation-components"/> | [@elastic/kibana-visualizations](https://github.com/orgs/elastic/teams/kibana-visualizations) | - | 52 | 0 | 52 | 1 |
 | <DocLink id="kibKbnExpandableFlyoutPluginApi" text="@kbn/expandable-flyout"/> | [@elastic/security-threat-hunting-investigations](https://github.com/orgs/elastic/teams/security-threat-hunting-investigations) | - | 38 | 0 | 14 | 1 |
 | <DocLink id="kibKbnFieldTypesPluginApi" text="@kbn/field-types"/> | [@elastic/kibana-data-discovery](https://github.com/orgs/elastic/teams/kibana-data-discovery) | - | 22 | 0 | 18 | 0 |
-| <DocLink id="kibKbnFieldUtilsPluginApi" text="@kbn/field-utils"/> | [@elastic/kibana-data-discovery](https://github.com/orgs/elastic/teams/kibana-data-discovery) | - | 50 | 0 | 42 | 1 |
+| <DocLink id="kibKbnFieldUtilsPluginApi" text="@kbn/field-utils"/> | [@elastic/kibana-data-discovery](https://github.com/orgs/elastic/teams/kibana-data-discovery) | - | 54 | 0 | 45 | 1 |
 | <DocLink id="kibKbnFindUsedNodeModulesPluginApi" text="@kbn/find-used-node-modules"/> | [@elastic/kibana-operations](https://github.com/orgs/elastic/teams/kibana-operations) | - | 2 | 0 | 0 | 0 |
 | <DocLink id="kibKbnFormattersPluginApi" text="@kbn/formatters"/> | [@elastic/obs-ux-logs-team](https://github.com/orgs/elastic/teams/obs-ux-logs-team) | - | 3 | 0 | 3 | 0 |
 | <DocLink id="kibKbnFtrCommonFunctionalServicesPluginApi" text="@kbn/ftr-common-functional-services"/> | [@elastic/kibana-operations](https://github.com/orgs/elastic/teams/kibana-operations) | - | 36 | 0 | 21 | 1 |
@@ -537,7 +538,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibKbnManagementSettingsComponentsFieldRowPluginApi" text="@kbn/management-settings-components-field-row"/> | [@elastic/kibana-management](https://github.com/orgs/elastic/teams/kibana-management) | - | 23 | 0 | 7 | 0 |
 | <DocLink id="kibKbnManagementSettingsComponentsFormPluginApi" text="@kbn/management-settings-components-form"/> | [@elastic/kibana-management](https://github.com/orgs/elastic/teams/kibana-management) | - | 8 | 0 | 2 | 3 |
 | <DocLink id="kibKbnManagementSettingsFieldDefinitionPluginApi" text="@kbn/management-settings-field-definition"/> | [@elastic/kibana-management](https://github.com/orgs/elastic/teams/kibana-management) | - | 45 | 0 | 0 | 0 |
-| <DocLink id="kibKbnManagementSettingsIdsPluginApi" text="@kbn/management-settings-ids"/> | [@elastic/appex-sharedux @elastic/kibana-management](https://github.com/orgs/elastic/teams/appex-sharedux ) | - | 137 | 0 | 134 | 0 |
+| <DocLink id="kibKbnManagementSettingsIdsPluginApi" text="@kbn/management-settings-ids"/> | [@elastic/appex-sharedux @elastic/kibana-management](https://github.com/orgs/elastic/teams/appex-sharedux ) | - | 138 | 0 | 135 | 0 |
 | <DocLink id="kibKbnManagementSettingsSectionRegistryPluginApi" text="@kbn/management-settings-section-registry"/> | [@elastic/appex-sharedux @elastic/kibana-management](https://github.com/orgs/elastic/teams/appex-sharedux ) | - | 20 | 0 | 11 | 0 |
 | <DocLink id="kibKbnManagementSettingsTypesPluginApi" text="@kbn/management-settings-types"/> | [@elastic/kibana-management](https://github.com/orgs/elastic/teams/kibana-management) | - | 88 | 0 | 10 | 0 |
 | <DocLink id="kibKbnManagementSettingsUtilitiesPluginApi" text="@kbn/management-settings-utilities"/> | [@elastic/kibana-management](https://github.com/orgs/elastic/teams/kibana-management) | - | 56 | 0 | 6 | 0 |
@@ -627,12 +628,12 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibKbnSearchResponseWarningsPluginApi" text="@kbn/search-response-warnings"/> | [@elastic/kibana-data-discovery](https://github.com/orgs/elastic/teams/kibana-data-discovery) | - | 20 | 0 | 18 | 1 |
 | <DocLink id="kibKbnSearchTypesPluginApi" text="@kbn/search-types"/> | [@elastic/kibana-data-discovery](https://github.com/orgs/elastic/teams/kibana-data-discovery) | - | 50 | 0 | 25 | 0 |
 | <DocLink id="kibKbnSecurityHardeningPluginApi" text="@kbn/security-hardening"/> | [@elastic/kibana-security](https://github.com/orgs/elastic/teams/kibana-security) | - | 7 | 0 | 7 | 0 |
-| <DocLink id="kibKbnSecurityPluginTypesCommonPluginApi" text="@kbn/security-plugin-types-common"/> | [@elastic/kibana-security](https://github.com/orgs/elastic/teams/kibana-security) | - | 84 | 0 | 37 | 0 |
+| <DocLink id="kibKbnSecurityPluginTypesCommonPluginApi" text="@kbn/security-plugin-types-common"/> | [@elastic/kibana-security](https://github.com/orgs/elastic/teams/kibana-security) | - | 88 | 0 | 40 | 0 |
 | <DocLink id="kibKbnSecurityPluginTypesPublicPluginApi" text="@kbn/security-plugin-types-public"/> | [@elastic/kibana-security](https://github.com/orgs/elastic/teams/kibana-security) | - | 39 | 0 | 14 | 0 |
 | <DocLink id="kibKbnSecurityPluginTypesServerPluginApi" text="@kbn/security-plugin-types-server"/> | [@elastic/kibana-security](https://github.com/orgs/elastic/teams/kibana-security) | - | 207 | 0 | 114 | 0 |
 | <DocLink id="kibKbnSecuritySolutionFeaturesPluginApi" text="@kbn/security-solution-features"/> | [@elastic/security-threat-hunting-explore](https://github.com/orgs/elastic/teams/security-threat-hunting-explore) | - | 14 | 0 | 14 | 6 |
 | <DocLink id="kibKbnSecuritySolutionNavigationPluginApi" text="@kbn/security-solution-navigation"/> | [@elastic/security-threat-hunting-explore](https://github.com/orgs/elastic/teams/security-threat-hunting-explore) | - | 54 | 0 | 49 | 0 |
-| <DocLink id="kibKbnSecuritySolutionSideNavPluginApi" text="@kbn/security-solution-side-nav"/> | [@elastic/security-threat-hunting-explore](https://github.com/orgs/elastic/teams/security-threat-hunting-explore) | - | 29 | 0 | 23 | 0 |
+| <DocLink id="kibKbnSecuritySolutionSideNavPluginApi" text="@kbn/security-solution-side-nav"/> | [@elastic/security-threat-hunting-explore](https://github.com/orgs/elastic/teams/security-threat-hunting-explore) | - | 30 | 0 | 24 | 0 |
 | <DocLink id="kibKbnSecuritySolutionStorybookConfigPluginApi" text="@kbn/security-solution-storybook-config"/> | [@elastic/security-threat-hunting-explore](https://github.com/orgs/elastic/teams/security-threat-hunting-explore) | - | 2 | 0 | 0 | 0 |
 | <DocLink id="kibKbnSecuritysolutionAutocompletePluginApi" text="@kbn/securitysolution-autocomplete"/> | [@elastic/security-detection-engine](https://github.com/orgs/elastic/teams/security-detection-engine) | - | 56 | 1 | 41 | 1 |
 | <DocLink id="kibKbnSecuritysolutionDataTablePluginApi" text="@kbn/securitysolution-data-table"/> | [@elastic/security-threat-hunting-investigations](https://github.com/orgs/elastic/teams/security-threat-hunting-investigations) | - | 94 | 0 | 71 | 7 |
diff --git a/api_docs/presentation_panel.mdx b/api_docs/presentation_panel.mdx
index 063b9cf5e2b710..374ba33d506422 100644
--- a/api_docs/presentation_panel.mdx
+++ b/api_docs/presentation_panel.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/presentationPanel
 title: "presentationPanel"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the presentationPanel plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'presentationPanel']
 ---
 import presentationPanelObj from './presentation_panel.devdocs.json';
diff --git a/api_docs/presentation_util.mdx b/api_docs/presentation_util.mdx
index a6a52059416e86..01b9345b29a0dd 100644
--- a/api_docs/presentation_util.mdx
+++ b/api_docs/presentation_util.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/presentationUtil
 title: "presentationUtil"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the presentationUtil plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'presentationUtil']
 ---
 import presentationUtilObj from './presentation_util.devdocs.json';
diff --git a/api_docs/profiling.mdx b/api_docs/profiling.mdx
index 3f82a29534996c..a432ee9fabffe5 100644
--- a/api_docs/profiling.mdx
+++ b/api_docs/profiling.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/profiling
 title: "profiling"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the profiling plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'profiling']
 ---
 import profilingObj from './profiling.devdocs.json';
diff --git a/api_docs/profiling_data_access.mdx b/api_docs/profiling_data_access.mdx
index df964c28711562..dea210496234b8 100644
--- a/api_docs/profiling_data_access.mdx
+++ b/api_docs/profiling_data_access.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/profilingDataAccess
 title: "profilingDataAccess"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the profilingDataAccess plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'profilingDataAccess']
 ---
 import profilingDataAccessObj from './profiling_data_access.devdocs.json';
diff --git a/api_docs/remote_clusters.mdx b/api_docs/remote_clusters.mdx
index f5df410601e03d..9a19b249d78b0e 100644
--- a/api_docs/remote_clusters.mdx
+++ b/api_docs/remote_clusters.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/remoteClusters
 title: "remoteClusters"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the remoteClusters plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'remoteClusters']
 ---
 import remoteClustersObj from './remote_clusters.devdocs.json';
diff --git a/api_docs/reporting.mdx b/api_docs/reporting.mdx
index ab221e6bfec7f3..4181402ce69d30 100644
--- a/api_docs/reporting.mdx
+++ b/api_docs/reporting.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/reporting
 title: "reporting"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the reporting plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'reporting']
 ---
 import reportingObj from './reporting.devdocs.json';
diff --git a/api_docs/rollup.mdx b/api_docs/rollup.mdx
index 27289bf32ec69b..1909c2e6523f38 100644
--- a/api_docs/rollup.mdx
+++ b/api_docs/rollup.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/rollup
 title: "rollup"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the rollup plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'rollup']
 ---
 import rollupObj from './rollup.devdocs.json';
diff --git a/api_docs/rule_registry.devdocs.json b/api_docs/rule_registry.devdocs.json
index d5f57b730b6a13..642c93433b9515 100644
--- a/api_docs/rule_registry.devdocs.json
+++ b/api_docs/rule_registry.devdocs.json
@@ -107,15 +107,7 @@
             "label": "get",
             "description": [],
             "signature": [
-              "({ id, index }: GetAlertParams) => Promise<OutputOf<SetOptional<{ readonly \"ecs.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.risk_score\": { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.author\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.description\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.enabled\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.from\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.interval\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.license\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.note\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.references\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.rule_name_override\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.to\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.type\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.severity\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.docs_count\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.terms.field\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.suppression.terms.value\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.system_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_status_updated_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_user\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"@timestamp\": { readonly type: \"date\"; readonly required: true; readonly array: false; }; readonly \"event.action\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_type_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.consumer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.execution.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.instance.id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.category\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.name\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.producer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.revision\": { readonly type: \"long\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.status\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.space_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: true; }; readonly \"event.kind\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.action_group\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.case_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.consecutive_matches\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.duration.us\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping\": { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping_history\": { readonly type: \"boolean\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.last_detected\": { readonly type: \"date\"; readonly required: false; readonly array: false; }; readonly \"kibana.alert.maintenance_window_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; readonly multi_fields: ",
-              {
-                "pluginId": "@kbn/alerts-as-data-utils",
-                "scope": "common",
-                "docId": "kibKbnAlertsAsDataUtilsPluginApi",
-                "section": "def-common.MultiField",
-                "text": "MultiField"
-              },
-              "[]; }; readonly \"kibana.alert.rule.execution.timestamp\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.parameters\": { readonly array: false; readonly type: \"flattened\"; readonly ignore_above: 4096; readonly required: false; }; readonly \"kibana.alert.rule.tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.time_range\": { readonly type: \"date_range\"; readonly format: \"epoch_millis||strict_date_optional_time\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.url\": { readonly type: \"keyword\"; readonly array: false; readonly index: false; readonly required: false; readonly ignore_above: 2048; }; readonly \"kibana.alert.workflow_assignee_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.workflow_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.version\": { readonly type: \"version\"; readonly array: false; readonly required: false; }; }>> | undefined>"
+              "({ id, index }: GetAlertParams) => Promise<{ _index: string; \"@timestamp\"?: string | undefined; \"kibana.alert.rule.rule_type_id\"?: string | undefined; \"kibana.alert.rule.consumer\"?: string | undefined; \"kibana.alert.instance.id\"?: string | undefined; \"kibana.alert.rule.category\"?: string | undefined; \"kibana.alert.rule.name\"?: string | undefined; \"kibana.alert.rule.producer\"?: string | undefined; \"kibana.alert.rule.revision\"?: number | undefined; \"kibana.alert.rule.uuid\"?: string | undefined; \"kibana.alert.status\"?: string | undefined; \"kibana.alert.uuid\"?: string | undefined; \"kibana.space_ids\"?: string[] | undefined; \"event.action\"?: string | undefined; tags?: string[] | undefined; \"kibana.alert.rule.execution.uuid\"?: string | undefined; \"event.kind\"?: string | undefined; \"kibana.alert.action_group\"?: string | undefined; \"kibana.alert.case_ids\"?: string[] | undefined; \"kibana.alert.consecutive_matches\"?: number | undefined; \"kibana.alert.duration.us\"?: number | undefined; \"kibana.alert.end\"?: string | undefined; \"kibana.alert.flapping\"?: boolean | undefined; \"kibana.alert.flapping_history\"?: boolean[] | undefined; \"kibana.alert.last_detected\"?: string | undefined; \"kibana.alert.maintenance_window_ids\"?: string[] | undefined; \"kibana.alert.reason\"?: string | undefined; \"kibana.alert.rule.execution.timestamp\"?: string | undefined; \"kibana.alert.rule.parameters\"?: { [key: string]: unknown; } | undefined; \"kibana.alert.rule.tags\"?: string[] | undefined; \"kibana.alert.start\"?: string | undefined; \"kibana.alert.time_range\"?: unknown; \"kibana.alert.url\"?: string | undefined; \"kibana.alert.workflow_assignee_ids\"?: string[] | undefined; \"kibana.alert.workflow_status\"?: string | undefined; \"kibana.alert.workflow_tags\"?: string[] | undefined; \"kibana.version\"?: string | undefined; \"ecs.version\"?: string | undefined; \"kibana.alert.risk_score\"?: number | undefined; \"kibana.alert.rule.author\"?: string | undefined; \"kibana.alert.rule.created_at\"?: string | undefined; \"kibana.alert.rule.created_by\"?: string | undefined; \"kibana.alert.rule.description\"?: string | undefined; \"kibana.alert.rule.enabled\"?: string | undefined; \"kibana.alert.rule.from\"?: string | undefined; \"kibana.alert.rule.interval\"?: string | undefined; \"kibana.alert.rule.license\"?: string | undefined; \"kibana.alert.rule.note\"?: string | undefined; \"kibana.alert.rule.references\"?: string[] | undefined; \"kibana.alert.rule.rule_id\"?: string | undefined; \"kibana.alert.rule.rule_name_override\"?: string | undefined; \"kibana.alert.rule.to\"?: string | undefined; \"kibana.alert.rule.type\"?: string | undefined; \"kibana.alert.rule.updated_at\"?: string | undefined; \"kibana.alert.rule.updated_by\"?: string | undefined; \"kibana.alert.rule.version\"?: string | undefined; \"kibana.alert.severity\"?: string | undefined; \"kibana.alert.suppression.docs_count\"?: number | undefined; \"kibana.alert.suppression.end\"?: string | undefined; \"kibana.alert.suppression.start\"?: string | undefined; \"kibana.alert.suppression.terms.field\"?: string[] | undefined; \"kibana.alert.suppression.terms.value\"?: string[] | undefined; \"kibana.alert.system_status\"?: string | undefined; \"kibana.alert.workflow_reason\"?: string | undefined; \"kibana.alert.workflow_status_updated_at\"?: string | undefined; \"kibana.alert.workflow_user\"?: string | undefined; }>"
             ],
             "path": "x-pack/plugins/rule_registry/server/alert_data_client/alerts_client.ts",
             "deprecated": false,
diff --git a/api_docs/rule_registry.mdx b/api_docs/rule_registry.mdx
index 56bf12a9d113e5..4630f562528c5f 100644
--- a/api_docs/rule_registry.mdx
+++ b/api_docs/rule_registry.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/ruleRegistry
 title: "ruleRegistry"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the ruleRegistry plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'ruleRegistry']
 ---
 import ruleRegistryObj from './rule_registry.devdocs.json';
diff --git a/api_docs/runtime_fields.mdx b/api_docs/runtime_fields.mdx
index cac00818b4148c..bf16cd2212c040 100644
--- a/api_docs/runtime_fields.mdx
+++ b/api_docs/runtime_fields.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/runtimeFields
 title: "runtimeFields"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the runtimeFields plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'runtimeFields']
 ---
 import runtimeFieldsObj from './runtime_fields.devdocs.json';
diff --git a/api_docs/saved_objects.mdx b/api_docs/saved_objects.mdx
index 984a23721fe154..dc2f507f45660b 100644
--- a/api_docs/saved_objects.mdx
+++ b/api_docs/saved_objects.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/savedObjects
 title: "savedObjects"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the savedObjects plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'savedObjects']
 ---
 import savedObjectsObj from './saved_objects.devdocs.json';
diff --git a/api_docs/saved_objects_finder.mdx b/api_docs/saved_objects_finder.mdx
index 93a1044b251994..f640852cbd5703 100644
--- a/api_docs/saved_objects_finder.mdx
+++ b/api_docs/saved_objects_finder.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/savedObjectsFinder
 title: "savedObjectsFinder"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the savedObjectsFinder plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'savedObjectsFinder']
 ---
 import savedObjectsFinderObj from './saved_objects_finder.devdocs.json';
diff --git a/api_docs/saved_objects_management.mdx b/api_docs/saved_objects_management.mdx
index deb861b0fc1183..07973a3192b8b3 100644
--- a/api_docs/saved_objects_management.mdx
+++ b/api_docs/saved_objects_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/savedObjectsManagement
 title: "savedObjectsManagement"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the savedObjectsManagement plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'savedObjectsManagement']
 ---
 import savedObjectsManagementObj from './saved_objects_management.devdocs.json';
diff --git a/api_docs/saved_objects_tagging.mdx b/api_docs/saved_objects_tagging.mdx
index 39e7778ff56bb4..d9ae5356e13933 100644
--- a/api_docs/saved_objects_tagging.mdx
+++ b/api_docs/saved_objects_tagging.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/savedObjectsTagging
 title: "savedObjectsTagging"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the savedObjectsTagging plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'savedObjectsTagging']
 ---
 import savedObjectsTaggingObj from './saved_objects_tagging.devdocs.json';
diff --git a/api_docs/saved_objects_tagging_oss.mdx b/api_docs/saved_objects_tagging_oss.mdx
index 405e8e22d1da80..3bfac85dfe100f 100644
--- a/api_docs/saved_objects_tagging_oss.mdx
+++ b/api_docs/saved_objects_tagging_oss.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/savedObjectsTaggingOss
 title: "savedObjectsTaggingOss"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the savedObjectsTaggingOss plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'savedObjectsTaggingOss']
 ---
 import savedObjectsTaggingOssObj from './saved_objects_tagging_oss.devdocs.json';
diff --git a/api_docs/saved_search.devdocs.json b/api_docs/saved_search.devdocs.json
index 8898805e7cbbbc..b69de932fb6857 100644
--- a/api_docs/saved_search.devdocs.json
+++ b/api_docs/saved_search.devdocs.json
@@ -1117,22 +1117,6 @@
                 "section": "def-common.SearchSource",
                 "text": "SearchSource"
               },
-              "; setFields: (newFields: ",
-              {
-                "pluginId": "data",
-                "scope": "common",
-                "docId": "kibDataSearchPluginApi",
-                "section": "def-common.SearchSourceFields",
-                "text": "SearchSourceFields"
-              },
-              ") => ",
-              {
-                "pluginId": "data",
-                "scope": "common",
-                "docId": "kibDataSearchPluginApi",
-                "section": "def-common.SearchSource",
-                "text": "SearchSource"
-              },
               "; getId: () => string; getFields: () => ",
               {
                 "pluginId": "data",
diff --git a/api_docs/saved_search.mdx b/api_docs/saved_search.mdx
index db2f0c595705f3..5e79a0f9699dda 100644
--- a/api_docs/saved_search.mdx
+++ b/api_docs/saved_search.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/savedSearch
 title: "savedSearch"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the savedSearch plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'savedSearch']
 ---
 import savedSearchObj from './saved_search.devdocs.json';
diff --git a/api_docs/screenshot_mode.mdx b/api_docs/screenshot_mode.mdx
index fa3d7f94c17a6b..41ddadc68ded8b 100644
--- a/api_docs/screenshot_mode.mdx
+++ b/api_docs/screenshot_mode.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/screenshotMode
 title: "screenshotMode"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the screenshotMode plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'screenshotMode']
 ---
 import screenshotModeObj from './screenshot_mode.devdocs.json';
diff --git a/api_docs/screenshotting.mdx b/api_docs/screenshotting.mdx
index 24062313dc2525..c3a8d962abea2f 100644
--- a/api_docs/screenshotting.mdx
+++ b/api_docs/screenshotting.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/screenshotting
 title: "screenshotting"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the screenshotting plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'screenshotting']
 ---
 import screenshottingObj from './screenshotting.devdocs.json';
diff --git a/api_docs/search_connectors.mdx b/api_docs/search_connectors.mdx
index cc39a5ab07dd5e..9596648ef61d62 100644
--- a/api_docs/search_connectors.mdx
+++ b/api_docs/search_connectors.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/searchConnectors
 title: "searchConnectors"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the searchConnectors plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'searchConnectors']
 ---
 import searchConnectorsObj from './search_connectors.devdocs.json';
diff --git a/api_docs/search_notebooks.mdx b/api_docs/search_notebooks.mdx
index da7c51f45377be..7a52d62fdebc68 100644
--- a/api_docs/search_notebooks.mdx
+++ b/api_docs/search_notebooks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/searchNotebooks
 title: "searchNotebooks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the searchNotebooks plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'searchNotebooks']
 ---
 import searchNotebooksObj from './search_notebooks.devdocs.json';
diff --git a/api_docs/search_playground.mdx b/api_docs/search_playground.mdx
index 092eef3bfc1b2a..5bbcd64aa0cc97 100644
--- a/api_docs/search_playground.mdx
+++ b/api_docs/search_playground.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/searchPlayground
 title: "searchPlayground"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the searchPlayground plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'searchPlayground']
 ---
 import searchPlaygroundObj from './search_playground.devdocs.json';
diff --git a/api_docs/security.devdocs.json b/api_docs/security.devdocs.json
index e3643791497361..c86bad58007a31 100644
--- a/api_docs/security.devdocs.json
+++ b/api_docs/security.devdocs.json
@@ -573,6 +573,19 @@
             "deprecated": false,
             "trackAdoption": false
           },
+          {
+            "parentPluginId": "security",
+            "id": "def-public.SecurityLicenseFeatures.allowRemoteClusterPrivileges",
+            "type": "boolean",
+            "tags": [],
+            "label": "allowRemoteClusterPrivileges",
+            "description": [
+              "\nIndicates whether we allow users to define remote cluster privileges in roles."
+            ],
+            "path": "x-pack/packages/security/plugin_types_common/src/licensing/license_features.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
           {
             "parentPluginId": "security",
             "id": "def-public.SecurityLicenseFeatures.allowRbac",
@@ -1905,7 +1918,7 @@
                 "section": "def-common.KibanaRequest",
                 "text": "KibanaRequest"
               },
-              "<unknown, unknown, unknown, any>, createParams: Readonly<{ type?: \"rest\" | undefined; metadata?: Readonly<{} & {}> | undefined; expiration?: string | undefined; } & { name: string; role_descriptors: Record<string, Readonly<{} & {}>>; }> | Readonly<{ type?: \"rest\" | undefined; metadata?: Readonly<{} & {}> | undefined; expiration?: string | undefined; } & { name: string; kibana_role_descriptors: Record<string, Readonly<{} & { kibana: Readonly<{ base?: string[] | undefined; feature?: Record<string, string[]> | undefined; } & { spaces: string[] | \"*\"[]; }>[]; elasticsearch: Readonly<{ cluster?: string[] | undefined; indices?: Readonly<{ query?: string | undefined; field_security?: Record<\"grant\" | \"except\", string[]> | undefined; allow_restricted_indices?: boolean | undefined; } & { names: string[]; privileges: string[]; }>[] | undefined; remote_indices?: Readonly<{ query?: string | undefined; field_security?: Record<\"grant\" | \"except\", string[]> | undefined; allow_restricted_indices?: boolean | undefined; } & { names: string[]; privileges: string[]; clusters: string[]; }>[] | undefined; run_as?: string[] | undefined; } & {}>; }>>; }>) => Promise<",
+              "<unknown, unknown, unknown, any>, createParams: Readonly<{ type?: \"rest\" | undefined; metadata?: Readonly<{} & {}> | undefined; expiration?: string | undefined; } & { name: string; role_descriptors: Record<string, Readonly<{} & {}>>; }> | Readonly<{ type?: \"rest\" | undefined; metadata?: Readonly<{} & {}> | undefined; expiration?: string | undefined; } & { name: string; kibana_role_descriptors: Record<string, Readonly<{} & { kibana: Readonly<{ base?: string[] | undefined; feature?: Record<string, string[]> | undefined; } & { spaces: string[] | \"*\"[]; }>[]; elasticsearch: Readonly<{ cluster?: string[] | undefined; indices?: Readonly<{ query?: string | undefined; field_security?: Record<\"grant\" | \"except\", string[]> | undefined; allow_restricted_indices?: boolean | undefined; } & { names: string[]; privileges: string[]; }>[] | undefined; remote_cluster?: Readonly<{} & { privileges: string[]; clusters: string[]; }>[] | undefined; remote_indices?: Readonly<{ query?: string | undefined; field_security?: Record<\"grant\" | \"except\", string[]> | undefined; allow_restricted_indices?: boolean | undefined; } & { names: string[]; privileges: string[]; clusters: string[]; }>[] | undefined; run_as?: string[] | undefined; } & {}>; }>>; }>) => Promise<",
               {
                 "pluginId": "@kbn/security-plugin-types-server",
                 "scope": "server",
@@ -1953,7 +1966,7 @@
                   "Create operation parameters."
                 ],
                 "signature": [
-                  "Readonly<{ type?: \"rest\" | undefined; metadata?: Readonly<{} & {}> | undefined; expiration?: string | undefined; } & { name: string; role_descriptors: Record<string, Readonly<{} & {}>>; }> | Readonly<{ type?: \"rest\" | undefined; metadata?: Readonly<{} & {}> | undefined; expiration?: string | undefined; } & { name: string; kibana_role_descriptors: Record<string, Readonly<{} & { kibana: Readonly<{ base?: string[] | undefined; feature?: Record<string, string[]> | undefined; } & { spaces: string[] | \"*\"[]; }>[]; elasticsearch: Readonly<{ cluster?: string[] | undefined; indices?: Readonly<{ query?: string | undefined; field_security?: Record<\"grant\" | \"except\", string[]> | undefined; allow_restricted_indices?: boolean | undefined; } & { names: string[]; privileges: string[]; }>[] | undefined; remote_indices?: Readonly<{ query?: string | undefined; field_security?: Record<\"grant\" | \"except\", string[]> | undefined; allow_restricted_indices?: boolean | undefined; } & { names: string[]; privileges: string[]; clusters: string[]; }>[] | undefined; run_as?: string[] | undefined; } & {}>; }>>; }>"
+                  "Readonly<{ type?: \"rest\" | undefined; metadata?: Readonly<{} & {}> | undefined; expiration?: string | undefined; } & { name: string; role_descriptors: Record<string, Readonly<{} & {}>>; }> | Readonly<{ type?: \"rest\" | undefined; metadata?: Readonly<{} & {}> | undefined; expiration?: string | undefined; } & { name: string; kibana_role_descriptors: Record<string, Readonly<{} & { kibana: Readonly<{ base?: string[] | undefined; feature?: Record<string, string[]> | undefined; } & { spaces: string[] | \"*\"[]; }>[]; elasticsearch: Readonly<{ cluster?: string[] | undefined; indices?: Readonly<{ query?: string | undefined; field_security?: Record<\"grant\" | \"except\", string[]> | undefined; allow_restricted_indices?: boolean | undefined; } & { names: string[]; privileges: string[]; }>[] | undefined; remote_cluster?: Readonly<{} & { privileges: string[]; clusters: string[]; }>[] | undefined; remote_indices?: Readonly<{ query?: string | undefined; field_security?: Record<\"grant\" | \"except\", string[]> | undefined; allow_restricted_indices?: boolean | undefined; } & { names: string[]; privileges: string[]; clusters: string[]; }>[] | undefined; run_as?: string[] | undefined; } & {}>; }>>; }>"
                 ],
                 "path": "x-pack/packages/security/plugin_types_server/src/authentication/api_keys/api_keys.ts",
                 "deprecated": false,
@@ -5025,7 +5038,7 @@
         "label": "CreateAPIKeyParams",
         "description": [],
         "signature": [
-          "Readonly<{ type?: \"rest\" | undefined; metadata?: Readonly<{} & {}> | undefined; expiration?: string | undefined; } & { name: string; role_descriptors: Record<string, Readonly<{} & {}>>; }> | Readonly<{ type?: \"rest\" | undefined; metadata?: Readonly<{} & {}> | undefined; expiration?: string | undefined; } & { name: string; kibana_role_descriptors: Record<string, Readonly<{} & { kibana: Readonly<{ base?: string[] | undefined; feature?: Record<string, string[]> | undefined; } & { spaces: string[] | \"*\"[]; }>[]; elasticsearch: Readonly<{ cluster?: string[] | undefined; indices?: Readonly<{ query?: string | undefined; field_security?: Record<\"grant\" | \"except\", string[]> | undefined; allow_restricted_indices?: boolean | undefined; } & { names: string[]; privileges: string[]; }>[] | undefined; remote_indices?: Readonly<{ query?: string | undefined; field_security?: Record<\"grant\" | \"except\", string[]> | undefined; allow_restricted_indices?: boolean | undefined; } & { names: string[]; privileges: string[]; clusters: string[]; }>[] | undefined; run_as?: string[] | undefined; } & {}>; }>>; }> | Readonly<{ metadata?: Readonly<{} & {}> | undefined; expiration?: string | undefined; } & { type: \"cross_cluster\"; name: string; access: Readonly<{ search?: Readonly<{} & { names: string[]; }>[] | undefined; replication?: Readonly<{} & { names: string[]; }>[] | undefined; } & {}>; }>"
+          "Readonly<{ type?: \"rest\" | undefined; metadata?: Readonly<{} & {}> | undefined; expiration?: string | undefined; } & { name: string; role_descriptors: Record<string, Readonly<{} & {}>>; }> | Readonly<{ type?: \"rest\" | undefined; metadata?: Readonly<{} & {}> | undefined; expiration?: string | undefined; } & { name: string; kibana_role_descriptors: Record<string, Readonly<{} & { kibana: Readonly<{ base?: string[] | undefined; feature?: Record<string, string[]> | undefined; } & { spaces: string[] | \"*\"[]; }>[]; elasticsearch: Readonly<{ cluster?: string[] | undefined; indices?: Readonly<{ query?: string | undefined; field_security?: Record<\"grant\" | \"except\", string[]> | undefined; allow_restricted_indices?: boolean | undefined; } & { names: string[]; privileges: string[]; }>[] | undefined; remote_cluster?: Readonly<{} & { privileges: string[]; clusters: string[]; }>[] | undefined; remote_indices?: Readonly<{ query?: string | undefined; field_security?: Record<\"grant\" | \"except\", string[]> | undefined; allow_restricted_indices?: boolean | undefined; } & { names: string[]; privileges: string[]; clusters: string[]; }>[] | undefined; run_as?: string[] | undefined; } & {}>; }>>; }> | Readonly<{ metadata?: Readonly<{} & {}> | undefined; expiration?: string | undefined; } & { type: \"cross_cluster\"; name: string; access: Readonly<{ search?: Readonly<{} & { names: string[]; }>[] | undefined; replication?: Readonly<{} & { names: string[]; }>[] | undefined; } & {}>; }>"
         ],
         "path": "x-pack/packages/security/plugin_types_server/src/authentication/api_keys/api_keys.ts",
         "deprecated": false,
@@ -5087,7 +5100,7 @@
         "label": "CreateRestAPIKeyWithKibanaPrivilegesParams",
         "description": [],
         "signature": [
-          "{ readonly type?: \"rest\" | undefined; readonly metadata?: Readonly<{} & {}> | undefined; readonly expiration?: string | undefined; readonly name: string; readonly kibana_role_descriptors: Record<string, Readonly<{} & { kibana: Readonly<{ base?: string[] | undefined; feature?: Record<string, string[]> | undefined; } & { spaces: string[] | \"*\"[]; }>[]; elasticsearch: Readonly<{ cluster?: string[] | undefined; indices?: Readonly<{ query?: string | undefined; field_security?: Record<\"grant\" | \"except\", string[]> | undefined; allow_restricted_indices?: boolean | undefined; } & { names: string[]; privileges: string[]; }>[] | undefined; remote_indices?: Readonly<{ query?: string | undefined; field_security?: Record<\"grant\" | \"except\", string[]> | undefined; allow_restricted_indices?: boolean | undefined; } & { names: string[]; privileges: string[]; clusters: string[]; }>[] | undefined; run_as?: string[] | undefined; } & {}>; }>>; }"
+          "{ readonly type?: \"rest\" | undefined; readonly metadata?: Readonly<{} & {}> | undefined; readonly expiration?: string | undefined; readonly name: string; readonly kibana_role_descriptors: Record<string, Readonly<{} & { kibana: Readonly<{ base?: string[] | undefined; feature?: Record<string, string[]> | undefined; } & { spaces: string[] | \"*\"[]; }>[]; elasticsearch: Readonly<{ cluster?: string[] | undefined; indices?: Readonly<{ query?: string | undefined; field_security?: Record<\"grant\" | \"except\", string[]> | undefined; allow_restricted_indices?: boolean | undefined; } & { names: string[]; privileges: string[]; }>[] | undefined; remote_cluster?: Readonly<{} & { privileges: string[]; clusters: string[]; }>[] | undefined; remote_indices?: Readonly<{ query?: string | undefined; field_security?: Record<\"grant\" | \"except\", string[]> | undefined; allow_restricted_indices?: boolean | undefined; } & { names: string[]; privileges: string[]; clusters: string[]; }>[] | undefined; run_as?: string[] | undefined; } & {}>; }>>; }"
         ],
         "path": "x-pack/packages/security/plugin_types_server/src/authentication/api_keys/api_keys.ts",
         "deprecated": false,
@@ -5102,7 +5115,7 @@
         "label": "ElasticsearchPrivilegesType",
         "description": [],
         "signature": [
-          "{ readonly cluster?: string[] | undefined; readonly indices?: Readonly<{ query?: string | undefined; field_security?: Record<\"grant\" | \"except\", string[]> | undefined; allow_restricted_indices?: boolean | undefined; } & { names: string[]; privileges: string[]; }>[] | undefined; readonly remote_indices?: Readonly<{ query?: string | undefined; field_security?: Record<\"grant\" | \"except\", string[]> | undefined; allow_restricted_indices?: boolean | undefined; } & { names: string[]; privileges: string[]; clusters: string[]; }>[] | undefined; readonly run_as?: string[] | undefined; }"
+          "{ readonly cluster?: string[] | undefined; readonly indices?: Readonly<{ query?: string | undefined; field_security?: Record<\"grant\" | \"except\", string[]> | undefined; allow_restricted_indices?: boolean | undefined; } & { names: string[]; privileges: string[]; }>[] | undefined; readonly remote_cluster?: Readonly<{} & { privileges: string[]; clusters: string[]; }>[] | undefined; readonly remote_indices?: Readonly<{ query?: string | undefined; field_security?: Record<\"grant\" | \"except\", string[]> | undefined; allow_restricted_indices?: boolean | undefined; } & { names: string[]; privileges: string[]; clusters: string[]; }>[] | undefined; readonly run_as?: string[] | undefined; }"
         ],
         "path": "x-pack/packages/security/plugin_types_server/src/authorization/role_schema.ts",
         "deprecated": false,
@@ -5830,6 +5843,20 @@
             "path": "x-pack/plugins/security/common/model/builtin_es_privileges.ts",
             "deprecated": false,
             "trackAdoption": false
+          },
+          {
+            "parentPluginId": "security",
+            "id": "def-common.BuiltinESPrivileges.remote_cluster",
+            "type": "Array",
+            "tags": [],
+            "label": "remote_cluster",
+            "description": [],
+            "signature": [
+              "string[]"
+            ],
+            "path": "x-pack/plugins/security/common/model/builtin_es_privileges.ts",
+            "deprecated": false,
+            "trackAdoption": false
           }
         ],
         "initialIsOpen": false
@@ -6290,7 +6317,15 @@
             "label": "elasticsearch",
             "description": [],
             "signature": [
-              "{ cluster: string[]; indices: ",
+              "{ cluster: string[]; remote_cluster?: ",
+              {
+                "pluginId": "@kbn/security-plugin-types-common",
+                "scope": "common",
+                "docId": "kibKbnSecurityPluginTypesCommonPluginApi",
+                "section": "def-common.RoleRemoteClusterPrivilege",
+                "text": "RoleRemoteClusterPrivilege"
+              },
+              "[] | undefined; indices: ",
               {
                 "pluginId": "@kbn/security-plugin-types-common",
                 "scope": "common",
@@ -6637,6 +6672,48 @@
         ],
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "security",
+        "id": "def-common.RoleRemoteClusterPrivilege",
+        "type": "Interface",
+        "tags": [],
+        "label": "RoleRemoteClusterPrivilege",
+        "description": [],
+        "path": "x-pack/packages/security/plugin_types_common/src/authorization/role.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "security",
+            "id": "def-common.RoleRemoteClusterPrivilege.clusters",
+            "type": "Array",
+            "tags": [],
+            "label": "clusters",
+            "description": [],
+            "signature": [
+              "string[]"
+            ],
+            "path": "x-pack/packages/security/plugin_types_common/src/authorization/role.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "security",
+            "id": "def-common.RoleRemoteClusterPrivilege.privileges",
+            "type": "Array",
+            "tags": [],
+            "label": "privileges",
+            "description": [],
+            "signature": [
+              "string[]"
+            ],
+            "path": "x-pack/packages/security/plugin_types_common/src/authorization/role.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "security",
         "id": "def-common.RoleRemoteIndexPrivilege",
@@ -6952,6 +7029,19 @@
             "deprecated": false,
             "trackAdoption": false
           },
+          {
+            "parentPluginId": "security",
+            "id": "def-common.SecurityLicenseFeatures.allowRemoteClusterPrivileges",
+            "type": "boolean",
+            "tags": [],
+            "label": "allowRemoteClusterPrivileges",
+            "description": [
+              "\nIndicates whether we allow users to define remote cluster privileges in roles."
+            ],
+            "path": "x-pack/packages/security/plugin_types_common/src/licensing/license_features.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
           {
             "parentPluginId": "security",
             "id": "def-common.SecurityLicenseFeatures.allowRbac",
diff --git a/api_docs/security.mdx b/api_docs/security.mdx
index ce89204dc52e29..264b14638b0130 100644
--- a/api_docs/security.mdx
+++ b/api_docs/security.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/security
 title: "security"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the security plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'security']
 ---
 import securityObj from './security.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/kibana-security](https://github.com/orgs/elastic/teams/kibana-
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 407 | 0 | 201 | 2 |
+| 413 | 0 | 205 | 2 |
 
 ## Client
 
diff --git a/api_docs/security_solution.devdocs.json b/api_docs/security_solution.devdocs.json
index 2ce600a624ca80..a5ac269fd642ec 100644
--- a/api_docs/security_solution.devdocs.json
+++ b/api_docs/security_solution.devdocs.json
@@ -485,7 +485,7 @@
               "\nExperimental flag needed to enable the link"
             ],
             "signature": [
-              "\"assistantModelEvaluation\" | \"attackDiscoveryEnabled\" | \"tGridEnabled\" | \"tGridEventRenderedViewEnabled\" | \"excludePoliciesInFilterEnabled\" | \"kubernetesEnabled\" | \"donutChartEmbeddablesEnabled\" | \"previewTelemetryUrlEnabled\" | \"insightsRelatedAlertsByProcessAncestry\" | \"extendedRuleExecutionLoggingEnabled\" | \"socTrendsEnabled\" | \"responseActionsEnabled\" | \"endpointResponseActionsEnabled\" | \"responseActionUploadEnabled\" | \"automatedProcessActionsEnabled\" | \"responseActionsSentinelOneV1Enabled\" | \"responseActionsSentinelOneV2Enabled\" | \"responseActionsSentinelOneGetFileEnabled\" | \"agentStatusClientEnabled\" | \"responseActionsCrowdstrikeManualHostIsolationEnabled\" | \"alertsPageChartsEnabled\" | \"alertTypeEnabled\" | \"expandableFlyoutInCreateRuleEnabled\" | \"expandableEventFlyoutEnabled\" | \"expandableTimelineFlyoutEnabled\" | \"alertsPageFiltersEnabled\" | \"newUserDetailsFlyout\" | \"newUserDetailsFlyoutManagedUser\" | \"newHostDetailsFlyout\" | \"riskScoringPersistence\" | \"riskScoringRoutesEnabled\" | \"esqlRulesDisabled\" | \"protectionUpdatesEnabled\" | \"disableTimelineSaveTour\" | \"riskEnginePrivilegesRouteEnabled\" | \"sentinelOneDataInAnalyzerEnabled\" | \"sentinelOneManualHostActionsEnabled\" | \"crowdstrikeDataInAnalyzerEnabled\" | \"jsonPrebuiltRulesDiffingEnabled\" | \"timelineEsqlTabDisabled\" | \"unifiedComponentsInTimelineEnabled\" | \"analyzerDatePickersAndSourcererDisabled\" | \"perFieldPrebuiltRulesDiffingEnabled\" | \"malwareOnWriteScanOptionAvailable\" | \"aiAssistantFlyoutMode\" | \"valueListItemsModalEnabled\" | \"bulkCustomHighlightedFieldsEnabled\" | undefined"
+              "\"assistantModelEvaluation\" | \"tGridEnabled\" | \"tGridEventRenderedViewEnabled\" | \"excludePoliciesInFilterEnabled\" | \"kubernetesEnabled\" | \"donutChartEmbeddablesEnabled\" | \"previewTelemetryUrlEnabled\" | \"insightsRelatedAlertsByProcessAncestry\" | \"extendedRuleExecutionLoggingEnabled\" | \"socTrendsEnabled\" | \"responseActionsEnabled\" | \"endpointResponseActionsEnabled\" | \"responseActionUploadEnabled\" | \"automatedProcessActionsEnabled\" | \"responseActionsSentinelOneV1Enabled\" | \"responseActionsSentinelOneV2Enabled\" | \"responseActionsSentinelOneGetFileEnabled\" | \"agentStatusClientEnabled\" | \"responseActionsCrowdstrikeManualHostIsolationEnabled\" | \"alertsPageChartsEnabled\" | \"alertTypeEnabled\" | \"expandableFlyoutInCreateRuleEnabled\" | \"expandableEventFlyoutEnabled\" | \"expandableTimelineFlyoutEnabled\" | \"alertsPageFiltersEnabled\" | \"newUserDetailsFlyout\" | \"newUserDetailsFlyoutManagedUser\" | \"newHostDetailsFlyout\" | \"riskScoringPersistence\" | \"riskScoringRoutesEnabled\" | \"esqlRulesDisabled\" | \"protectionUpdatesEnabled\" | \"disableTimelineSaveTour\" | \"riskEnginePrivilegesRouteEnabled\" | \"sentinelOneDataInAnalyzerEnabled\" | \"sentinelOneManualHostActionsEnabled\" | \"crowdstrikeDataInAnalyzerEnabled\" | \"jamfDataInAnalyzerEnabled\" | \"jsonPrebuiltRulesDiffingEnabled\" | \"timelineEsqlTabDisabled\" | \"unifiedComponentsInTimelineEnabled\" | \"analyzerDatePickersAndSourcererDisabled\" | \"perFieldPrebuiltRulesDiffingEnabled\" | \"malwareOnWriteScanOptionAvailable\" | \"aiAssistantFlyoutMode\" | \"valueListItemsModalEnabled\" | \"bulkCustomHighlightedFieldsEnabled\" | undefined"
             ],
             "path": "x-pack/plugins/security_solution/public/common/links/types.ts",
             "deprecated": false,
@@ -565,7 +565,7 @@
               "\nExperimental flag needed to disable the link. Opposite of experimentalKey"
             ],
             "signature": [
-              "\"assistantModelEvaluation\" | \"attackDiscoveryEnabled\" | \"tGridEnabled\" | \"tGridEventRenderedViewEnabled\" | \"excludePoliciesInFilterEnabled\" | \"kubernetesEnabled\" | \"donutChartEmbeddablesEnabled\" | \"previewTelemetryUrlEnabled\" | \"insightsRelatedAlertsByProcessAncestry\" | \"extendedRuleExecutionLoggingEnabled\" | \"socTrendsEnabled\" | \"responseActionsEnabled\" | \"endpointResponseActionsEnabled\" | \"responseActionUploadEnabled\" | \"automatedProcessActionsEnabled\" | \"responseActionsSentinelOneV1Enabled\" | \"responseActionsSentinelOneV2Enabled\" | \"responseActionsSentinelOneGetFileEnabled\" | \"agentStatusClientEnabled\" | \"responseActionsCrowdstrikeManualHostIsolationEnabled\" | \"alertsPageChartsEnabled\" | \"alertTypeEnabled\" | \"expandableFlyoutInCreateRuleEnabled\" | \"expandableEventFlyoutEnabled\" | \"expandableTimelineFlyoutEnabled\" | \"alertsPageFiltersEnabled\" | \"newUserDetailsFlyout\" | \"newUserDetailsFlyoutManagedUser\" | \"newHostDetailsFlyout\" | \"riskScoringPersistence\" | \"riskScoringRoutesEnabled\" | \"esqlRulesDisabled\" | \"protectionUpdatesEnabled\" | \"disableTimelineSaveTour\" | \"riskEnginePrivilegesRouteEnabled\" | \"sentinelOneDataInAnalyzerEnabled\" | \"sentinelOneManualHostActionsEnabled\" | \"crowdstrikeDataInAnalyzerEnabled\" | \"jsonPrebuiltRulesDiffingEnabled\" | \"timelineEsqlTabDisabled\" | \"unifiedComponentsInTimelineEnabled\" | \"analyzerDatePickersAndSourcererDisabled\" | \"perFieldPrebuiltRulesDiffingEnabled\" | \"malwareOnWriteScanOptionAvailable\" | \"aiAssistantFlyoutMode\" | \"valueListItemsModalEnabled\" | \"bulkCustomHighlightedFieldsEnabled\" | undefined"
+              "\"assistantModelEvaluation\" | \"tGridEnabled\" | \"tGridEventRenderedViewEnabled\" | \"excludePoliciesInFilterEnabled\" | \"kubernetesEnabled\" | \"donutChartEmbeddablesEnabled\" | \"previewTelemetryUrlEnabled\" | \"insightsRelatedAlertsByProcessAncestry\" | \"extendedRuleExecutionLoggingEnabled\" | \"socTrendsEnabled\" | \"responseActionsEnabled\" | \"endpointResponseActionsEnabled\" | \"responseActionUploadEnabled\" | \"automatedProcessActionsEnabled\" | \"responseActionsSentinelOneV1Enabled\" | \"responseActionsSentinelOneV2Enabled\" | \"responseActionsSentinelOneGetFileEnabled\" | \"agentStatusClientEnabled\" | \"responseActionsCrowdstrikeManualHostIsolationEnabled\" | \"alertsPageChartsEnabled\" | \"alertTypeEnabled\" | \"expandableFlyoutInCreateRuleEnabled\" | \"expandableEventFlyoutEnabled\" | \"expandableTimelineFlyoutEnabled\" | \"alertsPageFiltersEnabled\" | \"newUserDetailsFlyout\" | \"newUserDetailsFlyoutManagedUser\" | \"newHostDetailsFlyout\" | \"riskScoringPersistence\" | \"riskScoringRoutesEnabled\" | \"esqlRulesDisabled\" | \"protectionUpdatesEnabled\" | \"disableTimelineSaveTour\" | \"riskEnginePrivilegesRouteEnabled\" | \"sentinelOneDataInAnalyzerEnabled\" | \"sentinelOneManualHostActionsEnabled\" | \"crowdstrikeDataInAnalyzerEnabled\" | \"jamfDataInAnalyzerEnabled\" | \"jsonPrebuiltRulesDiffingEnabled\" | \"timelineEsqlTabDisabled\" | \"unifiedComponentsInTimelineEnabled\" | \"analyzerDatePickersAndSourcererDisabled\" | \"perFieldPrebuiltRulesDiffingEnabled\" | \"malwareOnWriteScanOptionAvailable\" | \"aiAssistantFlyoutMode\" | \"valueListItemsModalEnabled\" | \"bulkCustomHighlightedFieldsEnabled\" | undefined"
             ],
             "path": "x-pack/plugins/security_solution/public/common/links/types.ts",
             "deprecated": false,
@@ -1964,7 +1964,7 @@
           "label": "experimentalFeatures",
           "description": [],
           "signature": [
-            "{ readonly tGridEnabled: boolean; readonly tGridEventRenderedViewEnabled: boolean; readonly excludePoliciesInFilterEnabled: boolean; readonly kubernetesEnabled: boolean; readonly donutChartEmbeddablesEnabled: boolean; readonly previewTelemetryUrlEnabled: boolean; readonly insightsRelatedAlertsByProcessAncestry: boolean; readonly extendedRuleExecutionLoggingEnabled: boolean; readonly socTrendsEnabled: boolean; readonly responseActionsEnabled: boolean; readonly endpointResponseActionsEnabled: boolean; readonly responseActionUploadEnabled: boolean; readonly automatedProcessActionsEnabled: boolean; readonly responseActionsSentinelOneV1Enabled: boolean; readonly responseActionsSentinelOneV2Enabled: boolean; readonly responseActionsSentinelOneGetFileEnabled: boolean; readonly agentStatusClientEnabled: boolean; readonly responseActionsCrowdstrikeManualHostIsolationEnabled: boolean; readonly alertsPageChartsEnabled: boolean; readonly alertTypeEnabled: boolean; readonly expandableFlyoutInCreateRuleEnabled: boolean; readonly expandableEventFlyoutEnabled: boolean; readonly expandableTimelineFlyoutEnabled: boolean; readonly alertsPageFiltersEnabled: boolean; readonly attackDiscoveryEnabled: boolean; readonly assistantModelEvaluation: boolean; readonly newUserDetailsFlyout: boolean; readonly newUserDetailsFlyoutManagedUser: boolean; readonly newHostDetailsFlyout: boolean; readonly riskScoringPersistence: boolean; readonly riskScoringRoutesEnabled: boolean; readonly esqlRulesDisabled: boolean; readonly protectionUpdatesEnabled: boolean; readonly disableTimelineSaveTour: boolean; readonly riskEnginePrivilegesRouteEnabled: boolean; readonly sentinelOneDataInAnalyzerEnabled: boolean; readonly sentinelOneManualHostActionsEnabled: boolean; readonly crowdstrikeDataInAnalyzerEnabled: boolean; readonly jsonPrebuiltRulesDiffingEnabled: boolean; readonly timelineEsqlTabDisabled: boolean; readonly unifiedComponentsInTimelineEnabled: boolean; readonly analyzerDatePickersAndSourcererDisabled: boolean; readonly perFieldPrebuiltRulesDiffingEnabled: boolean; readonly malwareOnWriteScanOptionAvailable: boolean; readonly aiAssistantFlyoutMode: boolean; readonly valueListItemsModalEnabled: boolean; readonly bulkCustomHighlightedFieldsEnabled: boolean; }"
+            "{ readonly tGridEnabled: boolean; readonly tGridEventRenderedViewEnabled: boolean; readonly excludePoliciesInFilterEnabled: boolean; readonly kubernetesEnabled: boolean; readonly donutChartEmbeddablesEnabled: boolean; readonly previewTelemetryUrlEnabled: boolean; readonly insightsRelatedAlertsByProcessAncestry: boolean; readonly extendedRuleExecutionLoggingEnabled: boolean; readonly socTrendsEnabled: boolean; readonly responseActionsEnabled: boolean; readonly endpointResponseActionsEnabled: boolean; readonly responseActionUploadEnabled: boolean; readonly automatedProcessActionsEnabled: boolean; readonly responseActionsSentinelOneV1Enabled: boolean; readonly responseActionsSentinelOneV2Enabled: boolean; readonly responseActionsSentinelOneGetFileEnabled: boolean; readonly agentStatusClientEnabled: boolean; readonly responseActionsCrowdstrikeManualHostIsolationEnabled: boolean; readonly alertsPageChartsEnabled: boolean; readonly alertTypeEnabled: boolean; readonly expandableFlyoutInCreateRuleEnabled: boolean; readonly expandableEventFlyoutEnabled: boolean; readonly expandableTimelineFlyoutEnabled: boolean; readonly alertsPageFiltersEnabled: boolean; readonly assistantModelEvaluation: boolean; readonly newUserDetailsFlyout: boolean; readonly newUserDetailsFlyoutManagedUser: boolean; readonly newHostDetailsFlyout: boolean; readonly riskScoringPersistence: boolean; readonly riskScoringRoutesEnabled: boolean; readonly esqlRulesDisabled: boolean; readonly protectionUpdatesEnabled: boolean; readonly disableTimelineSaveTour: boolean; readonly riskEnginePrivilegesRouteEnabled: boolean; readonly sentinelOneDataInAnalyzerEnabled: boolean; readonly sentinelOneManualHostActionsEnabled: boolean; readonly crowdstrikeDataInAnalyzerEnabled: boolean; readonly jamfDataInAnalyzerEnabled: boolean; readonly jsonPrebuiltRulesDiffingEnabled: boolean; readonly timelineEsqlTabDisabled: boolean; readonly unifiedComponentsInTimelineEnabled: boolean; readonly analyzerDatePickersAndSourcererDisabled: boolean; readonly perFieldPrebuiltRulesDiffingEnabled: boolean; readonly malwareOnWriteScanOptionAvailable: boolean; readonly aiAssistantFlyoutMode: boolean; readonly valueListItemsModalEnabled: boolean; readonly bulkCustomHighlightedFieldsEnabled: boolean; }"
           ],
           "path": "x-pack/plugins/security_solution/public/types.ts",
           "deprecated": false,
@@ -3054,7 +3054,7 @@
             "\nThe security solution generic experimental features"
           ],
           "signature": [
-            "{ readonly tGridEnabled: boolean; readonly tGridEventRenderedViewEnabled: boolean; readonly excludePoliciesInFilterEnabled: boolean; readonly kubernetesEnabled: boolean; readonly donutChartEmbeddablesEnabled: boolean; readonly previewTelemetryUrlEnabled: boolean; readonly insightsRelatedAlertsByProcessAncestry: boolean; readonly extendedRuleExecutionLoggingEnabled: boolean; readonly socTrendsEnabled: boolean; readonly responseActionsEnabled: boolean; readonly endpointResponseActionsEnabled: boolean; readonly responseActionUploadEnabled: boolean; readonly automatedProcessActionsEnabled: boolean; readonly responseActionsSentinelOneV1Enabled: boolean; readonly responseActionsSentinelOneV2Enabled: boolean; readonly responseActionsSentinelOneGetFileEnabled: boolean; readonly agentStatusClientEnabled: boolean; readonly responseActionsCrowdstrikeManualHostIsolationEnabled: boolean; readonly alertsPageChartsEnabled: boolean; readonly alertTypeEnabled: boolean; readonly expandableFlyoutInCreateRuleEnabled: boolean; readonly expandableEventFlyoutEnabled: boolean; readonly expandableTimelineFlyoutEnabled: boolean; readonly alertsPageFiltersEnabled: boolean; readonly attackDiscoveryEnabled: boolean; readonly assistantModelEvaluation: boolean; readonly newUserDetailsFlyout: boolean; readonly newUserDetailsFlyoutManagedUser: boolean; readonly newHostDetailsFlyout: boolean; readonly riskScoringPersistence: boolean; readonly riskScoringRoutesEnabled: boolean; readonly esqlRulesDisabled: boolean; readonly protectionUpdatesEnabled: boolean; readonly disableTimelineSaveTour: boolean; readonly riskEnginePrivilegesRouteEnabled: boolean; readonly sentinelOneDataInAnalyzerEnabled: boolean; readonly sentinelOneManualHostActionsEnabled: boolean; readonly crowdstrikeDataInAnalyzerEnabled: boolean; readonly jsonPrebuiltRulesDiffingEnabled: boolean; readonly timelineEsqlTabDisabled: boolean; readonly unifiedComponentsInTimelineEnabled: boolean; readonly analyzerDatePickersAndSourcererDisabled: boolean; readonly perFieldPrebuiltRulesDiffingEnabled: boolean; readonly malwareOnWriteScanOptionAvailable: boolean; readonly aiAssistantFlyoutMode: boolean; readonly valueListItemsModalEnabled: boolean; readonly bulkCustomHighlightedFieldsEnabled: boolean; }"
+            "{ readonly tGridEnabled: boolean; readonly tGridEventRenderedViewEnabled: boolean; readonly excludePoliciesInFilterEnabled: boolean; readonly kubernetesEnabled: boolean; readonly donutChartEmbeddablesEnabled: boolean; readonly previewTelemetryUrlEnabled: boolean; readonly insightsRelatedAlertsByProcessAncestry: boolean; readonly extendedRuleExecutionLoggingEnabled: boolean; readonly socTrendsEnabled: boolean; readonly responseActionsEnabled: boolean; readonly endpointResponseActionsEnabled: boolean; readonly responseActionUploadEnabled: boolean; readonly automatedProcessActionsEnabled: boolean; readonly responseActionsSentinelOneV1Enabled: boolean; readonly responseActionsSentinelOneV2Enabled: boolean; readonly responseActionsSentinelOneGetFileEnabled: boolean; readonly agentStatusClientEnabled: boolean; readonly responseActionsCrowdstrikeManualHostIsolationEnabled: boolean; readonly alertsPageChartsEnabled: boolean; readonly alertTypeEnabled: boolean; readonly expandableFlyoutInCreateRuleEnabled: boolean; readonly expandableEventFlyoutEnabled: boolean; readonly expandableTimelineFlyoutEnabled: boolean; readonly alertsPageFiltersEnabled: boolean; readonly assistantModelEvaluation: boolean; readonly newUserDetailsFlyout: boolean; readonly newUserDetailsFlyoutManagedUser: boolean; readonly newHostDetailsFlyout: boolean; readonly riskScoringPersistence: boolean; readonly riskScoringRoutesEnabled: boolean; readonly esqlRulesDisabled: boolean; readonly protectionUpdatesEnabled: boolean; readonly disableTimelineSaveTour: boolean; readonly riskEnginePrivilegesRouteEnabled: boolean; readonly sentinelOneDataInAnalyzerEnabled: boolean; readonly sentinelOneManualHostActionsEnabled: boolean; readonly crowdstrikeDataInAnalyzerEnabled: boolean; readonly jamfDataInAnalyzerEnabled: boolean; readonly jsonPrebuiltRulesDiffingEnabled: boolean; readonly timelineEsqlTabDisabled: boolean; readonly unifiedComponentsInTimelineEnabled: boolean; readonly analyzerDatePickersAndSourcererDisabled: boolean; readonly perFieldPrebuiltRulesDiffingEnabled: boolean; readonly malwareOnWriteScanOptionAvailable: boolean; readonly aiAssistantFlyoutMode: boolean; readonly valueListItemsModalEnabled: boolean; readonly bulkCustomHighlightedFieldsEnabled: boolean; }"
           ],
           "path": "x-pack/plugins/security_solution/server/plugin_contract.ts",
           "deprecated": false,
@@ -3230,7 +3230,7 @@
         "label": "ExperimentalFeatures",
         "description": [],
         "signature": [
-          "{ readonly tGridEnabled: boolean; readonly tGridEventRenderedViewEnabled: boolean; readonly excludePoliciesInFilterEnabled: boolean; readonly kubernetesEnabled: boolean; readonly donutChartEmbeddablesEnabled: boolean; readonly previewTelemetryUrlEnabled: boolean; readonly insightsRelatedAlertsByProcessAncestry: boolean; readonly extendedRuleExecutionLoggingEnabled: boolean; readonly socTrendsEnabled: boolean; readonly responseActionsEnabled: boolean; readonly endpointResponseActionsEnabled: boolean; readonly responseActionUploadEnabled: boolean; readonly automatedProcessActionsEnabled: boolean; readonly responseActionsSentinelOneV1Enabled: boolean; readonly responseActionsSentinelOneV2Enabled: boolean; readonly responseActionsSentinelOneGetFileEnabled: boolean; readonly agentStatusClientEnabled: boolean; readonly responseActionsCrowdstrikeManualHostIsolationEnabled: boolean; readonly alertsPageChartsEnabled: boolean; readonly alertTypeEnabled: boolean; readonly expandableFlyoutInCreateRuleEnabled: boolean; readonly expandableEventFlyoutEnabled: boolean; readonly expandableTimelineFlyoutEnabled: boolean; readonly alertsPageFiltersEnabled: boolean; readonly attackDiscoveryEnabled: boolean; readonly assistantModelEvaluation: boolean; readonly newUserDetailsFlyout: boolean; readonly newUserDetailsFlyoutManagedUser: boolean; readonly newHostDetailsFlyout: boolean; readonly riskScoringPersistence: boolean; readonly riskScoringRoutesEnabled: boolean; readonly esqlRulesDisabled: boolean; readonly protectionUpdatesEnabled: boolean; readonly disableTimelineSaveTour: boolean; readonly riskEnginePrivilegesRouteEnabled: boolean; readonly sentinelOneDataInAnalyzerEnabled: boolean; readonly sentinelOneManualHostActionsEnabled: boolean; readonly crowdstrikeDataInAnalyzerEnabled: boolean; readonly jsonPrebuiltRulesDiffingEnabled: boolean; readonly timelineEsqlTabDisabled: boolean; readonly unifiedComponentsInTimelineEnabled: boolean; readonly analyzerDatePickersAndSourcererDisabled: boolean; readonly perFieldPrebuiltRulesDiffingEnabled: boolean; readonly malwareOnWriteScanOptionAvailable: boolean; readonly aiAssistantFlyoutMode: boolean; readonly valueListItemsModalEnabled: boolean; readonly bulkCustomHighlightedFieldsEnabled: boolean; }"
+          "{ readonly tGridEnabled: boolean; readonly tGridEventRenderedViewEnabled: boolean; readonly excludePoliciesInFilterEnabled: boolean; readonly kubernetesEnabled: boolean; readonly donutChartEmbeddablesEnabled: boolean; readonly previewTelemetryUrlEnabled: boolean; readonly insightsRelatedAlertsByProcessAncestry: boolean; readonly extendedRuleExecutionLoggingEnabled: boolean; readonly socTrendsEnabled: boolean; readonly responseActionsEnabled: boolean; readonly endpointResponseActionsEnabled: boolean; readonly responseActionUploadEnabled: boolean; readonly automatedProcessActionsEnabled: boolean; readonly responseActionsSentinelOneV1Enabled: boolean; readonly responseActionsSentinelOneV2Enabled: boolean; readonly responseActionsSentinelOneGetFileEnabled: boolean; readonly agentStatusClientEnabled: boolean; readonly responseActionsCrowdstrikeManualHostIsolationEnabled: boolean; readonly alertsPageChartsEnabled: boolean; readonly alertTypeEnabled: boolean; readonly expandableFlyoutInCreateRuleEnabled: boolean; readonly expandableEventFlyoutEnabled: boolean; readonly expandableTimelineFlyoutEnabled: boolean; readonly alertsPageFiltersEnabled: boolean; readonly assistantModelEvaluation: boolean; readonly newUserDetailsFlyout: boolean; readonly newUserDetailsFlyoutManagedUser: boolean; readonly newHostDetailsFlyout: boolean; readonly riskScoringPersistence: boolean; readonly riskScoringRoutesEnabled: boolean; readonly esqlRulesDisabled: boolean; readonly protectionUpdatesEnabled: boolean; readonly disableTimelineSaveTour: boolean; readonly riskEnginePrivilegesRouteEnabled: boolean; readonly sentinelOneDataInAnalyzerEnabled: boolean; readonly sentinelOneManualHostActionsEnabled: boolean; readonly crowdstrikeDataInAnalyzerEnabled: boolean; readonly jamfDataInAnalyzerEnabled: boolean; readonly jsonPrebuiltRulesDiffingEnabled: boolean; readonly timelineEsqlTabDisabled: boolean; readonly unifiedComponentsInTimelineEnabled: boolean; readonly analyzerDatePickersAndSourcererDisabled: boolean; readonly perFieldPrebuiltRulesDiffingEnabled: boolean; readonly malwareOnWriteScanOptionAvailable: boolean; readonly aiAssistantFlyoutMode: boolean; readonly valueListItemsModalEnabled: boolean; readonly bulkCustomHighlightedFieldsEnabled: boolean; }"
         ],
         "path": "x-pack/plugins/security_solution/common/experimental_features.ts",
         "deprecated": false,
@@ -3296,7 +3296,7 @@
           "\nA list of allowed values that can be used in `xpack.securitySolution.enableExperimental`.\nThis object is then used to validate and parse the value entered."
         ],
         "signature": [
-          "{ readonly tGridEnabled: true; readonly tGridEventRenderedViewEnabled: true; readonly excludePoliciesInFilterEnabled: false; readonly kubernetesEnabled: true; readonly donutChartEmbeddablesEnabled: false; readonly previewTelemetryUrlEnabled: false; readonly insightsRelatedAlertsByProcessAncestry: true; readonly extendedRuleExecutionLoggingEnabled: false; readonly socTrendsEnabled: false; readonly responseActionsEnabled: true; readonly endpointResponseActionsEnabled: true; readonly responseActionUploadEnabled: true; readonly automatedProcessActionsEnabled: true; readonly responseActionsSentinelOneV1Enabled: true; readonly responseActionsSentinelOneV2Enabled: false; readonly responseActionsSentinelOneGetFileEnabled: false; readonly agentStatusClientEnabled: false; readonly responseActionsCrowdstrikeManualHostIsolationEnabled: false; readonly alertsPageChartsEnabled: true; readonly alertTypeEnabled: false; readonly expandableFlyoutInCreateRuleEnabled: true; readonly expandableEventFlyoutEnabled: true; readonly expandableTimelineFlyoutEnabled: true; readonly alertsPageFiltersEnabled: true; readonly attackDiscoveryEnabled: false; readonly assistantModelEvaluation: false; readonly newUserDetailsFlyout: true; readonly newUserDetailsFlyoutManagedUser: false; readonly newHostDetailsFlyout: true; readonly riskScoringPersistence: true; readonly riskScoringRoutesEnabled: true; readonly esqlRulesDisabled: false; readonly protectionUpdatesEnabled: true; readonly disableTimelineSaveTour: false; readonly riskEnginePrivilegesRouteEnabled: true; readonly sentinelOneDataInAnalyzerEnabled: true; readonly sentinelOneManualHostActionsEnabled: true; readonly crowdstrikeDataInAnalyzerEnabled: false; readonly jsonPrebuiltRulesDiffingEnabled: true; readonly timelineEsqlTabDisabled: false; readonly unifiedComponentsInTimelineEnabled: false; readonly analyzerDatePickersAndSourcererDisabled: false; readonly perFieldPrebuiltRulesDiffingEnabled: true; readonly malwareOnWriteScanOptionAvailable: false; readonly aiAssistantFlyoutMode: false; readonly valueListItemsModalEnabled: true; readonly bulkCustomHighlightedFieldsEnabled: false; }"
+          "{ readonly tGridEnabled: true; readonly tGridEventRenderedViewEnabled: true; readonly excludePoliciesInFilterEnabled: false; readonly kubernetesEnabled: true; readonly donutChartEmbeddablesEnabled: false; readonly previewTelemetryUrlEnabled: false; readonly insightsRelatedAlertsByProcessAncestry: true; readonly extendedRuleExecutionLoggingEnabled: false; readonly socTrendsEnabled: false; readonly responseActionsEnabled: true; readonly endpointResponseActionsEnabled: true; readonly responseActionUploadEnabled: true; readonly automatedProcessActionsEnabled: true; readonly responseActionsSentinelOneV1Enabled: true; readonly responseActionsSentinelOneV2Enabled: false; readonly responseActionsSentinelOneGetFileEnabled: false; readonly agentStatusClientEnabled: false; readonly responseActionsCrowdstrikeManualHostIsolationEnabled: false; readonly alertsPageChartsEnabled: true; readonly alertTypeEnabled: false; readonly expandableFlyoutInCreateRuleEnabled: true; readonly expandableEventFlyoutEnabled: true; readonly expandableTimelineFlyoutEnabled: true; readonly alertsPageFiltersEnabled: true; readonly assistantModelEvaluation: false; readonly newUserDetailsFlyout: true; readonly newUserDetailsFlyoutManagedUser: false; readonly newHostDetailsFlyout: true; readonly riskScoringPersistence: true; readonly riskScoringRoutesEnabled: true; readonly esqlRulesDisabled: false; readonly protectionUpdatesEnabled: true; readonly disableTimelineSaveTour: false; readonly riskEnginePrivilegesRouteEnabled: true; readonly sentinelOneDataInAnalyzerEnabled: true; readonly sentinelOneManualHostActionsEnabled: true; readonly crowdstrikeDataInAnalyzerEnabled: false; readonly jamfDataInAnalyzerEnabled: false; readonly jsonPrebuiltRulesDiffingEnabled: true; readonly timelineEsqlTabDisabled: false; readonly unifiedComponentsInTimelineEnabled: false; readonly analyzerDatePickersAndSourcererDisabled: false; readonly perFieldPrebuiltRulesDiffingEnabled: true; readonly malwareOnWriteScanOptionAvailable: false; readonly aiAssistantFlyoutMode: true; readonly valueListItemsModalEnabled: true; readonly bulkCustomHighlightedFieldsEnabled: false; }"
         ],
         "path": "x-pack/plugins/security_solution/common/experimental_features.ts",
         "deprecated": false,
diff --git a/api_docs/security_solution.mdx b/api_docs/security_solution.mdx
index 08b96ce0a84298..c1fc0f48585a8b 100644
--- a/api_docs/security_solution.mdx
+++ b/api_docs/security_solution.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/securitySolution
 title: "securitySolution"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the securitySolution plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'securitySolution']
 ---
 import securitySolutionObj from './security_solution.devdocs.json';
diff --git a/api_docs/security_solution_ess.mdx b/api_docs/security_solution_ess.mdx
index f59da08d735380..f2614a47539bea 100644
--- a/api_docs/security_solution_ess.mdx
+++ b/api_docs/security_solution_ess.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/securitySolutionEss
 title: "securitySolutionEss"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the securitySolutionEss plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'securitySolutionEss']
 ---
 import securitySolutionEssObj from './security_solution_ess.devdocs.json';
diff --git a/api_docs/security_solution_serverless.mdx b/api_docs/security_solution_serverless.mdx
index c14277be9ef2d8..7ece8ee7922d8c 100644
--- a/api_docs/security_solution_serverless.mdx
+++ b/api_docs/security_solution_serverless.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/securitySolutionServerless
 title: "securitySolutionServerless"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the securitySolutionServerless plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'securitySolutionServerless']
 ---
 import securitySolutionServerlessObj from './security_solution_serverless.devdocs.json';
diff --git a/api_docs/serverless.mdx b/api_docs/serverless.mdx
index 0d34ac524e71d8..256fd9ccaa537b 100644
--- a/api_docs/serverless.mdx
+++ b/api_docs/serverless.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/serverless
 title: "serverless"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the serverless plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'serverless']
 ---
 import serverlessObj from './serverless.devdocs.json';
diff --git a/api_docs/serverless_observability.mdx b/api_docs/serverless_observability.mdx
index 7e488cd888441b..2a5a8127b1d2b7 100644
--- a/api_docs/serverless_observability.mdx
+++ b/api_docs/serverless_observability.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/serverlessObservability
 title: "serverlessObservability"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the serverlessObservability plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'serverlessObservability']
 ---
 import serverlessObservabilityObj from './serverless_observability.devdocs.json';
diff --git a/api_docs/serverless_search.mdx b/api_docs/serverless_search.mdx
index 0b4ca7fe945178..407febe6f0f504 100644
--- a/api_docs/serverless_search.mdx
+++ b/api_docs/serverless_search.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/serverlessSearch
 title: "serverlessSearch"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the serverlessSearch plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'serverlessSearch']
 ---
 import serverlessSearchObj from './serverless_search.devdocs.json';
diff --git a/api_docs/session_view.mdx b/api_docs/session_view.mdx
index a39633343914d3..5f854bb1d15c51 100644
--- a/api_docs/session_view.mdx
+++ b/api_docs/session_view.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/sessionView
 title: "sessionView"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the sessionView plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'sessionView']
 ---
 import sessionViewObj from './session_view.devdocs.json';
diff --git a/api_docs/share.mdx b/api_docs/share.mdx
index 8e7cd6bc73892a..ac098296f17a89 100644
--- a/api_docs/share.mdx
+++ b/api_docs/share.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/share
 title: "share"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the share plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'share']
 ---
 import shareObj from './share.devdocs.json';
diff --git a/api_docs/slo.mdx b/api_docs/slo.mdx
index b9af365750fff2..b84afcc46b00ff 100644
--- a/api_docs/slo.mdx
+++ b/api_docs/slo.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/slo
 title: "slo"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the slo plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'slo']
 ---
 import sloObj from './slo.devdocs.json';
diff --git a/api_docs/snapshot_restore.mdx b/api_docs/snapshot_restore.mdx
index 1a198ffddd57fd..17a0b57cc8fb31 100644
--- a/api_docs/snapshot_restore.mdx
+++ b/api_docs/snapshot_restore.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/snapshotRestore
 title: "snapshotRestore"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the snapshotRestore plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'snapshotRestore']
 ---
 import snapshotRestoreObj from './snapshot_restore.devdocs.json';
diff --git a/api_docs/spaces.mdx b/api_docs/spaces.mdx
index dc4ccd6b61d7da..f150fb542521e0 100644
--- a/api_docs/spaces.mdx
+++ b/api_docs/spaces.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/spaces
 title: "spaces"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the spaces plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'spaces']
 ---
 import spacesObj from './spaces.devdocs.json';
diff --git a/api_docs/stack_alerts.mdx b/api_docs/stack_alerts.mdx
index 398c602108f666..1b8553b6135b82 100644
--- a/api_docs/stack_alerts.mdx
+++ b/api_docs/stack_alerts.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/stackAlerts
 title: "stackAlerts"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the stackAlerts plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'stackAlerts']
 ---
 import stackAlertsObj from './stack_alerts.devdocs.json';
diff --git a/api_docs/stack_connectors.mdx b/api_docs/stack_connectors.mdx
index b780bc73f80368..aeb0401903b201 100644
--- a/api_docs/stack_connectors.mdx
+++ b/api_docs/stack_connectors.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/stackConnectors
 title: "stackConnectors"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the stackConnectors plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'stackConnectors']
 ---
 import stackConnectorsObj from './stack_connectors.devdocs.json';
diff --git a/api_docs/task_manager.mdx b/api_docs/task_manager.mdx
index 2fc876ce182681..4cfcb50844fb5b 100644
--- a/api_docs/task_manager.mdx
+++ b/api_docs/task_manager.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/taskManager
 title: "taskManager"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the taskManager plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'taskManager']
 ---
 import taskManagerObj from './task_manager.devdocs.json';
diff --git a/api_docs/telemetry.mdx b/api_docs/telemetry.mdx
index e32b438a32f33d..0e27a41139dc28 100644
--- a/api_docs/telemetry.mdx
+++ b/api_docs/telemetry.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/telemetry
 title: "telemetry"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the telemetry plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'telemetry']
 ---
 import telemetryObj from './telemetry.devdocs.json';
diff --git a/api_docs/telemetry_collection_manager.mdx b/api_docs/telemetry_collection_manager.mdx
index 5bb462f5ee0620..fc11bad1d2d4ad 100644
--- a/api_docs/telemetry_collection_manager.mdx
+++ b/api_docs/telemetry_collection_manager.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/telemetryCollectionManager
 title: "telemetryCollectionManager"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the telemetryCollectionManager plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'telemetryCollectionManager']
 ---
 import telemetryCollectionManagerObj from './telemetry_collection_manager.devdocs.json';
diff --git a/api_docs/telemetry_collection_xpack.mdx b/api_docs/telemetry_collection_xpack.mdx
index d5c1bf80a808d3..160547b4deadb7 100644
--- a/api_docs/telemetry_collection_xpack.mdx
+++ b/api_docs/telemetry_collection_xpack.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/telemetryCollectionXpack
 title: "telemetryCollectionXpack"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the telemetryCollectionXpack plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'telemetryCollectionXpack']
 ---
 import telemetryCollectionXpackObj from './telemetry_collection_xpack.devdocs.json';
diff --git a/api_docs/telemetry_management_section.mdx b/api_docs/telemetry_management_section.mdx
index 1f5d2e06093756..a9265f2dc5306a 100644
--- a/api_docs/telemetry_management_section.mdx
+++ b/api_docs/telemetry_management_section.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/telemetryManagementSection
 title: "telemetryManagementSection"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the telemetryManagementSection plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'telemetryManagementSection']
 ---
 import telemetryManagementSectionObj from './telemetry_management_section.devdocs.json';
diff --git a/api_docs/text_based_languages.mdx b/api_docs/text_based_languages.mdx
index df475489c6d1d6..a6bc1ae899518c 100644
--- a/api_docs/text_based_languages.mdx
+++ b/api_docs/text_based_languages.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/textBasedLanguages
 title: "textBasedLanguages"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the textBasedLanguages plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'textBasedLanguages']
 ---
 import textBasedLanguagesObj from './text_based_languages.devdocs.json';
diff --git a/api_docs/threat_intelligence.mdx b/api_docs/threat_intelligence.mdx
index cacc0d9cbd9064..854a7d311d365b 100644
--- a/api_docs/threat_intelligence.mdx
+++ b/api_docs/threat_intelligence.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/threatIntelligence
 title: "threatIntelligence"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the threatIntelligence plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'threatIntelligence']
 ---
 import threatIntelligenceObj from './threat_intelligence.devdocs.json';
diff --git a/api_docs/timelines.devdocs.json b/api_docs/timelines.devdocs.json
index c4025785898db7..c321be514a5b63 100644
--- a/api_docs/timelines.devdocs.json
+++ b/api_docs/timelines.devdocs.json
@@ -1217,7 +1217,9 @@
           "parentPluginId": "timelines",
           "id": "def-public.TimelinesUIStart.getHoverActions",
           "type": "Function",
-          "tags": [],
+          "tags": [
+            "deprecated"
+          ],
           "label": "getHoverActions",
           "description": [],
           "signature": [
@@ -1225,8 +1227,34 @@
             "HoverActionsConfig"
           ],
           "path": "x-pack/plugins/timelines/public/types.ts",
-          "deprecated": false,
+          "deprecated": true,
           "trackAdoption": false,
+          "references": [
+            {
+              "plugin": "kubernetesSecurity",
+              "path": "x-pack/plugins/kubernetes_security/public/hooks/use_filter.ts"
+            },
+            {
+              "plugin": "osquery",
+              "path": "x-pack/plugins/osquery/public/timelines/add_to_timeline_button.tsx"
+            },
+            {
+              "plugin": "threatIntelligence",
+              "path": "x-pack/plugins/threat_intelligence/public/modules/timeline/components/add_to_timeline.tsx"
+            },
+            {
+              "plugin": "threatIntelligence",
+              "path": "x-pack/plugins/threat_intelligence/public/modules/timeline/components/add_to_timeline.tsx"
+            },
+            {
+              "plugin": "threatIntelligence",
+              "path": "x-pack/plugins/threat_intelligence/public/modules/timeline/components/add_to_timeline.tsx"
+            },
+            {
+              "plugin": "threatIntelligence",
+              "path": "x-pack/plugins/threat_intelligence/public/modules/timeline/components/add_to_timeline.tsx"
+            }
+          ],
           "children": [],
           "returnComment": []
         },
diff --git a/api_docs/timelines.mdx b/api_docs/timelines.mdx
index 329a5f23bb0f58..d5e9a9fff3ad60 100644
--- a/api_docs/timelines.mdx
+++ b/api_docs/timelines.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/timelines
 title: "timelines"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the timelines plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'timelines']
 ---
 import timelinesObj from './timelines.devdocs.json';
diff --git a/api_docs/transform.mdx b/api_docs/transform.mdx
index e3aa5f939d5a61..bf8448fc6f7022 100644
--- a/api_docs/transform.mdx
+++ b/api_docs/transform.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/transform
 title: "transform"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the transform plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'transform']
 ---
 import transformObj from './transform.devdocs.json';
diff --git a/api_docs/triggers_actions_ui.mdx b/api_docs/triggers_actions_ui.mdx
index 848f94d5674f49..7fc93c65cb3ef4 100644
--- a/api_docs/triggers_actions_ui.mdx
+++ b/api_docs/triggers_actions_ui.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/triggersActionsUi
 title: "triggersActionsUi"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the triggersActionsUi plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'triggersActionsUi']
 ---
 import triggersActionsUiObj from './triggers_actions_ui.devdocs.json';
diff --git a/api_docs/ui_actions.mdx b/api_docs/ui_actions.mdx
index ecd4e86a802935..45286fa1674520 100644
--- a/api_docs/ui_actions.mdx
+++ b/api_docs/ui_actions.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/uiActions
 title: "uiActions"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the uiActions plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'uiActions']
 ---
 import uiActionsObj from './ui_actions.devdocs.json';
diff --git a/api_docs/ui_actions_enhanced.mdx b/api_docs/ui_actions_enhanced.mdx
index f740435d1095d6..b66613276fb755 100644
--- a/api_docs/ui_actions_enhanced.mdx
+++ b/api_docs/ui_actions_enhanced.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/uiActionsEnhanced
 title: "uiActionsEnhanced"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the uiActionsEnhanced plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'uiActionsEnhanced']
 ---
 import uiActionsEnhancedObj from './ui_actions_enhanced.devdocs.json';
diff --git a/api_docs/unified_doc_viewer.mdx b/api_docs/unified_doc_viewer.mdx
index fc7852338b7144..b4ce3eacfc7f1e 100644
--- a/api_docs/unified_doc_viewer.mdx
+++ b/api_docs/unified_doc_viewer.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/unifiedDocViewer
 title: "unifiedDocViewer"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the unifiedDocViewer plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'unifiedDocViewer']
 ---
 import unifiedDocViewerObj from './unified_doc_viewer.devdocs.json';
diff --git a/api_docs/unified_histogram.devdocs.json b/api_docs/unified_histogram.devdocs.json
index ea83b62c3c8ce7..0518cdf17da56e 100644
--- a/api_docs/unified_histogram.devdocs.json
+++ b/api_docs/unified_histogram.devdocs.json
@@ -614,7 +614,7 @@
           },
           ") => void) | undefined; } & Pick<",
           "UnifiedHistogramLayoutProps",
-          ", \"className\" | \"children\" | \"query\" | \"filters\" | \"columns\" | \"container\" | \"onBrushEnd\" | \"disabledActions\" | \"timeRange\" | \"table\" | \"services\" | \"dataView\" | \"relativeTimeRange\" | \"renderCustomChartToggleActions\" | \"onFilter\" | \"externalVisContext\" | \"withDefaultActions\" | \"abortController\"> & ",
+          ", \"className\" | \"children\" | \"query\" | \"filters\" | \"columns\" | \"container\" | \"onBrushEnd\" | \"disabledActions\" | \"timeRange\" | \"dataView\" | \"table\" | \"services\" | \"relativeTimeRange\" | \"renderCustomChartToggleActions\" | \"onFilter\" | \"externalVisContext\" | \"withDefaultActions\" | \"abortController\"> & ",
           {
             "pluginId": "@kbn/shared-ux-utility",
             "scope": "common",
@@ -1615,7 +1615,7 @@
           },
           ") => void) | undefined; } & Pick<",
           "UnifiedHistogramLayoutProps",
-          ", \"className\" | \"children\" | \"query\" | \"filters\" | \"columns\" | \"container\" | \"onBrushEnd\" | \"disabledActions\" | \"timeRange\" | \"table\" | \"services\" | \"dataView\" | \"relativeTimeRange\" | \"renderCustomChartToggleActions\" | \"onFilter\" | \"externalVisContext\" | \"withDefaultActions\" | \"abortController\">"
+          ", \"className\" | \"children\" | \"query\" | \"filters\" | \"columns\" | \"container\" | \"onBrushEnd\" | \"disabledActions\" | \"timeRange\" | \"dataView\" | \"table\" | \"services\" | \"relativeTimeRange\" | \"renderCustomChartToggleActions\" | \"onFilter\" | \"externalVisContext\" | \"withDefaultActions\" | \"abortController\">"
         ],
         "path": "src/plugins/unified_histogram/public/container/container.tsx",
         "deprecated": false,
diff --git a/api_docs/unified_histogram.mdx b/api_docs/unified_histogram.mdx
index 98a006a8491e8b..01840c4110822a 100644
--- a/api_docs/unified_histogram.mdx
+++ b/api_docs/unified_histogram.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/unifiedHistogram
 title: "unifiedHistogram"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the unifiedHistogram plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'unifiedHistogram']
 ---
 import unifiedHistogramObj from './unified_histogram.devdocs.json';
diff --git a/api_docs/unified_search.mdx b/api_docs/unified_search.mdx
index 8e3fe86d3c0606..9de85d772e0867 100644
--- a/api_docs/unified_search.mdx
+++ b/api_docs/unified_search.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/unifiedSearch
 title: "unifiedSearch"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the unifiedSearch plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'unifiedSearch']
 ---
 import unifiedSearchObj from './unified_search.devdocs.json';
diff --git a/api_docs/unified_search_autocomplete.mdx b/api_docs/unified_search_autocomplete.mdx
index a183f9d9552519..42a97ae3092136 100644
--- a/api_docs/unified_search_autocomplete.mdx
+++ b/api_docs/unified_search_autocomplete.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/unifiedSearch-autocomplete
 title: "unifiedSearch.autocomplete"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the unifiedSearch.autocomplete plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'unifiedSearch.autocomplete']
 ---
 import unifiedSearchAutocompleteObj from './unified_search_autocomplete.devdocs.json';
diff --git a/api_docs/uptime.mdx b/api_docs/uptime.mdx
index a72811ee6f272f..81606baa95d8db 100644
--- a/api_docs/uptime.mdx
+++ b/api_docs/uptime.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/uptime
 title: "uptime"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the uptime plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'uptime']
 ---
 import uptimeObj from './uptime.devdocs.json';
diff --git a/api_docs/url_forwarding.mdx b/api_docs/url_forwarding.mdx
index 53bd29a071eb0d..29790e12d14d26 100644
--- a/api_docs/url_forwarding.mdx
+++ b/api_docs/url_forwarding.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/urlForwarding
 title: "urlForwarding"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the urlForwarding plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'urlForwarding']
 ---
 import urlForwardingObj from './url_forwarding.devdocs.json';
diff --git a/api_docs/usage_collection.mdx b/api_docs/usage_collection.mdx
index 0ba7760f02d7b8..0b0f006322603c 100644
--- a/api_docs/usage_collection.mdx
+++ b/api_docs/usage_collection.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/usageCollection
 title: "usageCollection"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the usageCollection plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'usageCollection']
 ---
 import usageCollectionObj from './usage_collection.devdocs.json';
diff --git a/api_docs/ux.mdx b/api_docs/ux.mdx
index 6a6471e55881ba..d9025021b3532f 100644
--- a/api_docs/ux.mdx
+++ b/api_docs/ux.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/ux
 title: "ux"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the ux plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'ux']
 ---
 import uxObj from './ux.devdocs.json';
diff --git a/api_docs/vis_default_editor.mdx b/api_docs/vis_default_editor.mdx
index 38a57a2cda4ebb..c137686396d672 100644
--- a/api_docs/vis_default_editor.mdx
+++ b/api_docs/vis_default_editor.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visDefaultEditor
 title: "visDefaultEditor"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visDefaultEditor plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visDefaultEditor']
 ---
 import visDefaultEditorObj from './vis_default_editor.devdocs.json';
diff --git a/api_docs/vis_type_gauge.mdx b/api_docs/vis_type_gauge.mdx
index f913b1c15e04ef..e4865fecc70766 100644
--- a/api_docs/vis_type_gauge.mdx
+++ b/api_docs/vis_type_gauge.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeGauge
 title: "visTypeGauge"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypeGauge plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeGauge']
 ---
 import visTypeGaugeObj from './vis_type_gauge.devdocs.json';
diff --git a/api_docs/vis_type_heatmap.mdx b/api_docs/vis_type_heatmap.mdx
index 6dc7562445401f..4a15a02a18bb40 100644
--- a/api_docs/vis_type_heatmap.mdx
+++ b/api_docs/vis_type_heatmap.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeHeatmap
 title: "visTypeHeatmap"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypeHeatmap plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeHeatmap']
 ---
 import visTypeHeatmapObj from './vis_type_heatmap.devdocs.json';
diff --git a/api_docs/vis_type_pie.mdx b/api_docs/vis_type_pie.mdx
index 04c1f0360d9171..2be5efe7e9e464 100644
--- a/api_docs/vis_type_pie.mdx
+++ b/api_docs/vis_type_pie.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypePie
 title: "visTypePie"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypePie plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypePie']
 ---
 import visTypePieObj from './vis_type_pie.devdocs.json';
diff --git a/api_docs/vis_type_table.mdx b/api_docs/vis_type_table.mdx
index 7ed5f1478f808c..9efcff25e56ecb 100644
--- a/api_docs/vis_type_table.mdx
+++ b/api_docs/vis_type_table.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeTable
 title: "visTypeTable"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypeTable plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeTable']
 ---
 import visTypeTableObj from './vis_type_table.devdocs.json';
diff --git a/api_docs/vis_type_timelion.mdx b/api_docs/vis_type_timelion.mdx
index 6be95d98066412..c2fc2317aee1d8 100644
--- a/api_docs/vis_type_timelion.mdx
+++ b/api_docs/vis_type_timelion.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeTimelion
 title: "visTypeTimelion"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypeTimelion plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeTimelion']
 ---
 import visTypeTimelionObj from './vis_type_timelion.devdocs.json';
diff --git a/api_docs/vis_type_timeseries.mdx b/api_docs/vis_type_timeseries.mdx
index 1649e43a3ae9b9..ed48387a78f4e4 100644
--- a/api_docs/vis_type_timeseries.mdx
+++ b/api_docs/vis_type_timeseries.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeTimeseries
 title: "visTypeTimeseries"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypeTimeseries plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeTimeseries']
 ---
 import visTypeTimeseriesObj from './vis_type_timeseries.devdocs.json';
diff --git a/api_docs/vis_type_vega.mdx b/api_docs/vis_type_vega.mdx
index a3dc522271ef70..279fbb58215b42 100644
--- a/api_docs/vis_type_vega.mdx
+++ b/api_docs/vis_type_vega.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeVega
 title: "visTypeVega"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypeVega plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeVega']
 ---
 import visTypeVegaObj from './vis_type_vega.devdocs.json';
diff --git a/api_docs/vis_type_vislib.mdx b/api_docs/vis_type_vislib.mdx
index 4416a05f81b202..bebf6bfef5ac01 100644
--- a/api_docs/vis_type_vislib.mdx
+++ b/api_docs/vis_type_vislib.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeVislib
 title: "visTypeVislib"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypeVislib plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeVislib']
 ---
 import visTypeVislibObj from './vis_type_vislib.devdocs.json';
diff --git a/api_docs/vis_type_xy.mdx b/api_docs/vis_type_xy.mdx
index e09fee372091f3..20e9fac3cf7767 100644
--- a/api_docs/vis_type_xy.mdx
+++ b/api_docs/vis_type_xy.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeXy
 title: "visTypeXy"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypeXy plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeXy']
 ---
 import visTypeXyObj from './vis_type_xy.devdocs.json';
diff --git a/api_docs/visualizations.mdx b/api_docs/visualizations.mdx
index 2ca1fc860febee..50737811a2616a 100644
--- a/api_docs/visualizations.mdx
+++ b/api_docs/visualizations.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visualizations
 title: "visualizations"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visualizations plugin
-date: 2024-05-07
+date: 2024-05-13
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visualizations']
 ---
 import visualizationsObj from './visualizations.devdocs.json';
diff --git a/config/serverless.es.yml b/config/serverless.es.yml
index c7d5044ac2c2c3..ed71ce0d7819ce 100644
--- a/config/serverless.es.yml
+++ b/config/serverless.es.yml
@@ -47,3 +47,6 @@ data_visualizer.resultLinks.fileBeat.enabled: false
 
 # Search Playground
 xpack.searchPlayground.ui.enabled: true
+
+# Search Notebooks
+xpack.search.notebooks.catalog.url: https://elastic-enterprise-search.s3.us-east-2.amazonaws.com/serverless/catalog.json
diff --git a/dev_docs/key_concepts/embeddables.mdx b/dev_docs/key_concepts/embeddables.mdx
index e42233a7f3f26e..eb27dfbd5745d4 100644
--- a/dev_docs/key_concepts/embeddables.mdx
+++ b/dev_docs/key_concepts/embeddables.mdx
@@ -2,51 +2,10 @@
 id: kibDevDocsEmbeddables
 slug: /kibana-dev-docs/key-concepts/embeddables
 title: Embeddables
-description: Embeddables provide a way to expose a reusable widget.
-date: 2022-07-27
+description: Documentation and examples.
+date: 2024-05-09
 tags: ['kibana', 'dev', 'contributor', 'api docs']
 ---
 
-The Embeddables Plugin provides an opportunity to expose reusable interactive widgets that can be embedded outside the original plugin.
-
-If you are planning to integrate with the plugin, please get in touch with the App Services team to get to know all the limitations.
-
-## Capabilities
-- Framework-agnostic API.
-- Out-of-the-box React support.
-- Integration with Redux.
-- Integration with the [UI Actions](https://github.com/elastic/kibana/tree/HEAD/src/plugins/ui_actions) plugin.
-- Hierarchical structure to enclose multiple widgets.
-- Error handling.
-
-## Key Concepts
-### Embeddable
-Embeddable is a re-usable widget that can be rendered on a dashboard as well as in other applications.
-Developers are free to embed them directly in their plugins.
-End users can dynamically select an embeddable to add to a _container_.
-Dashboard container powers the grid of panels on the Dashboard app.
-
-### Container
-Container is a special type of embeddable that can hold other embeddable items.
-Embeddables can be added dynamically to the containers, but that should be implemented on the end plugin side.
-Currently, the dashboard plugin provides such functionality.
-
-### Input
-Every embeddable has an input which is a serializable set of data.
-This data can be used to update the state of the embeddable widget.
-The input can be updated later so that the embeddable should be capable of reacting to those changes.
-
-### Output
-Every embeddable may expose some data to the external interface.
-Usually, it is diverged from the input and not necessarily serializable.
-Output data can also be updated, but that should always be done inside the embeddable.
-
-## Documentation
-<DocCallOut>
-  Check the plugin documentation [here](https://github.com/elastic/kibana/tree/HEAD/src/plugins/embeddable) to get to know all the capabilities better.
-</DocCallOut>
-
-## API
-<DocCallOut>
-  Check the complete API reference <DocLink id="kibEmbeddablePluginApi" text="here" />.
-</DocCallOut>
+Embeddable documentation and examples are bundled with Kibana and accessable by running `yarn start --run-examples`.
+Navigate to `http://localhost:5601/app/embeddablesApp`.
diff --git a/docs/CHANGELOG.asciidoc b/docs/CHANGELOG.asciidoc
index e821cb98f4fd00..09b083b7213b21 100644
--- a/docs/CHANGELOG.asciidoc
+++ b/docs/CHANGELOG.asciidoc
@@ -10,6 +10,7 @@
 
 Review important information about the {kib} 8.x releases.
 
+* <<release-notes-8.13.4>>
 * <<release-notes-8.13.3>>
 * <<release-notes-8.13.2>>
 * <<release-notes-8.13.1>>
@@ -65,6 +66,19 @@ Review important information about the {kib} 8.x releases.
 
 --
 
+[[release-notes-8.13.4]]
+== {kib} 8.13.4
+
+The 8.13.4 release includes the following bug fixes.
+
+[float]
+[[fixes-v8.13.4]]
+=== Bug Fixes
+Lens & Visualizations::
+* Fixes table sorting when changing the interval on the time picker in *Lens* ({kibana-pull}182173[#182173]).
+Dashboards::
+* Fixes a bug with drilldowns where the control group on a source dashboard could be replaced by the control group from the destination dashboard ({kibana-pull}179485[#179485]).
+
 [[release-notes-8.13.3]]
 == {kib} 8.13.3
 
diff --git a/docs/api/role-management/put.asciidoc b/docs/api/role-management/put.asciidoc
index 50612760782954..ce293f75b63ae9 100644
--- a/docs/api/role-management/put.asciidoc
+++ b/docs/api/role-management/put.asciidoc
@@ -26,7 +26,7 @@ To use the create or update role API, you must have the `manage_security` cluste
 
 `elasticsearch`::
   (Optional, object) {es} cluster and index privileges. Valid keys include
-  `cluster`, `indices`, `remote_indices`, and `run_as`. For more information, see
+  `cluster`, `indices`, `remote_indices`, `remote_cluster`, and `run_as`. For more information, see
   {ref}/defining-roles.html[Defining roles].
 
 `kibana`::
@@ -210,6 +210,12 @@ $ curl -X PUT api/security/role/my_kibana_role
         "names": [ "remote_index1", "remote_index2" ],
         "privileges": [ "all" ]
       }
+    ],
+    "remote_cluster": [
+      {
+        "clusters": [ "remote_cluster1" ],
+        "privileges": [ "monitor_enrich" ]
+      }
     ]
   },
   "kibana": [
diff --git a/docs/developer/plugin-list.asciidoc b/docs/developer/plugin-list.asciidoc
index b5a11cf016bc72..6aea45cfe68c32 100644
--- a/docs/developer/plugin-list.asciidoc
+++ b/docs/developer/plugin-list.asciidoc
@@ -99,7 +99,8 @@ This API doesn't support angular, for registering angular dev tools, bootstrap a
 
 
 |{kib-repo}blob/{branch}/src/plugins/embeddable/README.md[embeddable]
-|The Embeddables Plugin provides an opportunity to expose reusable interactive widgets that can be embedded outside the original plugin.
+|Embeddable documentation and examples are bundled with Kibana and accessable by running yarn start --run-examples.
+Navigate to http://localhost:5601/app/embeddablesApp.
 
 
 |{kib-repo}blob/{branch}/src/plugins/es_ui_shared/README.md[esUiShared]
@@ -651,6 +652,10 @@ the infrastructure monitoring use-case within Kibana.
 using the CURL scripts in the scripts folder.
 
 
+|{kib-repo}blob/{branch}/x-pack/plugins/observability_solution/logs_data_access/README.md[logsDataAccess]
+|Exposes services to access logs data.
+
+
 |{kib-repo}blob/{branch}/x-pack/plugins/observability_solution/logs_explorer/README.md[logsExplorer]
 |This plugin is home to the <LogsExplorer /> component and related types. It implements several of the underlying concepts that the Observability Logs Explorer app builds upon.
 
diff --git a/docs/playground/images/chat-interface.png b/docs/playground/images/chat-interface.png
new file mode 100644
index 00000000000000..8f13fba59666ec
Binary files /dev/null and b/docs/playground/images/chat-interface.png differ
diff --git a/docs/playground/images/edit-query.png b/docs/playground/images/edit-query.png
new file mode 100644
index 00000000000000..a1122dbf9ba6ae
Binary files /dev/null and b/docs/playground/images/edit-query.png differ
diff --git a/docs/playground/images/select-indices.png b/docs/playground/images/select-indices.png
new file mode 100644
index 00000000000000..9fe455bdb0be2a
Binary files /dev/null and b/docs/playground/images/select-indices.png differ
diff --git a/docs/playground/index.asciidoc b/docs/playground/index.asciidoc
new file mode 100644
index 00000000000000..fe0aaea05a3056
--- /dev/null
+++ b/docs/playground/index.asciidoc
@@ -0,0 +1,203 @@
+[role="xpack"]
+[[playground]]
+= Playground
+
+preview::[]
+
+// Variable (attribute) definition 
+:x:                    Playground 
+
+Use {x} to combine your Elasticsearch data with the power of large language models (LLMs) for retrieval augmented generation (RAG).
+The chat interface translates your natural language questions into {es} queries, retrieves the most relevant results from your {es} documents, and passes those documents to the LLM to generate tailored responses.
+
+Once you start chatting, use the UI to view and modify the Elasticsearch queries that search your data.
+You can also view the underlying Python code that powers the chat interface, and download this code to integrate into your own application.
+
+Learn how to get started on this page.
+Refer to the following for more advanced topics:
+
+* <<playground-context>>
+* <<playground-query>>
+* <<playground-troubleshooting>> 
+
+[float]
+[[playground-how-it-works]]
+== How {x} works
+
+Here's a simpified overview of how {x} works:
+
+* User *creates a connection* to LLM provider
+* User *selects a model* to use for generating responses
+* User *define the model's behavior and tone* with initial instructions
+** *Example*: "_You are a friendly assistant for question-answering tasks. Keep responses as clear and concise as possible._"
+* User *selects {es} indices* to search
+* User *enters a question* in the chat interface
+* {x} *autogenerates an {es} query* to retrieve relevant documents
+** User can *view and modify underlying {es} query* in the UI
+* {x} *auto-selects relevant fields* from retrieved documents to pass to the LLM
+** User can *edit fields targeted*
+* {x} passes *filtered documents* to the LLM
+** The LLM generates a response based on the original query, initial instructions, chat history, and {es} context
+* User can *view the Python code* that powers the chat interface
+** User can also *Download the code* to integrate into application
+
+[float]
+[[playground-availability-prerequisites]]
+== Availability and prerequisites
+
+For Elastic Cloud and self-managed deployments {x} is available in the *Search* space in {kib}, under *Content* > *{x}*.
+
+For Elastic Serverless, {x} is available in your {es} project UI.
+// TODO: Confirm URL path for Serverless
+
+To use {x}, you'll need the following:
+
+1. An Elastic *v8.14.0+* deployment or {es} *Serverless* project. (Start a https://cloud.elastic.co/registration[free trial]).
+2. At least one *{es} index* with documents to search.
+** See <<playground-getting-started-ingest, ingest data>> if you'd like to ingest sample data.
+3. An account with a *supported LLM provider*. {x} supports the following:
++
+[cols="2a,2a,1a", options="header"]
+|===
+| Provider | Models | Notes
+
+| *Amazon Bedrock*
+a|
+* Anthropic: Claude 3 Sonnet
+* Anthropic: Claude 3 Haiku
+a|
+Does not currently support streaming.
+
+| *OpenAI*
+a|
+* GPT-3 turbo
+* GPT-4 turbo
+a|
+
+| *Azure OpenAI*
+a|
+* GPT-3 turbo
+* GPT-4 turbo
+a|
+
+|===
+
+[float]
+[[playground-getting-started]]
+== Getting started
+
+[float]
+[[playground-getting-started-connect]]
+=== Connect to LLM provider
+
+To get started with {x}, you need to create a <<action-types,connector>> for your LLM provider.
+Follow these steps on the {x} landing page:
+
+. Under *Connect to LLM*, click *Create connector*.
+. Select your *LLM provider*.
+. *Name* your connector.
+. Select a *URL endpoint* (or use the default).
+. Enter *access credentials* for your LLM provider.
+
+[TIP]
+====
+If you need to update a connector, or add a new one, click the wrench button (🔧) under *Model settings*.
+====
+
+[float]
+[[playground-getting-started-ingest]]
+=== Ingest data (optional)
+
+_You can skip this step if you already have data in one or more {es} indices._
+
+There are many options for ingesting data into {es}, including:
+
+* The {enterprise-search-ref}/crawler.html[Elastic crawler] for web content (*NOTE*: Not yet available in _Serverless_)
+* {enterprise-search-ref}/connectors.html[Elastic connectors] for data synced from third-party sources
+* The {es} {ref}/docs-bulk.html[Bulk API] for JSON documents
++
+.*Expand* for example
+[%collapsible]
+==============
+To add a few documents to an index called `books` run the following in Dev Tools Console:
+
+[source,console]
+----
+POST /_bulk
+{ "index" : { "_index" : "books" } }
+{"name": "Snow Crash", "author": "Neal Stephenson", "release_date": "1992-06-01", "page_count": 470}
+{ "index" : { "_index" : "books" } }
+{"name": "Revelation Space", "author": "Alastair Reynolds", "release_date": "2000-03-15", "page_count": 585}
+{ "index" : { "_index" : "books" } }
+{"name": "1984", "author": "George Orwell", "release_date": "1985-06-01", "page_count": 328}
+{ "index" : { "_index" : "books" } }
+{"name": "Fahrenheit 451", "author": "Ray Bradbury", "release_date": "1953-10-15", "page_count": 227}
+{ "index" : { "_index" : "books" } }
+{"name": "Brave New World", "author": "Aldous Huxley", "release_date": "1932-06-01", "page_count": 268}
+{ "index" : { "_index" : "books" } }
+{"name": "The Handmaids Tale", "author": "Margaret Atwood", "release_date": "1985-06-01", "page_count": 311}
+----
+==============
+
+We've also provided some Jupyter notebooks to easily ingest sample data into {es}. 
+Find these in the https://github.com/elastic/elasticsearch-labs/blob/main/notebooks/ingestion-and-chunking[elasticsearch-labs] repository.
+These notebooks use the official {es} Python client.
+// TODO: [The above link will be broken until https://github.com/elastic/elasticsearch-labs/pull/232 is merged]
+
+[float]
+[[playground-getting-started-index]]
+=== Select {es} indices
+
+Once you've connected to your LLM provider, it's time to choose the data you want to search.
+Follow the steps under *Select indices*:
+
+. Select one or more {es} indices under *Add index*.
+. Click *Start* to launch the chat interface.
++
+[.screenshot]
+image::select-indices.png[width=400]
+
+Learn more about the underlying {es} queries used to search your data in <<playground-query>>.
+
+[float]
+[[playground-getting-started-setup-chat]]
+=== Set up the chat interface
+
+You can start chatting with your data immediately, but you might want to tweak some defaults first.
+
+[.screenshot]
+image::chat-interface.png[]
+
+You can adjust the following under *Model settings*:
+
+* *Model*. The model used for generating responses.
+* *Instructions*. Also known as the _system prompt_, these initial instructions and guidelines define the behavior of the model throughout the conversation. Be *clear and specific* for best results.
+* *Include citations*. A toggle to include citations from the relevant {es} documents in responses.
+
+{x} also uses another LLM under the hood, to encode all previous questions and responses, and make them available to the main model.
+This ensures the model has "conversational memory".
+
+Under *Indices*, you can edit which {es} indices will be searched.
+This will affect the underlying {es} query.
+
+[TIP]
+====
+Click *✨ Regenerate* to resend the last query to the model for a fresh response.
+
+Click *⟳ Clear chat* to clear chat history and start a new conversation.
+====
+
+[float]
+[[playground-next-steps]]
+=== Next steps
+
+Once you've got {x} up and running, and you've tested out the chat interface, you might want to explore some more advanced topics:
+
+* <<playground-context>>
+* <<playground-query>>
+* <<playground-troubleshooting>> 
+
+include::playground-context.asciidoc[]
+include::playground-query.asciidoc[]
+include::playground-troubleshooting.asciidoc[]
+
diff --git a/docs/playground/playground-context.asciidoc b/docs/playground/playground-context.asciidoc
new file mode 100644
index 00000000000000..c0c4533fcb1a06
--- /dev/null
+++ b/docs/playground/playground-context.asciidoc
@@ -0,0 +1,68 @@
+[role="xpack"]
+[[playground-context]]
+== Optimize model context
+
+preview::[]
+
+// Variable (attribute) definition 
+:x:                    Playground 
+
+Context is the information you provide to the LLM, to optimize the relevance of your query results.
+Without additional context, an LLM will generate results solely based on its training data.
+In {x}, this additional context is the information contained in your {es} indices.
+
+There are a few ways to optimize this context for better results.
+Some adjustments can be made directly in the {x} UI.
+Others require refining your indexing strategy, and potentially reindexing your data.
+
+[float]
+[[playground-context-ui]]
+== Edit context in UI
+
+Use the *Edit context* button in the {x} UI to adjust the number of documents and fields sent to the LLM.
+
+If you're hitting context length limits, try the following:
+
+* Limit the number of documents retrieved
+* Pick a field with less tokens, reducing the context length
+
+[float]
+[[playground-context-index]]
+== Other context optimizations
+
+This section covers additional context optimizations that you won't be able to make directly in the UI.
+
+[float]
+[[playground-context-index-chunking]]
+=== Chunking large documents
+
+If you're working with large fields, you may need to adjust your indexing strategy.
+Consider breaking your documents into smaller chunks, such as sentences or paragraphs.
+
+If you don't yet have a chunking strategy, start by chunking your documents into passages.
+
+Otherwise, consider updating your chunking strategy, for example, from sentence based to paragraph based chunking.
+
+Refer to the following Python notebooks for examples of how to chunk your documents:
+
+* https://github.com/elastic/elasticsearch-labs/tree/main/notebooks/ingestion-and-chunking/json-chunking-ingest.ipynb[JSON documents]
+* https://github.com/elastic/elasticsearch-labs/tree/main/notebooks/ingestion-and-chunking/pdf-chunking-ingest.ipynb[PDF document]
+* https://github.com/elastic/elasticsearch-labs/tree/main/notebooks/ingestion-and-chunking/website-chunking-ingest.ipynb[Website content]
+
+[float]
+[[playground-context-balance]]
+=== Balancing cost and latency
+
+Here are some general recommendations for balancing cost and latency with different context sizes:
+
+Optimize context length::
+Determine the optimal context length through empirical testing.
+Start with a baseline and adjust incrementally to find a balance that optimizes both response quality and system performance.
+Implement token pruning for ELSER model::
+If you're using our ELSER model, consider implementing token pruning to reduce the number of tokens sent to the model.
+Refer to these relevant blog posts:
++
+* https://www.elastic.co/search-labs/blog/introducing-elser-v2-part-2[Optimizing retrieval with ELSER v2]
+* https://www.elastic.co/search-labs/blog/text-expansion-pruning[Improving text expansion performance using token pruning]
+Monitor and adjust::
+Continuously monitor the effects of context size changes on performance and adjust as necessary.
diff --git a/docs/playground/playground-query.asciidoc b/docs/playground/playground-query.asciidoc
new file mode 100644
index 00000000000000..11ed2e71b1a2df
--- /dev/null
+++ b/docs/playground/playground-query.asciidoc
@@ -0,0 +1,51 @@
+[xpack]
+[[playground-query]]
+== View and modify queries
+
+:x:                    Playground
+
+preview::[]
+
+Once you've set up your chat interface, you can start chatting with the model.
+{x} will automatically generate {es} queries based on your questions, and retrieve the most relevant documents from your {es} indices.
+The {x} UI enables you to view and modify these queries.
+
+* Click *View query* to open the visual query editor.
+* Modify the query by selecting fields to query per index.
+* Click *Save changes*.
+
+[TIP]
+====
+The `{query}` variable represents the user's question, rewritten as an {es} query.
+====
+
+The following screenshot shows the query editor in the {x} UI.
+In this simple example, the `books` index has two fields: `author` and `name`.
+Selecting a field adds it to the `fields` array in the query.
+
+[.screenshot]
+image::images/edit-query.png[View and modify queries]
+
+[float]
+[[playground-query-relevance]]
+=== Improving relevance
+
+The fields you select in the query editor determine the relevance of the retrieved documents.
+
+Remember that the next step in the workflow is to send the retrieved documents to the LLM to answer the question.
+Context length is an important factor in ensuring the model has enough information to generate a relevant answer.
+Refer to <<playground-context, Optimize context>> for more information.
+
+<<playground-troubleshooting, Troubleshooting>> provides tips on how to diagnose and fix relevance issues.
+
+[.screenshot]
+
+
+
+[NOTE]
+====
+{x} uses the {ref}/retriever.html[`retriever`] syntax for {es} queries.
+Retrievers make it easier to compose and test different retrieval strategies in your search pipelines. 
+====
+// TODO: uncomment and add to note once following page is live
+//Refer to {ref}/retrievers-overview.html[documentation] for a high level overview of retrievers.
\ No newline at end of file
diff --git a/docs/playground/playground-troubleshooting.asciidoc b/docs/playground/playground-troubleshooting.asciidoc
new file mode 100644
index 00000000000000..8fece498b12d52
--- /dev/null
+++ b/docs/playground/playground-troubleshooting.asciidoc
@@ -0,0 +1,26 @@
+[role="xpack"]
+[[playground-troubleshooting]]
+== Troubleshooting
+
+preview::[]
+
+:x:                    Playground
+
+Dense vectors are not searchable::
+Embeddings must be generated using the {ref}/inference-processor.html[inference processor] with an ML node.
+
+Context length error::
+You'll need to adjust the size of the context you're sending to the model.
+Refer to <<playground-context>>.
+
+LLM credentials not working::
+Under *Model settings*, use the wrench button (🔧) to edit your GenAI connector settings.
+
+Poor answer quality::
+Check the retrieved documents to see if they are valid.
+Adjust your {es} queries to improve the relevance of the documents retrieved. Refer to <<playground-query>>.
++
+You can update the initial instructions to be more detailed. This is called 'prompt engineering'. Refer to this https://platform.openai.com/docs/guides/prompt-engineering[OpenAI guide] for more information.
++
+You might need to click *⟳ Clear chat* to clear chat history and start a new conversation.
+If you mix topics, the model will find it harder to generate relevant responses.
\ No newline at end of file
diff --git a/docs/redirects.asciidoc b/docs/redirects.asciidoc
index 007a9d9f48cfc5..be017fbd1c94e9 100644
--- a/docs/redirects.asciidoc
+++ b/docs/redirects.asciidoc
@@ -432,9 +432,4 @@ This connector was renamed. Refer to <<openai-action-type>>.
 == APIs
 
 For the most up-to-date API details, refer to the
-{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[alerting], {kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[cases], {kib-repo}/tree/{branch}/x-pack/plugins/actions/docs/openapi[connectors], and {kib-repo}/tree/{branch}/x-pack/plugins/ml/common/openapi[machine learning] open API specifications.
-
-[role="exclude",id="playground"]
-== Playground
-
-Coming in 8.14.0.
\ No newline at end of file
+{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[alerting], {kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[cases], {kib-repo}/tree/{branch}/x-pack/plugins/actions/docs/openapi[connectors], and {kib-repo}/tree/{branch}/x-pack/plugins/ml/common/openapi[machine learning] open API specifications.
\ No newline at end of file
diff --git a/docs/settings/security-settings.asciidoc b/docs/settings/security-settings.asciidoc
index b87973d8227cb2..94c21486fe9cb5 100644
--- a/docs/settings/security-settings.asciidoc
+++ b/docs/settings/security-settings.asciidoc
@@ -367,9 +367,13 @@ xpack.security.audit.ignore_filters:
 - actions: [http_request] <1>
 - categories: [database]
   types: [creation, change, deletion] <2>
+- spaces: [default] <3>
+- users: [elastic, kibana_system] <4>
 ----------------------------------------
 <1> Filters out HTTP request events
 <2> Filters out any data write events
+<3> Filters out events from the `default` space
+<4> Filters out events from the `elastic` and `kibana_system` users
 
 xpack.security.audit.ignore_filters[].actions[] {ess-icon}::
 List of values matched against the `event.action` field of an audit event. Refer to <<xpack-security-audit-logging>> for a list of available events.
@@ -377,8 +381,14 @@ List of values matched against the `event.action` field of an audit event. Refer
 xpack.security.audit.ignore_filters[].categories[] {ess-icon}::
 List of values matched against the `event.category` field of an audit event. Refer to https://www.elastic.co/guide/en/ecs/1.5/ecs-allowed-values-event-category.html[ECS categorization field] for allowed values.
 
+xpack.security.audit.ignore_filters[].outcomes[] {ess-icon}::
+List of values matched against the `event.outcome` field of an audit event. Refer to https://www.elastic.co/guide/en/ecs/1.5/ecs-allowed-values-event-outcome.html[ECS outcome field] for allowed values.
+
+xpack.security.audit.ignore_filters[].spaces[] {ess-icon}::
+List of values matched against the `kibana.space_id` field of an audit event. This represents the space id in which the event took place.
+
 xpack.security.audit.ignore_filters[].types[] {ess-icon}::
 List of values matched against the `event.type` field of an audit event. Refer to https://www.elastic.co/guide/en/ecs/1.5/ecs-allowed-values-event-type.html[ECS type field] for allowed values.
 
-xpack.security.audit.ignore_filters[].outcomes[] {ess-icon}::
-List of values matched against the `event.outcome` field of an audit event. Refer to https://www.elastic.co/guide/en/ecs/1.5/ecs-allowed-values-event-outcome.html[ECS outcome field] for allowed values.
+xpack.security.audit.ignore_filters[].users[] {ess-icon}::
+List of values matched against the `user.name` field of an audit event. This represents the `username` associated with the audit event.
diff --git a/docs/user/index.asciidoc b/docs/user/index.asciidoc
index bf21f7b2629241..419574804312cc 100644
--- a/docs/user/index.asciidoc
+++ b/docs/user/index.asciidoc
@@ -28,6 +28,8 @@ include::alerting/index.asciidoc[]
 
 include::{kibana-root}/docs/observability/index.asciidoc[]
 
+include::{kibana-root}/docs/playground/index.asciidoc[]
+
 include::{kibana-root}/docs/apm/index.asciidoc[]
 
 include::{kibana-root}/docs/siem/index.asciidoc[]
diff --git a/examples/embeddable_examples/public/plugin.ts b/examples/embeddable_examples/public/plugin.ts
index 312c9630fd91ee..bcac6bf4d13677 100644
--- a/examples/embeddable_examples/public/plugin.ts
+++ b/examples/embeddable_examples/public/plugin.ts
@@ -13,11 +13,7 @@ import { DataPublicPluginStart } from '@kbn/data-plugin/public';
 import { DataViewFieldEditorStart } from '@kbn/data-view-field-editor-plugin/public';
 import { DataViewsPublicPluginStart } from '@kbn/data-views-plugin/public';
 import { DeveloperExamplesSetup } from '@kbn/developer-examples-plugin/public';
-import {
-  EmbeddableSetup,
-  EmbeddableStart,
-  registerReactEmbeddableFactory,
-} from '@kbn/embeddable-plugin/public';
+import { EmbeddableSetup, EmbeddableStart } from '@kbn/embeddable-plugin/public';
 import { FieldFormatsStart } from '@kbn/field-formats-plugin/public';
 import { UiActionsStart } from '@kbn/ui-actions-plugin/public';
 import { setupApp } from './app/setup_app';
@@ -51,36 +47,47 @@ export interface StartDeps {
 export class EmbeddableExamplesPlugin implements Plugin<void, void, SetupDeps, StartDeps> {
   public setup(core: CoreSetup<StartDeps>, { embeddable, developerExamples }: SetupDeps) {
     setupApp(core, developerExamples);
-  }
 
-  public start(core: CoreStart, deps: StartDeps) {
-    registerCreateFieldListAction(deps.uiActions);
-    registerReactEmbeddableFactory(FIELD_LIST_ID, async () => {
+    const startServicesPromise = core.getStartServices();
+
+    embeddable.registerReactEmbeddableFactory(FIELD_LIST_ID, async () => {
       const { getFieldListFactory } = await import(
         './react_embeddables/field_list/field_list_react_embeddable'
       );
-      return getFieldListFactory(core, deps);
+      const [coreStart, deps] = await startServicesPromise;
+      return getFieldListFactory(coreStart, deps);
     });
-    registerFieldListPanelPlacementSetting(deps.dashboard);
 
-    registerCreateEuiMarkdownAction(deps.uiActions);
-    registerReactEmbeddableFactory(EUI_MARKDOWN_ID, async () => {
+    embeddable.registerReactEmbeddableFactory(EUI_MARKDOWN_ID, async () => {
       const { markdownEmbeddableFactory } = await import(
         './react_embeddables/eui_markdown/eui_markdown_react_embeddable'
       );
       return markdownEmbeddableFactory;
     });
 
-    registerAddSearchPanelAction(deps.uiActions);
-    registerSearchEmbeddable(deps);
-
-    registerCreateDataTableAction(deps.uiActions);
-    registerReactEmbeddableFactory(DATA_TABLE_ID, async () => {
+    embeddable.registerReactEmbeddableFactory(DATA_TABLE_ID, async () => {
       const { getDataTableFactory } = await import(
         './react_embeddables/data_table/data_table_react_embeddable'
       );
-      return getDataTableFactory(core, deps);
+      const [coreStart, deps] = await startServicesPromise;
+      return getDataTableFactory(coreStart, deps);
     });
+
+    registerSearchEmbeddable(
+      embeddable,
+      new Promise((resolve) => startServicesPromise.then(([_, startDeps]) => resolve(startDeps)))
+    );
+  }
+
+  public start(core: CoreStart, deps: StartDeps) {
+    registerCreateFieldListAction(deps.uiActions);
+    registerFieldListPanelPlacementSetting(deps.dashboard);
+
+    registerCreateEuiMarkdownAction(deps.uiActions);
+
+    registerAddSearchPanelAction(deps.uiActions);
+
+    registerCreateDataTableAction(deps.uiActions);
   }
 
   public stop() {}
diff --git a/examples/embeddable_examples/public/react_embeddables/register_saved_object_example.ts b/examples/embeddable_examples/public/react_embeddables/register_saved_object_example.ts
index d2263240519933..35485c2a63337c 100644
--- a/examples/embeddable_examples/public/react_embeddables/register_saved_object_example.ts
+++ b/examples/embeddable_examples/public/react_embeddables/register_saved_object_example.ts
@@ -6,14 +6,14 @@
  * Side Public License, v 1.
  */
 
-import { registerReactEmbeddableSavedObject } from '@kbn/embeddable-plugin/public';
+import { EmbeddableSetup } from '@kbn/embeddable-plugin/public';
 
 const MY_EMBEDDABLE_TYPE = 'myEmbeddableType';
 const MY_SAVED_OBJECT_TYPE = 'mySavedObjectType';
 const APP_ICON = 'logoKibana';
 
-export const registerMyEmbeddableSavedObject = () =>
-  registerReactEmbeddableSavedObject({
+export const registerMyEmbeddableSavedObject = (embeddableSetup: EmbeddableSetup) =>
+  embeddableSetup.registerReactEmbeddableSavedObject({
     onAdd: (container, savedObject) => {
       container.addNewPanel({
         panelType: MY_EMBEDDABLE_TYPE,
diff --git a/examples/embeddable_examples/public/react_embeddables/search/register_search_embeddable.ts b/examples/embeddable_examples/public/react_embeddables/search/register_search_embeddable.ts
index 547437a61a2836..45ef203062e111 100644
--- a/examples/embeddable_examples/public/react_embeddables/search/register_search_embeddable.ts
+++ b/examples/embeddable_examples/public/react_embeddables/search/register_search_embeddable.ts
@@ -6,13 +6,13 @@
  * Side Public License, v 1.
  */
 
-import { registerReactEmbeddableFactory } from '@kbn/embeddable-plugin/public';
+import { EmbeddableSetup } from '@kbn/embeddable-plugin/public';
 import { SEARCH_EMBEDDABLE_ID } from './constants';
 import { Services } from './types';
 
-export function registerSearchEmbeddable(services: Services) {
-  registerReactEmbeddableFactory(SEARCH_EMBEDDABLE_ID, async () => {
+export function registerSearchEmbeddable(embeddable: EmbeddableSetup, services: Promise<Services>) {
+  embeddable.registerReactEmbeddableFactory(SEARCH_EMBEDDABLE_ID, async () => {
     const { getSearchEmbeddableFactory } = await import('./search_react_embeddable');
-    return getSearchEmbeddableFactory(services);
+    return getSearchEmbeddableFactory(await services);
   });
 }
diff --git a/examples/esql_ast_inspector/README.md b/examples/esql_ast_inspector/README.md
new file mode 100644
index 00000000000000..5c6646c4829e0d
--- /dev/null
+++ b/examples/esql_ast_inspector/README.md
@@ -0,0 +1,9 @@
+# esql_ast_inspector
+
+ES|QL AST inspector tool
+
+To run this example, start kibana with the `--run-examples` flag.
+
+```bash
+yarn start --run-examples
+```
diff --git a/examples/esql_ast_inspector/kibana.jsonc b/examples/esql_ast_inspector/kibana.jsonc
new file mode 100644
index 00000000000000..a3aded4fb210b1
--- /dev/null
+++ b/examples/esql_ast_inspector/kibana.jsonc
@@ -0,0 +1,17 @@
+{
+    "type": "plugin",
+    "id": "@kbn/esql-ast-inspector-plugin",
+    "owner": "@elastic/kibana-esql",
+    "plugin": {
+      "id": "esqlASTInspector",
+      "server": false,
+      "browser": true,
+      "configPath": [
+        "esql_ast_inspector"
+      ],
+      "requiredPlugins": [
+        "dataViews",
+        "developerExamples"
+      ]
+    }
+  }
\ No newline at end of file
diff --git a/examples/esql_ast_inspector/public/app.tsx b/examples/esql_ast_inspector/public/app.tsx
new file mode 100644
index 00000000000000..4936544345f439
--- /dev/null
+++ b/examples/esql_ast_inspector/public/app.tsx
@@ -0,0 +1,89 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import React, { useRef, useState } from 'react';
+import {
+  EuiPage,
+  EuiPageBody,
+  EuiPageSection,
+  EuiPageHeader,
+  EuiSpacer,
+  EuiForm,
+  EuiTextArea,
+  EuiFormRow,
+  EuiButton,
+} from '@elastic/eui';
+
+import type { CoreStart } from '@kbn/core/public';
+
+import { EditorError, ESQLAst, getAstAndSyntaxErrors } from '@kbn/esql-ast';
+import { CodeEditor } from '@kbn/code-editor';
+import type { StartDependencies } from './plugin';
+
+export const App = (props: { core: CoreStart; plugins: StartDependencies }) => {
+  const [currentErrors, setErrors] = useState<EditorError[]>([]);
+  const [currentQuery, setQuery] = useState(
+    'from index1 | eval var0 = round(numberField, 2) | stats by stringField'
+  );
+
+  const inputRef = useRef<HTMLTextAreaElement | null>(null);
+
+  const [ast, setAST] = useState<ESQLAst>(getAstAndSyntaxErrors(currentQuery).ast);
+
+  const parseQuery = (query: string) => {
+    const { ast: _ast, errors } = getAstAndSyntaxErrors(query);
+    setErrors(errors);
+    setAST(_ast);
+  };
+
+  return (
+    <EuiPage>
+      <EuiPageBody style={{ maxWidth: 800, margin: '0 auto' }}>
+        <EuiPageHeader paddingSize="s" bottomBorder={true} pageTitle="ES|QL AST Inspector" />
+        <EuiPageSection paddingSize="s">
+          <p>This app gives you the AST for a particular ES|QL query.</p>
+
+          <EuiSpacer />
+
+          <EuiForm>
+            <EuiFormRow
+              fullWidth
+              label="Query"
+              isInvalid={Boolean(currentErrors.length)}
+              error={currentErrors.map((error) => error.message)}
+            >
+              <EuiTextArea
+                inputRef={(node) => {
+                  inputRef.current = node;
+                }}
+                isInvalid={Boolean(currentErrors.length)}
+                fullWidth
+                value={currentQuery}
+                onChange={(e) => setQuery(e.target.value)}
+                css={{
+                  height: '5em',
+                }}
+              />
+            </EuiFormRow>
+            <EuiFormRow fullWidth>
+              <EuiButton fullWidth onClick={() => parseQuery(inputRef.current?.value ?? '')}>
+                Parse
+              </EuiButton>
+            </EuiFormRow>
+          </EuiForm>
+          <EuiSpacer />
+          <CodeEditor
+            allowFullScreen={true}
+            languageId={'json'}
+            value={JSON.stringify(ast, null, 2)}
+          />
+        </EuiPageSection>
+      </EuiPageBody>
+    </EuiPage>
+  );
+};
diff --git a/examples/esql_ast_inspector/public/esql_ast_inspector.png b/examples/esql_ast_inspector/public/esql_ast_inspector.png
new file mode 100644
index 00000000000000..9ffb695e8d19b8
Binary files /dev/null and b/examples/esql_ast_inspector/public/esql_ast_inspector.png differ
diff --git a/examples/esql_ast_inspector/public/index.tsx b/examples/esql_ast_inspector/public/index.tsx
new file mode 100644
index 00000000000000..79d4b18ae72250
--- /dev/null
+++ b/examples/esql_ast_inspector/public/index.tsx
@@ -0,0 +1,11 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { ESQLASTInspectorPlugin } from './plugin';
+
+export const plugin = () => new ESQLASTInspectorPlugin();
diff --git a/examples/esql_ast_inspector/public/mount.tsx b/examples/esql_ast_inspector/public/mount.tsx
new file mode 100644
index 00000000000000..2133fe83a84060
--- /dev/null
+++ b/examples/esql_ast_inspector/public/mount.tsx
@@ -0,0 +1,34 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import * as React from 'react';
+import { render, unmountComponentAtNode } from 'react-dom';
+
+import type { CoreSetup, AppMountParameters } from '@kbn/core/public';
+import type { StartDependencies } from './plugin';
+
+export const mount =
+  (coreSetup: CoreSetup<StartDependencies>) =>
+  async ({ element }: AppMountParameters) => {
+    const [core, plugins] = await coreSetup.getStartServices();
+    const { App } = await import('./app');
+
+    const i18nCore = core.i18n;
+
+    const reactElement = (
+      <i18nCore.Context>
+        <App core={core} plugins={plugins} />
+      </i18nCore.Context>
+    );
+
+    render(reactElement, element);
+    return () => {
+      unmountComponentAtNode(element);
+      plugins.data.search.session.clear();
+    };
+  };
diff --git a/examples/esql_ast_inspector/public/plugin.ts b/examples/esql_ast_inspector/public/plugin.ts
new file mode 100644
index 00000000000000..40b6cb7ba8a188
--- /dev/null
+++ b/examples/esql_ast_inspector/public/plugin.ts
@@ -0,0 +1,56 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { Plugin, CoreSetup } from '@kbn/core/public';
+import { DataPublicPluginStart } from '@kbn/data-plugin/public';
+import { DataViewsPublicPluginStart } from '@kbn/data-views-plugin/public';
+import { DeveloperExamplesSetup } from '@kbn/developer-examples-plugin/public';
+import { mount } from './mount';
+import image from './esql_ast_inspector.png';
+
+export interface SetupDependencies {
+  developerExamples: DeveloperExamplesSetup;
+}
+
+export interface StartDependencies {
+  data: DataPublicPluginStart;
+  dataViews: DataViewsPublicPluginStart;
+}
+
+export class ESQLASTInspectorPlugin
+  implements Plugin<void, void, SetupDependencies, StartDependencies>
+{
+  public setup(core: CoreSetup<StartDependencies>, { developerExamples }: SetupDependencies) {
+    core.application.register({
+      id: 'esql_ast_inspector',
+      title: 'ES|QL AST Inspector',
+      visibleIn: [],
+      mount: mount(core),
+    });
+
+    developerExamples.register({
+      appId: 'esql_ast_inspector',
+      title: 'ES|QL AST Inspector',
+      description: 'Inspect the ES|QL AST.',
+      image,
+      links: [
+        {
+          label: 'README',
+          href: 'https://github.com/elastic/kibana/tree/main/packages/kbn-esql-validation-autocomplete/README.md',
+          iconType: 'logoGithub',
+          size: 's',
+          target: '_blank',
+        },
+      ],
+    });
+  }
+
+  public start() {}
+
+  public stop() {}
+}
diff --git a/examples/esql_ast_inspector/tsconfig.json b/examples/esql_ast_inspector/tsconfig.json
new file mode 100644
index 00000000000000..2e73e440673faa
--- /dev/null
+++ b/examples/esql_ast_inspector/tsconfig.json
@@ -0,0 +1,24 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "target/types"
+  },
+  "include": [
+    "index.ts",
+    "public/**/*.ts",
+    "public/**/*.tsx",
+    "server/**/*.ts",
+    "../../../typings/**/*"
+  ],
+  "exclude": [
+    "target/**/*",
+  ],
+  "kbn_references": [
+    "@kbn/core",
+    "@kbn/data-plugin",
+    "@kbn/data-views-plugin",
+    "@kbn/developer-examples-plugin",
+    "@kbn/esql-ast",
+    "@kbn/code-editor",
+  ]
+}
diff --git a/examples/portable_dashboards_example/public/plugin.tsx b/examples/portable_dashboards_example/public/plugin.tsx
index 74d16be104277a..6ba9ed420c23e2 100644
--- a/examples/portable_dashboards_example/public/plugin.tsx
+++ b/examples/portable_dashboards_example/public/plugin.tsx
@@ -7,17 +7,17 @@
  */
 
 import { AppMountParameters, CoreSetup, Plugin } from '@kbn/core/public';
+import { DashboardStart } from '@kbn/dashboard-plugin/public';
+import type { DataPublicPluginStart } from '@kbn/data-plugin/public';
 import type { DeveloperExamplesSetup } from '@kbn/developer-examples-plugin/public';
+import { EmbeddableSetup } from '@kbn/embeddable-plugin/public';
 import type { NavigationPublicPluginStart } from '@kbn/navigation-plugin/public';
-import type { DataPublicPluginStart } from '@kbn/data-plugin/public';
-import { DashboardStart } from '@kbn/dashboard-plugin/public';
-import { registerReactEmbeddableFactory } from '@kbn/embeddable-plugin/public';
-
-import img from './portable_dashboard_image.png';
 import { FILTER_DEBUGGER_EMBEDDABLE_ID, PLUGIN_ID } from './constants';
+import img from './portable_dashboard_image.png';
 
 interface SetupDeps {
   developerExamples: DeveloperExamplesSetup;
+  embeddable: EmbeddableSetup;
 }
 
 export interface StartDeps {
@@ -27,7 +27,7 @@ export interface StartDeps {
 }
 
 export class PortableDashboardsExamplePlugin implements Plugin<void, void, SetupDeps, StartDeps> {
-  public setup(core: CoreSetup<StartDeps>, { developerExamples }: SetupDeps) {
+  public setup(core: CoreSetup<StartDeps>, { developerExamples, embeddable }: SetupDeps) {
     core.application.register({
       id: PLUGIN_ID,
       title: 'Portable dashboard examples',
@@ -45,14 +45,14 @@ export class PortableDashboardsExamplePlugin implements Plugin<void, void, Setup
       description: `Showcases different ways to embed a dashboard into your app`,
       image: img,
     });
-  }
 
-  public async start() {
-    registerReactEmbeddableFactory(FILTER_DEBUGGER_EMBEDDABLE_ID, async () => {
+    embeddable.registerReactEmbeddableFactory(FILTER_DEBUGGER_EMBEDDABLE_ID, async () => {
       const { factory } = await import('./filter_debugger_embeddable');
       return factory;
     });
   }
 
+  public async start() {}
+
   public stop() {}
 }
diff --git a/fleet_packages.json b/fleet_packages.json
index 9f0b28f9da0a6a..2e9d769d2dea8b 100644
--- a/fleet_packages.json
+++ b/fleet_packages.json
@@ -42,12 +42,12 @@
   },
   {
     "name": "profiler_symbolizer",
-    "version": "8.12.0",
+    "version": "8.14.0",
     "forceAlignStackVersion": true
   },
   {
     "name": "profiler_collector",
-    "version": "8.12.0",
+    "version": "8.14.0",
     "forceAlignStackVersion": true
   },
   {
@@ -58,4 +58,4 @@
     "name": "security_detection_engine",
     "version": "8.13.6"
   }
-]
\ No newline at end of file
+]
diff --git a/package.json b/package.json
index 1f73374cd2d63f..4e2a2f6df494cd 100644
--- a/package.json
+++ b/package.json
@@ -98,9 +98,9 @@
     "@appland/sql-parser": "^1.5.1",
     "@babel/runtime": "^7.24.4",
     "@cfworker/json-schema": "^1.12.7",
-    "@dnd-kit/core": "^3.1.1",
-    "@dnd-kit/sortable": "^4.0.0",
-    "@dnd-kit/utilities": "^2.0.0",
+    "@dnd-kit/core": "^6.1.0",
+    "@dnd-kit/sortable": "^8.0.0",
+    "@dnd-kit/utilities": "^3.2.2",
     "@elastic/apm-rum": "^5.16.0",
     "@elastic/apm-rum-react": "^2.0.2",
     "@elastic/charts": "64.1.0",
@@ -108,7 +108,7 @@
     "@elastic/ecs": "^8.11.1",
     "@elastic/elasticsearch": "^8.13.0",
     "@elastic/ems-client": "8.5.1",
-    "@elastic/eui": "94.2.1-backport.0",
+    "@elastic/eui": "94.3.0",
     "@elastic/filesaver": "1.1.2",
     "@elastic/node-crypto": "1.2.1",
     "@elastic/numeral": "^2.5.1",
@@ -448,6 +448,7 @@
     "@kbn/eso-model-version-example": "link:examples/eso_model_version_example",
     "@kbn/eso-plugin": "link:x-pack/test/encrypted_saved_objects_api_integration/plugins/api_consumer_plugin",
     "@kbn/esql-ast": "link:packages/kbn-esql-ast",
+    "@kbn/esql-ast-inspector-plugin": "link:examples/esql_ast_inspector",
     "@kbn/esql-utils": "link:packages/kbn-esql-utils",
     "@kbn/esql-validation-autocomplete": "link:packages/kbn-esql-validation-autocomplete",
     "@kbn/esql-validation-example-plugin": "link:examples/esql_validation_example",
@@ -558,6 +559,7 @@
     "@kbn/locator-explorer-plugin": "link:examples/locator_explorer",
     "@kbn/logging": "link:packages/kbn-logging",
     "@kbn/logging-mocks": "link:packages/kbn-logging-mocks",
+    "@kbn/logs-data-access-plugin": "link:x-pack/plugins/observability_solution/logs_data_access",
     "@kbn/logs-explorer-plugin": "link:x-pack/plugins/observability_solution/logs_explorer",
     "@kbn/logs-shared-plugin": "link:x-pack/plugins/observability_solution/logs_shared",
     "@kbn/logstash-plugin": "link:x-pack/plugins/logstash",
@@ -1372,7 +1374,7 @@
     "@mapbox/vector-tile": "1.3.1",
     "@octokit/rest": "^16.35.0",
     "@parcel/watcher": "^2.1.0",
-    "@redocly/cli": "^1.6.0",
+    "@redocly/cli": "^1.12.0",
     "@statoscope/webpack-plugin": "^5.28.2",
     "@storybook/addon-a11y": "^6.5.16",
     "@storybook/addon-actions": "^6.5.16",
@@ -1463,7 +1465,6 @@
     "@types/json5": "^2.2.0",
     "@types/jsonwebtoken": "^9.0.0",
     "@types/license-checker": "15.0.0",
-    "@types/listr": "^0.14.0",
     "@types/loader-utils": "^2.0.3",
     "@types/lodash": "^4.14.159",
     "@types/lru-cache": "^5.1.0",
@@ -1641,7 +1642,7 @@
     "json5": "^2.2.3",
     "jsondiffpatch": "0.4.1",
     "license-checker": "^25.0.1",
-    "listr": "^0.14.1",
+    "listr2": "^8.2.1",
     "lmdb": "^2.9.2",
     "loader-utils": "^2.0.4",
     "marge": "^1.0.1",
diff --git a/packages/core/chrome/core-chrome-browser-internal/src/project_navigation/breadcrumbs.tsx b/packages/core/chrome/core-chrome-browser-internal/src/project_navigation/breadcrumbs.tsx
index 39a7a25424d6f9..ed23d25434664e 100644
--- a/packages/core/chrome/core-chrome-browser-internal/src/project_navigation/breadcrumbs.tsx
+++ b/packages/core/chrome/core-chrome-browser-internal/src/project_navigation/breadcrumbs.tsx
@@ -41,7 +41,7 @@ export function buildBreadcrumbs({
   solutionNavigations?: {
     definitions: SolutionNavigationDefinitions;
     activeId: string;
-    onChange: (id: string, options?: { redirect?: boolean }) => void;
+    onChange: (id: string) => void;
   };
 }): ChromeProjectBreadcrumb[] {
   const rootCrumb = buildRootCrumb({
@@ -107,7 +107,7 @@ function buildRootCrumb({
   solutionNavigations?: {
     definitions: SolutionNavigationDefinitions;
     activeId: string;
-    onChange: (id: string, options?: { redirect?: boolean }) => void;
+    onChange: (id: string) => void;
   };
 }): ChromeProjectBreadcrumb {
   if (solutionNavigations) {
diff --git a/packages/core/chrome/core-chrome-browser-internal/src/project_navigation/project_navigation_service.test.ts b/packages/core/chrome/core-chrome-browser-internal/src/project_navigation/project_navigation_service.test.ts
index 508e72c5b86b49..71fac1455031b8 100644
--- a/packages/core/chrome/core-chrome-browser-internal/src/project_navigation/project_navigation_service.test.ts
+++ b/packages/core/chrome/core-chrome-browser-internal/src/project_navigation/project_navigation_service.test.ts
@@ -1003,28 +1003,18 @@ describe('solution navigations', () => {
     }
   });
 
-  it('should throw if the active solution navigation is not registered', async () => {
-    const { projectNavigation } = setup();
-
-    projectNavigation.updateSolutionNavigations({ 1: solution1, 2: solution2 });
-
-    expect(() => {
-      projectNavigation.changeActiveSolutionNavigation('3');
-    }).toThrowErrorMatchingInlineSnapshot(
-      `"Solution navigation definition with id \\"3\\" does not exist."`
-    );
-  });
-
   it('should change the active solution if no node match the current Location', async () => {
-    const { projectNavigation, navLinksService } = setup({
+    const { projectNavigation, navLinksService, application } = setup({
       locationPathName: '/app/app3', // we are on app3 which only exists in solution3
       navLinkIds: ['app1', 'app2', 'app3'],
     });
 
+    navLinksService.get.mockReturnValue({ url: '/app/app3', href: '/app/app3' } as any);
+
     const getActiveDefinition = () =>
-      lastValueFrom(projectNavigation.getActiveSolutionNavDefinition$().pipe(take(1)));
+      firstValueFrom(projectNavigation.getActiveSolutionNavDefinition$());
 
-    projectNavigation.updateSolutionNavigations({ 1: solution1, 2: solution2, 3: solution3 });
+    projectNavigation.updateSolutionNavigations({ solution1, solution2, solution3 });
 
     {
       const definition = await getActiveDefinition();
@@ -1032,20 +1022,12 @@ describe('solution navigations', () => {
     }
 
     // Change to solution 2, but we are still on '/app/app3' which only exists in solution3
-    projectNavigation.changeActiveSolutionNavigation('2');
+    projectNavigation.changeActiveSolutionNavigation('solution2');
 
     {
       const definition = await getActiveDefinition();
       expect(definition?.id).toBe('solution3'); // The solution3 was activated as it matches the "/app/app3" location
+      expect(application.navigateToUrl).toHaveBeenCalled(); // Redirect
     }
-
-    navLinksService.get.mockReturnValue({ url: '/app/app2', href: '/app/app2' } as any);
-    projectNavigation.changeActiveSolutionNavigation('2', { redirect: true }); // We ask to redirect to the home page of solution 2
-    {
-      const definition = await getActiveDefinition();
-      expect(definition?.id).toBe('solution2');
-    }
-
-    navLinksService.get.mockReset();
   });
 });
diff --git a/packages/core/chrome/core-chrome-browser-internal/src/project_navigation/project_navigation_service.ts b/packages/core/chrome/core-chrome-browser-internal/src/project_navigation/project_navigation_service.ts
index 1f3efef5d7821d..ddd00cea5b37e8 100644
--- a/packages/core/chrome/core-chrome-browser-internal/src/project_navigation/project_navigation_service.ts
+++ b/packages/core/chrome/core-chrome-browser-internal/src/project_navigation/project_navigation_service.ts
@@ -33,7 +33,6 @@ import {
   type Observable,
   type Subscription,
   take,
-  debounceTime,
 } from 'rxjs';
 import { type Location, createLocation } from 'history';
 import deepEqual from 'react-fast-compare';
@@ -80,26 +79,30 @@ export class ProjectNavigationService {
   }>({ breadcrumbs: [], params: { absolute: false } });
   private readonly stop$ = new ReplaySubject<void>(1);
   private readonly solutionNavDefinitions$ = new BehaviorSubject<SolutionNavigationDefinitions>({});
+  // As the active definition **id** and the definitions are set independently, one before the other without
+  // any guarantee of order, we need to store the next active definition id in a separate BehaviorSubject
+  private readonly nextSolutionNavDefinitionId$ = new BehaviorSubject<string | null>(null);
+  // The active solution navigation definition id that has been initiated and is currently active
   private readonly activeSolutionNavDefinitionId$ = new BehaviorSubject<string | null>(null);
   private readonly location$ = new BehaviorSubject<Location>(createLocation('/'));
   private deepLinksMap$: Observable<Record<string, ChromeNavLink>> = of({});
   private cloudLinks$ = new BehaviorSubject<CloudLinks>({});
   private application?: InternalApplicationStart;
   private navLinksService?: ChromeNavLinks;
-  private http?: InternalHttpStart;
+  private _http?: InternalHttpStart;
   private navigationChangeSubscription?: Subscription;
   private unlistenHistory?: () => void;
 
   public start({ application, navLinksService, http, chromeBreadcrumbs$, logger }: StartDeps) {
     this.application = application;
     this.navLinksService = navLinksService;
-    this.http = http;
+    this._http = http;
     this.logger = logger;
     this.onHistoryLocationChange(application.history.location);
     this.unlistenHistory = application.history.listen(this.onHistoryLocationChange.bind(this));
 
     this.handleActiveNodesChange();
-    this.handleEmptyActiveNodes();
+    this.handleSolutionNavDefinitionChange();
 
     this.deepLinksMap$ = navLinksService.getNavLinks$().pipe(
       map((navLinks) => {
@@ -137,7 +140,7 @@ export class ProjectNavigationService {
       },
       getNavigationTreeUi$: this.getNavigationTreeUi$.bind(this),
       getActiveNodes$: () => {
-        return this.activeNodes$.pipe(takeUntil(this.stop$));
+        return this.activeNodes$.pipe(takeUntil(this.stop$), distinctUntilChanged(deepEqual));
       },
       setSideNavComponent: this.setSideNavComponent.bind(this),
       getProjectSideNavComponent$: () => {
@@ -178,7 +181,10 @@ export class ProjectNavigationService {
                   ? {
                       definitions: solutionNavDefinitions,
                       activeId: activeSolutionNavDefinitionId,
-                      onChange: this.changeActiveSolutionNavigation.bind(this),
+                      onChange: (id: string) => {
+                        this.goToSolutionHome(id);
+                        this.changeActiveSolutionNavigation(id);
+                      },
                     }
                   : undefined;
 
@@ -217,14 +223,13 @@ export class ProjectNavigationService {
   private initNavigation(id: string, navTreeDefinition$: Observable<NavigationTreeDefinition>) {
     if (this.activeSolutionNavDefinitionId$.getValue() === id) return;
 
-    this.activeSolutionNavDefinitionId$.next(id);
-
     if (this.navigationChangeSubscription) {
       this.navigationChangeSubscription.unsubscribe();
     }
 
     let initialised = false;
     this.projectNavigationNavTreeFlattened = {};
+
     this.navigationChangeSubscription = combineLatest([
       navTreeDefinition$,
       this.deepLinksMap$,
@@ -243,13 +248,26 @@ export class ProjectNavigationService {
         next: ({ navigationTree, navigationTreeUI }) => {
           this.navigationTree$.next(navigationTree);
           this.navigationTreeUi$.next(navigationTreeUI);
-
           this.projectNavigationNavTreeFlattened = flattenNav(navigationTree);
 
-          // At initialization, we want to force the update of the active nodes, so 2 empty arrays []
-          // are not considered equal and we update the Observable value.
-          this.updateActiveProjectNavigationNodes({ forceUpdate: !initialised });
-          initialised = true;
+          // Verify if the current location is part of the navigation tree of
+          // the initiated solution. If not, we need to find the correct solution
+          const activeNodes = this.updateActiveProjectNavigationNodes();
+          let willChangeSolution = false;
+
+          if (activeNodes.length === 0) {
+            const solutionForCurrentLocation = this.findSolutionForCurrentLocation();
+            if (solutionForCurrentLocation) {
+              willChangeSolution = true;
+              this.goToSolutionHome(solutionForCurrentLocation);
+              this.changeActiveSolutionNavigation(solutionForCurrentLocation);
+            }
+          }
+
+          if (!initialised && !willChangeSolution) {
+            this.activeSolutionNavDefinitionId$.next(id);
+            initialised = true;
+          }
         },
         error: (err) => {
           this.logger?.error(err);
@@ -271,7 +289,7 @@ export class ProjectNavigationService {
     flattendTree?: Record<string, ChromeProjectNavigationNode>;
   } = {}): ChromeProjectNavigationNode[][] {
     if (!this.application) return [];
-    if (!Object.keys(this.projectNavigationNavTreeFlattened).length) return [];
+    if (!Object.keys(flattendTree).length) return [];
 
     const location = _location ?? this.application.history.location;
     let currentPathname = this.http?.basePath.prepend(location.pathname) ?? location.pathname;
@@ -292,23 +310,15 @@ export class ProjectNavigationService {
    */
   private updateActiveProjectNavigationNodes({
     location,
-    forceUpdate = false,
-  }: { location?: Location; forceUpdate?: boolean } = {}) {
+  }: { location?: Location } = {}): ChromeProjectNavigationNode[][] {
     const activeNodes = this.findActiveNodes({ location });
-    // Each time we call findActiveNodes() we create a new array of activeNodes. As this array is used
-    // in React in useCallback() and useMemo() dependencies arrays it triggers an infinite navigation
-    // tree registration loop. To avoid that we only notify the listeners when the activeNodes array
-    // has actually changed.
-    const requiresUpdate = forceUpdate ? true : !deepEqual(activeNodes, this.activeNodes$.value);
-
-    if (!requiresUpdate) return;
-
     this.activeNodes$.next(activeNodes);
+    return activeNodes;
   }
 
   private onHistoryLocationChange(location: Location) {
-    this.location$.next(location);
     this.updateActiveProjectNavigationNodes({ location });
+    this.location$.next(location);
   }
 
   private handleActiveNodesChange() {
@@ -338,30 +348,17 @@ export class ProjectNavigationService {
    * lands on a page that does not belong to the current active solution navigation. In this case,
    * we need to find the correct solution navigation based on the current location and switch to it.
    */
-  private handleEmptyActiveNodes() {
-    combineLatest([
-      this.activeNodes$,
-      this.solutionNavDefinitions$,
-      this.activeSolutionNavDefinitionId$.pipe(distinctUntilChanged()),
-      this.location$,
-    ])
-      .pipe(takeUntil(this.stop$), debounceTime(20))
-      .subscribe(([activeNodes, definitions, activeSolution, location]) => {
-        if (
-          activeNodes.length > 0 ||
-          activeSolution === null ||
-          Object.keys(definitions).length === 0 ||
-          Object.keys(this.projectNavigationNavTreeFlattened).length === 0
-        ) {
-          return;
-        }
+  private findSolutionForCurrentLocation(): string | null {
+    if (Object.keys(this.solutionNavDefinitions$.getValue()).length === 0) return null;
 
-        // We have an active solution navigation but no active nodes, this means that
-        // the current location is not part of the current solution navigation.
-        // We need to find the correct solution navigation based on the current location.
-        let found = false;
+    let idFound: string | null = null;
 
+    combineLatest([this.solutionNavDefinitions$, this.location$])
+      .pipe(take(1))
+      .subscribe(([definitions, location]) => {
         Object.entries(definitions).forEach(([id, definition]) => {
+          if (idFound) return;
+
           combineLatest([definition.navigationTree$, this.deepLinksMap$, this.cloudLinks$])
             .pipe(
               take(1),
@@ -373,72 +370,71 @@ export class ProjectNavigationService {
               )
             )
             .subscribe(({ navigationTree }) => {
-              if (found) return;
-
               const maybeActiveNodes = this.findActiveNodes({
                 location,
                 flattendTree: flattenNav(navigationTree),
               });
 
               if (maybeActiveNodes.length > 0) {
-                found = true;
-                this.changeActiveSolutionNavigation(id);
+                idFound = id;
               }
             });
         });
       });
+
+    return idFound;
   }
 
   private setSideNavComponent(component: SideNavComponent | null) {
     this.customProjectSideNavComponent$.next({ current: component });
   }
 
-  private changeActiveSolutionNavigation(
-    id: string | null,
-    { onlyIfNotSet = false, redirect = false } = {}
-  ) {
-    if (this.activeSolutionNavDefinitionId$.getValue() === id) return;
-    if (onlyIfNotSet && this.activeSolutionNavDefinitionId$.getValue() !== null) {
-      return;
-    }
-
-    const definitions = this.solutionNavDefinitions$.getValue();
-    this.activeSolutionNavDefinitionId$.next(null);
-    // We don't want to change to "classic" if `id` is `null` when we haven't received
-    // any definitions yet. Serverless Kibana could be impacted by this.
-    // When we **do** have definitions, then passing `null` does mean we should change to "classic".
-    if (Object.keys(definitions).length > 0) {
-      if (id === null) {
-        this.navigationTree$.next(undefined);
-        this.activeSolutionNavDefinitionId$.next(null);
-      } else {
-        const definition = definitions[id];
-        if (!definition) {
-          throw new Error(`Solution navigation definition with id "${id}" does not exist.`);
+  private handleSolutionNavDefinitionChange() {
+    combineLatest([
+      this.solutionNavDefinitions$,
+      this.nextSolutionNavDefinitionId$.pipe(distinctUntilChanged()),
+    ])
+      .pipe(takeUntil(this.stop$))
+      .subscribe(([definitions, nextId]) => {
+        const definition = typeof nextId === 'string' ? definitions[nextId] : undefined;
+        const noActiveDefinition =
+          Object.keys(definitions).length === 0 || !definition || nextId === null;
+
+        if (noActiveDefinition) {
+          this.navigationTree$.next(undefined);
+          this.activeNodes$.next([]);
+          return;
         }
 
         const { sideNavComponent } = definition;
         if (sideNavComponent) {
           this.setSideNavComponent(sideNavComponent);
         }
+        this.initNavigation(nextId, definition.navigationTree$);
+      });
+  }
 
-        let location: Location | undefined;
-        if (redirect) {
-          // Navigate to the new home page if it's defined, otherwise navigate to the default home page
-          const link = this.navLinksService?.get(definition.homePage ?? 'home');
-          if (link) {
-            const linkUrl = this.http?.basePath.remove(link.url) ?? link.url;
-            location = createLocation(linkUrl);
-            this.location$.next(location);
-            this.application?.navigateToUrl(link.href);
-          }
-        }
+  private goToSolutionHome(id: string) {
+    const definitions = this.solutionNavDefinitions$.getValue();
+    const definition = definitions[id];
+    if (!definition) {
+      throw new Error(`No solution navigation definition found for id ${id}`);
+    }
 
-        this.initNavigation(id, definition.navigationTree$);
-      }
-    } else if (id !== null) {
-      this.activeSolutionNavDefinitionId$.next(id);
+    // Navigate to the new home page if it's defined
+    const link = this.navLinksService?.get(definition.homePage ?? 'undefined');
+    if (!link) {
+      throw new Error(`No home page defined for solution navigation ${definition.id}`);
     }
+
+    const location = createLocation(link.url);
+    this.location$.next(location);
+    this.application?.navigateToUrl(link.url);
+  }
+
+  private changeActiveSolutionNavigation(id: string | null) {
+    if (this.nextSolutionNavDefinitionId$.getValue() === id) return;
+    this.nextSolutionNavDefinitionId$.next(id);
   }
 
   private getSolutionsNavDefinitions$() {
@@ -451,9 +447,8 @@ export class ProjectNavigationService {
       map(([definitions, id]) => {
         if (id === null) return null;
         if (Object.keys(definitions).length === 0) return null;
-        if (!definitions[id]) {
-          throw new Error(`Solution navigation definition with id "${id}" does not exist.`);
-        }
+        if (!definitions[id]) return null;
+
         // We strip out the sideNavComponent from the definition as it should only be used internally
         const { sideNavComponent, ...definition } = definitions[id];
         return definition;
@@ -475,6 +470,13 @@ export class ProjectNavigationService {
     }
   }
 
+  private get http() {
+    if (!this._http) {
+      throw new Error('Http service not provided.');
+    }
+    return this._http;
+  }
+
   public stop() {
     this.stop$.next();
     this.unlistenHistory?.();
diff --git a/packages/core/chrome/core-chrome-browser-internal/src/types.ts b/packages/core/chrome/core-chrome-browser-internal/src/types.ts
index 6413c0a683112b..41f96b6e751d6c 100644
--- a/packages/core/chrome/core-chrome-browser-internal/src/types.ts
+++ b/packages/core/chrome/core-chrome-browser-internal/src/types.ts
@@ -113,14 +113,6 @@ export interface InternalChromeStart extends ChromeStart {
      * @param id The id of the active solution navigation. If `null` is provided, the solution navigation
      * will be replaced with the legacy Kibana navigation.
      */
-    changeActiveSolutionNavigation(
-      id: string | null,
-      options?: {
-        /** only change if there isn't any active solution yet */
-        onlyIfNotSet?: boolean;
-        /** redirect to the new navigation home page */
-        redirect?: boolean;
-      }
-    ): void;
+    changeActiveSolutionNavigation(id: string | null): void;
   };
 }
diff --git a/packages/core/chrome/core-chrome-browser-internal/src/ui/solution_nav_switcher_breadcrumbs.tsx b/packages/core/chrome/core-chrome-browser-internal/src/ui/solution_nav_switcher_breadcrumbs.tsx
index a536cb0e0bfd80..abb617e9887249 100644
--- a/packages/core/chrome/core-chrome-browser-internal/src/ui/solution_nav_switcher_breadcrumbs.tsx
+++ b/packages/core/chrome/core-chrome-browser-internal/src/ui/solution_nav_switcher_breadcrumbs.tsx
@@ -22,7 +22,7 @@ export const getSolutionNavSwitcherBreadCrumb = ({
 }: {
   definitions: SolutionNavigationDefinitions;
   activeId: string;
-  onChange: (id: string, options?: { redirect?: boolean }) => void;
+  onChange: (id: string) => void;
   cloudLinks: CloudLinks;
 }): ChromeProjectBreadcrumb => {
   const text = Object.values(definitions).find(({ id }) => id === activeId)?.title;
@@ -48,7 +48,7 @@ export const getSolutionNavSwitcherBreadCrumb = ({
               iconType={icon as string}
               data-test-subj={`solutionNavSwitcher-${id}`}
               onClick={() => {
-                onChange(id, { redirect: true });
+                onChange(id);
                 closePopover();
               }}
             />,
diff --git a/packages/core/i18n/core-i18n-browser-internal/src/i18n_eui_mapping.tsx b/packages/core/i18n/core-i18n-browser-internal/src/i18n_eui_mapping.tsx
index d01f439fbb9783..c7d290f3af603e 100644
--- a/packages/core/i18n/core-i18n-browser-internal/src/i18n_eui_mapping.tsx
+++ b/packages/core/i18n/core-i18n-browser-internal/src/i18n_eui_mapping.tsx
@@ -1389,11 +1389,13 @@ export const getEuiContextMapping = (): EuiTokensObject => {
       'core.euiDatePopoverContent.nowTabButtonEnd',
       { defaultMessage: 'Set end date and time to now' }
     ),
-    'euiAbsoluteTab.dateFormatError': ({ dateFormat }: EuiValues) =>
-      i18n.translate('core.euiAbsoluteTab.dateFormatError', {
-        defaultMessage: 'Allowed formats: {dateFormat}, ISO 8601, RFC 2822, or Unix timestamp.',
-        values: { dateFormat },
-      }),
+    'euiAbsoluteTab.dateFormatError': ({ dateFormat }: EuiValues) => (
+      <FormattedMessage
+        id="core.euiAbsoluteTab.dateFormatError"
+        defaultMessage="Allowed formats: {dateFormat}, ISO 8601, RFC 2822, or Unix timestamp."
+        values={{ dateFormat }}
+      />
+    ),
     'euiRelativeTab.fullDescription': ({ unit }: EuiValues) =>
       i18n.translate('core.euiRelativeTab.fullDescription', {
         defaultMessage: 'The unit is changeable. Currently set to {unit}.',
diff --git a/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/mocks.ts b/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/mocks.ts
index ae52a8556784b4..360487c0c5c3ca 100644
--- a/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/mocks.ts
+++ b/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/mocks.ts
@@ -12,13 +12,16 @@ import type { RollingFileContext } from './rolling_file_context';
 import type { RollingFileManager } from './rolling_file_manager';
 import type { TriggeringPolicy } from './policies/policy';
 import type { RollingStrategy } from './strategies/strategy';
+import type { RetentionPolicy } from './retention/retention_policy';
 
-const createContextMock = (filePath: string) => {
+const createContextMock = (filePath: string = 'kibana.log') => {
   const mock: jest.Mocked<RollingFileContext> = {
     currentFileSize: 0,
     currentFileTime: 0,
     filePath,
     refreshFileInfo: jest.fn(),
+    getOrderedRolledFiles: jest.fn(),
+    setOrderedRolledFileFn: jest.fn(),
   };
   return mock;
 };
@@ -52,10 +55,18 @@ const createFileManagerMock = () => {
   return mock;
 };
 
+const createRetentionPolicyMock = () => {
+  const mock: jest.Mocked<RetentionPolicy> = {
+    apply: jest.fn(),
+  };
+  return mock;
+};
+
 export const rollingFileAppenderMocks = {
   createContext: createContextMock,
   createStrategy: createStrategyMock,
   createPolicy: createPolicyMock,
   createLayout: createLayoutMock,
   createFileManager: createFileManagerMock,
+  createRetentionPolicy: createRetentionPolicyMock,
 };
diff --git a/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/retention/create_retention_policy.test.ts b/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/retention/create_retention_policy.test.ts
new file mode 100644
index 00000000000000..24974d4e33e44f
--- /dev/null
+++ b/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/retention/create_retention_policy.test.ts
@@ -0,0 +1,34 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import type { RollingStrategyConfig } from '@kbn/core-logging-server';
+import { mergeRetentionPolicyConfig } from './create_retention_policy';
+
+describe('mergeRetentionPolicyConfig', () => {
+  const createRollingStrategyConfig = (max: number): RollingStrategyConfig => {
+    return {
+      type: 'numeric',
+      pattern: '-%i',
+      max,
+    };
+  };
+
+  it('uses the value from the retention strategy config if defined', () => {
+    const merged = mergeRetentionPolicyConfig({ maxFiles: 42 }, createRollingStrategyConfig(10));
+    expect(merged).toEqual({
+      maxFiles: 42,
+    });
+  });
+
+  it('uses the value from the rolling strategy config not defined on the retention config', () => {
+    const merged = mergeRetentionPolicyConfig({}, createRollingStrategyConfig(10));
+    expect(merged).toEqual({
+      maxFiles: 10,
+    });
+  });
+});
diff --git a/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/retention/create_retention_policy.ts b/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/retention/create_retention_policy.ts
new file mode 100644
index 00000000000000..33e8bb4c8da358
--- /dev/null
+++ b/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/retention/create_retention_policy.ts
@@ -0,0 +1,28 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import type { RetentionPolicyConfig, RollingStrategyConfig } from '@kbn/core-logging-server';
+import type { RollingFileContext } from '../rolling_file_context';
+import { GenericRetentionPolicy, type RetentionPolicy } from './retention_policy';
+
+export const createRetentionPolicy = (
+  config: RetentionPolicyConfig,
+  context: RollingFileContext
+): RetentionPolicy => {
+  return new GenericRetentionPolicy(config, context);
+};
+
+export const mergeRetentionPolicyConfig = (
+  config: RetentionPolicyConfig | undefined,
+  strategyConfig: RollingStrategyConfig
+): RetentionPolicyConfig => {
+  return {
+    ...config,
+    maxFiles: config?.maxFiles || strategyConfig.max,
+  };
+};
diff --git a/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/retention/fs.ts b/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/retention/fs.ts
new file mode 100644
index 00000000000000..ffa0f5d4ebe21a
--- /dev/null
+++ b/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/retention/fs.ts
@@ -0,0 +1,27 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { unlink, stat } from 'fs/promises';
+
+export const deleteFiles = async ({ filesToDelete }: { filesToDelete: string[] }) => {
+  await Promise.all(filesToDelete.map((fileToDelete) => unlink(fileToDelete)));
+};
+
+export type GetFileInfoResult = { exist: false } | { exist: true; size: number; mtime: Date };
+
+export const getFileInfo = async (absFilePath: string): Promise<GetFileInfoResult> => {
+  try {
+    const { size, mtime } = await stat(absFilePath);
+    return { exist: true, size, mtime };
+  } catch (e) {
+    if (e.code === 'ENOENT') {
+      return { exist: false };
+    }
+    throw e;
+  }
+};
diff --git a/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/retention/index.ts b/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/retention/index.ts
new file mode 100644
index 00000000000000..26fac7ac06e801
--- /dev/null
+++ b/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/retention/index.ts
@@ -0,0 +1,10 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export { retentionPolicyConfigSchema, type RetentionPolicy } from './retention_policy';
+export { createRetentionPolicy, mergeRetentionPolicyConfig } from './create_retention_policy';
diff --git a/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/retention/retention_policy.test.mocks.ts b/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/retention/retention_policy.test.mocks.ts
new file mode 100644
index 00000000000000..b3aeb0c5fb97c8
--- /dev/null
+++ b/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/retention/retention_policy.test.mocks.ts
@@ -0,0 +1,32 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import type { listFilesOlderThan, listFilesExceedingSize } from './utils';
+import type { deleteFiles } from './fs';
+
+export const listFilesExceedingSizeMock: jest.MockedFn<typeof listFilesExceedingSize> = jest.fn();
+export const listFilesOlderThanMock: jest.MockedFn<typeof listFilesOlderThan> = jest.fn();
+
+jest.doMock('./utils', () => {
+  const actual = jest.requireActual('./utils');
+  return {
+    ...actual,
+    listFilesExceedingSize: listFilesExceedingSizeMock,
+    listFilesOlderThan: listFilesOlderThanMock,
+  };
+});
+
+export const deleteFilesMock: jest.MockedFn<typeof deleteFiles> = jest.fn();
+
+jest.doMock('./fs', () => {
+  const actual = jest.requireActual('./fs');
+  return {
+    ...actual,
+    deleteFiles: deleteFilesMock,
+  };
+});
diff --git a/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/retention/retention_policy.test.ts b/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/retention/retention_policy.test.ts
new file mode 100644
index 00000000000000..142523b4bf8eb1
--- /dev/null
+++ b/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/retention/retention_policy.test.ts
@@ -0,0 +1,141 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import {
+  listFilesExceedingSizeMock,
+  listFilesOlderThanMock,
+  deleteFilesMock,
+} from './retention_policy.test.mocks';
+import type { RetentionPolicyConfig } from '@kbn/core-logging-server';
+import { rollingFileAppenderMocks } from '../mocks';
+import { GenericRetentionPolicy, retentionPolicyConfigSchema } from './retention_policy';
+
+describe('GenericRetentionPolicy', () => {
+  let context: ReturnType<typeof rollingFileAppenderMocks.createContext>;
+  let config: RetentionPolicyConfig;
+
+  beforeEach(() => {
+    deleteFilesMock.mockReset();
+    listFilesExceedingSizeMock.mockReset();
+    listFilesOlderThanMock.mockReset();
+
+    context = rollingFileAppenderMocks.createContext();
+  });
+
+  it('supports the maxFile directive', async () => {
+    config = retentionPolicyConfigSchema.validate({
+      maxFiles: 2,
+    });
+    context.getOrderedRolledFiles.mockResolvedValue(['file-1', 'file-2', 'file-3', 'file-4']);
+
+    const policy = new GenericRetentionPolicy(config, context);
+
+    await policy.apply();
+
+    expect(deleteFilesMock).toHaveBeenCalledTimes(1);
+    expect(deleteFilesMock).toHaveBeenCalledWith({
+      filesToDelete: ['file-3', 'file-4'],
+    });
+  });
+
+  it('supports the maxAccumulatedFileSize directive', async () => {
+    config = retentionPolicyConfigSchema.validate({
+      maxAccumulatedFileSize: '50b',
+    });
+    context.getOrderedRolledFiles.mockResolvedValue(['file-1', 'file-2', 'file-3', 'file-4']);
+
+    listFilesExceedingSizeMock.mockResolvedValue(['file-4']);
+
+    const policy = new GenericRetentionPolicy(config, context);
+
+    await policy.apply();
+
+    expect(listFilesOlderThanMock).not.toHaveBeenCalled();
+    expect(listFilesExceedingSizeMock).toHaveBeenCalledTimes(1);
+    expect(listFilesExceedingSizeMock).toHaveBeenCalledWith({
+      orderedFiles: ['file-1', 'file-2', 'file-3', 'file-4'],
+      maxSizeInBytes: config.maxAccumulatedFileSize!.getValueInBytes(),
+    });
+
+    expect(deleteFilesMock).toHaveBeenCalledTimes(1);
+    expect(deleteFilesMock).toHaveBeenCalledWith({
+      filesToDelete: ['file-4'],
+    });
+  });
+
+  it('supports the removeOlderThan directive', async () => {
+    config = retentionPolicyConfigSchema.validate({
+      removeOlderThan: '30d',
+    });
+    context.getOrderedRolledFiles.mockResolvedValue(['file-1', 'file-2', 'file-3', 'file-4']);
+
+    listFilesOlderThanMock.mockResolvedValue(['file-2', 'file-3', 'file-4']);
+
+    const policy = new GenericRetentionPolicy(config, context);
+
+    await policy.apply();
+
+    expect(listFilesExceedingSizeMock).not.toHaveBeenCalled();
+    expect(listFilesOlderThanMock).toHaveBeenCalledTimes(1);
+    expect(listFilesOlderThanMock).toHaveBeenCalledWith({
+      orderedFiles: ['file-1', 'file-2', 'file-3', 'file-4'],
+      duration: config.removeOlderThan!,
+    });
+
+    expect(deleteFilesMock).toHaveBeenCalledTimes(1);
+    expect(deleteFilesMock).toHaveBeenCalledWith({
+      filesToDelete: ['file-2', 'file-3', 'file-4'],
+    });
+  });
+
+  it('supports all directives at the same time', async () => {
+    config = retentionPolicyConfigSchema.validate({
+      maxFiles: 3,
+      removeOlderThan: '30d',
+      maxAccumulatedFileSize: '50b',
+    });
+    context.getOrderedRolledFiles.mockResolvedValue(['file-1', 'file-2', 'file-3', 'file-4']);
+
+    listFilesOlderThanMock.mockResolvedValue(['file-2']);
+    listFilesExceedingSizeMock.mockResolvedValue(['file-3']);
+
+    const policy = new GenericRetentionPolicy(config, context);
+
+    await policy.apply();
+
+    expect(listFilesExceedingSizeMock).toHaveBeenCalledTimes(1);
+    expect(listFilesExceedingSizeMock).toHaveBeenCalledWith({
+      orderedFiles: ['file-1', 'file-2', 'file-3', 'file-4'],
+      maxSizeInBytes: config.maxAccumulatedFileSize!.getValueInBytes(),
+    });
+
+    expect(listFilesOlderThanMock).toHaveBeenCalledTimes(1);
+    expect(listFilesOlderThanMock).toHaveBeenCalledWith({
+      orderedFiles: ['file-1', 'file-2', 'file-3', 'file-4'],
+      duration: config.removeOlderThan!,
+    });
+
+    expect(deleteFilesMock).toHaveBeenCalledTimes(1);
+    expect(deleteFilesMock).toHaveBeenCalledWith({
+      filesToDelete: ['file-4', 'file-3', 'file-2'],
+    });
+  });
+
+  it('do not call deleteFiles if no file should be deleted', async () => {
+    config = retentionPolicyConfigSchema.validate({
+      maxFiles: 5,
+    });
+    context.getOrderedRolledFiles.mockResolvedValue(['file-1', 'file-2', 'file-3', 'file-4']);
+
+    const policy = new GenericRetentionPolicy(config, context);
+
+    await policy.apply();
+
+    expect(deleteFilesMock).not.toHaveBeenCalled();
+  });
+});
diff --git a/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/retention/retention_policy.ts b/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/retention/retention_policy.ts
new file mode 100644
index 00000000000000..9f2150e4a575d4
--- /dev/null
+++ b/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/retention/retention_policy.ts
@@ -0,0 +1,85 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { dirname, join } from 'path';
+import { schema } from '@kbn/config-schema';
+import type { RetentionPolicyConfig } from '@kbn/core-logging-server';
+import type { RollingFileContext } from '../rolling_file_context';
+import { deleteFiles } from './fs';
+import { listFilesExceedingSize, listFilesOlderThan } from './utils';
+
+export const retentionPolicyConfigSchema = schema.object(
+  {
+    maxFiles: schema.maybe(schema.number({ min: 1, max: 365 })),
+    maxAccumulatedFileSize: schema.maybe(schema.byteSize()),
+    removeOlderThan: schema.maybe(schema.duration({ max: '365d' })),
+  },
+  {
+    validate: (config) => {
+      if (!config.maxFiles && !config.maxAccumulatedFileSize && !config.removeOlderThan) {
+        return 'Retention policy must define at least one directive: maxFiles, maxAccumulatedFileSize or removeOlderThan';
+      }
+    },
+  }
+);
+
+export interface RetentionPolicy {
+  /**
+   * Apply the configured policy, checking the existing log files bound to the appender
+   * and disposing of those that should.
+   */
+  apply(): Promise<void>;
+}
+
+export class GenericRetentionPolicy implements RetentionPolicy {
+  private readonly logFileFolder;
+
+  constructor(
+    private readonly config: RetentionPolicyConfig,
+    private readonly context: RollingFileContext
+  ) {
+    this.logFileFolder = dirname(this.context.filePath);
+  }
+
+  async apply() {
+    const { maxFiles, maxAccumulatedFileSize, removeOlderThan } = this.config;
+    const orderedFilesBaseNames = await this.context.getOrderedRolledFiles();
+    const absOrderedFiles = orderedFilesBaseNames.map((filepath) =>
+      join(this.logFileFolder, filepath)
+    );
+
+    const filesToDelete: Set<string> = new Set();
+
+    if (maxFiles) {
+      const exceedingFiles = absOrderedFiles.slice(maxFiles, absOrderedFiles.length);
+      exceedingFiles.forEach((file) => filesToDelete.add(file));
+    }
+
+    if (maxAccumulatedFileSize) {
+      const toRemoveByFileSize = await listFilesExceedingSize({
+        orderedFiles: absOrderedFiles,
+        maxSizeInBytes: maxAccumulatedFileSize.getValueInBytes(),
+      });
+      toRemoveByFileSize.forEach((file) => filesToDelete.add(file));
+    }
+
+    if (removeOlderThan) {
+      const toRemoveByAge = await listFilesOlderThan({
+        orderedFiles: absOrderedFiles,
+        duration: removeOlderThan,
+      });
+      toRemoveByAge.forEach((file) => filesToDelete.add(file));
+    }
+
+    if (filesToDelete.size > 0) {
+      await deleteFiles({
+        filesToDelete: [...filesToDelete],
+      });
+    }
+  }
+}
diff --git a/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/retention/utils.test.mocks.ts b/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/retention/utils.test.mocks.ts
new file mode 100644
index 00000000000000..ed8da1f9e513b3
--- /dev/null
+++ b/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/retention/utils.test.mocks.ts
@@ -0,0 +1,19 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import type { getFileInfo } from './fs';
+
+export const getFileInfoMock: jest.MockedFn<typeof getFileInfo> = jest.fn();
+
+jest.doMock('./fs', () => {
+  const actual = jest.requireActual('./fs');
+  return {
+    ...actual,
+    getFileInfo: getFileInfoMock,
+  };
+});
diff --git a/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/retention/utils.test.ts b/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/retention/utils.test.ts
new file mode 100644
index 00000000000000..deba5ff7265f84
--- /dev/null
+++ b/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/retention/utils.test.ts
@@ -0,0 +1,104 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import moment from 'moment-timezone';
+import { getFileInfoMock } from './utils.test.mocks';
+import { listFilesOlderThan, listFilesExceedingSize } from './utils';
+
+describe('listFilesExceedingSize', () => {
+  beforeEach(() => {
+    getFileInfoMock.mockReset();
+  });
+
+  const mockWithSizeMap = (fileSizeMap: Record<string, number | undefined>) => {
+    getFileInfoMock.mockImplementation(async (fileName) => {
+      const fileSize = fileSizeMap[fileName];
+      if (fileSize !== undefined) {
+        return { exist: true, size: fileSize, mtime: new Date() };
+      }
+      return { exist: false };
+    });
+  };
+
+  it('returns an empty list if total accumulated size is lower than the limit', async () => {
+    mockWithSizeMap({
+      'file-1': 50,
+      'file-2': 50,
+      'file-3': 50,
+    });
+
+    const result = await listFilesExceedingSize({
+      orderedFiles: ['file-1', 'file-2', 'file-3'],
+      maxSizeInBytes: 200,
+    });
+
+    expect(result).toEqual([]);
+  });
+
+  it('returns the list of files over the limit, including the one that breached the limit', async () => {
+    mockWithSizeMap({
+      'file-1': 100,
+      'file-2': 100,
+      'file-3': 100,
+      'file-4': 100,
+    });
+
+    const result = await listFilesExceedingSize({
+      orderedFiles: ['file-1', 'file-2', 'file-3', 'file-4'],
+      maxSizeInBytes: 250,
+    });
+
+    expect(result).toEqual(['file-3', 'file-4']);
+  });
+});
+
+describe('listFilesOlderThan', () => {
+  beforeEach(() => {
+    getFileInfoMock.mockReset();
+  });
+
+  const mockWithMtime = (fileMtimeMap: Record<string, Date | undefined>) => {
+    getFileInfoMock.mockImplementation(async (fileName) => {
+      const fileDate = fileMtimeMap[fileName];
+      if (fileDate !== undefined) {
+        return { exist: true, size: 0, mtime: fileDate };
+      }
+      return { exist: false };
+    });
+  };
+
+  it('returns an empty list if total accumulated size is lower than the limit', async () => {
+    mockWithMtime({
+      'file-1': moment().add(-1, 'day').toDate(),
+      'file-2': moment().add(-10, 'day').toDate(),
+      'file-3': moment().add(-20, 'day').toDate(),
+    });
+
+    const result = await listFilesOlderThan({
+      orderedFiles: ['file-1', 'file-2', 'file-3'],
+      duration: moment.duration(15, 'day'),
+    });
+
+    expect(result).toEqual(['file-3']);
+  });
+
+  it('ignores files that were not found', async () => {
+    mockWithMtime({
+      'file-1': moment().add(-1, 'day').toDate(),
+      'file-2': moment().add(-20, 'day').toDate(),
+      'file-3': undefined,
+    });
+
+    const result = await listFilesOlderThan({
+      orderedFiles: ['file-1', 'file-2', 'file-3'],
+      duration: moment.duration(15, 'day'),
+    });
+
+    expect(result).toEqual(['file-2']);
+  });
+});
diff --git a/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/retention/utils.ts b/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/retention/utils.ts
new file mode 100644
index 00000000000000..4b75ac5eb63803
--- /dev/null
+++ b/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/retention/utils.ts
@@ -0,0 +1,56 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import moment, { type Duration } from 'moment-timezone';
+import { getFileInfo } from './fs';
+
+export const listFilesExceedingSize = async ({
+  orderedFiles,
+  maxSizeInBytes,
+}: {
+  orderedFiles: string[];
+  maxSizeInBytes: number;
+}): Promise<string[]> => {
+  let currentSize = 0;
+
+  for (let i = 0; i < orderedFiles.length; i++) {
+    const filePath = orderedFiles[i];
+    const stats = await getFileInfo(filePath);
+    if (stats.exist) {
+      currentSize += stats.size;
+      if (currentSize > maxSizeInBytes) {
+        return orderedFiles.slice(i);
+      }
+    }
+  }
+
+  return [];
+};
+
+export const listFilesOlderThan = async ({
+  orderedFiles,
+  duration,
+}: {
+  orderedFiles: string[];
+  duration: Duration;
+}): Promise<string[]> => {
+  const filesOlderThanLimit = [];
+  const timeLimit = moment().subtract(duration).toDate().getTime();
+
+  for (let i = 0; i < orderedFiles.length; i++) {
+    const filePath = orderedFiles[i];
+    const stats = await getFileInfo(filePath);
+    if (stats.exist) {
+      if (stats.mtime.getTime() < timeLimit) {
+        filesOlderThanLimit.push(filePath);
+      }
+    }
+  }
+
+  return filesOlderThanLimit;
+};
diff --git a/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/rolling_file_appender.test.mocks.ts b/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/rolling_file_appender.test.mocks.ts
index b9037106329698..2384db0d573a44 100644
--- a/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/rolling_file_appender.test.mocks.ts
+++ b/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/rolling_file_appender.test.mocks.ts
@@ -38,10 +38,20 @@ jest.doMock('./rolling_file_context', () => ({
   RollingFileContext: RollingFileContextMock,
 }));
 
+export const createRetentionPolicyMock = jest.fn();
+jest.doMock('./retention', () => {
+  const actual = jest.requireActual('./retention');
+  return {
+    ...actual,
+    createRetentionPolicy: createRetentionPolicyMock,
+  };
+});
+
 export const resetAllMocks = () => {
   LayoutsMock.create.mockReset();
   createTriggeringPolicyMock.mockReset();
   createRollingStrategyMock.mockReset();
+  createRetentionPolicyMock.mockReset();
   RollingFileManagerMock.mockReset();
   RollingFileContextMock.mockReset();
 };
diff --git a/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/rolling_file_appender.test.ts b/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/rolling_file_appender.test.ts
index f5bdc5d3070841..1379dc13da70f2 100644
--- a/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/rolling_file_appender.test.ts
+++ b/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/rolling_file_appender.test.ts
@@ -9,6 +9,7 @@
 import {
   createRollingStrategyMock,
   createTriggeringPolicyMock,
+  createRetentionPolicyMock,
   LayoutsMock,
   resetAllMocks,
   RollingFileContextMock,
@@ -38,6 +39,9 @@ const config: RollingFileAppenderConfig = {
     max: 5,
     pattern: '-%i',
   },
+  retention: {
+    maxFiles: 7,
+  },
 };
 
 const createLogRecord = (parts: Partial<LogRecord> = {}): LogRecord => ({
@@ -72,6 +76,7 @@ describe('RollingFileAppender', () => {
   let layout: ReturnType<typeof rollingFileAppenderMocks.createLayout>;
   let strategy: ReturnType<typeof rollingFileAppenderMocks.createStrategy>;
   let policy: ReturnType<typeof rollingFileAppenderMocks.createPolicy>;
+  let retention: ReturnType<typeof rollingFileAppenderMocks.createRetentionPolicy>;
   let context: ReturnType<typeof rollingFileAppenderMocks.createContext>;
   let fileManager: ReturnType<typeof rollingFileAppenderMocks.createFileManager>;
 
@@ -85,6 +90,9 @@ describe('RollingFileAppender', () => {
     strategy = rollingFileAppenderMocks.createStrategy();
     createRollingStrategyMock.mockReturnValue(strategy);
 
+    retention = rollingFileAppenderMocks.createRetentionPolicy();
+    createRetentionPolicyMock.mockReturnValue(retention);
+
     context = rollingFileAppenderMocks.createContext('file-path');
     RollingFileContextMock.mockImplementation(() => context);
 
@@ -111,6 +119,9 @@ describe('RollingFileAppender', () => {
     expect(createTriggeringPolicyMock).toHaveBeenCalledTimes(1);
     expect(createTriggeringPolicyMock).toHaveBeenCalledWith(config.policy, context);
 
+    expect(createRetentionPolicyMock).toHaveBeenCalledTimes(1);
+    expect(createRetentionPolicyMock).toHaveBeenCalledWith(config.retention, context);
+
     expect(createRollingStrategyMock).toHaveBeenCalledTimes(1);
     expect(createRollingStrategyMock).toHaveBeenCalledWith(config.strategy, context);
   });
@@ -189,6 +200,21 @@ describe('RollingFileAppender', () => {
         expect(fileManager.closeStream).toHaveBeenCalledTimes(1);
       });
 
+      it('triggers the retention policy once the rollout is complete', async () => {
+        const { promise, resolve } = createPromiseResolver();
+        strategy.rollout.mockReturnValue(promise);
+
+        const log = createLogRecord({ message: '1' });
+        appender.append(log);
+
+        expect(retention.apply).not.toHaveBeenCalled();
+
+        resolve();
+        await nextTick();
+
+        expect(retention.apply).toHaveBeenCalledTimes(1);
+      });
+
       it('logs the event once the rollout is complete', async () => {
         const { promise, resolve } = createPromiseResolver();
         strategy.rollout.mockReturnValue(promise);
diff --git a/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/rolling_file_appender.ts b/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/rolling_file_appender.ts
index 3dee8a83c4c084..33c3af6ed5a5f1 100644
--- a/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/rolling_file_appender.ts
+++ b/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/rolling_file_appender.ts
@@ -7,12 +7,26 @@
  */
 
 import { schema } from '@kbn/config-schema';
-import { LogRecord, Layout, DisposableAppender } from '@kbn/logging';
+import type { LogRecord, Layout, DisposableAppender } from '@kbn/logging';
 import type { RollingFileAppenderConfig } from '@kbn/core-logging-server';
 import { Layouts } from '../../layouts/layouts';
 import { BufferAppender } from '../buffer/buffer_appender';
-import { createTriggeringPolicy, triggeringPolicyConfigSchema, TriggeringPolicy } from './policies';
-import { RollingStrategy, createRollingStrategy, rollingStrategyConfigSchema } from './strategies';
+import {
+  createTriggeringPolicy,
+  triggeringPolicyConfigSchema,
+  type TriggeringPolicy,
+} from './policies';
+import {
+  createRollingStrategy,
+  rollingStrategyConfigSchema,
+  type RollingStrategy,
+} from './strategies';
+import {
+  createRetentionPolicy,
+  mergeRetentionPolicyConfig,
+  retentionPolicyConfigSchema,
+  type RetentionPolicy,
+} from './retention';
 import { RollingFileManager } from './rolling_file_manager';
 import { RollingFileContext } from './rolling_file_context';
 
@@ -27,6 +41,7 @@ export class RollingFileAppender implements DisposableAppender {
     fileName: schema.string(),
     policy: triggeringPolicyConfigSchema,
     strategy: rollingStrategyConfigSchema,
+    retention: schema.maybe(retentionPolicyConfigSchema),
   });
 
   private isRolling = false;
@@ -36,8 +51,9 @@ export class RollingFileAppender implements DisposableAppender {
   private readonly layout: Layout;
   private readonly context: RollingFileContext;
   private readonly fileManager: RollingFileManager;
-  private readonly policy: TriggeringPolicy;
-  private readonly strategy: RollingStrategy;
+  private readonly triggeringPolicy: TriggeringPolicy;
+  private readonly rollingStrategy: RollingStrategy;
+  private readonly retentionPolicy: RetentionPolicy;
   private readonly buffer: BufferAppender;
 
   constructor(config: RollingFileAppenderConfig) {
@@ -45,8 +61,12 @@ export class RollingFileAppender implements DisposableAppender {
     this.context.refreshFileInfo();
     this.fileManager = new RollingFileManager(this.context);
     this.layout = Layouts.create(config.layout);
-    this.policy = createTriggeringPolicy(config.policy, this.context);
-    this.strategy = createRollingStrategy(config.strategy, this.context);
+    this.triggeringPolicy = createTriggeringPolicy(config.policy, this.context);
+    this.rollingStrategy = createRollingStrategy(config.strategy, this.context);
+    this.retentionPolicy = createRetentionPolicy(
+      mergeRetentionPolicyConfig(config.retention, config.strategy),
+      this.context
+    );
     this.buffer = new BufferAppender();
   }
 
@@ -96,8 +116,9 @@ export class RollingFileAppender implements DisposableAppender {
     }
     this.isRolling = true;
     try {
-      await this.strategy.rollout();
+      await this.rollingStrategy.rollout();
       await this.fileManager.closeStream();
+      await this.retentionPolicy.apply();
     } catch (e) {
       // eslint-disable-next-line no-console
       console.error('[RollingFileAppender]: error while rolling file: ', e);
@@ -129,6 +150,6 @@ export class RollingFileAppender implements DisposableAppender {
    * Checks if the current event should trigger a rollout
    */
   private needRollout(record: LogRecord) {
-    return this.policy.isTriggeringEvent(record);
+    return this.triggeringPolicy.isTriggeringEvent(record);
   }
 }
diff --git a/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/rolling_file_context.ts b/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/rolling_file_context.ts
index 744a15535a8634..995cd08583e05b 100644
--- a/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/rolling_file_context.ts
+++ b/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/rolling_file_context.ts
@@ -8,6 +8,8 @@
 
 import { statSync } from 'fs';
 
+export type GetOrderedRolledFileFn = () => Promise<string[]>;
+
 /**
  * Context shared between the rolling file manager, policy and strategy.
  */
@@ -36,4 +38,17 @@ export class RollingFileContext {
       this.currentFileSize = 0;
     }
   }
+
+  #orderedRolledFileFn?: GetOrderedRolledFileFn;
+
+  public async getOrderedRolledFiles(): Promise<string[]> {
+    if (this.#orderedRolledFileFn) {
+      return this.#orderedRolledFileFn();
+    }
+    throw new Error('orderedRolledFileFn not registered on the context');
+  }
+
+  public setOrderedRolledFileFn(fn: GetOrderedRolledFileFn) {
+    this.#orderedRolledFileFn = fn;
+  }
 }
diff --git a/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/strategies/numeric/numeric_strategy.test.mocks.ts b/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/strategies/numeric/numeric_strategy.test.mocks.ts
index 4ba76cb5148a02..cba9531feaa110 100644
--- a/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/strategies/numeric/numeric_strategy.test.mocks.ts
+++ b/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/strategies/numeric/numeric_strategy.test.mocks.ts
@@ -7,14 +7,12 @@
  */
 
 export const getOrderedRolledFilesMock = jest.fn();
-export const deleteFilesMock = jest.fn();
 export const rollPreviousFilesInOrderMock = jest.fn();
 export const rollCurrentFileMock = jest.fn();
 export const shouldSkipRolloutMock = jest.fn();
 
 jest.doMock('./rolling_tasks', () => ({
   getOrderedRolledFiles: getOrderedRolledFilesMock,
-  deleteFiles: deleteFilesMock,
   rollPreviousFilesInOrder: rollPreviousFilesInOrderMock,
   rollCurrentFile: rollCurrentFileMock,
   shouldSkipRollout: shouldSkipRolloutMock,
@@ -23,7 +21,6 @@ jest.doMock('./rolling_tasks', () => ({
 export const resetAllMock = () => {
   shouldSkipRolloutMock.mockReset();
   getOrderedRolledFilesMock.mockReset();
-  deleteFilesMock.mockReset();
   rollPreviousFilesInOrderMock.mockReset();
   rollCurrentFileMock.mockReset();
 };
diff --git a/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/strategies/numeric/numeric_strategy.test.ts b/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/strategies/numeric/numeric_strategy.test.ts
index 731c0079bd9e7a..3571daa30ab431 100644
--- a/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/strategies/numeric/numeric_strategy.test.ts
+++ b/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/strategies/numeric/numeric_strategy.test.ts
@@ -10,7 +10,6 @@ import { join } from 'path';
 import {
   resetAllMock,
   shouldSkipRolloutMock,
-  deleteFilesMock,
   getOrderedRolledFilesMock,
   rollCurrentFileMock,
   rollPreviousFilesInOrderMock,
@@ -42,6 +41,11 @@ describe('NumericRollingStrategy', () => {
     resetAllMock();
   });
 
+  it('calls `context.setOrderedRolledFileFn` in constructor', () => {
+    expect(context.setOrderedRolledFileFn).toHaveBeenCalledTimes(1);
+    expect(context.setOrderedRolledFileFn).toHaveBeenCalledWith(expect.any(Function));
+  });
+
   it('calls `getOrderedRolledFiles` with the correct parameters', async () => {
     await strategy.rollout();
 
@@ -53,23 +57,6 @@ describe('NumericRollingStrategy', () => {
     });
   });
 
-  it('calls `deleteFiles` with the correct files', async () => {
-    getOrderedRolledFilesMock.mockResolvedValue([
-      'kibana.1.log',
-      'kibana.2.log',
-      'kibana.3.log',
-      'kibana.4.log',
-    ]);
-
-    await strategy.rollout();
-
-    expect(deleteFilesMock).toHaveBeenCalledTimes(1);
-    expect(deleteFilesMock).toHaveBeenCalledWith({
-      filesToDelete: ['kibana.3.log', 'kibana.4.log'],
-      logFileFolder,
-    });
-  });
-
   it('calls `rollPreviousFilesInOrder` with the correct files', async () => {
     getOrderedRolledFilesMock.mockResolvedValue([
       'kibana.1.log',
@@ -82,7 +69,7 @@ describe('NumericRollingStrategy', () => {
 
     expect(rollPreviousFilesInOrderMock).toHaveBeenCalledTimes(1);
     expect(rollPreviousFilesInOrderMock).toHaveBeenCalledWith({
-      filesToRoll: ['kibana.1.log', 'kibana.2.log'],
+      filesToRoll: ['kibana.1.log', 'kibana.2.log', 'kibana.3.log', 'kibana.4.log'],
       logFileFolder,
       logFileBaseName,
       pattern,
@@ -116,24 +103,14 @@ describe('NumericRollingStrategy', () => {
 
     await strategy.rollout();
 
-    const deleteFilesCall = deleteFilesMock.mock.invocationCallOrder[0];
     const rollPreviousFilesInOrderCall = rollPreviousFilesInOrderMock.mock.invocationCallOrder[0];
     const rollCurrentFileCall = rollCurrentFileMock.mock.invocationCallOrder[0];
     const refreshFileInfoCall = context.refreshFileInfo.mock.invocationCallOrder[0];
 
-    expect(deleteFilesCall).toBeLessThan(rollPreviousFilesInOrderCall);
     expect(rollPreviousFilesInOrderCall).toBeLessThan(rollCurrentFileCall);
     expect(rollCurrentFileCall).toBeLessThan(refreshFileInfoCall);
   });
 
-  it('do not calls `deleteFiles` if no file should be deleted', async () => {
-    getOrderedRolledFilesMock.mockResolvedValue(['kibana.1.log', 'kibana.2.log']);
-
-    await strategy.rollout();
-
-    expect(deleteFilesMock).not.toHaveBeenCalled();
-  });
-
   it('do not calls `rollPreviousFilesInOrder` if no file should be rolled', async () => {
     getOrderedRolledFilesMock.mockResolvedValue([]);
 
@@ -154,7 +131,6 @@ describe('NumericRollingStrategy', () => {
     await strategy.rollout();
 
     expect(getOrderedRolledFilesMock).not.toHaveBeenCalled();
-    expect(deleteFilesMock).not.toHaveBeenCalled();
     expect(rollPreviousFilesInOrderMock).not.toHaveBeenCalled();
     expect(rollCurrentFileMock).not.toHaveBeenCalled();
     expect(context.refreshFileInfo).not.toHaveBeenCalled();
diff --git a/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/strategies/numeric/numeric_strategy.ts b/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/strategies/numeric/numeric_strategy.ts
index f63c78264dc469..8791b3f46e52a5 100644
--- a/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/strategies/numeric/numeric_strategy.ts
+++ b/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/strategies/numeric/numeric_strategy.ts
@@ -14,7 +14,6 @@ import { RollingFileContext } from '../../rolling_file_context';
 import {
   shouldSkipRollout,
   getOrderedRolledFiles,
-  deleteFiles,
   rollCurrentFile,
   rollPreviousFilesInOrder,
 } from './rolling_tasks';
@@ -46,7 +45,8 @@ export const numericRollingStrategyConfigSchema = schema.object({
  *       strategy:
  *         type: numeric
  *         pattern: "-%i"
- *         max: 2
+ *       retention:
+ *         maxFiles: 2
  * ```
  * - During the first rollover kibana.log is renamed to kibana-1.log. A new kibana.log file is created and starts
  *   being written to.
@@ -69,6 +69,15 @@ export class NumericRollingStrategy implements RollingStrategy {
     this.logFilePath = this.context.filePath;
     this.logFileBaseName = basename(this.context.filePath);
     this.logFileFolder = dirname(this.context.filePath);
+    context.setOrderedRolledFileFn(this.getOrderedRolledFiles.bind(this));
+  }
+
+  private async getOrderedRolledFiles() {
+    return await getOrderedRolledFiles({
+      logFileFolder: this.logFileFolder,
+      logFileBaseName: this.logFileBaseName,
+      pattern: this.config.pattern,
+    });
   }
 
   async rollout() {
@@ -82,20 +91,15 @@ export class NumericRollingStrategy implements RollingStrategy {
     }
 
     // get the files matching the pattern in the folder, and sort them by `%i` value
-    const orderedFiles = await getOrderedRolledFiles({
-      logFileFolder,
-      logFileBaseName,
-      pattern,
-    });
-    const filesToRoll = orderedFiles.slice(0, this.config.max - 1);
-    const filesToDelete = orderedFiles.slice(filesToRoll.length, orderedFiles.length);
-
-    if (filesToDelete.length > 0) {
-      await deleteFiles({ logFileFolder, filesToDelete });
-    }
+    const orderedFilesToRoll = await this.getOrderedRolledFiles();
 
-    if (filesToRoll.length > 0) {
-      await rollPreviousFilesInOrder({ filesToRoll, logFileFolder, logFileBaseName, pattern });
+    if (orderedFilesToRoll.length > 0) {
+      await rollPreviousFilesInOrder({
+        filesToRoll: orderedFilesToRoll,
+        logFileFolder,
+        logFileBaseName,
+        pattern,
+      });
     }
 
     await rollCurrentFile({ pattern, logFileBaseName, logFileFolder });
diff --git a/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/strategies/numeric/rolling_tasks.test.mocks.ts b/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/strategies/numeric/rolling_tasks.test.mocks.ts
index 03d51ea68cac15..3a69c86fcb7473 100644
--- a/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/strategies/numeric/rolling_tasks.test.mocks.ts
+++ b/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/strategies/numeric/rolling_tasks.test.mocks.ts
@@ -7,20 +7,17 @@
  */
 
 export const readdirMock = jest.fn();
-export const unlinkMock = jest.fn();
 export const renameMock = jest.fn();
 export const accessMock = jest.fn();
 
 jest.doMock('fs/promises', () => ({
   readdir: readdirMock,
-  unlink: unlinkMock,
   rename: renameMock,
   access: accessMock,
 }));
 
 export const clearAllMocks = () => {
   readdirMock.mockClear();
-  unlinkMock.mockClear();
   renameMock.mockClear();
   accessMock.mockClear();
 };
diff --git a/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/strategies/numeric/rolling_tasks.test.ts b/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/strategies/numeric/rolling_tasks.test.ts
index 3f7c56bac582b0..12d408f9ab6117 100644
--- a/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/strategies/numeric/rolling_tasks.test.ts
+++ b/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/strategies/numeric/rolling_tasks.test.ts
@@ -7,18 +7,11 @@
  */
 
 import { join } from 'path';
-import {
-  accessMock,
-  readdirMock,
-  renameMock,
-  unlinkMock,
-  clearAllMocks,
-} from './rolling_tasks.test.mocks';
+import { accessMock, readdirMock, renameMock, clearAllMocks } from './rolling_tasks.test.mocks';
 import {
   shouldSkipRollout,
   rollCurrentFile,
   rollPreviousFilesInOrder,
-  deleteFiles,
   getOrderedRolledFiles,
 } from './rolling_tasks';
 
@@ -97,26 +90,6 @@ describe('NumericRollingStrategy tasks', () => {
     });
   });
 
-  describe('deleteFiles', () => {
-    it('calls `unlink` once for each file', async () => {
-      await deleteFiles({
-        logFileFolder: 'log-folder',
-        filesToDelete: ['file-a', 'file-b', 'file-c'],
-      });
-
-      expect(unlinkMock).toHaveBeenCalledTimes(3);
-    });
-    it('calls `unlink` with the correct parameters', async () => {
-      await deleteFiles({
-        logFileFolder: 'log-folder',
-        filesToDelete: ['file-a', 'file-b'],
-      });
-
-      expect(unlinkMock).toHaveBeenNthCalledWith(1, join('log-folder', 'file-a'));
-      expect(unlinkMock).toHaveBeenNthCalledWith(2, join('log-folder', 'file-b'));
-    });
-  });
-
   describe('getOrderedRolledFiles', () => {
     it('returns the rolled files matching the pattern in order', async () => {
       readdirMock.mockResolvedValue([
diff --git a/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/strategies/numeric/rolling_tasks.ts b/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/strategies/numeric/rolling_tasks.ts
index 15bae8901ddcbd..4f880653cb81b9 100644
--- a/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/strategies/numeric/rolling_tasks.ts
+++ b/packages/core/logging/core-logging-server-internal/src/appenders/rolling_file/strategies/numeric/rolling_tasks.ts
@@ -7,7 +7,7 @@
  */
 
 import { join } from 'path';
-import { readdir, unlink, access } from 'fs/promises';
+import { readdir, access } from 'fs/promises';
 import { getFileNameMatcher, getRollingFileName } from './pattern_matcher';
 import { moveFile } from './utils';
 
@@ -47,16 +47,6 @@ export const getOrderedRolledFiles = async ({
     .map(({ fileName }) => fileName);
 };
 
-export const deleteFiles = async ({
-  logFileFolder,
-  filesToDelete,
-}: {
-  logFileFolder: string;
-  filesToDelete: string[];
-}) => {
-  await Promise.all(filesToDelete.map((fileToDelete) => unlink(join(logFileFolder, fileToDelete))));
-};
-
 export const rollPreviousFilesInOrder = async ({
   filesToRoll,
   logFileFolder,
diff --git a/packages/core/logging/core-logging-server/index.ts b/packages/core/logging/core-logging-server/index.ts
index 1cade96cf3d01b..16f4b188fee236 100644
--- a/packages/core/logging/core-logging-server/index.ts
+++ b/packages/core/logging/core-logging-server/index.ts
@@ -23,4 +23,5 @@ export type {
   RewritePolicyConfig,
   MetaRewritePolicyConfigProperty,
   MetaRewritePolicyConfig,
+  RetentionPolicyConfig,
 } from './src/appenders';
diff --git a/packages/core/logging/core-logging-server/src/appenders/index.ts b/packages/core/logging/core-logging-server/src/appenders/index.ts
index 698b70c9393476..ddaa4c9ee1ae18 100644
--- a/packages/core/logging/core-logging-server/src/appenders/index.ts
+++ b/packages/core/logging/core-logging-server/src/appenders/index.ts
@@ -26,6 +26,7 @@ export type {
   TimeIntervalTriggeringPolicyConfig,
   NumericRollingStrategyConfig,
   RollingStrategyConfig,
+  RetentionPolicyConfig,
 } from './rolling_file';
 
 /** @public */
diff --git a/packages/core/logging/core-logging-server/src/appenders/rolling_file.ts b/packages/core/logging/core-logging-server/src/appenders/rolling_file.ts
index 4de6c92cedd0aa..dda8a57a940c74 100644
--- a/packages/core/logging/core-logging-server/src/appenders/rolling_file.ts
+++ b/packages/core/logging/core-logging-server/src/appenders/rolling_file.ts
@@ -32,6 +32,10 @@ export interface RollingFileAppenderConfig {
    * The {@link RollingStrategy | rollout strategy} to use for rolling.
    */
   strategy: RollingStrategyConfig;
+  /**
+   * The {@link RetentionPolicy | retention strategy} to use to know which files to keep.
+   */
+  retention?: RetentionPolicyConfig;
 }
 
 /**
@@ -106,6 +110,14 @@ export interface NumericRollingStrategyConfig {
   /**
    * The maximum number of files to keep. Once this number is reached, oldest
    * files will be deleted. Defaults to `7`
+   *
+   * @deprecated use retention policy instead
    */
   max: number;
 }
+
+export interface RetentionPolicyConfig {
+  maxFiles?: number;
+  maxAccumulatedFileSize?: ByteSizeValue;
+  removeOlderThan?: Duration;
+}
diff --git a/packages/core/saved-objects/core-saved-objects-base-server-internal/src/constants.ts b/packages/core/saved-objects/core-saved-objects-base-server-internal/src/constants.ts
index f39d0d8ab26a8a..d4861ae5808ad7 100644
--- a/packages/core/saved-objects/core-saved-objects-base-server-internal/src/constants.ts
+++ b/packages/core/saved-objects/core-saved-objects-base-server-internal/src/constants.ts
@@ -182,7 +182,7 @@ export const HASH_TO_VERSION_MAP = {
   'infrastructure-monitoring-log-view|c50526fc6040c5355ed027d34d05b35c': '10.0.0',
   'infrastructure-ui-source|3d1b76c39bfb2cc8296b024d73854724': '10.0.0',
   'ingest_manager_settings|b91ffb075799c78ffd7dbd51a279c8c9': '10.1.0',
-  'ingest-agent-policies|0fd93cd11c019b118e93a9157c22057b': '10.1.0',
+  'ingest-agent-policies|0ab9774bc7728d0c0f37d841570f2872': '10.2.0',
   'ingest-download-sources|0b0f6828e59805bd07a650d80817c342': '10.0.0',
   'ingest-outputs|b1237f7fdc0967709e75d65d208ace05': '10.6.0',
   'ingest-package-policies|ca63c4c5a946704f045803a6b975dbc6': '10.9.0',
diff --git a/packages/core/usage-data/core-usage-data-server-internal/src/core_usage_data_service.test.ts b/packages/core/usage-data/core-usage-data-server-internal/src/core_usage_data_service.test.ts
index 11602704cf0f0a..a2f5baacca07aa 100644
--- a/packages/core/usage-data/core-usage-data-server-internal/src/core_usage_data_service.test.ts
+++ b/packages/core/usage-data/core-usage-data-server-internal/src/core_usage_data_service.test.ts
@@ -377,9 +377,12 @@ describe('CoreUsageDataService', () => {
             },
             "environment": Object {
               "memory": Object {
+                "arrayBuffersBytes": 1,
+                "externalBytes": 1,
                 "heapSizeLimit": 1,
                 "heapTotalBytes": 1,
                 "heapUsedBytes": 1,
+                "residentSetSizeBytes": 1,
               },
             },
             "services": Object {
diff --git a/packages/core/usage-data/core-usage-data-server-internal/src/core_usage_data_service.ts b/packages/core/usage-data/core-usage-data-server-internal/src/core_usage_data_service.ts
index 261db435a1a730..eaa2b0888147bd 100644
--- a/packages/core/usage-data/core-usage-data-server-internal/src/core_usage_data_service.ts
+++ b/packages/core/usage-data/core-usage-data-server-internal/src/core_usage_data_service.ts
@@ -333,6 +333,9 @@ export class CoreUsageDataService
       },
       environment: {
         memory: {
+          arrayBuffersBytes: this.opsMetrics.process.memory.array_buffers_in_bytes,
+          residentSetSizeBytes: this.opsMetrics.process.memory.resident_set_size_in_bytes,
+          externalBytes: this.opsMetrics.process.memory.external_in_bytes,
           heapSizeLimit: this.opsMetrics.process.memory.heap.size_limit,
           heapTotalBytes: this.opsMetrics.process.memory.heap.total_in_bytes,
           heapUsedBytes: this.opsMetrics.process.memory.heap.used_in_bytes,
diff --git a/packages/core/usage-data/core-usage-data-server-mocks/src/core_usage_data_service.mock.ts b/packages/core/usage-data/core-usage-data-server-mocks/src/core_usage_data_service.mock.ts
index 3b81d25460d9d0..1c13f607912dce 100644
--- a/packages/core/usage-data/core-usage-data-server-mocks/src/core_usage_data_service.mock.ts
+++ b/packages/core/usage-data/core-usage-data-server-mocks/src/core_usage_data_service.mock.ts
@@ -128,6 +128,9 @@ const createStartContractMock = () => {
         },
         environment: {
           memory: {
+            arrayBuffersBytes: 1,
+            externalBytes: 1,
+            residentSetSizeBytes: 1,
             heapSizeLimit: 1,
             heapTotalBytes: 1,
             heapUsedBytes: 1,
diff --git a/packages/core/usage-data/core-usage-data-server/src/core_usage_data.ts b/packages/core/usage-data/core-usage-data-server/src/core_usage_data.ts
index c10ad14d9f7f31..f3905c9879c662 100644
--- a/packages/core/usage-data/core-usage-data-server/src/core_usage_data.ts
+++ b/packages/core/usage-data/core-usage-data-server/src/core_usage_data.ts
@@ -38,6 +38,9 @@ export interface CoreServicesUsageData {
  */
 export interface CoreEnvironmentUsageData {
   memory: {
+    arrayBuffersBytes: number;
+    residentSetSizeBytes: number;
+    externalBytes: number;
     heapTotalBytes: number;
     heapUsedBytes: number;
     /** V8 heap size limit */
diff --git a/packages/kbn-apm-synthtrace/index.ts b/packages/kbn-apm-synthtrace/index.ts
index 8ed45126e7cf94..459e3802ae6606 100644
--- a/packages/kbn-apm-synthtrace/index.ts
+++ b/packages/kbn-apm-synthtrace/index.ts
@@ -14,7 +14,7 @@ export { InfraSynthtraceEsClient } from './src/lib/infra/infra_synthtrace_es_cli
 export { InfraSynthtraceKibanaClient } from './src/lib/infra/infra_synthtrace_kibana_client';
 export { MonitoringSynthtraceEsClient } from './src/lib/monitoring/monitoring_synthtrace_es_client';
 export { LogsSynthtraceEsClient } from './src/lib/logs/logs_synthtrace_es_client';
-
+export { AssetsSynthtraceEsClient } from './src/lib/assets/assets_synthtrace_es_client';
 export {
   addObserverVersionTransform,
   deleteSummaryFieldTransform,
diff --git a/packages/kbn-apm-synthtrace/src/lib/apm/client/apm_synthtrace_es_client/apm_pipeline.ts b/packages/kbn-apm-synthtrace/src/lib/apm/client/apm_synthtrace_es_client/apm_pipeline.ts
index bd6acc25431a71..a31b800d864c5d 100644
--- a/packages/kbn-apm-synthtrace/src/lib/apm/client/apm_synthtrace_es_client/apm_pipeline.ts
+++ b/packages/kbn-apm-synthtrace/src/lib/apm/client/apm_synthtrace_es_client/apm_pipeline.ts
@@ -6,11 +6,13 @@
  * Side Public License, v 1.
  */
 
+import semver from 'semver';
 import { PassThrough, pipeline, Readable } from 'stream';
 import { getDedotTransform } from '../../../shared/get_dedot_transform';
 import { getSerializeTransform } from '../../../shared/get_serialize_transform';
 import { Logger } from '../../../utils/create_logger';
 import { fork } from '../../../utils/stream_utils';
+import { deleteSummaryFieldTransform } from '../../../utils/transform_helpers';
 import { createBreakdownMetricsAggregator } from '../../aggregators/create_breakdown_metrics_aggregator';
 import { createServiceMetricsAggregator } from '../../aggregators/create_service_metrics_aggregator';
 import { createServiceSummaryMetricsAggregator } from '../../aggregators/create_service_summary_metrics_aggregator';
@@ -22,22 +24,32 @@ import { getRoutingTransform } from './get_routing_transform';
 
 export function apmPipeline(logger: Logger, version: string, includeSerialization: boolean = true) {
   return (base: Readable) => {
+    const continousRollupSupported =
+      !version || semver.gte(semver.coerce(version)?.version ?? version, '8.7.0');
+
     const aggregators = [
       createTransactionMetricsAggregator('1m'),
-      createTransactionMetricsAggregator('10m'),
-      createTransactionMetricsAggregator('60m'),
-      createServiceMetricsAggregator('1m'),
-      createServiceMetricsAggregator('10m'),
-      createServiceMetricsAggregator('60m'),
-      createServiceSummaryMetricsAggregator('1m'),
-      createServiceSummaryMetricsAggregator('10m'),
-      createServiceSummaryMetricsAggregator('60m'),
       createSpanMetricsAggregator('1m'),
-      createSpanMetricsAggregator('10m'),
-      createSpanMetricsAggregator('60m'),
+      ...(continousRollupSupported
+        ? [
+            createTransactionMetricsAggregator('10m'),
+            createTransactionMetricsAggregator('60m'),
+            createServiceMetricsAggregator('1m'),
+            createServiceMetricsAggregator('10m'),
+            createServiceMetricsAggregator('60m'),
+            createServiceSummaryMetricsAggregator('1m'),
+            createServiceSummaryMetricsAggregator('10m'),
+            createServiceSummaryMetricsAggregator('60m'),
+            createSpanMetricsAggregator('10m'),
+            createSpanMetricsAggregator('60m'),
+          ]
+        : []),
     ];
 
     const serializationTransform = includeSerialization ? [getSerializeTransform()] : [];
+    const removeDurationSummaryTransform = !continousRollupSupported
+      ? [deleteSummaryFieldTransform()]
+      : [];
 
     return pipeline(
       // @ts-expect-error Some weird stuff here with the type definition for pipeline. We have tests!
@@ -49,6 +61,7 @@ export function apmPipeline(logger: Logger, version: string, includeSerializatio
       getApmServerMetadataTransform(version),
       getRoutingTransform(),
       getDedotTransform(),
+      ...removeDurationSummaryTransform,
       (err) => {
         if (err) {
           logger.error(err);
diff --git a/packages/kbn-apm-synthtrace/src/lib/apm/client/apm_synthtrace_es_client/index.ts b/packages/kbn-apm-synthtrace/src/lib/apm/client/apm_synthtrace_es_client/index.ts
index 310c33c10483dc..db63334009d3ab 100644
--- a/packages/kbn-apm-synthtrace/src/lib/apm/client/apm_synthtrace_es_client/index.ts
+++ b/packages/kbn-apm-synthtrace/src/lib/apm/client/apm_synthtrace_es_client/index.ts
@@ -65,7 +65,15 @@ export class ApmSynthtraceEsClient extends SynthtraceEsClient<ApmFields> {
     this.logger.info(`Updated component template: ${name}`);
   }
 
-  getDefaultPipeline(includeSerialization: boolean = true) {
-    return apmPipeline(this.logger, this.version, includeSerialization);
+  getDefaultPipeline(
+    {
+      includeSerialization,
+      versionOverride,
+    }: {
+      includeSerialization?: boolean;
+      versionOverride?: string;
+    } = { includeSerialization: true }
+  ) {
+    return apmPipeline(this.logger, versionOverride ?? this.version, includeSerialization);
   }
 }
diff --git a/packages/kbn-apm-synthtrace/src/scenarios/service_summary_field_version_dependent.ts b/packages/kbn-apm-synthtrace/src/scenarios/service_summary_field_version_dependent.ts
index 37999bff114c2a..fed416d787936a 100644
--- a/packages/kbn-apm-synthtrace/src/scenarios/service_summary_field_version_dependent.ts
+++ b/packages/kbn-apm-synthtrace/src/scenarios/service_summary_field_version_dependent.ts
@@ -8,36 +8,26 @@
 
 import { ApmFields, apm } from '@kbn/apm-synthtrace-client';
 import { random } from 'lodash';
-import { pipeline, Readable } from 'stream';
+import { Readable } from 'stream';
 import semver from 'semver';
 import { Scenario } from '../cli/scenario';
-import {
-  addObserverVersionTransform,
-  deleteSummaryFieldTransform,
-} from '../lib/utils/transform_helpers';
 import { withClient } from '../lib/utils/with_client';
+import { RunOptions } from '../cli/utils/parse_run_cli_flags';
+import { Logger } from '../lib/utils/create_logger';
 
-const scenario: Scenario<ApmFields> = async ({ logger, versionOverride }) => {
+const scenario: Scenario<ApmFields> = async ({
+  logger,
+  versionOverride,
+}: RunOptions & { logger: Logger }) => {
   const version = versionOverride as string;
-  const isLegacy = versionOverride && semver.lt(version, '8.7.0');
+  const isLegacy = version ? semver.lt(version as string, '8.7.0') : false;
   return {
     bootstrap: async ({ apmEsClient }) => {
       if (isLegacy) {
         apmEsClient.pipeline((base: Readable) => {
-          const defaultPipeline = apmEsClient.getDefaultPipeline()(
-            base
-          ) as unknown as NodeJS.ReadableStream;
-
-          return pipeline(
-            defaultPipeline,
-            addObserverVersionTransform(version),
-            deleteSummaryFieldTransform(),
-            (err) => {
-              if (err) {
-                logger.error(err);
-              }
-            }
-          );
+          return apmEsClient.getDefaultPipeline({
+            versionOverride: version,
+          })(base);
         });
       }
     },
@@ -45,7 +35,7 @@ const scenario: Scenario<ApmFields> = async ({ logger, versionOverride }) => {
       const successfulTimestamps = range.ratePerMinute(6);
       const instance = apm
         .service({
-          name: `java${isLegacy ? '-legacy' : ''}`,
+          name: `java`,
           environment: 'production',
           agentName: 'java',
         })
diff --git a/packages/kbn-apm-synthtrace/src/scenarios/traces_logs_assets.ts b/packages/kbn-apm-synthtrace/src/scenarios/traces_logs_assets.ts
index afdec115f5b9eb..187be94f62e36f 100644
--- a/packages/kbn-apm-synthtrace/src/scenarios/traces_logs_assets.ts
+++ b/packages/kbn-apm-synthtrace/src/scenarios/traces_logs_assets.ts
@@ -10,6 +10,7 @@ import {
   ApmFields,
   generateLongId,
   generateShortId,
+  infra,
   Instance,
   log,
   Serializable,
@@ -23,16 +24,37 @@ const ENVIRONMENT = getSynthtraceEnvironment(__filename);
 
 const scenario: Scenario<ApmFields> = async (runOptions) => {
   const { logger } = runOptions;
-  const { numServices = 3 } = runOptions.scenarioOpts || {};
+  const { numServices = 3, numHosts = 10 } = runOptions.scenarioOpts || {};
 
   return {
-    generate: ({ range, clients: { apmEsClient, assetsEsClient, logsEsClient } }) => {
+    generate: ({
+      range,
+      clients: { apmEsClient, assetsEsClient, logsEsClient, infraEsClient },
+    }) => {
       const transactionName = '240rpm/75% 1000ms';
 
       const successfulTimestamps = range.interval('1m').rate(1);
       const failedTimestamps = range.interval('1m').rate(1);
       const serviceNames = [...Array(numServices).keys()].map((index) => `synth-node-${index}`);
 
+      const HOSTS = Array(numHosts)
+        .fill(0)
+        .map((_, idx) => infra.host(`my-host-${idx}`));
+
+      const hosts = range
+        .interval('30s')
+        .rate(1)
+        .generator((timestamp) =>
+          HOSTS.flatMap((host) => [
+            host.cpu().timestamp(timestamp),
+            host.memory().timestamp(timestamp),
+            host.network().timestamp(timestamp),
+            host.load().timestamp(timestamp),
+            host.filesystem().timestamp(timestamp),
+            host.diskio().timestamp(timestamp),
+          ])
+        );
+
       const instances = serviceNames.map((serviceName) =>
         apm
           .service({ name: serviceName, environment: ENVIRONMENT, agentName: 'nodejs' })
@@ -97,6 +119,12 @@ const scenario: Scenario<ApmFields> = async (runOptions) => {
         return [...successfulTraceEvents, ...failedTraceEvents, ...metricsets];
       };
 
+      const MESSAGE_LOG_LEVELS = [
+        { message: 'A simple log with something random <random> in the middle', level: 'info' },
+        { message: 'Yet another debug log', level: 'debug' },
+        { message: 'Error with certificate: "ca_trusted_fingerprint"', level: 'error' },
+      ];
+
       const logsWithTraces = range
         .interval('1m')
         .rate(1)
@@ -104,10 +132,8 @@ const scenario: Scenario<ApmFields> = async (runOptions) => {
           return Array(3)
             .fill(0)
             .map(() => {
-              const { message, level } = {
-                message: 'A simple log with something random <random> in the middle',
-                level: 'info',
-              };
+              const index = Math.floor(Math.random() * 3);
+              const { message, level } = MESSAGE_LOG_LEVELS[index];
               const CLUSTER = {
                 clusterId: generateShortId(),
                 clusterName: 'synth-cluster-2',
@@ -145,10 +171,8 @@ const scenario: Scenario<ApmFields> = async (runOptions) => {
           return Array(3)
             .fill(0)
             .map(() => {
-              const { message, level } = {
-                message: 'A simple log with something random <random> in the middle',
-                level: 'info',
-              };
+              const index = Math.floor(Math.random() * 3);
+              const { message, level } = MESSAGE_LOG_LEVELS[index];
               const CLUSTER = {
                 clusterId: generateShortId(),
                 clusterName: 'synth-cluster-2',
@@ -206,6 +230,10 @@ const scenario: Scenario<ApmFields> = async (runOptions) => {
           apmEsClient,
           logger.perf('generating_apm_events', () => tracesGen)
         ),
+        withClient(
+          infraEsClient,
+          logger.perf('generating_infra_hosts', () => hosts)
+        ),
       ];
     },
   };
diff --git a/packages/kbn-cell-actions/actions/index.ts b/packages/kbn-cell-actions/actions/index.ts
new file mode 100644
index 00000000000000..ca38510c84aaa2
--- /dev/null
+++ b/packages/kbn-cell-actions/actions/index.ts
@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export * from '../src/actions';
diff --git a/packages/kbn-cell-actions/actions/utils.ts b/packages/kbn-cell-actions/actions/utils.ts
new file mode 100644
index 00000000000000..ede7ac90577db5
--- /dev/null
+++ b/packages/kbn-cell-actions/actions/utils.ts
@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export * from '../src/actions/utils';
diff --git a/packages/kbn-cell-actions/index.ts b/packages/kbn-cell-actions/index.ts
index de0577ee3ed833..9829b99a0572b3 100644
--- a/packages/kbn-cell-actions/index.ts
+++ b/packages/kbn-cell-actions/index.ts
@@ -6,4 +6,8 @@
  * Side Public License, v 1.
  */
 
-export * from './src';
+export * from './src/types';
+
+export * from './src/context';
+export * from './src/components';
+export * from './src/hooks';
diff --git a/packages/kbn-cell-actions/src/actions/index.ts b/packages/kbn-cell-actions/src/actions/index.ts
new file mode 100644
index 00000000000000..955b10f067c447
--- /dev/null
+++ b/packages/kbn-cell-actions/src/actions/index.ts
@@ -0,0 +1,20 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export * from './types';
+
+export { createCellActionFactory } from './factory';
+
+export { createCopyToClipboardActionFactory } from './copy_to_clipboard';
+export {
+  createFilterInActionFactory,
+  createFilterOutActionFactory,
+  addFilterIn,
+  addFilterOut,
+  addExistsFilter,
+} from './filter';
diff --git a/packages/kbn-cell-actions/src/actions/types.ts b/packages/kbn-cell-actions/src/actions/types.ts
index f7700e3c5edafe..842b196e9cad2c 100644
--- a/packages/kbn-cell-actions/src/actions/types.ts
+++ b/packages/kbn-cell-actions/src/actions/types.ts
@@ -6,8 +6,9 @@
  * Side Public License, v 1.
  */
 
-import { SerializableRecord } from '@kbn/utility-types';
-import { SerializableArray } from '@kbn/utility-types/src/serializable';
+import type { SerializableRecord } from '@kbn/utility-types';
+import type { SerializableArray } from '@kbn/utility-types/src/serializable';
+import type { CellAction } from '../types';
 
 export type DefaultActionsSupportedValue = string[] | number[] | boolean[];
 
@@ -17,3 +18,20 @@ export type NonNullableSerializable =
   | boolean
   | SerializableArray
   | SerializableRecord;
+
+/**
+ * Cell action factory template with optional `id`.
+ * The id override is required when using the action factory so it
+ * can be omitted in the original action creator
+ */
+export type CellActionTemplate<C extends CellAction = CellAction> = Omit<C, 'id'>;
+/**
+ * Action factory extend parameter type,
+ */
+export type CellActionExtend<C extends CellAction = CellAction> = Partial<C> & { id: string };
+export interface CellActionFactory<C extends CellAction = CellAction> {
+  <A extends C = C>(extend: CellActionExtend<A>): A;
+  combine: <A extends C = C>(
+    partialActionTemplate: Partial<CellActionTemplate<A>>
+  ) => CellActionFactory<A>;
+}
diff --git a/packages/kbn-cell-actions/src/components/hover_actions_popover.test.tsx b/packages/kbn-cell-actions/src/components/hover_actions_popover.test.tsx
index de524edfac9fe2..d6dab633fec71d 100644
--- a/packages/kbn-cell-actions/src/components/hover_actions_popover.test.tsx
+++ b/packages/kbn-cell-actions/src/components/hover_actions_popover.test.tsx
@@ -31,14 +31,16 @@ describe('HoverActionsPopover', () => {
   const TestComponent = () => <span data-test-subj="test-component" />;
   jest.useFakeTimers();
 
-  it('renders', () => {
+  it('renders the children', () => {
     const getActions = () => Promise.resolve([]);
-    const { queryByTestId } = render(
+    const { getByTestId } = render(
       <CellActionsProvider getTriggerCompatibleActions={getActions}>
-        <HoverActionsPopover {...defaultProps} children={null} />
+        <HoverActionsPopover {...defaultProps}>
+          <TestComponent />
+        </HoverActionsPopover>
       </CellActionsProvider>
     );
-    expect(queryByTestId('hoverActionsPopover')).toBeInTheDocument();
+    expect(getByTestId('test-component')).toBeInTheDocument();
   });
 
   it('renders actions when hovered', async () => {
diff --git a/packages/kbn-cell-actions/src/components/hover_actions_popover.tsx b/packages/kbn-cell-actions/src/components/hover_actions_popover.tsx
index 8ba273f98c6a17..8cced2665fd893 100644
--- a/packages/kbn-cell-actions/src/components/hover_actions_popover.tsx
+++ b/packages/kbn-cell-actions/src/components/hover_actions_popover.tsx
@@ -135,7 +135,7 @@ export const HoverActionsPopover: React.FC<Props> = ({
           panelPaddingSize="none"
           repositionOnScroll
           ownFocus={false}
-          data-test-subj={'hoverActionsPopover'}
+          panelProps={{ ['data-test-subj']: 'hoverActionsPopover' }}
           aria-label={ACTIONS_AREA_LABEL}
         >
           {showHoverContent && (
diff --git a/packages/kbn-cell-actions/src/index.ts b/packages/kbn-cell-actions/src/index.ts
deleted file mode 100644
index 4b7dde4cdcaf1f..00000000000000
--- a/packages/kbn-cell-actions/src/index.ts
+++ /dev/null
@@ -1,41 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-// Types and enums
-export type {
-  CellAction,
-  CellActionFieldValue,
-  CellActionsProps,
-  CellActionExecutionContext,
-  CellActionCompatibilityContext,
-  CellActionTemplate,
-  CellActionFactory,
-  CellActionExtend,
-} from './types';
-export type { UseDataGridColumnsCellActions, UseDataGridColumnsCellActionsProps } from './hooks';
-
-// Constants
-export { CellActionsMode } from './constants';
-
-// Components and hooks
-export { CellActionsProvider } from './context';
-export { CellActions } from './components';
-export { useDataGridColumnsCellActions } from './hooks';
-
-// Generic actions
-export { createCopyToClipboardActionFactory } from './actions/copy_to_clipboard';
-export {
-  createFilterInActionFactory,
-  createFilterOutActionFactory,
-  addFilterIn,
-  addFilterOut,
-  addExistsFilter,
-} from './actions/filter';
-
-// Action factory
-export { createCellActionFactory } from './actions/factory';
diff --git a/packages/kbn-cell-actions/src/types.ts b/packages/kbn-cell-actions/src/types.ts
index 301997618b6f3e..17679c2a2c14e0 100644
--- a/packages/kbn-cell-actions/src/types.ts
+++ b/packages/kbn-cell-actions/src/types.ts
@@ -16,6 +16,8 @@ import type { FieldSpec } from '@kbn/data-views-plugin/common';
 import { Serializable } from '@kbn/utility-types';
 import type { CellActionsMode } from './constants';
 
+export * from './actions/types';
+
 export type CellActionsProviderProps = PropsWithChildren<{
   /**
    * Please assign `uiActions.getTriggerCompatibleActions` function.
@@ -133,20 +135,3 @@ export interface PartitionedActions {
   extraActions: CellAction[];
   visibleActions: CellAction[];
 }
-
-/**
- * Cell action factory template with optional `id`.
- * The id override is required when using the action factory so it
- * can be omitted in the original action creator
- */
-export type CellActionTemplate<C extends CellAction = CellAction> = Omit<C, 'id'>;
-/**
- * Action factory extend parameter type,
- */
-export type CellActionExtend<C extends CellAction = CellAction> = Partial<C> & { id: string };
-export interface CellActionFactory<C extends CellAction = CellAction> {
-  <A extends C = C>(extend: CellActionExtend<A>): A;
-  combine: <A extends C = C>(
-    partialActionTemplate: Partial<CellActionTemplate<A>>
-  ) => CellActionFactory<A>;
-}
diff --git a/packages/kbn-check-mappings-update-cli/current_fields.json b/packages/kbn-check-mappings-update-cli/current_fields.json
index 8d0f793317f5c1..65fd6af2ce9196 100644
--- a/packages/kbn-check-mappings-update-cli/current_fields.json
+++ b/packages/kbn-check-mappings-update-cli/current_fields.json
@@ -510,6 +510,7 @@
     "revision",
     "schema_version",
     "status",
+    "supports_agentless",
     "unenroll_timeout",
     "updated_at",
     "updated_by"
diff --git a/packages/kbn-check-mappings-update-cli/current_mappings.json b/packages/kbn-check-mappings-update-cli/current_mappings.json
index 4a1016cf62224c..03a189b1549be6 100644
--- a/packages/kbn-check-mappings-update-cli/current_mappings.json
+++ b/packages/kbn-check-mappings-update-cli/current_mappings.json
@@ -1711,6 +1711,9 @@
       "status": {
         "type": "keyword"
       },
+      "supports_agentless": {
+        "type": "boolean"
+      },
       "unenroll_timeout": {
         "type": "integer"
       },
diff --git a/packages/kbn-doc-links/src/get_doc_links.ts b/packages/kbn-doc-links/src/get_doc_links.ts
index f42bd3b688e4eb..16d4fc648c3c62 100644
--- a/packages/kbn-doc-links/src/get_doc_links.ts
+++ b/packages/kbn-doc-links/src/get_doc_links.ts
@@ -578,21 +578,33 @@ export const getDocLinks = ({ kibanaBranch, buildFlavor }: GetDocLinkOptions): D
         ? `${SERVERLESS_OBSERVABILITY_DOCS}create-custom-threshold-alert-rule`
         : `${OBSERVABILITY_DOCS}custom-threshold-alert.html`,
       monitorStatus: `${OBSERVABILITY_DOCS}monitor-status-alert.html`,
-      monitorUptime: `${OBSERVABILITY_DOCS}monitor-uptime.html`,
+      monitorUptime: isServerless
+        ? `${SERVERLESS_OBSERVABILITY_DOCS}monitor-synthetics`
+        : `${OBSERVABILITY_DOCS}monitor-uptime.html`,
       tlsCertificate: `${OBSERVABILITY_DOCS}tls-certificate-alert.html`,
       uptimeDurationAnomaly: `${OBSERVABILITY_DOCS}duration-anomaly-alert.html`,
-      monitorLogs: `${OBSERVABILITY_DOCS}monitor-logs.html`,
+      monitorLogs: isServerless
+        ? `${SERVERLESS_OBSERVABILITY_DOCS}discover-and-explore-logs`
+        : `${OBSERVABILITY_DOCS}monitor-logs.html`,
       analyzeMetrics: isServerless
         ? `${SERVERLESS_OBSERVABILITY_DOCS}infrastructure-monitoring`
         : `${OBSERVABILITY_DOCS}analyze-metrics.html`,
-      monitorUptimeSynthetics: `${OBSERVABILITY_DOCS}monitor-uptime-synthetics.html`,
+      monitorUptimeSynthetics: isServerless
+        ? `${SERVERLESS_OBSERVABILITY_DOCS}monitor-synthetics`
+        : `${OBSERVABILITY_DOCS}monitor-uptime-synthetics.html`,
       userExperience: `${OBSERVABILITY_DOCS}user-experience.html`,
       createAlerts: isServerless
         ? `${SERVERLESS_OBSERVABILITY_DOCS}alerting`
         : `${OBSERVABILITY_DOCS}create-alerts.html`,
-      syntheticsAlerting: `${OBSERVABILITY_DOCS}synthetics-settings.html#synthetics-settings-alerting`,
-      syntheticsCommandReference: `${OBSERVABILITY_DOCS}synthetics-configuration.html#synthetics-configuration-playwright-options`,
-      syntheticsProjectMonitors: `${OBSERVABILITY_DOCS}synthetic-run-tests.html#synthetic-monitor-choose-project`,
+      syntheticsAlerting: isServerless
+        ? `${SERVERLESS_OBSERVABILITY_DOCS}synthetics-settings#alerting`
+        : `${OBSERVABILITY_DOCS}synthetics-settings.html#synthetics-settings-alerting`,
+      syntheticsCommandReference: isServerless
+        ? `${SERVERLESS_OBSERVABILITY_DOCS}synthetics-configuration#playwrightoptions`
+        : `${OBSERVABILITY_DOCS}synthetics-configuration.html#synthetics-configuration-playwright-options`,
+      syntheticsProjectMonitors: isServerless
+        ? `${SERVERLESS_OBSERVABILITY_DOCS}synthetics-get-started-project`
+        : `${OBSERVABILITY_DOCS}synthetic-run-tests.html#synthetic-monitor-choose-project`,
       syntheticsMigrateFromIntegration: `${OBSERVABILITY_DOCS}synthetics-migrate-from-integration.html`,
       sloBurnRateRule: isServerless
         ? `${SERVERLESS_OBSERVABILITY_DOCS}create-slo-burn-rate-alert-rule`
@@ -940,7 +952,9 @@ export const getDocLinks = ({ kibanaBranch, buildFlavor }: GetDocLinkOptions): D
       apiKeyPrivileges: `${SERVERLESS_DOCS}api-keys#restrict-privileges`,
     },
     synthetics: {
-      featureRoles: `${OBSERVABILITY_DOCS}synthetics-feature-roles.html`,
+      featureRoles: isServerless
+        ? `${SERVERLESS_OBSERVABILITY_DOCS}synthetics-feature-roles`
+        : `${OBSERVABILITY_DOCS}synthetics-feature-roles.html`,
     },
     telemetry: {
       settings: `${KIBANA_DOCS}telemetry-settings-kbn.html`,
diff --git a/packages/kbn-esql-ast/src/antlr/esql_lexer.g4 b/packages/kbn-esql-ast/src/antlr/esql_lexer.g4
index 721a9280f3c106..39c21a950f2784 100644
--- a/packages/kbn-esql-ast/src/antlr/esql_lexer.g4
+++ b/packages/kbn-esql-ast/src/antlr/esql_lexer.g4
@@ -211,10 +211,6 @@ FROM_UNQUOTED_IDENTIFIER
     : FROM_UNQUOTED_IDENTIFIER_PART+
     ;
 
-FROM_QUOTED_IDENTIFIER
-    : QUOTED_IDENTIFIER -> type(QUOTED_IDENTIFIER)
-    ;
-
 FROM_LINE_COMMENT
     : LINE_COMMENT -> channel(HIDDEN)
     ;
diff --git a/packages/kbn-esql-ast/src/antlr/esql_lexer.interp b/packages/kbn-esql-ast/src/antlr/esql_lexer.interp
index 02c1e46a83c0ec..0fdcdb1939bd10 100644
--- a/packages/kbn-esql-ast/src/antlr/esql_lexer.interp
+++ b/packages/kbn-esql-ast/src/antlr/esql_lexer.interp
@@ -319,7 +319,6 @@ OPTIONS
 METADATA
 FROM_UNQUOTED_IDENTIFIER_PART
 FROM_UNQUOTED_IDENTIFIER
-FROM_QUOTED_IDENTIFIER
 FROM_LINE_COMMENT
 FROM_MULTILINE_COMMENT
 FROM_WS
@@ -405,4 +404,4 @@ META_MODE
 SETTING_MODE
 
 atn:
-[4, 0, 110, 1203, 6, -1, 6, -1, 6, -1, 6, -1, 6, -1, 6, -1, 6, -1, 6, -1, 6, -1, 6, -1, 6, -1, 6, -1, 2, 0, 7, 0, 2, 1, 7, 1, 2, 2, 7, 2, 2, 3, 7, 3, 2, 4, 7, 4, 2, 5, 7, 5, 2, 6, 7, 6, 2, 7, 7, 7, 2, 8, 7, 8, 2, 9, 7, 9, 2, 10, 7, 10, 2, 11, 7, 11, 2, 12, 7, 12, 2, 13, 7, 13, 2, 14, 7, 14, 2, 15, 7, 15, 2, 16, 7, 16, 2, 17, 7, 17, 2, 18, 7, 18, 2, 19, 7, 19, 2, 20, 7, 20, 2, 21, 7, 21, 2, 22, 7, 22, 2, 23, 7, 23, 2, 24, 7, 24, 2, 25, 7, 25, 2, 26, 7, 26, 2, 27, 7, 27, 2, 28, 7, 28, 2, 29, 7, 29, 2, 30, 7, 30, 2, 31, 7, 31, 2, 32, 7, 32, 2, 33, 7, 33, 2, 34, 7, 34, 2, 35, 7, 35, 2, 36, 7, 36, 2, 37, 7, 37, 2, 38, 7, 38, 2, 39, 7, 39, 2, 40, 7, 40, 2, 41, 7, 41, 2, 42, 7, 42, 2, 43, 7, 43, 2, 44, 7, 44, 2, 45, 7, 45, 2, 46, 7, 46, 2, 47, 7, 47, 2, 48, 7, 48, 2, 49, 7, 49, 2, 50, 7, 50, 2, 51, 7, 51, 2, 52, 7, 52, 2, 53, 7, 53, 2, 54, 7, 54, 2, 55, 7, 55, 2, 56, 7, 56, 2, 57, 7, 57, 2, 58, 7, 58, 2, 59, 7, 59, 2, 60, 7, 60, 2, 61, 7, 61, 2, 62, 7, 62, 2, 63, 7, 63, 2, 64, 7, 64, 2, 65, 7, 65, 2, 66, 7, 66, 2, 67, 7, 67, 2, 68, 7, 68, 2, 69, 7, 69, 2, 70, 7, 70, 2, 71, 7, 71, 2, 72, 7, 72, 2, 73, 7, 73, 2, 74, 7, 74, 2, 75, 7, 75, 2, 76, 7, 76, 2, 77, 7, 77, 2, 78, 7, 78, 2, 79, 7, 79, 2, 80, 7, 80, 2, 81, 7, 81, 2, 82, 7, 82, 2, 83, 7, 83, 2, 84, 7, 84, 2, 85, 7, 85, 2, 86, 7, 86, 2, 87, 7, 87, 2, 88, 7, 88, 2, 89, 7, 89, 2, 90, 7, 90, 2, 91, 7, 91, 2, 92, 7, 92, 2, 93, 7, 93, 2, 94, 7, 94, 2, 95, 7, 95, 2, 96, 7, 96, 2, 97, 7, 97, 2, 98, 7, 98, 2, 99, 7, 99, 2, 100, 7, 100, 2, 101, 7, 101, 2, 102, 7, 102, 2, 103, 7, 103, 2, 104, 7, 104, 2, 105, 7, 105, 2, 106, 7, 106, 2, 107, 7, 107, 2, 108, 7, 108, 2, 109, 7, 109, 2, 110, 7, 110, 2, 111, 7, 111, 2, 112, 7, 112, 2, 113, 7, 113, 2, 114, 7, 114, 2, 115, 7, 115, 2, 116, 7, 116, 2, 117, 7, 117, 2, 118, 7, 118, 2, 119, 7, 119, 2, 120, 7, 120, 2, 121, 7, 121, 2, 122, 7, 122, 2, 123, 7, 123, 2, 124, 7, 124, 2, 125, 7, 125, 2, 126, 7, 126, 2, 127, 7, 127, 2, 128, 7, 128, 2, 129, 7, 129, 2, 130, 7, 130, 2, 131, 7, 131, 2, 132, 7, 132, 2, 133, 7, 133, 2, 134, 7, 134, 2, 135, 7, 135, 2, 136, 7, 136, 2, 137, 7, 137, 2, 138, 7, 138, 2, 139, 7, 139, 2, 140, 7, 140, 2, 141, 7, 141, 2, 142, 7, 142, 2, 143, 7, 143, 2, 144, 7, 144, 2, 145, 7, 145, 2, 146, 7, 146, 2, 147, 7, 147, 2, 148, 7, 148, 2, 149, 7, 149, 2, 150, 7, 150, 2, 151, 7, 151, 2, 152, 7, 152, 2, 153, 7, 153, 2, 154, 7, 154, 2, 155, 7, 155, 2, 156, 7, 156, 2, 157, 7, 157, 2, 158, 7, 158, 2, 159, 7, 159, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 2, 1, 2, 1, 2, 1, 2, 1, 2, 1, 2, 1, 2, 1, 2, 1, 2, 1, 3, 1, 3, 1, 3, 1, 3, 1, 3, 1, 3, 1, 3, 1, 4, 1, 4, 1, 4, 1, 4, 1, 4, 1, 4, 1, 4, 1, 4, 1, 4, 1, 4, 1, 5, 1, 5, 1, 5, 1, 5, 1, 5, 1, 5, 1, 5, 1, 6, 1, 6, 1, 6, 1, 6, 1, 6, 1, 6, 1, 6, 1, 7, 1, 7, 1, 7, 1, 7, 1, 7, 1, 7, 1, 7, 1, 7, 1, 7, 1, 7, 1, 7, 1, 7, 1, 7, 1, 7, 1, 8, 1, 8, 1, 8, 1, 8, 1, 8, 1, 8, 1, 8, 1, 9, 1, 9, 1, 9, 1, 9, 1, 9, 1, 9, 1, 9, 1, 9, 1, 10, 1, 10, 1, 10, 1, 10, 1, 10, 1, 10, 1, 10, 1, 11, 1, 11, 1, 11, 1, 11, 1, 11, 1, 11, 1, 11, 1, 11, 1, 11, 1, 11, 1, 11, 1, 11, 1, 12, 1, 12, 1, 12, 1, 12, 1, 12, 1, 12, 1, 12, 1, 12, 1, 12, 1, 13, 1, 13, 1, 13, 1, 13, 1, 13, 1, 13, 1, 14, 1, 14, 1, 14, 1, 14, 1, 14, 1, 14, 1, 14, 1, 15, 1, 15, 1, 15, 1, 15, 1, 15, 1, 15, 1, 15, 1, 16, 1, 16, 1, 16, 1, 16, 1, 16, 1, 16, 1, 16, 1, 16, 1, 17, 1, 17, 1, 17, 1, 17, 1, 17, 1, 17, 1, 17, 1, 17, 1, 18, 4, 18, 484, 8, 18, 11, 18, 12, 18, 485, 1, 18, 1, 18, 1, 19, 1, 19, 1, 19, 1, 19, 5, 19, 494, 8, 19, 10, 19, 12, 19, 497, 9, 19, 1, 19, 3, 19, 500, 8, 19, 1, 19, 3, 19, 503, 8, 19, 1, 19, 1, 19, 1, 20, 1, 20, 1, 20, 1, 20, 1, 20, 5, 20, 512, 8, 20, 10, 20, 12, 20, 515, 9, 20, 1, 20, 1, 20, 1, 20, 1, 20, 1, 20, 1, 21, 4, 21, 523, 8, 21, 11, 21, 12, 21, 524, 1, 21, 1, 21, 1, 22, 1, 22, 1, 22, 1, 22, 1, 22, 1, 23, 1, 23, 1, 23, 1, 23, 1, 23, 1, 24, 1, 24, 1, 24, 1, 24, 1, 25, 1, 25, 1, 25, 1, 25, 1, 26, 1, 26, 1, 26, 1, 26, 1, 27, 1, 27, 1, 27, 1, 27, 1, 28, 1, 28, 1, 29, 1, 29, 1, 30, 1, 30, 1, 30, 1, 31, 1, 31, 1, 32, 1, 32, 3, 32, 566, 8, 32, 1, 32, 4, 32, 569, 8, 32, 11, 32, 12, 32, 570, 1, 33, 1, 33, 1, 34, 1, 34, 1, 35, 1, 35, 1, 35, 3, 35, 580, 8, 35, 1, 36, 1, 36, 1, 37, 1, 37, 1, 37, 3, 37, 587, 8, 37, 1, 38, 1, 38, 1, 38, 5, 38, 592, 8, 38, 10, 38, 12, 38, 595, 9, 38, 1, 38, 1, 38, 1, 38, 1, 38, 1, 38, 1, 38, 5, 38, 603, 8, 38, 10, 38, 12, 38, 606, 9, 38, 1, 38, 1, 38, 1, 38, 1, 38, 1, 38, 3, 38, 613, 8, 38, 1, 38, 3, 38, 616, 8, 38, 3, 38, 618, 8, 38, 1, 39, 4, 39, 621, 8, 39, 11, 39, 12, 39, 622, 1, 40, 4, 40, 626, 8, 40, 11, 40, 12, 40, 627, 1, 40, 1, 40, 5, 40, 632, 8, 40, 10, 40, 12, 40, 635, 9, 40, 1, 40, 1, 40, 4, 40, 639, 8, 40, 11, 40, 12, 40, 640, 1, 40, 4, 40, 644, 8, 40, 11, 40, 12, 40, 645, 1, 40, 1, 40, 5, 40, 650, 8, 40, 10, 40, 12, 40, 653, 9, 40, 3, 40, 655, 8, 40, 1, 40, 1, 40, 1, 40, 1, 40, 4, 40, 661, 8, 40, 11, 40, 12, 40, 662, 1, 40, 1, 40, 3, 40, 667, 8, 40, 1, 41, 1, 41, 1, 41, 1, 42, 1, 42, 1, 42, 1, 42, 1, 43, 1, 43, 1, 43, 1, 43, 1, 44, 1, 44, 1, 45, 1, 45, 1, 45, 1, 46, 1, 46, 1, 47, 1, 47, 1, 47, 1, 47, 1, 47, 1, 48, 1, 48, 1, 49, 1, 49, 1, 49, 1, 49, 1, 49, 1, 49, 1, 50, 1, 50, 1, 50, 1, 50, 1, 50, 1, 50, 1, 51, 1, 51, 1, 51, 1, 51, 1, 51, 1, 52, 1, 52, 1, 53, 1, 53, 1, 53, 1, 54, 1, 54, 1, 54, 1, 55, 1, 55, 1, 55, 1, 55, 1, 55, 1, 56, 1, 56, 1, 56, 1, 56, 1, 57, 1, 57, 1, 57, 1, 57, 1, 57, 1, 58, 1, 58, 1, 58, 1, 58, 1, 58, 1, 58, 1, 59, 1, 59, 1, 59, 1, 60, 1, 60, 1, 61, 1, 61, 1, 61, 1, 61, 1, 61, 1, 61, 1, 62, 1, 62, 1, 63, 1, 63, 1, 63, 1, 63, 1, 63, 1, 64, 1, 64, 1, 64, 1, 65, 1, 65, 1, 65, 1, 66, 1, 66, 1, 66, 1, 67, 1, 67, 1, 68, 1, 68, 1, 68, 1, 69, 1, 69, 1, 70, 1, 70, 1, 70, 1, 71, 1, 71, 1, 72, 1, 72, 1, 73, 1, 73, 1, 74, 1, 74, 1, 75, 1, 75, 1, 76, 1, 76, 1, 76, 1, 76, 1, 76, 1, 77, 1, 77, 1, 77, 1, 77, 1, 77, 1, 78, 1, 78, 5, 78, 798, 8, 78, 10, 78, 12, 78, 801, 9, 78, 1, 78, 1, 78, 3, 78, 805, 8, 78, 1, 78, 4, 78, 808, 8, 78, 11, 78, 12, 78, 809, 3, 78, 812, 8, 78, 1, 79, 1, 79, 4, 79, 816, 8, 79, 11, 79, 12, 79, 817, 1, 79, 1, 79, 1, 80, 1, 80, 1, 81, 1, 81, 1, 81, 1, 81, 1, 82, 1, 82, 1, 82, 1, 82, 1, 83, 1, 83, 1, 83, 1, 83, 1, 84, 1, 84, 1, 84, 1, 84, 1, 84, 1, 85, 1, 85, 1, 85, 1, 85, 1, 86, 1, 86, 1, 86, 1, 86, 1, 87, 1, 87, 1, 87, 1, 87, 1, 88, 1, 88, 1, 88, 1, 88, 1, 89, 1, 89, 1, 89, 1, 89, 1, 90, 1, 90, 1, 90, 1, 90, 1, 90, 1, 90, 1, 90, 1, 90, 1, 91, 1, 91, 1, 91, 1, 91, 1, 91, 1, 91, 1, 91, 1, 91, 1, 91, 1, 92, 1, 92, 1, 92, 3, 92, 881, 8, 92, 1, 93, 4, 93, 884, 8, 93, 11, 93, 12, 93, 885, 1, 94, 1, 94, 1, 94, 1, 94, 1, 95, 1, 95, 1, 95, 1, 95, 1, 96, 1, 96, 1, 96, 1, 96, 1, 97, 1, 97, 1, 97, 1, 97, 1, 98, 1, 98, 1, 98, 1, 98, 1, 98, 1, 99, 1, 99, 1, 99, 1, 99, 1, 100, 1, 100, 1, 100, 1, 100, 1, 101, 1, 101, 1, 101, 1, 101, 3, 101, 921, 8, 101, 1, 102, 1, 102, 3, 102, 925, 8, 102, 1, 102, 5, 102, 928, 8, 102, 10, 102, 12, 102, 931, 9, 102, 1, 102, 1, 102, 3, 102, 935, 8, 102, 1, 102, 4, 102, 938, 8, 102, 11, 102, 12, 102, 939, 3, 102, 942, 8, 102, 1, 103, 1, 103, 4, 103, 946, 8, 103, 11, 103, 12, 103, 947, 1, 104, 1, 104, 1, 104, 1, 104, 1, 105, 1, 105, 1, 105, 1, 105, 1, 106, 1, 106, 1, 106, 1, 106, 1, 107, 1, 107, 1, 107, 1, 107, 1, 107, 1, 108, 1, 108, 1, 108, 1, 108, 1, 109, 1, 109, 1, 109, 1, 109, 1, 110, 1, 110, 1, 110, 1, 110, 1, 111, 1, 111, 1, 111, 1, 112, 1, 112, 1, 112, 1, 112, 1, 113, 1, 113, 1, 113, 1, 113, 1, 114, 1, 114, 1, 114, 1, 114, 1, 115, 1, 115, 1, 115, 1, 115, 1, 116, 1, 116, 1, 116, 1, 116, 1, 116, 1, 117, 1, 117, 1, 117, 1, 117, 1, 117, 1, 118, 1, 118, 1, 118, 1, 118, 1, 118, 1, 119, 1, 119, 1, 119, 1, 119, 1, 119, 1, 119, 1, 119, 1, 120, 1, 120, 1, 121, 4, 121, 1023, 8, 121, 11, 121, 12, 121, 1024, 1, 121, 1, 121, 3, 121, 1029, 8, 121, 1, 121, 4, 121, 1032, 8, 121, 11, 121, 12, 121, 1033, 1, 122, 1, 122, 1, 122, 1, 122, 1, 123, 1, 123, 1, 123, 1, 123, 1, 124, 1, 124, 1, 124, 1, 124, 1, 125, 1, 125, 1, 125, 1, 125, 1, 126, 1, 126, 1, 126, 1, 126, 1, 127, 1, 127, 1, 127, 1, 127, 1, 127, 1, 127, 1, 128, 1, 128, 1, 128, 1, 128, 1, 129, 1, 129, 1, 129, 1, 129, 1, 130, 1, 130, 1, 130, 1, 130, 1, 131, 1, 131, 1, 131, 1, 131, 1, 132, 1, 132, 1, 132, 1, 132, 1, 133, 1, 133, 1, 133, 1, 133, 1, 134, 1, 134, 1, 134, 1, 134, 1, 135, 1, 135, 1, 135, 1, 135, 1, 136, 1, 136, 1, 136, 1, 136, 1, 137, 1, 137, 1, 137, 1, 137, 1, 137, 1, 138, 1, 138, 1, 138, 1, 138, 1, 139, 1, 139, 1, 139, 1, 139, 1, 140, 1, 140, 1, 140, 1, 140, 1, 141, 1, 141, 1, 141, 1, 141, 1, 142, 1, 142, 1, 142, 1, 142, 1, 143, 1, 143, 1, 143, 1, 143, 1, 144, 1, 144, 1, 144, 1, 144, 1, 144, 1, 145, 1, 145, 1, 145, 1, 145, 1, 145, 1, 146, 1, 146, 1, 146, 1, 146, 1, 147, 1, 147, 1, 147, 1, 147, 1, 148, 1, 148, 1, 148, 1, 148, 1, 149, 1, 149, 1, 149, 1, 149, 1, 149, 1, 150, 1, 150, 1, 150, 1, 150, 1, 150, 1, 150, 1, 150, 1, 150, 1, 150, 1, 150, 1, 151, 1, 151, 1, 151, 1, 151, 1, 152, 1, 152, 1, 152, 1, 152, 1, 153, 1, 153, 1, 153, 1, 153, 1, 154, 1, 154, 1, 154, 1, 154, 1, 154, 1, 155, 1, 155, 1, 156, 1, 156, 1, 156, 1, 156, 1, 156, 4, 156, 1188, 8, 156, 11, 156, 12, 156, 1189, 1, 157, 1, 157, 1, 157, 1, 157, 1, 158, 1, 158, 1, 158, 1, 158, 1, 159, 1, 159, 1, 159, 1, 159, 2, 513, 604, 0, 160, 12, 1, 14, 2, 16, 3, 18, 4, 20, 5, 22, 6, 24, 7, 26, 8, 28, 9, 30, 10, 32, 11, 34, 12, 36, 13, 38, 14, 40, 15, 42, 16, 44, 17, 46, 18, 48, 19, 50, 20, 52, 21, 54, 22, 56, 0, 58, 0, 60, 23, 62, 24, 64, 25, 66, 26, 68, 0, 70, 0, 72, 0, 74, 0, 76, 0, 78, 0, 80, 0, 82, 0, 84, 0, 86, 0, 88, 27, 90, 28, 92, 29, 94, 30, 96, 31, 98, 32, 100, 33, 102, 34, 104, 35, 106, 36, 108, 37, 110, 38, 112, 39, 114, 40, 116, 41, 118, 42, 120, 43, 122, 44, 124, 45, 126, 46, 128, 47, 130, 48, 132, 49, 134, 50, 136, 51, 138, 52, 140, 53, 142, 54, 144, 55, 146, 56, 148, 57, 150, 58, 152, 59, 154, 60, 156, 61, 158, 62, 160, 63, 162, 64, 164, 65, 166, 66, 168, 67, 170, 0, 172, 68, 174, 69, 176, 70, 178, 71, 180, 0, 182, 0, 184, 0, 186, 0, 188, 0, 190, 0, 192, 72, 194, 73, 196, 0, 198, 74, 200, 0, 202, 75, 204, 76, 206, 77, 208, 0, 210, 0, 212, 0, 214, 0, 216, 0, 218, 78, 220, 79, 222, 80, 224, 81, 226, 0, 228, 0, 230, 0, 232, 0, 234, 82, 236, 0, 238, 83, 240, 84, 242, 85, 244, 0, 246, 0, 248, 86, 250, 87, 252, 0, 254, 88, 256, 0, 258, 0, 260, 89, 262, 90, 264, 91, 266, 0, 268, 0, 270, 0, 272, 0, 274, 0, 276, 0, 278, 0, 280, 92, 282, 93, 284, 94, 286, 0, 288, 0, 290, 0, 292, 0, 294, 95, 296, 96, 298, 97, 300, 0, 302, 98, 304, 99, 306, 100, 308, 101, 310, 0, 312, 102, 314, 103, 316, 104, 318, 105, 320, 0, 322, 106, 324, 107, 326, 108, 328, 109, 330, 110, 12, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 35, 2, 0, 68, 68, 100, 100, 2, 0, 73, 73, 105, 105, 2, 0, 83, 83, 115, 115, 2, 0, 69, 69, 101, 101, 2, 0, 67, 67, 99, 99, 2, 0, 84, 84, 116, 116, 2, 0, 82, 82, 114, 114, 2, 0, 79, 79, 111, 111, 2, 0, 80, 80, 112, 112, 2, 0, 78, 78, 110, 110, 2, 0, 72, 72, 104, 104, 2, 0, 86, 86, 118, 118, 2, 0, 65, 65, 97, 97, 2, 0, 76, 76, 108, 108, 2, 0, 88, 88, 120, 120, 2, 0, 70, 70, 102, 102, 2, 0, 77, 77, 109, 109, 2, 0, 71, 71, 103, 103, 2, 0, 75, 75, 107, 107, 2, 0, 87, 87, 119, 119, 6, 0, 9, 10, 13, 13, 32, 32, 47, 47, 91, 91, 93, 93, 2, 0, 10, 10, 13, 13, 3, 0, 9, 10, 13, 13, 32, 32, 1, 0, 48, 57, 2, 0, 65, 90, 97, 122, 8, 0, 34, 34, 78, 78, 82, 82, 84, 84, 92, 92, 110, 110, 114, 114, 116, 116, 4, 0, 10, 10, 13, 13, 34, 34, 92, 92, 2, 0, 43, 43, 45, 45, 1, 0, 96, 96, 2, 0, 66, 66, 98, 98, 2, 0, 89, 89, 121, 121, 2, 0, 85, 85, 117, 117, 10, 0, 9, 10, 13, 13, 32, 32, 44, 44, 47, 47, 61, 61, 91, 91, 93, 93, 96, 96, 124, 124, 2, 0, 42, 42, 47, 47, 11, 0, 9, 10, 13, 13, 32, 32, 34, 35, 44, 44, 47, 47, 58, 58, 60, 60, 62, 63, 92, 92, 124, 124, 1230, 0, 12, 1, 0, 0, 0, 0, 14, 1, 0, 0, 0, 0, 16, 1, 0, 0, 0, 0, 18, 1, 0, 0, 0, 0, 20, 1, 0, 0, 0, 0, 22, 1, 0, 0, 0, 0, 24, 1, 0, 0, 0, 0, 26, 1, 0, 0, 0, 0, 28, 1, 0, 0, 0, 0, 30, 1, 0, 0, 0, 0, 32, 1, 0, 0, 0, 0, 34, 1, 0, 0, 0, 0, 36, 1, 0, 0, 0, 0, 38, 1, 0, 0, 0, 0, 40, 1, 0, 0, 0, 0, 42, 1, 0, 0, 0, 0, 44, 1, 0, 0, 0, 0, 46, 1, 0, 0, 0, 0, 48, 1, 0, 0, 0, 0, 50, 1, 0, 0, 0, 0, 52, 1, 0, 0, 0, 0, 54, 1, 0, 0, 0, 1, 56, 1, 0, 0, 0, 1, 58, 1, 0, 0, 0, 1, 60, 1, 0, 0, 0, 1, 62, 1, 0, 0, 0, 1, 64, 1, 0, 0, 0, 2, 66, 1, 0, 0, 0, 2, 88, 1, 0, 0, 0, 2, 90, 1, 0, 0, 0, 2, 92, 1, 0, 0, 0, 2, 94, 1, 0, 0, 0, 2, 96, 1, 0, 0, 0, 2, 98, 1, 0, 0, 0, 2, 100, 1, 0, 0, 0, 2, 102, 1, 0, 0, 0, 2, 104, 1, 0, 0, 0, 2, 106, 1, 0, 0, 0, 2, 108, 1, 0, 0, 0, 2, 110, 1, 0, 0, 0, 2, 112, 1, 0, 0, 0, 2, 114, 1, 0, 0, 0, 2, 116, 1, 0, 0, 0, 2, 118, 1, 0, 0, 0, 2, 120, 1, 0, 0, 0, 2, 122, 1, 0, 0, 0, 2, 124, 1, 0, 0, 0, 2, 126, 1, 0, 0, 0, 2, 128, 1, 0, 0, 0, 2, 130, 1, 0, 0, 0, 2, 132, 1, 0, 0, 0, 2, 134, 1, 0, 0, 0, 2, 136, 1, 0, 0, 0, 2, 138, 1, 0, 0, 0, 2, 140, 1, 0, 0, 0, 2, 142, 1, 0, 0, 0, 2, 144, 1, 0, 0, 0, 2, 146, 1, 0, 0, 0, 2, 148, 1, 0, 0, 0, 2, 150, 1, 0, 0, 0, 2, 152, 1, 0, 0, 0, 2, 154, 1, 0, 0, 0, 2, 156, 1, 0, 0, 0, 2, 158, 1, 0, 0, 0, 2, 160, 1, 0, 0, 0, 2, 162, 1, 0, 0, 0, 2, 164, 1, 0, 0, 0, 2, 166, 1, 0, 0, 0, 2, 168, 1, 0, 0, 0, 2, 172, 1, 0, 0, 0, 2, 174, 1, 0, 0, 0, 2, 176, 1, 0, 0, 0, 2, 178, 1, 0, 0, 0, 3, 180, 1, 0, 0, 0, 3, 182, 1, 0, 0, 0, 3, 184, 1, 0, 0, 0, 3, 186, 1, 0, 0, 0, 3, 188, 1, 0, 0, 0, 3, 190, 1, 0, 0, 0, 3, 192, 1, 0, 0, 0, 3, 194, 1, 0, 0, 0, 3, 198, 1, 0, 0, 0, 3, 200, 1, 0, 0, 0, 3, 202, 1, 0, 0, 0, 3, 204, 1, 0, 0, 0, 3, 206, 1, 0, 0, 0, 4, 208, 1, 0, 0, 0, 4, 210, 1, 0, 0, 0, 4, 212, 1, 0, 0, 0, 4, 218, 1, 0, 0, 0, 4, 220, 1, 0, 0, 0, 4, 222, 1, 0, 0, 0, 4, 224, 1, 0, 0, 0, 5, 226, 1, 0, 0, 0, 5, 228, 1, 0, 0, 0, 5, 230, 1, 0, 0, 0, 5, 232, 1, 0, 0, 0, 5, 234, 1, 0, 0, 0, 5, 236, 1, 0, 0, 0, 5, 238, 1, 0, 0, 0, 5, 240, 1, 0, 0, 0, 5, 242, 1, 0, 0, 0, 6, 244, 1, 0, 0, 0, 6, 246, 1, 0, 0, 0, 6, 248, 1, 0, 0, 0, 6, 250, 1, 0, 0, 0, 6, 254, 1, 0, 0, 0, 6, 256, 1, 0, 0, 0, 6, 258, 1, 0, 0, 0, 6, 260, 1, 0, 0, 0, 6, 262, 1, 0, 0, 0, 6, 264, 1, 0, 0, 0, 7, 266, 1, 0, 0, 0, 7, 268, 1, 0, 0, 0, 7, 270, 1, 0, 0, 0, 7, 272, 1, 0, 0, 0, 7, 274, 1, 0, 0, 0, 7, 276, 1, 0, 0, 0, 7, 278, 1, 0, 0, 0, 7, 280, 1, 0, 0, 0, 7, 282, 1, 0, 0, 0, 7, 284, 1, 0, 0, 0, 8, 286, 1, 0, 0, 0, 8, 288, 1, 0, 0, 0, 8, 290, 1, 0, 0, 0, 8, 292, 1, 0, 0, 0, 8, 294, 1, 0, 0, 0, 8, 296, 1, 0, 0, 0, 8, 298, 1, 0, 0, 0, 9, 300, 1, 0, 0, 0, 9, 302, 1, 0, 0, 0, 9, 304, 1, 0, 0, 0, 9, 306, 1, 0, 0, 0, 9, 308, 1, 0, 0, 0, 10, 310, 1, 0, 0, 0, 10, 312, 1, 0, 0, 0, 10, 314, 1, 0, 0, 0, 10, 316, 1, 0, 0, 0, 10, 318, 1, 0, 0, 0, 11, 320, 1, 0, 0, 0, 11, 322, 1, 0, 0, 0, 11, 324, 1, 0, 0, 0, 11, 326, 1, 0, 0, 0, 11, 328, 1, 0, 0, 0, 11, 330, 1, 0, 0, 0, 12, 332, 1, 0, 0, 0, 14, 342, 1, 0, 0, 0, 16, 349, 1, 0, 0, 0, 18, 358, 1, 0, 0, 0, 20, 365, 1, 0, 0, 0, 22, 375, 1, 0, 0, 0, 24, 382, 1, 0, 0, 0, 26, 389, 1, 0, 0, 0, 28, 403, 1, 0, 0, 0, 30, 410, 1, 0, 0, 0, 32, 418, 1, 0, 0, 0, 34, 425, 1, 0, 0, 0, 36, 437, 1, 0, 0, 0, 38, 446, 1, 0, 0, 0, 40, 452, 1, 0, 0, 0, 42, 459, 1, 0, 0, 0, 44, 466, 1, 0, 0, 0, 46, 474, 1, 0, 0, 0, 48, 483, 1, 0, 0, 0, 50, 489, 1, 0, 0, 0, 52, 506, 1, 0, 0, 0, 54, 522, 1, 0, 0, 0, 56, 528, 1, 0, 0, 0, 58, 533, 1, 0, 0, 0, 60, 538, 1, 0, 0, 0, 62, 542, 1, 0, 0, 0, 64, 546, 1, 0, 0, 0, 66, 550, 1, 0, 0, 0, 68, 554, 1, 0, 0, 0, 70, 556, 1, 0, 0, 0, 72, 558, 1, 0, 0, 0, 74, 561, 1, 0, 0, 0, 76, 563, 1, 0, 0, 0, 78, 572, 1, 0, 0, 0, 80, 574, 1, 0, 0, 0, 82, 579, 1, 0, 0, 0, 84, 581, 1, 0, 0, 0, 86, 586, 1, 0, 0, 0, 88, 617, 1, 0, 0, 0, 90, 620, 1, 0, 0, 0, 92, 666, 1, 0, 0, 0, 94, 668, 1, 0, 0, 0, 96, 671, 1, 0, 0, 0, 98, 675, 1, 0, 0, 0, 100, 679, 1, 0, 0, 0, 102, 681, 1, 0, 0, 0, 104, 684, 1, 0, 0, 0, 106, 686, 1, 0, 0, 0, 108, 691, 1, 0, 0, 0, 110, 693, 1, 0, 0, 0, 112, 699, 1, 0, 0, 0, 114, 705, 1, 0, 0, 0, 116, 710, 1, 0, 0, 0, 118, 712, 1, 0, 0, 0, 120, 715, 1, 0, 0, 0, 122, 718, 1, 0, 0, 0, 124, 723, 1, 0, 0, 0, 126, 727, 1, 0, 0, 0, 128, 732, 1, 0, 0, 0, 130, 738, 1, 0, 0, 0, 132, 741, 1, 0, 0, 0, 134, 743, 1, 0, 0, 0, 136, 749, 1, 0, 0, 0, 138, 751, 1, 0, 0, 0, 140, 756, 1, 0, 0, 0, 142, 759, 1, 0, 0, 0, 144, 762, 1, 0, 0, 0, 146, 765, 1, 0, 0, 0, 148, 767, 1, 0, 0, 0, 150, 770, 1, 0, 0, 0, 152, 772, 1, 0, 0, 0, 154, 775, 1, 0, 0, 0, 156, 777, 1, 0, 0, 0, 158, 779, 1, 0, 0, 0, 160, 781, 1, 0, 0, 0, 162, 783, 1, 0, 0, 0, 164, 785, 1, 0, 0, 0, 166, 790, 1, 0, 0, 0, 168, 811, 1, 0, 0, 0, 170, 813, 1, 0, 0, 0, 172, 821, 1, 0, 0, 0, 174, 823, 1, 0, 0, 0, 176, 827, 1, 0, 0, 0, 178, 831, 1, 0, 0, 0, 180, 835, 1, 0, 0, 0, 182, 840, 1, 0, 0, 0, 184, 844, 1, 0, 0, 0, 186, 848, 1, 0, 0, 0, 188, 852, 1, 0, 0, 0, 190, 856, 1, 0, 0, 0, 192, 860, 1, 0, 0, 0, 194, 868, 1, 0, 0, 0, 196, 880, 1, 0, 0, 0, 198, 883, 1, 0, 0, 0, 200, 887, 1, 0, 0, 0, 202, 891, 1, 0, 0, 0, 204, 895, 1, 0, 0, 0, 206, 899, 1, 0, 0, 0, 208, 903, 1, 0, 0, 0, 210, 908, 1, 0, 0, 0, 212, 912, 1, 0, 0, 0, 214, 920, 1, 0, 0, 0, 216, 941, 1, 0, 0, 0, 218, 945, 1, 0, 0, 0, 220, 949, 1, 0, 0, 0, 222, 953, 1, 0, 0, 0, 224, 957, 1, 0, 0, 0, 226, 961, 1, 0, 0, 0, 228, 966, 1, 0, 0, 0, 230, 970, 1, 0, 0, 0, 232, 974, 1, 0, 0, 0, 234, 978, 1, 0, 0, 0, 236, 981, 1, 0, 0, 0, 238, 985, 1, 0, 0, 0, 240, 989, 1, 0, 0, 0, 242, 993, 1, 0, 0, 0, 244, 997, 1, 0, 0, 0, 246, 1002, 1, 0, 0, 0, 248, 1007, 1, 0, 0, 0, 250, 1012, 1, 0, 0, 0, 252, 1019, 1, 0, 0, 0, 254, 1028, 1, 0, 0, 0, 256, 1035, 1, 0, 0, 0, 258, 1039, 1, 0, 0, 0, 260, 1043, 1, 0, 0, 0, 262, 1047, 1, 0, 0, 0, 264, 1051, 1, 0, 0, 0, 266, 1055, 1, 0, 0, 0, 268, 1061, 1, 0, 0, 0, 270, 1065, 1, 0, 0, 0, 272, 1069, 1, 0, 0, 0, 274, 1073, 1, 0, 0, 0, 276, 1077, 1, 0, 0, 0, 278, 1081, 1, 0, 0, 0, 280, 1085, 1, 0, 0, 0, 282, 1089, 1, 0, 0, 0, 284, 1093, 1, 0, 0, 0, 286, 1097, 1, 0, 0, 0, 288, 1102, 1, 0, 0, 0, 290, 1106, 1, 0, 0, 0, 292, 1110, 1, 0, 0, 0, 294, 1114, 1, 0, 0, 0, 296, 1118, 1, 0, 0, 0, 298, 1122, 1, 0, 0, 0, 300, 1126, 1, 0, 0, 0, 302, 1131, 1, 0, 0, 0, 304, 1136, 1, 0, 0, 0, 306, 1140, 1, 0, 0, 0, 308, 1144, 1, 0, 0, 0, 310, 1148, 1, 0, 0, 0, 312, 1153, 1, 0, 0, 0, 314, 1163, 1, 0, 0, 0, 316, 1167, 1, 0, 0, 0, 318, 1171, 1, 0, 0, 0, 320, 1175, 1, 0, 0, 0, 322, 1180, 1, 0, 0, 0, 324, 1187, 1, 0, 0, 0, 326, 1191, 1, 0, 0, 0, 328, 1195, 1, 0, 0, 0, 330, 1199, 1, 0, 0, 0, 332, 333, 7, 0, 0, 0, 333, 334, 7, 1, 0, 0, 334, 335, 7, 2, 0, 0, 335, 336, 7, 2, 0, 0, 336, 337, 7, 3, 0, 0, 337, 338, 7, 4, 0, 0, 338, 339, 7, 5, 0, 0, 339, 340, 1, 0, 0, 0, 340, 341, 6, 0, 0, 0, 341, 13, 1, 0, 0, 0, 342, 343, 7, 0, 0, 0, 343, 344, 7, 6, 0, 0, 344, 345, 7, 7, 0, 0, 345, 346, 7, 8, 0, 0, 346, 347, 1, 0, 0, 0, 347, 348, 6, 1, 1, 0, 348, 15, 1, 0, 0, 0, 349, 350, 7, 3, 0, 0, 350, 351, 7, 9, 0, 0, 351, 352, 7, 6, 0, 0, 352, 353, 7, 1, 0, 0, 353, 354, 7, 4, 0, 0, 354, 355, 7, 10, 0, 0, 355, 356, 1, 0, 0, 0, 356, 357, 6, 2, 2, 0, 357, 17, 1, 0, 0, 0, 358, 359, 7, 3, 0, 0, 359, 360, 7, 11, 0, 0, 360, 361, 7, 12, 0, 0, 361, 362, 7, 13, 0, 0, 362, 363, 1, 0, 0, 0, 363, 364, 6, 3, 0, 0, 364, 19, 1, 0, 0, 0, 365, 366, 7, 3, 0, 0, 366, 367, 7, 14, 0, 0, 367, 368, 7, 8, 0, 0, 368, 369, 7, 13, 0, 0, 369, 370, 7, 12, 0, 0, 370, 371, 7, 1, 0, 0, 371, 372, 7, 9, 0, 0, 372, 373, 1, 0, 0, 0, 373, 374, 6, 4, 3, 0, 374, 21, 1, 0, 0, 0, 375, 376, 7, 15, 0, 0, 376, 377, 7, 6, 0, 0, 377, 378, 7, 7, 0, 0, 378, 379, 7, 16, 0, 0, 379, 380, 1, 0, 0, 0, 380, 381, 6, 5, 4, 0, 381, 23, 1, 0, 0, 0, 382, 383, 7, 17, 0, 0, 383, 384, 7, 6, 0, 0, 384, 385, 7, 7, 0, 0, 385, 386, 7, 18, 0, 0, 386, 387, 1, 0, 0, 0, 387, 388, 6, 6, 0, 0, 388, 25, 1, 0, 0, 0, 389, 390, 7, 1, 0, 0, 390, 391, 7, 9, 0, 0, 391, 392, 7, 13, 0, 0, 392, 393, 7, 1, 0, 0, 393, 394, 7, 9, 0, 0, 394, 395, 7, 3, 0, 0, 395, 396, 7, 2, 0, 0, 396, 397, 7, 5, 0, 0, 397, 398, 7, 12, 0, 0, 398, 399, 7, 5, 0, 0, 399, 400, 7, 2, 0, 0, 400, 401, 1, 0, 0, 0, 401, 402, 6, 7, 0, 0, 402, 27, 1, 0, 0, 0, 403, 404, 7, 18, 0, 0, 404, 405, 7, 3, 0, 0, 405, 406, 7, 3, 0, 0, 406, 407, 7, 8, 0, 0, 407, 408, 1, 0, 0, 0, 408, 409, 6, 8, 1, 0, 409, 29, 1, 0, 0, 0, 410, 411, 7, 13, 0, 0, 411, 412, 7, 1, 0, 0, 412, 413, 7, 16, 0, 0, 413, 414, 7, 1, 0, 0, 414, 415, 7, 5, 0, 0, 415, 416, 1, 0, 0, 0, 416, 417, 6, 9, 0, 0, 417, 31, 1, 0, 0, 0, 418, 419, 7, 16, 0, 0, 419, 420, 7, 3, 0, 0, 420, 421, 7, 5, 0, 0, 421, 422, 7, 12, 0, 0, 422, 423, 1, 0, 0, 0, 423, 424, 6, 10, 5, 0, 424, 33, 1, 0, 0, 0, 425, 426, 7, 16, 0, 0, 426, 427, 7, 11, 0, 0, 427, 428, 5, 95, 0, 0, 428, 429, 7, 3, 0, 0, 429, 430, 7, 14, 0, 0, 430, 431, 7, 8, 0, 0, 431, 432, 7, 12, 0, 0, 432, 433, 7, 9, 0, 0, 433, 434, 7, 0, 0, 0, 434, 435, 1, 0, 0, 0, 435, 436, 6, 11, 6, 0, 436, 35, 1, 0, 0, 0, 437, 438, 7, 6, 0, 0, 438, 439, 7, 3, 0, 0, 439, 440, 7, 9, 0, 0, 440, 441, 7, 12, 0, 0, 441, 442, 7, 16, 0, 0, 442, 443, 7, 3, 0, 0, 443, 444, 1, 0, 0, 0, 444, 445, 6, 12, 7, 0, 445, 37, 1, 0, 0, 0, 446, 447, 7, 6, 0, 0, 447, 448, 7, 7, 0, 0, 448, 449, 7, 19, 0, 0, 449, 450, 1, 0, 0, 0, 450, 451, 6, 13, 0, 0, 451, 39, 1, 0, 0, 0, 452, 453, 7, 2, 0, 0, 453, 454, 7, 10, 0, 0, 454, 455, 7, 7, 0, 0, 455, 456, 7, 19, 0, 0, 456, 457, 1, 0, 0, 0, 457, 458, 6, 14, 8, 0, 458, 41, 1, 0, 0, 0, 459, 460, 7, 2, 0, 0, 460, 461, 7, 7, 0, 0, 461, 462, 7, 6, 0, 0, 462, 463, 7, 5, 0, 0, 463, 464, 1, 0, 0, 0, 464, 465, 6, 15, 0, 0, 465, 43, 1, 0, 0, 0, 466, 467, 7, 2, 0, 0, 467, 468, 7, 5, 0, 0, 468, 469, 7, 12, 0, 0, 469, 470, 7, 5, 0, 0, 470, 471, 7, 2, 0, 0, 471, 472, 1, 0, 0, 0, 472, 473, 6, 16, 0, 0, 473, 45, 1, 0, 0, 0, 474, 475, 7, 19, 0, 0, 475, 476, 7, 10, 0, 0, 476, 477, 7, 3, 0, 0, 477, 478, 7, 6, 0, 0, 478, 479, 7, 3, 0, 0, 479, 480, 1, 0, 0, 0, 480, 481, 6, 17, 0, 0, 481, 47, 1, 0, 0, 0, 482, 484, 8, 20, 0, 0, 483, 482, 1, 0, 0, 0, 484, 485, 1, 0, 0, 0, 485, 483, 1, 0, 0, 0, 485, 486, 1, 0, 0, 0, 486, 487, 1, 0, 0, 0, 487, 488, 6, 18, 0, 0, 488, 49, 1, 0, 0, 0, 489, 490, 5, 47, 0, 0, 490, 491, 5, 47, 0, 0, 491, 495, 1, 0, 0, 0, 492, 494, 8, 21, 0, 0, 493, 492, 1, 0, 0, 0, 494, 497, 1, 0, 0, 0, 495, 493, 1, 0, 0, 0, 495, 496, 1, 0, 0, 0, 496, 499, 1, 0, 0, 0, 497, 495, 1, 0, 0, 0, 498, 500, 5, 13, 0, 0, 499, 498, 1, 0, 0, 0, 499, 500, 1, 0, 0, 0, 500, 502, 1, 0, 0, 0, 501, 503, 5, 10, 0, 0, 502, 501, 1, 0, 0, 0, 502, 503, 1, 0, 0, 0, 503, 504, 1, 0, 0, 0, 504, 505, 6, 19, 9, 0, 505, 51, 1, 0, 0, 0, 506, 507, 5, 47, 0, 0, 507, 508, 5, 42, 0, 0, 508, 513, 1, 0, 0, 0, 509, 512, 3, 52, 20, 0, 510, 512, 9, 0, 0, 0, 511, 509, 1, 0, 0, 0, 511, 510, 1, 0, 0, 0, 512, 515, 1, 0, 0, 0, 513, 514, 1, 0, 0, 0, 513, 511, 1, 0, 0, 0, 514, 516, 1, 0, 0, 0, 515, 513, 1, 0, 0, 0, 516, 517, 5, 42, 0, 0, 517, 518, 5, 47, 0, 0, 518, 519, 1, 0, 0, 0, 519, 520, 6, 20, 9, 0, 520, 53, 1, 0, 0, 0, 521, 523, 7, 22, 0, 0, 522, 521, 1, 0, 0, 0, 523, 524, 1, 0, 0, 0, 524, 522, 1, 0, 0, 0, 524, 525, 1, 0, 0, 0, 525, 526, 1, 0, 0, 0, 526, 527, 6, 21, 9, 0, 527, 55, 1, 0, 0, 0, 528, 529, 3, 164, 76, 0, 529, 530, 1, 0, 0, 0, 530, 531, 6, 22, 10, 0, 531, 532, 6, 22, 11, 0, 532, 57, 1, 0, 0, 0, 533, 534, 3, 66, 27, 0, 534, 535, 1, 0, 0, 0, 535, 536, 6, 23, 12, 0, 536, 537, 6, 23, 13, 0, 537, 59, 1, 0, 0, 0, 538, 539, 3, 54, 21, 0, 539, 540, 1, 0, 0, 0, 540, 541, 6, 24, 9, 0, 541, 61, 1, 0, 0, 0, 542, 543, 3, 50, 19, 0, 543, 544, 1, 0, 0, 0, 544, 545, 6, 25, 9, 0, 545, 63, 1, 0, 0, 0, 546, 547, 3, 52, 20, 0, 547, 548, 1, 0, 0, 0, 548, 549, 6, 26, 9, 0, 549, 65, 1, 0, 0, 0, 550, 551, 5, 124, 0, 0, 551, 552, 1, 0, 0, 0, 552, 553, 6, 27, 13, 0, 553, 67, 1, 0, 0, 0, 554, 555, 7, 23, 0, 0, 555, 69, 1, 0, 0, 0, 556, 557, 7, 24, 0, 0, 557, 71, 1, 0, 0, 0, 558, 559, 5, 92, 0, 0, 559, 560, 7, 25, 0, 0, 560, 73, 1, 0, 0, 0, 561, 562, 8, 26, 0, 0, 562, 75, 1, 0, 0, 0, 563, 565, 7, 3, 0, 0, 564, 566, 7, 27, 0, 0, 565, 564, 1, 0, 0, 0, 565, 566, 1, 0, 0, 0, 566, 568, 1, 0, 0, 0, 567, 569, 3, 68, 28, 0, 568, 567, 1, 0, 0, 0, 569, 570, 1, 0, 0, 0, 570, 568, 1, 0, 0, 0, 570, 571, 1, 0, 0, 0, 571, 77, 1, 0, 0, 0, 572, 573, 5, 64, 0, 0, 573, 79, 1, 0, 0, 0, 574, 575, 5, 96, 0, 0, 575, 81, 1, 0, 0, 0, 576, 580, 8, 28, 0, 0, 577, 578, 5, 96, 0, 0, 578, 580, 5, 96, 0, 0, 579, 576, 1, 0, 0, 0, 579, 577, 1, 0, 0, 0, 580, 83, 1, 0, 0, 0, 581, 582, 5, 95, 0, 0, 582, 85, 1, 0, 0, 0, 583, 587, 3, 70, 29, 0, 584, 587, 3, 68, 28, 0, 585, 587, 3, 84, 36, 0, 586, 583, 1, 0, 0, 0, 586, 584, 1, 0, 0, 0, 586, 585, 1, 0, 0, 0, 587, 87, 1, 0, 0, 0, 588, 593, 5, 34, 0, 0, 589, 592, 3, 72, 30, 0, 590, 592, 3, 74, 31, 0, 591, 589, 1, 0, 0, 0, 591, 590, 1, 0, 0, 0, 592, 595, 1, 0, 0, 0, 593, 591, 1, 0, 0, 0, 593, 594, 1, 0, 0, 0, 594, 596, 1, 0, 0, 0, 595, 593, 1, 0, 0, 0, 596, 618, 5, 34, 0, 0, 597, 598, 5, 34, 0, 0, 598, 599, 5, 34, 0, 0, 599, 600, 5, 34, 0, 0, 600, 604, 1, 0, 0, 0, 601, 603, 8, 21, 0, 0, 602, 601, 1, 0, 0, 0, 603, 606, 1, 0, 0, 0, 604, 605, 1, 0, 0, 0, 604, 602, 1, 0, 0, 0, 605, 607, 1, 0, 0, 0, 606, 604, 1, 0, 0, 0, 607, 608, 5, 34, 0, 0, 608, 609, 5, 34, 0, 0, 609, 610, 5, 34, 0, 0, 610, 612, 1, 0, 0, 0, 611, 613, 5, 34, 0, 0, 612, 611, 1, 0, 0, 0, 612, 613, 1, 0, 0, 0, 613, 615, 1, 0, 0, 0, 614, 616, 5, 34, 0, 0, 615, 614, 1, 0, 0, 0, 615, 616, 1, 0, 0, 0, 616, 618, 1, 0, 0, 0, 617, 588, 1, 0, 0, 0, 617, 597, 1, 0, 0, 0, 618, 89, 1, 0, 0, 0, 619, 621, 3, 68, 28, 0, 620, 619, 1, 0, 0, 0, 621, 622, 1, 0, 0, 0, 622, 620, 1, 0, 0, 0, 622, 623, 1, 0, 0, 0, 623, 91, 1, 0, 0, 0, 624, 626, 3, 68, 28, 0, 625, 624, 1, 0, 0, 0, 626, 627, 1, 0, 0, 0, 627, 625, 1, 0, 0, 0, 627, 628, 1, 0, 0, 0, 628, 629, 1, 0, 0, 0, 629, 633, 3, 108, 48, 0, 630, 632, 3, 68, 28, 0, 631, 630, 1, 0, 0, 0, 632, 635, 1, 0, 0, 0, 633, 631, 1, 0, 0, 0, 633, 634, 1, 0, 0, 0, 634, 667, 1, 0, 0, 0, 635, 633, 1, 0, 0, 0, 636, 638, 3, 108, 48, 0, 637, 639, 3, 68, 28, 0, 638, 637, 1, 0, 0, 0, 639, 640, 1, 0, 0, 0, 640, 638, 1, 0, 0, 0, 640, 641, 1, 0, 0, 0, 641, 667, 1, 0, 0, 0, 642, 644, 3, 68, 28, 0, 643, 642, 1, 0, 0, 0, 644, 645, 1, 0, 0, 0, 645, 643, 1, 0, 0, 0, 645, 646, 1, 0, 0, 0, 646, 654, 1, 0, 0, 0, 647, 651, 3, 108, 48, 0, 648, 650, 3, 68, 28, 0, 649, 648, 1, 0, 0, 0, 650, 653, 1, 0, 0, 0, 651, 649, 1, 0, 0, 0, 651, 652, 1, 0, 0, 0, 652, 655, 1, 0, 0, 0, 653, 651, 1, 0, 0, 0, 654, 647, 1, 0, 0, 0, 654, 655, 1, 0, 0, 0, 655, 656, 1, 0, 0, 0, 656, 657, 3, 76, 32, 0, 657, 667, 1, 0, 0, 0, 658, 660, 3, 108, 48, 0, 659, 661, 3, 68, 28, 0, 660, 659, 1, 0, 0, 0, 661, 662, 1, 0, 0, 0, 662, 660, 1, 0, 0, 0, 662, 663, 1, 0, 0, 0, 663, 664, 1, 0, 0, 0, 664, 665, 3, 76, 32, 0, 665, 667, 1, 0, 0, 0, 666, 625, 1, 0, 0, 0, 666, 636, 1, 0, 0, 0, 666, 643, 1, 0, 0, 0, 666, 658, 1, 0, 0, 0, 667, 93, 1, 0, 0, 0, 668, 669, 7, 29, 0, 0, 669, 670, 7, 30, 0, 0, 670, 95, 1, 0, 0, 0, 671, 672, 7, 12, 0, 0, 672, 673, 7, 9, 0, 0, 673, 674, 7, 0, 0, 0, 674, 97, 1, 0, 0, 0, 675, 676, 7, 12, 0, 0, 676, 677, 7, 2, 0, 0, 677, 678, 7, 4, 0, 0, 678, 99, 1, 0, 0, 0, 679, 680, 5, 61, 0, 0, 680, 101, 1, 0, 0, 0, 681, 682, 5, 58, 0, 0, 682, 683, 5, 58, 0, 0, 683, 103, 1, 0, 0, 0, 684, 685, 5, 44, 0, 0, 685, 105, 1, 0, 0, 0, 686, 687, 7, 0, 0, 0, 687, 688, 7, 3, 0, 0, 688, 689, 7, 2, 0, 0, 689, 690, 7, 4, 0, 0, 690, 107, 1, 0, 0, 0, 691, 692, 5, 46, 0, 0, 692, 109, 1, 0, 0, 0, 693, 694, 7, 15, 0, 0, 694, 695, 7, 12, 0, 0, 695, 696, 7, 13, 0, 0, 696, 697, 7, 2, 0, 0, 697, 698, 7, 3, 0, 0, 698, 111, 1, 0, 0, 0, 699, 700, 7, 15, 0, 0, 700, 701, 7, 1, 0, 0, 701, 702, 7, 6, 0, 0, 702, 703, 7, 2, 0, 0, 703, 704, 7, 5, 0, 0, 704, 113, 1, 0, 0, 0, 705, 706, 7, 13, 0, 0, 706, 707, 7, 12, 0, 0, 707, 708, 7, 2, 0, 0, 708, 709, 7, 5, 0, 0, 709, 115, 1, 0, 0, 0, 710, 711, 5, 40, 0, 0, 711, 117, 1, 0, 0, 0, 712, 713, 7, 1, 0, 0, 713, 714, 7, 9, 0, 0, 714, 119, 1, 0, 0, 0, 715, 716, 7, 1, 0, 0, 716, 717, 7, 2, 0, 0, 717, 121, 1, 0, 0, 0, 718, 719, 7, 13, 0, 0, 719, 720, 7, 1, 0, 0, 720, 721, 7, 18, 0, 0, 721, 722, 7, 3, 0, 0, 722, 123, 1, 0, 0, 0, 723, 724, 7, 9, 0, 0, 724, 725, 7, 7, 0, 0, 725, 726, 7, 5, 0, 0, 726, 125, 1, 0, 0, 0, 727, 728, 7, 9, 0, 0, 728, 729, 7, 31, 0, 0, 729, 730, 7, 13, 0, 0, 730, 731, 7, 13, 0, 0, 731, 127, 1, 0, 0, 0, 732, 733, 7, 9, 0, 0, 733, 734, 7, 31, 0, 0, 734, 735, 7, 13, 0, 0, 735, 736, 7, 13, 0, 0, 736, 737, 7, 2, 0, 0, 737, 129, 1, 0, 0, 0, 738, 739, 7, 7, 0, 0, 739, 740, 7, 6, 0, 0, 740, 131, 1, 0, 0, 0, 741, 742, 5, 63, 0, 0, 742, 133, 1, 0, 0, 0, 743, 744, 7, 6, 0, 0, 744, 745, 7, 13, 0, 0, 745, 746, 7, 1, 0, 0, 746, 747, 7, 18, 0, 0, 747, 748, 7, 3, 0, 0, 748, 135, 1, 0, 0, 0, 749, 750, 5, 41, 0, 0, 750, 137, 1, 0, 0, 0, 751, 752, 7, 5, 0, 0, 752, 753, 7, 6, 0, 0, 753, 754, 7, 31, 0, 0, 754, 755, 7, 3, 0, 0, 755, 139, 1, 0, 0, 0, 756, 757, 5, 61, 0, 0, 757, 758, 5, 61, 0, 0, 758, 141, 1, 0, 0, 0, 759, 760, 5, 61, 0, 0, 760, 761, 5, 126, 0, 0, 761, 143, 1, 0, 0, 0, 762, 763, 5, 33, 0, 0, 763, 764, 5, 61, 0, 0, 764, 145, 1, 0, 0, 0, 765, 766, 5, 60, 0, 0, 766, 147, 1, 0, 0, 0, 767, 768, 5, 60, 0, 0, 768, 769, 5, 61, 0, 0, 769, 149, 1, 0, 0, 0, 770, 771, 5, 62, 0, 0, 771, 151, 1, 0, 0, 0, 772, 773, 5, 62, 0, 0, 773, 774, 5, 61, 0, 0, 774, 153, 1, 0, 0, 0, 775, 776, 5, 43, 0, 0, 776, 155, 1, 0, 0, 0, 777, 778, 5, 45, 0, 0, 778, 157, 1, 0, 0, 0, 779, 780, 5, 42, 0, 0, 780, 159, 1, 0, 0, 0, 781, 782, 5, 47, 0, 0, 782, 161, 1, 0, 0, 0, 783, 784, 5, 37, 0, 0, 784, 163, 1, 0, 0, 0, 785, 786, 5, 91, 0, 0, 786, 787, 1, 0, 0, 0, 787, 788, 6, 76, 0, 0, 788, 789, 6, 76, 0, 0, 789, 165, 1, 0, 0, 0, 790, 791, 5, 93, 0, 0, 791, 792, 1, 0, 0, 0, 792, 793, 6, 77, 13, 0, 793, 794, 6, 77, 13, 0, 794, 167, 1, 0, 0, 0, 795, 799, 3, 70, 29, 0, 796, 798, 3, 86, 37, 0, 797, 796, 1, 0, 0, 0, 798, 801, 1, 0, 0, 0, 799, 797, 1, 0, 0, 0, 799, 800, 1, 0, 0, 0, 800, 812, 1, 0, 0, 0, 801, 799, 1, 0, 0, 0, 802, 805, 3, 84, 36, 0, 803, 805, 3, 78, 33, 0, 804, 802, 1, 0, 0, 0, 804, 803, 1, 0, 0, 0, 805, 807, 1, 0, 0, 0, 806, 808, 3, 86, 37, 0, 807, 806, 1, 0, 0, 0, 808, 809, 1, 0, 0, 0, 809, 807, 1, 0, 0, 0, 809, 810, 1, 0, 0, 0, 810, 812, 1, 0, 0, 0, 811, 795, 1, 0, 0, 0, 811, 804, 1, 0, 0, 0, 812, 169, 1, 0, 0, 0, 813, 815, 3, 80, 34, 0, 814, 816, 3, 82, 35, 0, 815, 814, 1, 0, 0, 0, 816, 817, 1, 0, 0, 0, 817, 815, 1, 0, 0, 0, 817, 818, 1, 0, 0, 0, 818, 819, 1, 0, 0, 0, 819, 820, 3, 80, 34, 0, 820, 171, 1, 0, 0, 0, 821, 822, 3, 170, 79, 0, 822, 173, 1, 0, 0, 0, 823, 824, 3, 50, 19, 0, 824, 825, 1, 0, 0, 0, 825, 826, 6, 81, 9, 0, 826, 175, 1, 0, 0, 0, 827, 828, 3, 52, 20, 0, 828, 829, 1, 0, 0, 0, 829, 830, 6, 82, 9, 0, 830, 177, 1, 0, 0, 0, 831, 832, 3, 54, 21, 0, 832, 833, 1, 0, 0, 0, 833, 834, 6, 83, 9, 0, 834, 179, 1, 0, 0, 0, 835, 836, 3, 66, 27, 0, 836, 837, 1, 0, 0, 0, 837, 838, 6, 84, 12, 0, 838, 839, 6, 84, 13, 0, 839, 181, 1, 0, 0, 0, 840, 841, 3, 164, 76, 0, 841, 842, 1, 0, 0, 0, 842, 843, 6, 85, 10, 0, 843, 183, 1, 0, 0, 0, 844, 845, 3, 166, 77, 0, 845, 846, 1, 0, 0, 0, 846, 847, 6, 86, 14, 0, 847, 185, 1, 0, 0, 0, 848, 849, 3, 104, 46, 0, 849, 850, 1, 0, 0, 0, 850, 851, 6, 87, 15, 0, 851, 187, 1, 0, 0, 0, 852, 853, 3, 100, 44, 0, 853, 854, 1, 0, 0, 0, 854, 855, 6, 88, 16, 0, 855, 189, 1, 0, 0, 0, 856, 857, 3, 88, 38, 0, 857, 858, 1, 0, 0, 0, 858, 859, 6, 89, 17, 0, 859, 191, 1, 0, 0, 0, 860, 861, 7, 7, 0, 0, 861, 862, 7, 8, 0, 0, 862, 863, 7, 5, 0, 0, 863, 864, 7, 1, 0, 0, 864, 865, 7, 7, 0, 0, 865, 866, 7, 9, 0, 0, 866, 867, 7, 2, 0, 0, 867, 193, 1, 0, 0, 0, 868, 869, 7, 16, 0, 0, 869, 870, 7, 3, 0, 0, 870, 871, 7, 5, 0, 0, 871, 872, 7, 12, 0, 0, 872, 873, 7, 0, 0, 0, 873, 874, 7, 12, 0, 0, 874, 875, 7, 5, 0, 0, 875, 876, 7, 12, 0, 0, 876, 195, 1, 0, 0, 0, 877, 881, 8, 32, 0, 0, 878, 879, 5, 47, 0, 0, 879, 881, 8, 33, 0, 0, 880, 877, 1, 0, 0, 0, 880, 878, 1, 0, 0, 0, 881, 197, 1, 0, 0, 0, 882, 884, 3, 196, 92, 0, 883, 882, 1, 0, 0, 0, 884, 885, 1, 0, 0, 0, 885, 883, 1, 0, 0, 0, 885, 886, 1, 0, 0, 0, 886, 199, 1, 0, 0, 0, 887, 888, 3, 172, 80, 0, 888, 889, 1, 0, 0, 0, 889, 890, 6, 94, 18, 0, 890, 201, 1, 0, 0, 0, 891, 892, 3, 50, 19, 0, 892, 893, 1, 0, 0, 0, 893, 894, 6, 95, 9, 0, 894, 203, 1, 0, 0, 0, 895, 896, 3, 52, 20, 0, 896, 897, 1, 0, 0, 0, 897, 898, 6, 96, 9, 0, 898, 205, 1, 0, 0, 0, 899, 900, 3, 54, 21, 0, 900, 901, 1, 0, 0, 0, 901, 902, 6, 97, 9, 0, 902, 207, 1, 0, 0, 0, 903, 904, 3, 66, 27, 0, 904, 905, 1, 0, 0, 0, 905, 906, 6, 98, 12, 0, 906, 907, 6, 98, 13, 0, 907, 209, 1, 0, 0, 0, 908, 909, 3, 108, 48, 0, 909, 910, 1, 0, 0, 0, 910, 911, 6, 99, 19, 0, 911, 211, 1, 0, 0, 0, 912, 913, 3, 104, 46, 0, 913, 914, 1, 0, 0, 0, 914, 915, 6, 100, 15, 0, 915, 213, 1, 0, 0, 0, 916, 921, 3, 70, 29, 0, 917, 921, 3, 68, 28, 0, 918, 921, 3, 84, 36, 0, 919, 921, 3, 158, 73, 0, 920, 916, 1, 0, 0, 0, 920, 917, 1, 0, 0, 0, 920, 918, 1, 0, 0, 0, 920, 919, 1, 0, 0, 0, 921, 215, 1, 0, 0, 0, 922, 925, 3, 70, 29, 0, 923, 925, 3, 158, 73, 0, 924, 922, 1, 0, 0, 0, 924, 923, 1, 0, 0, 0, 925, 929, 1, 0, 0, 0, 926, 928, 3, 214, 101, 0, 927, 926, 1, 0, 0, 0, 928, 931, 1, 0, 0, 0, 929, 927, 1, 0, 0, 0, 929, 930, 1, 0, 0, 0, 930, 942, 1, 0, 0, 0, 931, 929, 1, 0, 0, 0, 932, 935, 3, 84, 36, 0, 933, 935, 3, 78, 33, 0, 934, 932, 1, 0, 0, 0, 934, 933, 1, 0, 0, 0, 935, 937, 1, 0, 0, 0, 936, 938, 3, 214, 101, 0, 937, 936, 1, 0, 0, 0, 938, 939, 1, 0, 0, 0, 939, 937, 1, 0, 0, 0, 939, 940, 1, 0, 0, 0, 940, 942, 1, 0, 0, 0, 941, 924, 1, 0, 0, 0, 941, 934, 1, 0, 0, 0, 942, 217, 1, 0, 0, 0, 943, 946, 3, 216, 102, 0, 944, 946, 3, 170, 79, 0, 945, 943, 1, 0, 0, 0, 945, 944, 1, 0, 0, 0, 946, 947, 1, 0, 0, 0, 947, 945, 1, 0, 0, 0, 947, 948, 1, 0, 0, 0, 948, 219, 1, 0, 0, 0, 949, 950, 3, 50, 19, 0, 950, 951, 1, 0, 0, 0, 951, 952, 6, 104, 9, 0, 952, 221, 1, 0, 0, 0, 953, 954, 3, 52, 20, 0, 954, 955, 1, 0, 0, 0, 955, 956, 6, 105, 9, 0, 956, 223, 1, 0, 0, 0, 957, 958, 3, 54, 21, 0, 958, 959, 1, 0, 0, 0, 959, 960, 6, 106, 9, 0, 960, 225, 1, 0, 0, 0, 961, 962, 3, 66, 27, 0, 962, 963, 1, 0, 0, 0, 963, 964, 6, 107, 12, 0, 964, 965, 6, 107, 13, 0, 965, 227, 1, 0, 0, 0, 966, 967, 3, 100, 44, 0, 967, 968, 1, 0, 0, 0, 968, 969, 6, 108, 16, 0, 969, 229, 1, 0, 0, 0, 970, 971, 3, 104, 46, 0, 971, 972, 1, 0, 0, 0, 972, 973, 6, 109, 15, 0, 973, 231, 1, 0, 0, 0, 974, 975, 3, 108, 48, 0, 975, 976, 1, 0, 0, 0, 976, 977, 6, 110, 19, 0, 977, 233, 1, 0, 0, 0, 978, 979, 7, 12, 0, 0, 979, 980, 7, 2, 0, 0, 980, 235, 1, 0, 0, 0, 981, 982, 3, 218, 103, 0, 982, 983, 1, 0, 0, 0, 983, 984, 6, 112, 20, 0, 984, 237, 1, 0, 0, 0, 985, 986, 3, 50, 19, 0, 986, 987, 1, 0, 0, 0, 987, 988, 6, 113, 9, 0, 988, 239, 1, 0, 0, 0, 989, 990, 3, 52, 20, 0, 990, 991, 1, 0, 0, 0, 991, 992, 6, 114, 9, 0, 992, 241, 1, 0, 0, 0, 993, 994, 3, 54, 21, 0, 994, 995, 1, 0, 0, 0, 995, 996, 6, 115, 9, 0, 996, 243, 1, 0, 0, 0, 997, 998, 3, 66, 27, 0, 998, 999, 1, 0, 0, 0, 999, 1000, 6, 116, 12, 0, 1000, 1001, 6, 116, 13, 0, 1001, 245, 1, 0, 0, 0, 1002, 1003, 3, 164, 76, 0, 1003, 1004, 1, 0, 0, 0, 1004, 1005, 6, 117, 10, 0, 1005, 1006, 6, 117, 21, 0, 1006, 247, 1, 0, 0, 0, 1007, 1008, 7, 7, 0, 0, 1008, 1009, 7, 9, 0, 0, 1009, 1010, 1, 0, 0, 0, 1010, 1011, 6, 118, 22, 0, 1011, 249, 1, 0, 0, 0, 1012, 1013, 7, 19, 0, 0, 1013, 1014, 7, 1, 0, 0, 1014, 1015, 7, 5, 0, 0, 1015, 1016, 7, 10, 0, 0, 1016, 1017, 1, 0, 0, 0, 1017, 1018, 6, 119, 22, 0, 1018, 251, 1, 0, 0, 0, 1019, 1020, 8, 34, 0, 0, 1020, 253, 1, 0, 0, 0, 1021, 1023, 3, 252, 120, 0, 1022, 1021, 1, 0, 0, 0, 1023, 1024, 1, 0, 0, 0, 1024, 1022, 1, 0, 0, 0, 1024, 1025, 1, 0, 0, 0, 1025, 1026, 1, 0, 0, 0, 1026, 1027, 3, 322, 155, 0, 1027, 1029, 1, 0, 0, 0, 1028, 1022, 1, 0, 0, 0, 1028, 1029, 1, 0, 0, 0, 1029, 1031, 1, 0, 0, 0, 1030, 1032, 3, 252, 120, 0, 1031, 1030, 1, 0, 0, 0, 1032, 1033, 1, 0, 0, 0, 1033, 1031, 1, 0, 0, 0, 1033, 1034, 1, 0, 0, 0, 1034, 255, 1, 0, 0, 0, 1035, 1036, 3, 172, 80, 0, 1036, 1037, 1, 0, 0, 0, 1037, 1038, 6, 122, 18, 0, 1038, 257, 1, 0, 0, 0, 1039, 1040, 3, 254, 121, 0, 1040, 1041, 1, 0, 0, 0, 1041, 1042, 6, 123, 23, 0, 1042, 259, 1, 0, 0, 0, 1043, 1044, 3, 50, 19, 0, 1044, 1045, 1, 0, 0, 0, 1045, 1046, 6, 124, 9, 0, 1046, 261, 1, 0, 0, 0, 1047, 1048, 3, 52, 20, 0, 1048, 1049, 1, 0, 0, 0, 1049, 1050, 6, 125, 9, 0, 1050, 263, 1, 0, 0, 0, 1051, 1052, 3, 54, 21, 0, 1052, 1053, 1, 0, 0, 0, 1053, 1054, 6, 126, 9, 0, 1054, 265, 1, 0, 0, 0, 1055, 1056, 3, 66, 27, 0, 1056, 1057, 1, 0, 0, 0, 1057, 1058, 6, 127, 12, 0, 1058, 1059, 6, 127, 13, 0, 1059, 1060, 6, 127, 13, 0, 1060, 267, 1, 0, 0, 0, 1061, 1062, 3, 100, 44, 0, 1062, 1063, 1, 0, 0, 0, 1063, 1064, 6, 128, 16, 0, 1064, 269, 1, 0, 0, 0, 1065, 1066, 3, 104, 46, 0, 1066, 1067, 1, 0, 0, 0, 1067, 1068, 6, 129, 15, 0, 1068, 271, 1, 0, 0, 0, 1069, 1070, 3, 108, 48, 0, 1070, 1071, 1, 0, 0, 0, 1071, 1072, 6, 130, 19, 0, 1072, 273, 1, 0, 0, 0, 1073, 1074, 3, 250, 119, 0, 1074, 1075, 1, 0, 0, 0, 1075, 1076, 6, 131, 24, 0, 1076, 275, 1, 0, 0, 0, 1077, 1078, 3, 218, 103, 0, 1078, 1079, 1, 0, 0, 0, 1079, 1080, 6, 132, 20, 0, 1080, 277, 1, 0, 0, 0, 1081, 1082, 3, 172, 80, 0, 1082, 1083, 1, 0, 0, 0, 1083, 1084, 6, 133, 18, 0, 1084, 279, 1, 0, 0, 0, 1085, 1086, 3, 50, 19, 0, 1086, 1087, 1, 0, 0, 0, 1087, 1088, 6, 134, 9, 0, 1088, 281, 1, 0, 0, 0, 1089, 1090, 3, 52, 20, 0, 1090, 1091, 1, 0, 0, 0, 1091, 1092, 6, 135, 9, 0, 1092, 283, 1, 0, 0, 0, 1093, 1094, 3, 54, 21, 0, 1094, 1095, 1, 0, 0, 0, 1095, 1096, 6, 136, 9, 0, 1096, 285, 1, 0, 0, 0, 1097, 1098, 3, 66, 27, 0, 1098, 1099, 1, 0, 0, 0, 1099, 1100, 6, 137, 12, 0, 1100, 1101, 6, 137, 13, 0, 1101, 287, 1, 0, 0, 0, 1102, 1103, 3, 108, 48, 0, 1103, 1104, 1, 0, 0, 0, 1104, 1105, 6, 138, 19, 0, 1105, 289, 1, 0, 0, 0, 1106, 1107, 3, 172, 80, 0, 1107, 1108, 1, 0, 0, 0, 1108, 1109, 6, 139, 18, 0, 1109, 291, 1, 0, 0, 0, 1110, 1111, 3, 168, 78, 0, 1111, 1112, 1, 0, 0, 0, 1112, 1113, 6, 140, 25, 0, 1113, 293, 1, 0, 0, 0, 1114, 1115, 3, 50, 19, 0, 1115, 1116, 1, 0, 0, 0, 1116, 1117, 6, 141, 9, 0, 1117, 295, 1, 0, 0, 0, 1118, 1119, 3, 52, 20, 0, 1119, 1120, 1, 0, 0, 0, 1120, 1121, 6, 142, 9, 0, 1121, 297, 1, 0, 0, 0, 1122, 1123, 3, 54, 21, 0, 1123, 1124, 1, 0, 0, 0, 1124, 1125, 6, 143, 9, 0, 1125, 299, 1, 0, 0, 0, 1126, 1127, 3, 66, 27, 0, 1127, 1128, 1, 0, 0, 0, 1128, 1129, 6, 144, 12, 0, 1129, 1130, 6, 144, 13, 0, 1130, 301, 1, 0, 0, 0, 1131, 1132, 7, 1, 0, 0, 1132, 1133, 7, 9, 0, 0, 1133, 1134, 7, 15, 0, 0, 1134, 1135, 7, 7, 0, 0, 1135, 303, 1, 0, 0, 0, 1136, 1137, 3, 50, 19, 0, 1137, 1138, 1, 0, 0, 0, 1138, 1139, 6, 146, 9, 0, 1139, 305, 1, 0, 0, 0, 1140, 1141, 3, 52, 20, 0, 1141, 1142, 1, 0, 0, 0, 1142, 1143, 6, 147, 9, 0, 1143, 307, 1, 0, 0, 0, 1144, 1145, 3, 54, 21, 0, 1145, 1146, 1, 0, 0, 0, 1146, 1147, 6, 148, 9, 0, 1147, 309, 1, 0, 0, 0, 1148, 1149, 3, 66, 27, 0, 1149, 1150, 1, 0, 0, 0, 1150, 1151, 6, 149, 12, 0, 1151, 1152, 6, 149, 13, 0, 1152, 311, 1, 0, 0, 0, 1153, 1154, 7, 15, 0, 0, 1154, 1155, 7, 31, 0, 0, 1155, 1156, 7, 9, 0, 0, 1156, 1157, 7, 4, 0, 0, 1157, 1158, 7, 5, 0, 0, 1158, 1159, 7, 1, 0, 0, 1159, 1160, 7, 7, 0, 0, 1160, 1161, 7, 9, 0, 0, 1161, 1162, 7, 2, 0, 0, 1162, 313, 1, 0, 0, 0, 1163, 1164, 3, 50, 19, 0, 1164, 1165, 1, 0, 0, 0, 1165, 1166, 6, 151, 9, 0, 1166, 315, 1, 0, 0, 0, 1167, 1168, 3, 52, 20, 0, 1168, 1169, 1, 0, 0, 0, 1169, 1170, 6, 152, 9, 0, 1170, 317, 1, 0, 0, 0, 1171, 1172, 3, 54, 21, 0, 1172, 1173, 1, 0, 0, 0, 1173, 1174, 6, 153, 9, 0, 1174, 319, 1, 0, 0, 0, 1175, 1176, 3, 166, 77, 0, 1176, 1177, 1, 0, 0, 0, 1177, 1178, 6, 154, 14, 0, 1178, 1179, 6, 154, 13, 0, 1179, 321, 1, 0, 0, 0, 1180, 1181, 5, 58, 0, 0, 1181, 323, 1, 0, 0, 0, 1182, 1188, 3, 78, 33, 0, 1183, 1188, 3, 68, 28, 0, 1184, 1188, 3, 108, 48, 0, 1185, 1188, 3, 70, 29, 0, 1186, 1188, 3, 84, 36, 0, 1187, 1182, 1, 0, 0, 0, 1187, 1183, 1, 0, 0, 0, 1187, 1184, 1, 0, 0, 0, 1187, 1185, 1, 0, 0, 0, 1187, 1186, 1, 0, 0, 0, 1188, 1189, 1, 0, 0, 0, 1189, 1187, 1, 0, 0, 0, 1189, 1190, 1, 0, 0, 0, 1190, 325, 1, 0, 0, 0, 1191, 1192, 3, 50, 19, 0, 1192, 1193, 1, 0, 0, 0, 1193, 1194, 6, 157, 9, 0, 1194, 327, 1, 0, 0, 0, 1195, 1196, 3, 52, 20, 0, 1196, 1197, 1, 0, 0, 0, 1197, 1198, 6, 158, 9, 0, 1198, 329, 1, 0, 0, 0, 1199, 1200, 3, 54, 21, 0, 1200, 1201, 1, 0, 0, 0, 1201, 1202, 6, 159, 9, 0, 1202, 331, 1, 0, 0, 0, 58, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 485, 495, 499, 502, 511, 513, 524, 565, 570, 579, 586, 591, 593, 604, 612, 615, 617, 622, 627, 633, 640, 645, 651, 654, 662, 666, 799, 804, 809, 811, 817, 880, 885, 920, 924, 929, 934, 939, 941, 945, 947, 1024, 1028, 1033, 1187, 1189, 26, 5, 2, 0, 5, 4, 0, 5, 6, 0, 5, 1, 0, 5, 3, 0, 5, 10, 0, 5, 8, 0, 5, 5, 0, 5, 9, 0, 0, 1, 0, 7, 65, 0, 5, 0, 0, 7, 26, 0, 4, 0, 0, 7, 66, 0, 7, 35, 0, 7, 33, 0, 7, 27, 0, 7, 68, 0, 7, 37, 0, 7, 78, 0, 5, 11, 0, 5, 7, 0, 7, 88, 0, 7, 87, 0, 7, 67, 0]
\ No newline at end of file
+[4, 0, 110, 1197, 6, -1, 6, -1, 6, -1, 6, -1, 6, -1, 6, -1, 6, -1, 6, -1, 6, -1, 6, -1, 6, -1, 6, -1, 2, 0, 7, 0, 2, 1, 7, 1, 2, 2, 7, 2, 2, 3, 7, 3, 2, 4, 7, 4, 2, 5, 7, 5, 2, 6, 7, 6, 2, 7, 7, 7, 2, 8, 7, 8, 2, 9, 7, 9, 2, 10, 7, 10, 2, 11, 7, 11, 2, 12, 7, 12, 2, 13, 7, 13, 2, 14, 7, 14, 2, 15, 7, 15, 2, 16, 7, 16, 2, 17, 7, 17, 2, 18, 7, 18, 2, 19, 7, 19, 2, 20, 7, 20, 2, 21, 7, 21, 2, 22, 7, 22, 2, 23, 7, 23, 2, 24, 7, 24, 2, 25, 7, 25, 2, 26, 7, 26, 2, 27, 7, 27, 2, 28, 7, 28, 2, 29, 7, 29, 2, 30, 7, 30, 2, 31, 7, 31, 2, 32, 7, 32, 2, 33, 7, 33, 2, 34, 7, 34, 2, 35, 7, 35, 2, 36, 7, 36, 2, 37, 7, 37, 2, 38, 7, 38, 2, 39, 7, 39, 2, 40, 7, 40, 2, 41, 7, 41, 2, 42, 7, 42, 2, 43, 7, 43, 2, 44, 7, 44, 2, 45, 7, 45, 2, 46, 7, 46, 2, 47, 7, 47, 2, 48, 7, 48, 2, 49, 7, 49, 2, 50, 7, 50, 2, 51, 7, 51, 2, 52, 7, 52, 2, 53, 7, 53, 2, 54, 7, 54, 2, 55, 7, 55, 2, 56, 7, 56, 2, 57, 7, 57, 2, 58, 7, 58, 2, 59, 7, 59, 2, 60, 7, 60, 2, 61, 7, 61, 2, 62, 7, 62, 2, 63, 7, 63, 2, 64, 7, 64, 2, 65, 7, 65, 2, 66, 7, 66, 2, 67, 7, 67, 2, 68, 7, 68, 2, 69, 7, 69, 2, 70, 7, 70, 2, 71, 7, 71, 2, 72, 7, 72, 2, 73, 7, 73, 2, 74, 7, 74, 2, 75, 7, 75, 2, 76, 7, 76, 2, 77, 7, 77, 2, 78, 7, 78, 2, 79, 7, 79, 2, 80, 7, 80, 2, 81, 7, 81, 2, 82, 7, 82, 2, 83, 7, 83, 2, 84, 7, 84, 2, 85, 7, 85, 2, 86, 7, 86, 2, 87, 7, 87, 2, 88, 7, 88, 2, 89, 7, 89, 2, 90, 7, 90, 2, 91, 7, 91, 2, 92, 7, 92, 2, 93, 7, 93, 2, 94, 7, 94, 2, 95, 7, 95, 2, 96, 7, 96, 2, 97, 7, 97, 2, 98, 7, 98, 2, 99, 7, 99, 2, 100, 7, 100, 2, 101, 7, 101, 2, 102, 7, 102, 2, 103, 7, 103, 2, 104, 7, 104, 2, 105, 7, 105, 2, 106, 7, 106, 2, 107, 7, 107, 2, 108, 7, 108, 2, 109, 7, 109, 2, 110, 7, 110, 2, 111, 7, 111, 2, 112, 7, 112, 2, 113, 7, 113, 2, 114, 7, 114, 2, 115, 7, 115, 2, 116, 7, 116, 2, 117, 7, 117, 2, 118, 7, 118, 2, 119, 7, 119, 2, 120, 7, 120, 2, 121, 7, 121, 2, 122, 7, 122, 2, 123, 7, 123, 2, 124, 7, 124, 2, 125, 7, 125, 2, 126, 7, 126, 2, 127, 7, 127, 2, 128, 7, 128, 2, 129, 7, 129, 2, 130, 7, 130, 2, 131, 7, 131, 2, 132, 7, 132, 2, 133, 7, 133, 2, 134, 7, 134, 2, 135, 7, 135, 2, 136, 7, 136, 2, 137, 7, 137, 2, 138, 7, 138, 2, 139, 7, 139, 2, 140, 7, 140, 2, 141, 7, 141, 2, 142, 7, 142, 2, 143, 7, 143, 2, 144, 7, 144, 2, 145, 7, 145, 2, 146, 7, 146, 2, 147, 7, 147, 2, 148, 7, 148, 2, 149, 7, 149, 2, 150, 7, 150, 2, 151, 7, 151, 2, 152, 7, 152, 2, 153, 7, 153, 2, 154, 7, 154, 2, 155, 7, 155, 2, 156, 7, 156, 2, 157, 7, 157, 2, 158, 7, 158, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 2, 1, 2, 1, 2, 1, 2, 1, 2, 1, 2, 1, 2, 1, 2, 1, 2, 1, 3, 1, 3, 1, 3, 1, 3, 1, 3, 1, 3, 1, 3, 1, 4, 1, 4, 1, 4, 1, 4, 1, 4, 1, 4, 1, 4, 1, 4, 1, 4, 1, 4, 1, 5, 1, 5, 1, 5, 1, 5, 1, 5, 1, 5, 1, 5, 1, 6, 1, 6, 1, 6, 1, 6, 1, 6, 1, 6, 1, 6, 1, 7, 1, 7, 1, 7, 1, 7, 1, 7, 1, 7, 1, 7, 1, 7, 1, 7, 1, 7, 1, 7, 1, 7, 1, 7, 1, 7, 1, 8, 1, 8, 1, 8, 1, 8, 1, 8, 1, 8, 1, 8, 1, 9, 1, 9, 1, 9, 1, 9, 1, 9, 1, 9, 1, 9, 1, 9, 1, 10, 1, 10, 1, 10, 1, 10, 1, 10, 1, 10, 1, 10, 1, 11, 1, 11, 1, 11, 1, 11, 1, 11, 1, 11, 1, 11, 1, 11, 1, 11, 1, 11, 1, 11, 1, 11, 1, 12, 1, 12, 1, 12, 1, 12, 1, 12, 1, 12, 1, 12, 1, 12, 1, 12, 1, 13, 1, 13, 1, 13, 1, 13, 1, 13, 1, 13, 1, 14, 1, 14, 1, 14, 1, 14, 1, 14, 1, 14, 1, 14, 1, 15, 1, 15, 1, 15, 1, 15, 1, 15, 1, 15, 1, 15, 1, 16, 1, 16, 1, 16, 1, 16, 1, 16, 1, 16, 1, 16, 1, 16, 1, 17, 1, 17, 1, 17, 1, 17, 1, 17, 1, 17, 1, 17, 1, 17, 1, 18, 4, 18, 482, 8, 18, 11, 18, 12, 18, 483, 1, 18, 1, 18, 1, 19, 1, 19, 1, 19, 1, 19, 5, 19, 492, 8, 19, 10, 19, 12, 19, 495, 9, 19, 1, 19, 3, 19, 498, 8, 19, 1, 19, 3, 19, 501, 8, 19, 1, 19, 1, 19, 1, 20, 1, 20, 1, 20, 1, 20, 1, 20, 5, 20, 510, 8, 20, 10, 20, 12, 20, 513, 9, 20, 1, 20, 1, 20, 1, 20, 1, 20, 1, 20, 1, 21, 4, 21, 521, 8, 21, 11, 21, 12, 21, 522, 1, 21, 1, 21, 1, 22, 1, 22, 1, 22, 1, 22, 1, 22, 1, 23, 1, 23, 1, 23, 1, 23, 1, 23, 1, 24, 1, 24, 1, 24, 1, 24, 1, 25, 1, 25, 1, 25, 1, 25, 1, 26, 1, 26, 1, 26, 1, 26, 1, 27, 1, 27, 1, 27, 1, 27, 1, 28, 1, 28, 1, 29, 1, 29, 1, 30, 1, 30, 1, 30, 1, 31, 1, 31, 1, 32, 1, 32, 3, 32, 564, 8, 32, 1, 32, 4, 32, 567, 8, 32, 11, 32, 12, 32, 568, 1, 33, 1, 33, 1, 34, 1, 34, 1, 35, 1, 35, 1, 35, 3, 35, 578, 8, 35, 1, 36, 1, 36, 1, 37, 1, 37, 1, 37, 3, 37, 585, 8, 37, 1, 38, 1, 38, 1, 38, 5, 38, 590, 8, 38, 10, 38, 12, 38, 593, 9, 38, 1, 38, 1, 38, 1, 38, 1, 38, 1, 38, 1, 38, 5, 38, 601, 8, 38, 10, 38, 12, 38, 604, 9, 38, 1, 38, 1, 38, 1, 38, 1, 38, 1, 38, 3, 38, 611, 8, 38, 1, 38, 3, 38, 614, 8, 38, 3, 38, 616, 8, 38, 1, 39, 4, 39, 619, 8, 39, 11, 39, 12, 39, 620, 1, 40, 4, 40, 624, 8, 40, 11, 40, 12, 40, 625, 1, 40, 1, 40, 5, 40, 630, 8, 40, 10, 40, 12, 40, 633, 9, 40, 1, 40, 1, 40, 4, 40, 637, 8, 40, 11, 40, 12, 40, 638, 1, 40, 4, 40, 642, 8, 40, 11, 40, 12, 40, 643, 1, 40, 1, 40, 5, 40, 648, 8, 40, 10, 40, 12, 40, 651, 9, 40, 3, 40, 653, 8, 40, 1, 40, 1, 40, 1, 40, 1, 40, 4, 40, 659, 8, 40, 11, 40, 12, 40, 660, 1, 40, 1, 40, 3, 40, 665, 8, 40, 1, 41, 1, 41, 1, 41, 1, 42, 1, 42, 1, 42, 1, 42, 1, 43, 1, 43, 1, 43, 1, 43, 1, 44, 1, 44, 1, 45, 1, 45, 1, 45, 1, 46, 1, 46, 1, 47, 1, 47, 1, 47, 1, 47, 1, 47, 1, 48, 1, 48, 1, 49, 1, 49, 1, 49, 1, 49, 1, 49, 1, 49, 1, 50, 1, 50, 1, 50, 1, 50, 1, 50, 1, 50, 1, 51, 1, 51, 1, 51, 1, 51, 1, 51, 1, 52, 1, 52, 1, 53, 1, 53, 1, 53, 1, 54, 1, 54, 1, 54, 1, 55, 1, 55, 1, 55, 1, 55, 1, 55, 1, 56, 1, 56, 1, 56, 1, 56, 1, 57, 1, 57, 1, 57, 1, 57, 1, 57, 1, 58, 1, 58, 1, 58, 1, 58, 1, 58, 1, 58, 1, 59, 1, 59, 1, 59, 1, 60, 1, 60, 1, 61, 1, 61, 1, 61, 1, 61, 1, 61, 1, 61, 1, 62, 1, 62, 1, 63, 1, 63, 1, 63, 1, 63, 1, 63, 1, 64, 1, 64, 1, 64, 1, 65, 1, 65, 1, 65, 1, 66, 1, 66, 1, 66, 1, 67, 1, 67, 1, 68, 1, 68, 1, 68, 1, 69, 1, 69, 1, 70, 1, 70, 1, 70, 1, 71, 1, 71, 1, 72, 1, 72, 1, 73, 1, 73, 1, 74, 1, 74, 1, 75, 1, 75, 1, 76, 1, 76, 1, 76, 1, 76, 1, 76, 1, 77, 1, 77, 1, 77, 1, 77, 1, 77, 1, 78, 1, 78, 5, 78, 796, 8, 78, 10, 78, 12, 78, 799, 9, 78, 1, 78, 1, 78, 3, 78, 803, 8, 78, 1, 78, 4, 78, 806, 8, 78, 11, 78, 12, 78, 807, 3, 78, 810, 8, 78, 1, 79, 1, 79, 4, 79, 814, 8, 79, 11, 79, 12, 79, 815, 1, 79, 1, 79, 1, 80, 1, 80, 1, 81, 1, 81, 1, 81, 1, 81, 1, 82, 1, 82, 1, 82, 1, 82, 1, 83, 1, 83, 1, 83, 1, 83, 1, 84, 1, 84, 1, 84, 1, 84, 1, 84, 1, 85, 1, 85, 1, 85, 1, 85, 1, 86, 1, 86, 1, 86, 1, 86, 1, 87, 1, 87, 1, 87, 1, 87, 1, 88, 1, 88, 1, 88, 1, 88, 1, 89, 1, 89, 1, 89, 1, 89, 1, 90, 1, 90, 1, 90, 1, 90, 1, 90, 1, 90, 1, 90, 1, 90, 1, 91, 1, 91, 1, 91, 1, 91, 1, 91, 1, 91, 1, 91, 1, 91, 1, 91, 1, 92, 1, 92, 1, 92, 3, 92, 879, 8, 92, 1, 93, 4, 93, 882, 8, 93, 11, 93, 12, 93, 883, 1, 94, 1, 94, 1, 94, 1, 94, 1, 95, 1, 95, 1, 95, 1, 95, 1, 96, 1, 96, 1, 96, 1, 96, 1, 97, 1, 97, 1, 97, 1, 97, 1, 97, 1, 98, 1, 98, 1, 98, 1, 98, 1, 99, 1, 99, 1, 99, 1, 99, 1, 100, 1, 100, 1, 100, 1, 100, 3, 100, 915, 8, 100, 1, 101, 1, 101, 3, 101, 919, 8, 101, 1, 101, 5, 101, 922, 8, 101, 10, 101, 12, 101, 925, 9, 101, 1, 101, 1, 101, 3, 101, 929, 8, 101, 1, 101, 4, 101, 932, 8, 101, 11, 101, 12, 101, 933, 3, 101, 936, 8, 101, 1, 102, 1, 102, 4, 102, 940, 8, 102, 11, 102, 12, 102, 941, 1, 103, 1, 103, 1, 103, 1, 103, 1, 104, 1, 104, 1, 104, 1, 104, 1, 105, 1, 105, 1, 105, 1, 105, 1, 106, 1, 106, 1, 106, 1, 106, 1, 106, 1, 107, 1, 107, 1, 107, 1, 107, 1, 108, 1, 108, 1, 108, 1, 108, 1, 109, 1, 109, 1, 109, 1, 109, 1, 110, 1, 110, 1, 110, 1, 111, 1, 111, 1, 111, 1, 111, 1, 112, 1, 112, 1, 112, 1, 112, 1, 113, 1, 113, 1, 113, 1, 113, 1, 114, 1, 114, 1, 114, 1, 114, 1, 115, 1, 115, 1, 115, 1, 115, 1, 115, 1, 116, 1, 116, 1, 116, 1, 116, 1, 116, 1, 117, 1, 117, 1, 117, 1, 117, 1, 117, 1, 118, 1, 118, 1, 118, 1, 118, 1, 118, 1, 118, 1, 118, 1, 119, 1, 119, 1, 120, 4, 120, 1017, 8, 120, 11, 120, 12, 120, 1018, 1, 120, 1, 120, 3, 120, 1023, 8, 120, 1, 120, 4, 120, 1026, 8, 120, 11, 120, 12, 120, 1027, 1, 121, 1, 121, 1, 121, 1, 121, 1, 122, 1, 122, 1, 122, 1, 122, 1, 123, 1, 123, 1, 123, 1, 123, 1, 124, 1, 124, 1, 124, 1, 124, 1, 125, 1, 125, 1, 125, 1, 125, 1, 126, 1, 126, 1, 126, 1, 126, 1, 126, 1, 126, 1, 127, 1, 127, 1, 127, 1, 127, 1, 128, 1, 128, 1, 128, 1, 128, 1, 129, 1, 129, 1, 129, 1, 129, 1, 130, 1, 130, 1, 130, 1, 130, 1, 131, 1, 131, 1, 131, 1, 131, 1, 132, 1, 132, 1, 132, 1, 132, 1, 133, 1, 133, 1, 133, 1, 133, 1, 134, 1, 134, 1, 134, 1, 134, 1, 135, 1, 135, 1, 135, 1, 135, 1, 136, 1, 136, 1, 136, 1, 136, 1, 136, 1, 137, 1, 137, 1, 137, 1, 137, 1, 138, 1, 138, 1, 138, 1, 138, 1, 139, 1, 139, 1, 139, 1, 139, 1, 140, 1, 140, 1, 140, 1, 140, 1, 141, 1, 141, 1, 141, 1, 141, 1, 142, 1, 142, 1, 142, 1, 142, 1, 143, 1, 143, 1, 143, 1, 143, 1, 143, 1, 144, 1, 144, 1, 144, 1, 144, 1, 144, 1, 145, 1, 145, 1, 145, 1, 145, 1, 146, 1, 146, 1, 146, 1, 146, 1, 147, 1, 147, 1, 147, 1, 147, 1, 148, 1, 148, 1, 148, 1, 148, 1, 148, 1, 149, 1, 149, 1, 149, 1, 149, 1, 149, 1, 149, 1, 149, 1, 149, 1, 149, 1, 149, 1, 150, 1, 150, 1, 150, 1, 150, 1, 151, 1, 151, 1, 151, 1, 151, 1, 152, 1, 152, 1, 152, 1, 152, 1, 153, 1, 153, 1, 153, 1, 153, 1, 153, 1, 154, 1, 154, 1, 155, 1, 155, 1, 155, 1, 155, 1, 155, 4, 155, 1182, 8, 155, 11, 155, 12, 155, 1183, 1, 156, 1, 156, 1, 156, 1, 156, 1, 157, 1, 157, 1, 157, 1, 157, 1, 158, 1, 158, 1, 158, 1, 158, 2, 511, 602, 0, 159, 12, 1, 14, 2, 16, 3, 18, 4, 20, 5, 22, 6, 24, 7, 26, 8, 28, 9, 30, 10, 32, 11, 34, 12, 36, 13, 38, 14, 40, 15, 42, 16, 44, 17, 46, 18, 48, 19, 50, 20, 52, 21, 54, 22, 56, 0, 58, 0, 60, 23, 62, 24, 64, 25, 66, 26, 68, 0, 70, 0, 72, 0, 74, 0, 76, 0, 78, 0, 80, 0, 82, 0, 84, 0, 86, 0, 88, 27, 90, 28, 92, 29, 94, 30, 96, 31, 98, 32, 100, 33, 102, 34, 104, 35, 106, 36, 108, 37, 110, 38, 112, 39, 114, 40, 116, 41, 118, 42, 120, 43, 122, 44, 124, 45, 126, 46, 128, 47, 130, 48, 132, 49, 134, 50, 136, 51, 138, 52, 140, 53, 142, 54, 144, 55, 146, 56, 148, 57, 150, 58, 152, 59, 154, 60, 156, 61, 158, 62, 160, 63, 162, 64, 164, 65, 166, 66, 168, 67, 170, 0, 172, 68, 174, 69, 176, 70, 178, 71, 180, 0, 182, 0, 184, 0, 186, 0, 188, 0, 190, 0, 192, 72, 194, 73, 196, 0, 198, 74, 200, 75, 202, 76, 204, 77, 206, 0, 208, 0, 210, 0, 212, 0, 214, 0, 216, 78, 218, 79, 220, 80, 222, 81, 224, 0, 226, 0, 228, 0, 230, 0, 232, 82, 234, 0, 236, 83, 238, 84, 240, 85, 242, 0, 244, 0, 246, 86, 248, 87, 250, 0, 252, 88, 254, 0, 256, 0, 258, 89, 260, 90, 262, 91, 264, 0, 266, 0, 268, 0, 270, 0, 272, 0, 274, 0, 276, 0, 278, 92, 280, 93, 282, 94, 284, 0, 286, 0, 288, 0, 290, 0, 292, 95, 294, 96, 296, 97, 298, 0, 300, 98, 302, 99, 304, 100, 306, 101, 308, 0, 310, 102, 312, 103, 314, 104, 316, 105, 318, 0, 320, 106, 322, 107, 324, 108, 326, 109, 328, 110, 12, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 35, 2, 0, 68, 68, 100, 100, 2, 0, 73, 73, 105, 105, 2, 0, 83, 83, 115, 115, 2, 0, 69, 69, 101, 101, 2, 0, 67, 67, 99, 99, 2, 0, 84, 84, 116, 116, 2, 0, 82, 82, 114, 114, 2, 0, 79, 79, 111, 111, 2, 0, 80, 80, 112, 112, 2, 0, 78, 78, 110, 110, 2, 0, 72, 72, 104, 104, 2, 0, 86, 86, 118, 118, 2, 0, 65, 65, 97, 97, 2, 0, 76, 76, 108, 108, 2, 0, 88, 88, 120, 120, 2, 0, 70, 70, 102, 102, 2, 0, 77, 77, 109, 109, 2, 0, 71, 71, 103, 103, 2, 0, 75, 75, 107, 107, 2, 0, 87, 87, 119, 119, 6, 0, 9, 10, 13, 13, 32, 32, 47, 47, 91, 91, 93, 93, 2, 0, 10, 10, 13, 13, 3, 0, 9, 10, 13, 13, 32, 32, 1, 0, 48, 57, 2, 0, 65, 90, 97, 122, 8, 0, 34, 34, 78, 78, 82, 82, 84, 84, 92, 92, 110, 110, 114, 114, 116, 116, 4, 0, 10, 10, 13, 13, 34, 34, 92, 92, 2, 0, 43, 43, 45, 45, 1, 0, 96, 96, 2, 0, 66, 66, 98, 98, 2, 0, 89, 89, 121, 121, 2, 0, 85, 85, 117, 117, 10, 0, 9, 10, 13, 13, 32, 32, 44, 44, 47, 47, 61, 61, 91, 91, 93, 93, 96, 96, 124, 124, 2, 0, 42, 42, 47, 47, 11, 0, 9, 10, 13, 13, 32, 32, 34, 35, 44, 44, 47, 47, 58, 58, 60, 60, 62, 63, 92, 92, 124, 124, 1224, 0, 12, 1, 0, 0, 0, 0, 14, 1, 0, 0, 0, 0, 16, 1, 0, 0, 0, 0, 18, 1, 0, 0, 0, 0, 20, 1, 0, 0, 0, 0, 22, 1, 0, 0, 0, 0, 24, 1, 0, 0, 0, 0, 26, 1, 0, 0, 0, 0, 28, 1, 0, 0, 0, 0, 30, 1, 0, 0, 0, 0, 32, 1, 0, 0, 0, 0, 34, 1, 0, 0, 0, 0, 36, 1, 0, 0, 0, 0, 38, 1, 0, 0, 0, 0, 40, 1, 0, 0, 0, 0, 42, 1, 0, 0, 0, 0, 44, 1, 0, 0, 0, 0, 46, 1, 0, 0, 0, 0, 48, 1, 0, 0, 0, 0, 50, 1, 0, 0, 0, 0, 52, 1, 0, 0, 0, 0, 54, 1, 0, 0, 0, 1, 56, 1, 0, 0, 0, 1, 58, 1, 0, 0, 0, 1, 60, 1, 0, 0, 0, 1, 62, 1, 0, 0, 0, 1, 64, 1, 0, 0, 0, 2, 66, 1, 0, 0, 0, 2, 88, 1, 0, 0, 0, 2, 90, 1, 0, 0, 0, 2, 92, 1, 0, 0, 0, 2, 94, 1, 0, 0, 0, 2, 96, 1, 0, 0, 0, 2, 98, 1, 0, 0, 0, 2, 100, 1, 0, 0, 0, 2, 102, 1, 0, 0, 0, 2, 104, 1, 0, 0, 0, 2, 106, 1, 0, 0, 0, 2, 108, 1, 0, 0, 0, 2, 110, 1, 0, 0, 0, 2, 112, 1, 0, 0, 0, 2, 114, 1, 0, 0, 0, 2, 116, 1, 0, 0, 0, 2, 118, 1, 0, 0, 0, 2, 120, 1, 0, 0, 0, 2, 122, 1, 0, 0, 0, 2, 124, 1, 0, 0, 0, 2, 126, 1, 0, 0, 0, 2, 128, 1, 0, 0, 0, 2, 130, 1, 0, 0, 0, 2, 132, 1, 0, 0, 0, 2, 134, 1, 0, 0, 0, 2, 136, 1, 0, 0, 0, 2, 138, 1, 0, 0, 0, 2, 140, 1, 0, 0, 0, 2, 142, 1, 0, 0, 0, 2, 144, 1, 0, 0, 0, 2, 146, 1, 0, 0, 0, 2, 148, 1, 0, 0, 0, 2, 150, 1, 0, 0, 0, 2, 152, 1, 0, 0, 0, 2, 154, 1, 0, 0, 0, 2, 156, 1, 0, 0, 0, 2, 158, 1, 0, 0, 0, 2, 160, 1, 0, 0, 0, 2, 162, 1, 0, 0, 0, 2, 164, 1, 0, 0, 0, 2, 166, 1, 0, 0, 0, 2, 168, 1, 0, 0, 0, 2, 172, 1, 0, 0, 0, 2, 174, 1, 0, 0, 0, 2, 176, 1, 0, 0, 0, 2, 178, 1, 0, 0, 0, 3, 180, 1, 0, 0, 0, 3, 182, 1, 0, 0, 0, 3, 184, 1, 0, 0, 0, 3, 186, 1, 0, 0, 0, 3, 188, 1, 0, 0, 0, 3, 190, 1, 0, 0, 0, 3, 192, 1, 0, 0, 0, 3, 194, 1, 0, 0, 0, 3, 198, 1, 0, 0, 0, 3, 200, 1, 0, 0, 0, 3, 202, 1, 0, 0, 0, 3, 204, 1, 0, 0, 0, 4, 206, 1, 0, 0, 0, 4, 208, 1, 0, 0, 0, 4, 210, 1, 0, 0, 0, 4, 216, 1, 0, 0, 0, 4, 218, 1, 0, 0, 0, 4, 220, 1, 0, 0, 0, 4, 222, 1, 0, 0, 0, 5, 224, 1, 0, 0, 0, 5, 226, 1, 0, 0, 0, 5, 228, 1, 0, 0, 0, 5, 230, 1, 0, 0, 0, 5, 232, 1, 0, 0, 0, 5, 234, 1, 0, 0, 0, 5, 236, 1, 0, 0, 0, 5, 238, 1, 0, 0, 0, 5, 240, 1, 0, 0, 0, 6, 242, 1, 0, 0, 0, 6, 244, 1, 0, 0, 0, 6, 246, 1, 0, 0, 0, 6, 248, 1, 0, 0, 0, 6, 252, 1, 0, 0, 0, 6, 254, 1, 0, 0, 0, 6, 256, 1, 0, 0, 0, 6, 258, 1, 0, 0, 0, 6, 260, 1, 0, 0, 0, 6, 262, 1, 0, 0, 0, 7, 264, 1, 0, 0, 0, 7, 266, 1, 0, 0, 0, 7, 268, 1, 0, 0, 0, 7, 270, 1, 0, 0, 0, 7, 272, 1, 0, 0, 0, 7, 274, 1, 0, 0, 0, 7, 276, 1, 0, 0, 0, 7, 278, 1, 0, 0, 0, 7, 280, 1, 0, 0, 0, 7, 282, 1, 0, 0, 0, 8, 284, 1, 0, 0, 0, 8, 286, 1, 0, 0, 0, 8, 288, 1, 0, 0, 0, 8, 290, 1, 0, 0, 0, 8, 292, 1, 0, 0, 0, 8, 294, 1, 0, 0, 0, 8, 296, 1, 0, 0, 0, 9, 298, 1, 0, 0, 0, 9, 300, 1, 0, 0, 0, 9, 302, 1, 0, 0, 0, 9, 304, 1, 0, 0, 0, 9, 306, 1, 0, 0, 0, 10, 308, 1, 0, 0, 0, 10, 310, 1, 0, 0, 0, 10, 312, 1, 0, 0, 0, 10, 314, 1, 0, 0, 0, 10, 316, 1, 0, 0, 0, 11, 318, 1, 0, 0, 0, 11, 320, 1, 0, 0, 0, 11, 322, 1, 0, 0, 0, 11, 324, 1, 0, 0, 0, 11, 326, 1, 0, 0, 0, 11, 328, 1, 0, 0, 0, 12, 330, 1, 0, 0, 0, 14, 340, 1, 0, 0, 0, 16, 347, 1, 0, 0, 0, 18, 356, 1, 0, 0, 0, 20, 363, 1, 0, 0, 0, 22, 373, 1, 0, 0, 0, 24, 380, 1, 0, 0, 0, 26, 387, 1, 0, 0, 0, 28, 401, 1, 0, 0, 0, 30, 408, 1, 0, 0, 0, 32, 416, 1, 0, 0, 0, 34, 423, 1, 0, 0, 0, 36, 435, 1, 0, 0, 0, 38, 444, 1, 0, 0, 0, 40, 450, 1, 0, 0, 0, 42, 457, 1, 0, 0, 0, 44, 464, 1, 0, 0, 0, 46, 472, 1, 0, 0, 0, 48, 481, 1, 0, 0, 0, 50, 487, 1, 0, 0, 0, 52, 504, 1, 0, 0, 0, 54, 520, 1, 0, 0, 0, 56, 526, 1, 0, 0, 0, 58, 531, 1, 0, 0, 0, 60, 536, 1, 0, 0, 0, 62, 540, 1, 0, 0, 0, 64, 544, 1, 0, 0, 0, 66, 548, 1, 0, 0, 0, 68, 552, 1, 0, 0, 0, 70, 554, 1, 0, 0, 0, 72, 556, 1, 0, 0, 0, 74, 559, 1, 0, 0, 0, 76, 561, 1, 0, 0, 0, 78, 570, 1, 0, 0, 0, 80, 572, 1, 0, 0, 0, 82, 577, 1, 0, 0, 0, 84, 579, 1, 0, 0, 0, 86, 584, 1, 0, 0, 0, 88, 615, 1, 0, 0, 0, 90, 618, 1, 0, 0, 0, 92, 664, 1, 0, 0, 0, 94, 666, 1, 0, 0, 0, 96, 669, 1, 0, 0, 0, 98, 673, 1, 0, 0, 0, 100, 677, 1, 0, 0, 0, 102, 679, 1, 0, 0, 0, 104, 682, 1, 0, 0, 0, 106, 684, 1, 0, 0, 0, 108, 689, 1, 0, 0, 0, 110, 691, 1, 0, 0, 0, 112, 697, 1, 0, 0, 0, 114, 703, 1, 0, 0, 0, 116, 708, 1, 0, 0, 0, 118, 710, 1, 0, 0, 0, 120, 713, 1, 0, 0, 0, 122, 716, 1, 0, 0, 0, 124, 721, 1, 0, 0, 0, 126, 725, 1, 0, 0, 0, 128, 730, 1, 0, 0, 0, 130, 736, 1, 0, 0, 0, 132, 739, 1, 0, 0, 0, 134, 741, 1, 0, 0, 0, 136, 747, 1, 0, 0, 0, 138, 749, 1, 0, 0, 0, 140, 754, 1, 0, 0, 0, 142, 757, 1, 0, 0, 0, 144, 760, 1, 0, 0, 0, 146, 763, 1, 0, 0, 0, 148, 765, 1, 0, 0, 0, 150, 768, 1, 0, 0, 0, 152, 770, 1, 0, 0, 0, 154, 773, 1, 0, 0, 0, 156, 775, 1, 0, 0, 0, 158, 777, 1, 0, 0, 0, 160, 779, 1, 0, 0, 0, 162, 781, 1, 0, 0, 0, 164, 783, 1, 0, 0, 0, 166, 788, 1, 0, 0, 0, 168, 809, 1, 0, 0, 0, 170, 811, 1, 0, 0, 0, 172, 819, 1, 0, 0, 0, 174, 821, 1, 0, 0, 0, 176, 825, 1, 0, 0, 0, 178, 829, 1, 0, 0, 0, 180, 833, 1, 0, 0, 0, 182, 838, 1, 0, 0, 0, 184, 842, 1, 0, 0, 0, 186, 846, 1, 0, 0, 0, 188, 850, 1, 0, 0, 0, 190, 854, 1, 0, 0, 0, 192, 858, 1, 0, 0, 0, 194, 866, 1, 0, 0, 0, 196, 878, 1, 0, 0, 0, 198, 881, 1, 0, 0, 0, 200, 885, 1, 0, 0, 0, 202, 889, 1, 0, 0, 0, 204, 893, 1, 0, 0, 0, 206, 897, 1, 0, 0, 0, 208, 902, 1, 0, 0, 0, 210, 906, 1, 0, 0, 0, 212, 914, 1, 0, 0, 0, 214, 935, 1, 0, 0, 0, 216, 939, 1, 0, 0, 0, 218, 943, 1, 0, 0, 0, 220, 947, 1, 0, 0, 0, 222, 951, 1, 0, 0, 0, 224, 955, 1, 0, 0, 0, 226, 960, 1, 0, 0, 0, 228, 964, 1, 0, 0, 0, 230, 968, 1, 0, 0, 0, 232, 972, 1, 0, 0, 0, 234, 975, 1, 0, 0, 0, 236, 979, 1, 0, 0, 0, 238, 983, 1, 0, 0, 0, 240, 987, 1, 0, 0, 0, 242, 991, 1, 0, 0, 0, 244, 996, 1, 0, 0, 0, 246, 1001, 1, 0, 0, 0, 248, 1006, 1, 0, 0, 0, 250, 1013, 1, 0, 0, 0, 252, 1022, 1, 0, 0, 0, 254, 1029, 1, 0, 0, 0, 256, 1033, 1, 0, 0, 0, 258, 1037, 1, 0, 0, 0, 260, 1041, 1, 0, 0, 0, 262, 1045, 1, 0, 0, 0, 264, 1049, 1, 0, 0, 0, 266, 1055, 1, 0, 0, 0, 268, 1059, 1, 0, 0, 0, 270, 1063, 1, 0, 0, 0, 272, 1067, 1, 0, 0, 0, 274, 1071, 1, 0, 0, 0, 276, 1075, 1, 0, 0, 0, 278, 1079, 1, 0, 0, 0, 280, 1083, 1, 0, 0, 0, 282, 1087, 1, 0, 0, 0, 284, 1091, 1, 0, 0, 0, 286, 1096, 1, 0, 0, 0, 288, 1100, 1, 0, 0, 0, 290, 1104, 1, 0, 0, 0, 292, 1108, 1, 0, 0, 0, 294, 1112, 1, 0, 0, 0, 296, 1116, 1, 0, 0, 0, 298, 1120, 1, 0, 0, 0, 300, 1125, 1, 0, 0, 0, 302, 1130, 1, 0, 0, 0, 304, 1134, 1, 0, 0, 0, 306, 1138, 1, 0, 0, 0, 308, 1142, 1, 0, 0, 0, 310, 1147, 1, 0, 0, 0, 312, 1157, 1, 0, 0, 0, 314, 1161, 1, 0, 0, 0, 316, 1165, 1, 0, 0, 0, 318, 1169, 1, 0, 0, 0, 320, 1174, 1, 0, 0, 0, 322, 1181, 1, 0, 0, 0, 324, 1185, 1, 0, 0, 0, 326, 1189, 1, 0, 0, 0, 328, 1193, 1, 0, 0, 0, 330, 331, 7, 0, 0, 0, 331, 332, 7, 1, 0, 0, 332, 333, 7, 2, 0, 0, 333, 334, 7, 2, 0, 0, 334, 335, 7, 3, 0, 0, 335, 336, 7, 4, 0, 0, 336, 337, 7, 5, 0, 0, 337, 338, 1, 0, 0, 0, 338, 339, 6, 0, 0, 0, 339, 13, 1, 0, 0, 0, 340, 341, 7, 0, 0, 0, 341, 342, 7, 6, 0, 0, 342, 343, 7, 7, 0, 0, 343, 344, 7, 8, 0, 0, 344, 345, 1, 0, 0, 0, 345, 346, 6, 1, 1, 0, 346, 15, 1, 0, 0, 0, 347, 348, 7, 3, 0, 0, 348, 349, 7, 9, 0, 0, 349, 350, 7, 6, 0, 0, 350, 351, 7, 1, 0, 0, 351, 352, 7, 4, 0, 0, 352, 353, 7, 10, 0, 0, 353, 354, 1, 0, 0, 0, 354, 355, 6, 2, 2, 0, 355, 17, 1, 0, 0, 0, 356, 357, 7, 3, 0, 0, 357, 358, 7, 11, 0, 0, 358, 359, 7, 12, 0, 0, 359, 360, 7, 13, 0, 0, 360, 361, 1, 0, 0, 0, 361, 362, 6, 3, 0, 0, 362, 19, 1, 0, 0, 0, 363, 364, 7, 3, 0, 0, 364, 365, 7, 14, 0, 0, 365, 366, 7, 8, 0, 0, 366, 367, 7, 13, 0, 0, 367, 368, 7, 12, 0, 0, 368, 369, 7, 1, 0, 0, 369, 370, 7, 9, 0, 0, 370, 371, 1, 0, 0, 0, 371, 372, 6, 4, 3, 0, 372, 21, 1, 0, 0, 0, 373, 374, 7, 15, 0, 0, 374, 375, 7, 6, 0, 0, 375, 376, 7, 7, 0, 0, 376, 377, 7, 16, 0, 0, 377, 378, 1, 0, 0, 0, 378, 379, 6, 5, 4, 0, 379, 23, 1, 0, 0, 0, 380, 381, 7, 17, 0, 0, 381, 382, 7, 6, 0, 0, 382, 383, 7, 7, 0, 0, 383, 384, 7, 18, 0, 0, 384, 385, 1, 0, 0, 0, 385, 386, 6, 6, 0, 0, 386, 25, 1, 0, 0, 0, 387, 388, 7, 1, 0, 0, 388, 389, 7, 9, 0, 0, 389, 390, 7, 13, 0, 0, 390, 391, 7, 1, 0, 0, 391, 392, 7, 9, 0, 0, 392, 393, 7, 3, 0, 0, 393, 394, 7, 2, 0, 0, 394, 395, 7, 5, 0, 0, 395, 396, 7, 12, 0, 0, 396, 397, 7, 5, 0, 0, 397, 398, 7, 2, 0, 0, 398, 399, 1, 0, 0, 0, 399, 400, 6, 7, 0, 0, 400, 27, 1, 0, 0, 0, 401, 402, 7, 18, 0, 0, 402, 403, 7, 3, 0, 0, 403, 404, 7, 3, 0, 0, 404, 405, 7, 8, 0, 0, 405, 406, 1, 0, 0, 0, 406, 407, 6, 8, 1, 0, 407, 29, 1, 0, 0, 0, 408, 409, 7, 13, 0, 0, 409, 410, 7, 1, 0, 0, 410, 411, 7, 16, 0, 0, 411, 412, 7, 1, 0, 0, 412, 413, 7, 5, 0, 0, 413, 414, 1, 0, 0, 0, 414, 415, 6, 9, 0, 0, 415, 31, 1, 0, 0, 0, 416, 417, 7, 16, 0, 0, 417, 418, 7, 3, 0, 0, 418, 419, 7, 5, 0, 0, 419, 420, 7, 12, 0, 0, 420, 421, 1, 0, 0, 0, 421, 422, 6, 10, 5, 0, 422, 33, 1, 0, 0, 0, 423, 424, 7, 16, 0, 0, 424, 425, 7, 11, 0, 0, 425, 426, 5, 95, 0, 0, 426, 427, 7, 3, 0, 0, 427, 428, 7, 14, 0, 0, 428, 429, 7, 8, 0, 0, 429, 430, 7, 12, 0, 0, 430, 431, 7, 9, 0, 0, 431, 432, 7, 0, 0, 0, 432, 433, 1, 0, 0, 0, 433, 434, 6, 11, 6, 0, 434, 35, 1, 0, 0, 0, 435, 436, 7, 6, 0, 0, 436, 437, 7, 3, 0, 0, 437, 438, 7, 9, 0, 0, 438, 439, 7, 12, 0, 0, 439, 440, 7, 16, 0, 0, 440, 441, 7, 3, 0, 0, 441, 442, 1, 0, 0, 0, 442, 443, 6, 12, 7, 0, 443, 37, 1, 0, 0, 0, 444, 445, 7, 6, 0, 0, 445, 446, 7, 7, 0, 0, 446, 447, 7, 19, 0, 0, 447, 448, 1, 0, 0, 0, 448, 449, 6, 13, 0, 0, 449, 39, 1, 0, 0, 0, 450, 451, 7, 2, 0, 0, 451, 452, 7, 10, 0, 0, 452, 453, 7, 7, 0, 0, 453, 454, 7, 19, 0, 0, 454, 455, 1, 0, 0, 0, 455, 456, 6, 14, 8, 0, 456, 41, 1, 0, 0, 0, 457, 458, 7, 2, 0, 0, 458, 459, 7, 7, 0, 0, 459, 460, 7, 6, 0, 0, 460, 461, 7, 5, 0, 0, 461, 462, 1, 0, 0, 0, 462, 463, 6, 15, 0, 0, 463, 43, 1, 0, 0, 0, 464, 465, 7, 2, 0, 0, 465, 466, 7, 5, 0, 0, 466, 467, 7, 12, 0, 0, 467, 468, 7, 5, 0, 0, 468, 469, 7, 2, 0, 0, 469, 470, 1, 0, 0, 0, 470, 471, 6, 16, 0, 0, 471, 45, 1, 0, 0, 0, 472, 473, 7, 19, 0, 0, 473, 474, 7, 10, 0, 0, 474, 475, 7, 3, 0, 0, 475, 476, 7, 6, 0, 0, 476, 477, 7, 3, 0, 0, 477, 478, 1, 0, 0, 0, 478, 479, 6, 17, 0, 0, 479, 47, 1, 0, 0, 0, 480, 482, 8, 20, 0, 0, 481, 480, 1, 0, 0, 0, 482, 483, 1, 0, 0, 0, 483, 481, 1, 0, 0, 0, 483, 484, 1, 0, 0, 0, 484, 485, 1, 0, 0, 0, 485, 486, 6, 18, 0, 0, 486, 49, 1, 0, 0, 0, 487, 488, 5, 47, 0, 0, 488, 489, 5, 47, 0, 0, 489, 493, 1, 0, 0, 0, 490, 492, 8, 21, 0, 0, 491, 490, 1, 0, 0, 0, 492, 495, 1, 0, 0, 0, 493, 491, 1, 0, 0, 0, 493, 494, 1, 0, 0, 0, 494, 497, 1, 0, 0, 0, 495, 493, 1, 0, 0, 0, 496, 498, 5, 13, 0, 0, 497, 496, 1, 0, 0, 0, 497, 498, 1, 0, 0, 0, 498, 500, 1, 0, 0, 0, 499, 501, 5, 10, 0, 0, 500, 499, 1, 0, 0, 0, 500, 501, 1, 0, 0, 0, 501, 502, 1, 0, 0, 0, 502, 503, 6, 19, 9, 0, 503, 51, 1, 0, 0, 0, 504, 505, 5, 47, 0, 0, 505, 506, 5, 42, 0, 0, 506, 511, 1, 0, 0, 0, 507, 510, 3, 52, 20, 0, 508, 510, 9, 0, 0, 0, 509, 507, 1, 0, 0, 0, 509, 508, 1, 0, 0, 0, 510, 513, 1, 0, 0, 0, 511, 512, 1, 0, 0, 0, 511, 509, 1, 0, 0, 0, 512, 514, 1, 0, 0, 0, 513, 511, 1, 0, 0, 0, 514, 515, 5, 42, 0, 0, 515, 516, 5, 47, 0, 0, 516, 517, 1, 0, 0, 0, 517, 518, 6, 20, 9, 0, 518, 53, 1, 0, 0, 0, 519, 521, 7, 22, 0, 0, 520, 519, 1, 0, 0, 0, 521, 522, 1, 0, 0, 0, 522, 520, 1, 0, 0, 0, 522, 523, 1, 0, 0, 0, 523, 524, 1, 0, 0, 0, 524, 525, 6, 21, 9, 0, 525, 55, 1, 0, 0, 0, 526, 527, 3, 164, 76, 0, 527, 528, 1, 0, 0, 0, 528, 529, 6, 22, 10, 0, 529, 530, 6, 22, 11, 0, 530, 57, 1, 0, 0, 0, 531, 532, 3, 66, 27, 0, 532, 533, 1, 0, 0, 0, 533, 534, 6, 23, 12, 0, 534, 535, 6, 23, 13, 0, 535, 59, 1, 0, 0, 0, 536, 537, 3, 54, 21, 0, 537, 538, 1, 0, 0, 0, 538, 539, 6, 24, 9, 0, 539, 61, 1, 0, 0, 0, 540, 541, 3, 50, 19, 0, 541, 542, 1, 0, 0, 0, 542, 543, 6, 25, 9, 0, 543, 63, 1, 0, 0, 0, 544, 545, 3, 52, 20, 0, 545, 546, 1, 0, 0, 0, 546, 547, 6, 26, 9, 0, 547, 65, 1, 0, 0, 0, 548, 549, 5, 124, 0, 0, 549, 550, 1, 0, 0, 0, 550, 551, 6, 27, 13, 0, 551, 67, 1, 0, 0, 0, 552, 553, 7, 23, 0, 0, 553, 69, 1, 0, 0, 0, 554, 555, 7, 24, 0, 0, 555, 71, 1, 0, 0, 0, 556, 557, 5, 92, 0, 0, 557, 558, 7, 25, 0, 0, 558, 73, 1, 0, 0, 0, 559, 560, 8, 26, 0, 0, 560, 75, 1, 0, 0, 0, 561, 563, 7, 3, 0, 0, 562, 564, 7, 27, 0, 0, 563, 562, 1, 0, 0, 0, 563, 564, 1, 0, 0, 0, 564, 566, 1, 0, 0, 0, 565, 567, 3, 68, 28, 0, 566, 565, 1, 0, 0, 0, 567, 568, 1, 0, 0, 0, 568, 566, 1, 0, 0, 0, 568, 569, 1, 0, 0, 0, 569, 77, 1, 0, 0, 0, 570, 571, 5, 64, 0, 0, 571, 79, 1, 0, 0, 0, 572, 573, 5, 96, 0, 0, 573, 81, 1, 0, 0, 0, 574, 578, 8, 28, 0, 0, 575, 576, 5, 96, 0, 0, 576, 578, 5, 96, 0, 0, 577, 574, 1, 0, 0, 0, 577, 575, 1, 0, 0, 0, 578, 83, 1, 0, 0, 0, 579, 580, 5, 95, 0, 0, 580, 85, 1, 0, 0, 0, 581, 585, 3, 70, 29, 0, 582, 585, 3, 68, 28, 0, 583, 585, 3, 84, 36, 0, 584, 581, 1, 0, 0, 0, 584, 582, 1, 0, 0, 0, 584, 583, 1, 0, 0, 0, 585, 87, 1, 0, 0, 0, 586, 591, 5, 34, 0, 0, 587, 590, 3, 72, 30, 0, 588, 590, 3, 74, 31, 0, 589, 587, 1, 0, 0, 0, 589, 588, 1, 0, 0, 0, 590, 593, 1, 0, 0, 0, 591, 589, 1, 0, 0, 0, 591, 592, 1, 0, 0, 0, 592, 594, 1, 0, 0, 0, 593, 591, 1, 0, 0, 0, 594, 616, 5, 34, 0, 0, 595, 596, 5, 34, 0, 0, 596, 597, 5, 34, 0, 0, 597, 598, 5, 34, 0, 0, 598, 602, 1, 0, 0, 0, 599, 601, 8, 21, 0, 0, 600, 599, 1, 0, 0, 0, 601, 604, 1, 0, 0, 0, 602, 603, 1, 0, 0, 0, 602, 600, 1, 0, 0, 0, 603, 605, 1, 0, 0, 0, 604, 602, 1, 0, 0, 0, 605, 606, 5, 34, 0, 0, 606, 607, 5, 34, 0, 0, 607, 608, 5, 34, 0, 0, 608, 610, 1, 0, 0, 0, 609, 611, 5, 34, 0, 0, 610, 609, 1, 0, 0, 0, 610, 611, 1, 0, 0, 0, 611, 613, 1, 0, 0, 0, 612, 614, 5, 34, 0, 0, 613, 612, 1, 0, 0, 0, 613, 614, 1, 0, 0, 0, 614, 616, 1, 0, 0, 0, 615, 586, 1, 0, 0, 0, 615, 595, 1, 0, 0, 0, 616, 89, 1, 0, 0, 0, 617, 619, 3, 68, 28, 0, 618, 617, 1, 0, 0, 0, 619, 620, 1, 0, 0, 0, 620, 618, 1, 0, 0, 0, 620, 621, 1, 0, 0, 0, 621, 91, 1, 0, 0, 0, 622, 624, 3, 68, 28, 0, 623, 622, 1, 0, 0, 0, 624, 625, 1, 0, 0, 0, 625, 623, 1, 0, 0, 0, 625, 626, 1, 0, 0, 0, 626, 627, 1, 0, 0, 0, 627, 631, 3, 108, 48, 0, 628, 630, 3, 68, 28, 0, 629, 628, 1, 0, 0, 0, 630, 633, 1, 0, 0, 0, 631, 629, 1, 0, 0, 0, 631, 632, 1, 0, 0, 0, 632, 665, 1, 0, 0, 0, 633, 631, 1, 0, 0, 0, 634, 636, 3, 108, 48, 0, 635, 637, 3, 68, 28, 0, 636, 635, 1, 0, 0, 0, 637, 638, 1, 0, 0, 0, 638, 636, 1, 0, 0, 0, 638, 639, 1, 0, 0, 0, 639, 665, 1, 0, 0, 0, 640, 642, 3, 68, 28, 0, 641, 640, 1, 0, 0, 0, 642, 643, 1, 0, 0, 0, 643, 641, 1, 0, 0, 0, 643, 644, 1, 0, 0, 0, 644, 652, 1, 0, 0, 0, 645, 649, 3, 108, 48, 0, 646, 648, 3, 68, 28, 0, 647, 646, 1, 0, 0, 0, 648, 651, 1, 0, 0, 0, 649, 647, 1, 0, 0, 0, 649, 650, 1, 0, 0, 0, 650, 653, 1, 0, 0, 0, 651, 649, 1, 0, 0, 0, 652, 645, 1, 0, 0, 0, 652, 653, 1, 0, 0, 0, 653, 654, 1, 0, 0, 0, 654, 655, 3, 76, 32, 0, 655, 665, 1, 0, 0, 0, 656, 658, 3, 108, 48, 0, 657, 659, 3, 68, 28, 0, 658, 657, 1, 0, 0, 0, 659, 660, 1, 0, 0, 0, 660, 658, 1, 0, 0, 0, 660, 661, 1, 0, 0, 0, 661, 662, 1, 0, 0, 0, 662, 663, 3, 76, 32, 0, 663, 665, 1, 0, 0, 0, 664, 623, 1, 0, 0, 0, 664, 634, 1, 0, 0, 0, 664, 641, 1, 0, 0, 0, 664, 656, 1, 0, 0, 0, 665, 93, 1, 0, 0, 0, 666, 667, 7, 29, 0, 0, 667, 668, 7, 30, 0, 0, 668, 95, 1, 0, 0, 0, 669, 670, 7, 12, 0, 0, 670, 671, 7, 9, 0, 0, 671, 672, 7, 0, 0, 0, 672, 97, 1, 0, 0, 0, 673, 674, 7, 12, 0, 0, 674, 675, 7, 2, 0, 0, 675, 676, 7, 4, 0, 0, 676, 99, 1, 0, 0, 0, 677, 678, 5, 61, 0, 0, 678, 101, 1, 0, 0, 0, 679, 680, 5, 58, 0, 0, 680, 681, 5, 58, 0, 0, 681, 103, 1, 0, 0, 0, 682, 683, 5, 44, 0, 0, 683, 105, 1, 0, 0, 0, 684, 685, 7, 0, 0, 0, 685, 686, 7, 3, 0, 0, 686, 687, 7, 2, 0, 0, 687, 688, 7, 4, 0, 0, 688, 107, 1, 0, 0, 0, 689, 690, 5, 46, 0, 0, 690, 109, 1, 0, 0, 0, 691, 692, 7, 15, 0, 0, 692, 693, 7, 12, 0, 0, 693, 694, 7, 13, 0, 0, 694, 695, 7, 2, 0, 0, 695, 696, 7, 3, 0, 0, 696, 111, 1, 0, 0, 0, 697, 698, 7, 15, 0, 0, 698, 699, 7, 1, 0, 0, 699, 700, 7, 6, 0, 0, 700, 701, 7, 2, 0, 0, 701, 702, 7, 5, 0, 0, 702, 113, 1, 0, 0, 0, 703, 704, 7, 13, 0, 0, 704, 705, 7, 12, 0, 0, 705, 706, 7, 2, 0, 0, 706, 707, 7, 5, 0, 0, 707, 115, 1, 0, 0, 0, 708, 709, 5, 40, 0, 0, 709, 117, 1, 0, 0, 0, 710, 711, 7, 1, 0, 0, 711, 712, 7, 9, 0, 0, 712, 119, 1, 0, 0, 0, 713, 714, 7, 1, 0, 0, 714, 715, 7, 2, 0, 0, 715, 121, 1, 0, 0, 0, 716, 717, 7, 13, 0, 0, 717, 718, 7, 1, 0, 0, 718, 719, 7, 18, 0, 0, 719, 720, 7, 3, 0, 0, 720, 123, 1, 0, 0, 0, 721, 722, 7, 9, 0, 0, 722, 723, 7, 7, 0, 0, 723, 724, 7, 5, 0, 0, 724, 125, 1, 0, 0, 0, 725, 726, 7, 9, 0, 0, 726, 727, 7, 31, 0, 0, 727, 728, 7, 13, 0, 0, 728, 729, 7, 13, 0, 0, 729, 127, 1, 0, 0, 0, 730, 731, 7, 9, 0, 0, 731, 732, 7, 31, 0, 0, 732, 733, 7, 13, 0, 0, 733, 734, 7, 13, 0, 0, 734, 735, 7, 2, 0, 0, 735, 129, 1, 0, 0, 0, 736, 737, 7, 7, 0, 0, 737, 738, 7, 6, 0, 0, 738, 131, 1, 0, 0, 0, 739, 740, 5, 63, 0, 0, 740, 133, 1, 0, 0, 0, 741, 742, 7, 6, 0, 0, 742, 743, 7, 13, 0, 0, 743, 744, 7, 1, 0, 0, 744, 745, 7, 18, 0, 0, 745, 746, 7, 3, 0, 0, 746, 135, 1, 0, 0, 0, 747, 748, 5, 41, 0, 0, 748, 137, 1, 0, 0, 0, 749, 750, 7, 5, 0, 0, 750, 751, 7, 6, 0, 0, 751, 752, 7, 31, 0, 0, 752, 753, 7, 3, 0, 0, 753, 139, 1, 0, 0, 0, 754, 755, 5, 61, 0, 0, 755, 756, 5, 61, 0, 0, 756, 141, 1, 0, 0, 0, 757, 758, 5, 61, 0, 0, 758, 759, 5, 126, 0, 0, 759, 143, 1, 0, 0, 0, 760, 761, 5, 33, 0, 0, 761, 762, 5, 61, 0, 0, 762, 145, 1, 0, 0, 0, 763, 764, 5, 60, 0, 0, 764, 147, 1, 0, 0, 0, 765, 766, 5, 60, 0, 0, 766, 767, 5, 61, 0, 0, 767, 149, 1, 0, 0, 0, 768, 769, 5, 62, 0, 0, 769, 151, 1, 0, 0, 0, 770, 771, 5, 62, 0, 0, 771, 772, 5, 61, 0, 0, 772, 153, 1, 0, 0, 0, 773, 774, 5, 43, 0, 0, 774, 155, 1, 0, 0, 0, 775, 776, 5, 45, 0, 0, 776, 157, 1, 0, 0, 0, 777, 778, 5, 42, 0, 0, 778, 159, 1, 0, 0, 0, 779, 780, 5, 47, 0, 0, 780, 161, 1, 0, 0, 0, 781, 782, 5, 37, 0, 0, 782, 163, 1, 0, 0, 0, 783, 784, 5, 91, 0, 0, 784, 785, 1, 0, 0, 0, 785, 786, 6, 76, 0, 0, 786, 787, 6, 76, 0, 0, 787, 165, 1, 0, 0, 0, 788, 789, 5, 93, 0, 0, 789, 790, 1, 0, 0, 0, 790, 791, 6, 77, 13, 0, 791, 792, 6, 77, 13, 0, 792, 167, 1, 0, 0, 0, 793, 797, 3, 70, 29, 0, 794, 796, 3, 86, 37, 0, 795, 794, 1, 0, 0, 0, 796, 799, 1, 0, 0, 0, 797, 795, 1, 0, 0, 0, 797, 798, 1, 0, 0, 0, 798, 810, 1, 0, 0, 0, 799, 797, 1, 0, 0, 0, 800, 803, 3, 84, 36, 0, 801, 803, 3, 78, 33, 0, 802, 800, 1, 0, 0, 0, 802, 801, 1, 0, 0, 0, 803, 805, 1, 0, 0, 0, 804, 806, 3, 86, 37, 0, 805, 804, 1, 0, 0, 0, 806, 807, 1, 0, 0, 0, 807, 805, 1, 0, 0, 0, 807, 808, 1, 0, 0, 0, 808, 810, 1, 0, 0, 0, 809, 793, 1, 0, 0, 0, 809, 802, 1, 0, 0, 0, 810, 169, 1, 0, 0, 0, 811, 813, 3, 80, 34, 0, 812, 814, 3, 82, 35, 0, 813, 812, 1, 0, 0, 0, 814, 815, 1, 0, 0, 0, 815, 813, 1, 0, 0, 0, 815, 816, 1, 0, 0, 0, 816, 817, 1, 0, 0, 0, 817, 818, 3, 80, 34, 0, 818, 171, 1, 0, 0, 0, 819, 820, 3, 170, 79, 0, 820, 173, 1, 0, 0, 0, 821, 822, 3, 50, 19, 0, 822, 823, 1, 0, 0, 0, 823, 824, 6, 81, 9, 0, 824, 175, 1, 0, 0, 0, 825, 826, 3, 52, 20, 0, 826, 827, 1, 0, 0, 0, 827, 828, 6, 82, 9, 0, 828, 177, 1, 0, 0, 0, 829, 830, 3, 54, 21, 0, 830, 831, 1, 0, 0, 0, 831, 832, 6, 83, 9, 0, 832, 179, 1, 0, 0, 0, 833, 834, 3, 66, 27, 0, 834, 835, 1, 0, 0, 0, 835, 836, 6, 84, 12, 0, 836, 837, 6, 84, 13, 0, 837, 181, 1, 0, 0, 0, 838, 839, 3, 164, 76, 0, 839, 840, 1, 0, 0, 0, 840, 841, 6, 85, 10, 0, 841, 183, 1, 0, 0, 0, 842, 843, 3, 166, 77, 0, 843, 844, 1, 0, 0, 0, 844, 845, 6, 86, 14, 0, 845, 185, 1, 0, 0, 0, 846, 847, 3, 104, 46, 0, 847, 848, 1, 0, 0, 0, 848, 849, 6, 87, 15, 0, 849, 187, 1, 0, 0, 0, 850, 851, 3, 100, 44, 0, 851, 852, 1, 0, 0, 0, 852, 853, 6, 88, 16, 0, 853, 189, 1, 0, 0, 0, 854, 855, 3, 88, 38, 0, 855, 856, 1, 0, 0, 0, 856, 857, 6, 89, 17, 0, 857, 191, 1, 0, 0, 0, 858, 859, 7, 7, 0, 0, 859, 860, 7, 8, 0, 0, 860, 861, 7, 5, 0, 0, 861, 862, 7, 1, 0, 0, 862, 863, 7, 7, 0, 0, 863, 864, 7, 9, 0, 0, 864, 865, 7, 2, 0, 0, 865, 193, 1, 0, 0, 0, 866, 867, 7, 16, 0, 0, 867, 868, 7, 3, 0, 0, 868, 869, 7, 5, 0, 0, 869, 870, 7, 12, 0, 0, 870, 871, 7, 0, 0, 0, 871, 872, 7, 12, 0, 0, 872, 873, 7, 5, 0, 0, 873, 874, 7, 12, 0, 0, 874, 195, 1, 0, 0, 0, 875, 879, 8, 32, 0, 0, 876, 877, 5, 47, 0, 0, 877, 879, 8, 33, 0, 0, 878, 875, 1, 0, 0, 0, 878, 876, 1, 0, 0, 0, 879, 197, 1, 0, 0, 0, 880, 882, 3, 196, 92, 0, 881, 880, 1, 0, 0, 0, 882, 883, 1, 0, 0, 0, 883, 881, 1, 0, 0, 0, 883, 884, 1, 0, 0, 0, 884, 199, 1, 0, 0, 0, 885, 886, 3, 50, 19, 0, 886, 887, 1, 0, 0, 0, 887, 888, 6, 94, 9, 0, 888, 201, 1, 0, 0, 0, 889, 890, 3, 52, 20, 0, 890, 891, 1, 0, 0, 0, 891, 892, 6, 95, 9, 0, 892, 203, 1, 0, 0, 0, 893, 894, 3, 54, 21, 0, 894, 895, 1, 0, 0, 0, 895, 896, 6, 96, 9, 0, 896, 205, 1, 0, 0, 0, 897, 898, 3, 66, 27, 0, 898, 899, 1, 0, 0, 0, 899, 900, 6, 97, 12, 0, 900, 901, 6, 97, 13, 0, 901, 207, 1, 0, 0, 0, 902, 903, 3, 108, 48, 0, 903, 904, 1, 0, 0, 0, 904, 905, 6, 98, 18, 0, 905, 209, 1, 0, 0, 0, 906, 907, 3, 104, 46, 0, 907, 908, 1, 0, 0, 0, 908, 909, 6, 99, 15, 0, 909, 211, 1, 0, 0, 0, 910, 915, 3, 70, 29, 0, 911, 915, 3, 68, 28, 0, 912, 915, 3, 84, 36, 0, 913, 915, 3, 158, 73, 0, 914, 910, 1, 0, 0, 0, 914, 911, 1, 0, 0, 0, 914, 912, 1, 0, 0, 0, 914, 913, 1, 0, 0, 0, 915, 213, 1, 0, 0, 0, 916, 919, 3, 70, 29, 0, 917, 919, 3, 158, 73, 0, 918, 916, 1, 0, 0, 0, 918, 917, 1, 0, 0, 0, 919, 923, 1, 0, 0, 0, 920, 922, 3, 212, 100, 0, 921, 920, 1, 0, 0, 0, 922, 925, 1, 0, 0, 0, 923, 921, 1, 0, 0, 0, 923, 924, 1, 0, 0, 0, 924, 936, 1, 0, 0, 0, 925, 923, 1, 0, 0, 0, 926, 929, 3, 84, 36, 0, 927, 929, 3, 78, 33, 0, 928, 926, 1, 0, 0, 0, 928, 927, 1, 0, 0, 0, 929, 931, 1, 0, 0, 0, 930, 932, 3, 212, 100, 0, 931, 930, 1, 0, 0, 0, 932, 933, 1, 0, 0, 0, 933, 931, 1, 0, 0, 0, 933, 934, 1, 0, 0, 0, 934, 936, 1, 0, 0, 0, 935, 918, 1, 0, 0, 0, 935, 928, 1, 0, 0, 0, 936, 215, 1, 0, 0, 0, 937, 940, 3, 214, 101, 0, 938, 940, 3, 170, 79, 0, 939, 937, 1, 0, 0, 0, 939, 938, 1, 0, 0, 0, 940, 941, 1, 0, 0, 0, 941, 939, 1, 0, 0, 0, 941, 942, 1, 0, 0, 0, 942, 217, 1, 0, 0, 0, 943, 944, 3, 50, 19, 0, 944, 945, 1, 0, 0, 0, 945, 946, 6, 103, 9, 0, 946, 219, 1, 0, 0, 0, 947, 948, 3, 52, 20, 0, 948, 949, 1, 0, 0, 0, 949, 950, 6, 104, 9, 0, 950, 221, 1, 0, 0, 0, 951, 952, 3, 54, 21, 0, 952, 953, 1, 0, 0, 0, 953, 954, 6, 105, 9, 0, 954, 223, 1, 0, 0, 0, 955, 956, 3, 66, 27, 0, 956, 957, 1, 0, 0, 0, 957, 958, 6, 106, 12, 0, 958, 959, 6, 106, 13, 0, 959, 225, 1, 0, 0, 0, 960, 961, 3, 100, 44, 0, 961, 962, 1, 0, 0, 0, 962, 963, 6, 107, 16, 0, 963, 227, 1, 0, 0, 0, 964, 965, 3, 104, 46, 0, 965, 966, 1, 0, 0, 0, 966, 967, 6, 108, 15, 0, 967, 229, 1, 0, 0, 0, 968, 969, 3, 108, 48, 0, 969, 970, 1, 0, 0, 0, 970, 971, 6, 109, 18, 0, 971, 231, 1, 0, 0, 0, 972, 973, 7, 12, 0, 0, 973, 974, 7, 2, 0, 0, 974, 233, 1, 0, 0, 0, 975, 976, 3, 216, 102, 0, 976, 977, 1, 0, 0, 0, 977, 978, 6, 111, 19, 0, 978, 235, 1, 0, 0, 0, 979, 980, 3, 50, 19, 0, 980, 981, 1, 0, 0, 0, 981, 982, 6, 112, 9, 0, 982, 237, 1, 0, 0, 0, 983, 984, 3, 52, 20, 0, 984, 985, 1, 0, 0, 0, 985, 986, 6, 113, 9, 0, 986, 239, 1, 0, 0, 0, 987, 988, 3, 54, 21, 0, 988, 989, 1, 0, 0, 0, 989, 990, 6, 114, 9, 0, 990, 241, 1, 0, 0, 0, 991, 992, 3, 66, 27, 0, 992, 993, 1, 0, 0, 0, 993, 994, 6, 115, 12, 0, 994, 995, 6, 115, 13, 0, 995, 243, 1, 0, 0, 0, 996, 997, 3, 164, 76, 0, 997, 998, 1, 0, 0, 0, 998, 999, 6, 116, 10, 0, 999, 1000, 6, 116, 20, 0, 1000, 245, 1, 0, 0, 0, 1001, 1002, 7, 7, 0, 0, 1002, 1003, 7, 9, 0, 0, 1003, 1004, 1, 0, 0, 0, 1004, 1005, 6, 117, 21, 0, 1005, 247, 1, 0, 0, 0, 1006, 1007, 7, 19, 0, 0, 1007, 1008, 7, 1, 0, 0, 1008, 1009, 7, 5, 0, 0, 1009, 1010, 7, 10, 0, 0, 1010, 1011, 1, 0, 0, 0, 1011, 1012, 6, 118, 21, 0, 1012, 249, 1, 0, 0, 0, 1013, 1014, 8, 34, 0, 0, 1014, 251, 1, 0, 0, 0, 1015, 1017, 3, 250, 119, 0, 1016, 1015, 1, 0, 0, 0, 1017, 1018, 1, 0, 0, 0, 1018, 1016, 1, 0, 0, 0, 1018, 1019, 1, 0, 0, 0, 1019, 1020, 1, 0, 0, 0, 1020, 1021, 3, 320, 154, 0, 1021, 1023, 1, 0, 0, 0, 1022, 1016, 1, 0, 0, 0, 1022, 1023, 1, 0, 0, 0, 1023, 1025, 1, 0, 0, 0, 1024, 1026, 3, 250, 119, 0, 1025, 1024, 1, 0, 0, 0, 1026, 1027, 1, 0, 0, 0, 1027, 1025, 1, 0, 0, 0, 1027, 1028, 1, 0, 0, 0, 1028, 253, 1, 0, 0, 0, 1029, 1030, 3, 172, 80, 0, 1030, 1031, 1, 0, 0, 0, 1031, 1032, 6, 121, 22, 0, 1032, 255, 1, 0, 0, 0, 1033, 1034, 3, 252, 120, 0, 1034, 1035, 1, 0, 0, 0, 1035, 1036, 6, 122, 23, 0, 1036, 257, 1, 0, 0, 0, 1037, 1038, 3, 50, 19, 0, 1038, 1039, 1, 0, 0, 0, 1039, 1040, 6, 123, 9, 0, 1040, 259, 1, 0, 0, 0, 1041, 1042, 3, 52, 20, 0, 1042, 1043, 1, 0, 0, 0, 1043, 1044, 6, 124, 9, 0, 1044, 261, 1, 0, 0, 0, 1045, 1046, 3, 54, 21, 0, 1046, 1047, 1, 0, 0, 0, 1047, 1048, 6, 125, 9, 0, 1048, 263, 1, 0, 0, 0, 1049, 1050, 3, 66, 27, 0, 1050, 1051, 1, 0, 0, 0, 1051, 1052, 6, 126, 12, 0, 1052, 1053, 6, 126, 13, 0, 1053, 1054, 6, 126, 13, 0, 1054, 265, 1, 0, 0, 0, 1055, 1056, 3, 100, 44, 0, 1056, 1057, 1, 0, 0, 0, 1057, 1058, 6, 127, 16, 0, 1058, 267, 1, 0, 0, 0, 1059, 1060, 3, 104, 46, 0, 1060, 1061, 1, 0, 0, 0, 1061, 1062, 6, 128, 15, 0, 1062, 269, 1, 0, 0, 0, 1063, 1064, 3, 108, 48, 0, 1064, 1065, 1, 0, 0, 0, 1065, 1066, 6, 129, 18, 0, 1066, 271, 1, 0, 0, 0, 1067, 1068, 3, 248, 118, 0, 1068, 1069, 1, 0, 0, 0, 1069, 1070, 6, 130, 24, 0, 1070, 273, 1, 0, 0, 0, 1071, 1072, 3, 216, 102, 0, 1072, 1073, 1, 0, 0, 0, 1073, 1074, 6, 131, 19, 0, 1074, 275, 1, 0, 0, 0, 1075, 1076, 3, 172, 80, 0, 1076, 1077, 1, 0, 0, 0, 1077, 1078, 6, 132, 22, 0, 1078, 277, 1, 0, 0, 0, 1079, 1080, 3, 50, 19, 0, 1080, 1081, 1, 0, 0, 0, 1081, 1082, 6, 133, 9, 0, 1082, 279, 1, 0, 0, 0, 1083, 1084, 3, 52, 20, 0, 1084, 1085, 1, 0, 0, 0, 1085, 1086, 6, 134, 9, 0, 1086, 281, 1, 0, 0, 0, 1087, 1088, 3, 54, 21, 0, 1088, 1089, 1, 0, 0, 0, 1089, 1090, 6, 135, 9, 0, 1090, 283, 1, 0, 0, 0, 1091, 1092, 3, 66, 27, 0, 1092, 1093, 1, 0, 0, 0, 1093, 1094, 6, 136, 12, 0, 1094, 1095, 6, 136, 13, 0, 1095, 285, 1, 0, 0, 0, 1096, 1097, 3, 108, 48, 0, 1097, 1098, 1, 0, 0, 0, 1098, 1099, 6, 137, 18, 0, 1099, 287, 1, 0, 0, 0, 1100, 1101, 3, 172, 80, 0, 1101, 1102, 1, 0, 0, 0, 1102, 1103, 6, 138, 22, 0, 1103, 289, 1, 0, 0, 0, 1104, 1105, 3, 168, 78, 0, 1105, 1106, 1, 0, 0, 0, 1106, 1107, 6, 139, 25, 0, 1107, 291, 1, 0, 0, 0, 1108, 1109, 3, 50, 19, 0, 1109, 1110, 1, 0, 0, 0, 1110, 1111, 6, 140, 9, 0, 1111, 293, 1, 0, 0, 0, 1112, 1113, 3, 52, 20, 0, 1113, 1114, 1, 0, 0, 0, 1114, 1115, 6, 141, 9, 0, 1115, 295, 1, 0, 0, 0, 1116, 1117, 3, 54, 21, 0, 1117, 1118, 1, 0, 0, 0, 1118, 1119, 6, 142, 9, 0, 1119, 297, 1, 0, 0, 0, 1120, 1121, 3, 66, 27, 0, 1121, 1122, 1, 0, 0, 0, 1122, 1123, 6, 143, 12, 0, 1123, 1124, 6, 143, 13, 0, 1124, 299, 1, 0, 0, 0, 1125, 1126, 7, 1, 0, 0, 1126, 1127, 7, 9, 0, 0, 1127, 1128, 7, 15, 0, 0, 1128, 1129, 7, 7, 0, 0, 1129, 301, 1, 0, 0, 0, 1130, 1131, 3, 50, 19, 0, 1131, 1132, 1, 0, 0, 0, 1132, 1133, 6, 145, 9, 0, 1133, 303, 1, 0, 0, 0, 1134, 1135, 3, 52, 20, 0, 1135, 1136, 1, 0, 0, 0, 1136, 1137, 6, 146, 9, 0, 1137, 305, 1, 0, 0, 0, 1138, 1139, 3, 54, 21, 0, 1139, 1140, 1, 0, 0, 0, 1140, 1141, 6, 147, 9, 0, 1141, 307, 1, 0, 0, 0, 1142, 1143, 3, 66, 27, 0, 1143, 1144, 1, 0, 0, 0, 1144, 1145, 6, 148, 12, 0, 1145, 1146, 6, 148, 13, 0, 1146, 309, 1, 0, 0, 0, 1147, 1148, 7, 15, 0, 0, 1148, 1149, 7, 31, 0, 0, 1149, 1150, 7, 9, 0, 0, 1150, 1151, 7, 4, 0, 0, 1151, 1152, 7, 5, 0, 0, 1152, 1153, 7, 1, 0, 0, 1153, 1154, 7, 7, 0, 0, 1154, 1155, 7, 9, 0, 0, 1155, 1156, 7, 2, 0, 0, 1156, 311, 1, 0, 0, 0, 1157, 1158, 3, 50, 19, 0, 1158, 1159, 1, 0, 0, 0, 1159, 1160, 6, 150, 9, 0, 1160, 313, 1, 0, 0, 0, 1161, 1162, 3, 52, 20, 0, 1162, 1163, 1, 0, 0, 0, 1163, 1164, 6, 151, 9, 0, 1164, 315, 1, 0, 0, 0, 1165, 1166, 3, 54, 21, 0, 1166, 1167, 1, 0, 0, 0, 1167, 1168, 6, 152, 9, 0, 1168, 317, 1, 0, 0, 0, 1169, 1170, 3, 166, 77, 0, 1170, 1171, 1, 0, 0, 0, 1171, 1172, 6, 153, 14, 0, 1172, 1173, 6, 153, 13, 0, 1173, 319, 1, 0, 0, 0, 1174, 1175, 5, 58, 0, 0, 1175, 321, 1, 0, 0, 0, 1176, 1182, 3, 78, 33, 0, 1177, 1182, 3, 68, 28, 0, 1178, 1182, 3, 108, 48, 0, 1179, 1182, 3, 70, 29, 0, 1180, 1182, 3, 84, 36, 0, 1181, 1176, 1, 0, 0, 0, 1181, 1177, 1, 0, 0, 0, 1181, 1178, 1, 0, 0, 0, 1181, 1179, 1, 0, 0, 0, 1181, 1180, 1, 0, 0, 0, 1182, 1183, 1, 0, 0, 0, 1183, 1181, 1, 0, 0, 0, 1183, 1184, 1, 0, 0, 0, 1184, 323, 1, 0, 0, 0, 1185, 1186, 3, 50, 19, 0, 1186, 1187, 1, 0, 0, 0, 1187, 1188, 6, 156, 9, 0, 1188, 325, 1, 0, 0, 0, 1189, 1190, 3, 52, 20, 0, 1190, 1191, 1, 0, 0, 0, 1191, 1192, 6, 157, 9, 0, 1192, 327, 1, 0, 0, 0, 1193, 1194, 3, 54, 21, 0, 1194, 1195, 1, 0, 0, 0, 1195, 1196, 6, 158, 9, 0, 1196, 329, 1, 0, 0, 0, 58, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 483, 493, 497, 500, 509, 511, 522, 563, 568, 577, 584, 589, 591, 602, 610, 613, 615, 620, 625, 631, 638, 643, 649, 652, 660, 664, 797, 802, 807, 809, 815, 878, 883, 914, 918, 923, 928, 933, 935, 939, 941, 1018, 1022, 1027, 1181, 1183, 26, 5, 2, 0, 5, 4, 0, 5, 6, 0, 5, 1, 0, 5, 3, 0, 5, 10, 0, 5, 8, 0, 5, 5, 0, 5, 9, 0, 0, 1, 0, 7, 65, 0, 5, 0, 0, 7, 26, 0, 4, 0, 0, 7, 66, 0, 7, 35, 0, 7, 33, 0, 7, 27, 0, 7, 37, 0, 7, 78, 0, 5, 11, 0, 5, 7, 0, 7, 68, 0, 7, 88, 0, 7, 87, 0, 7, 67, 0]
\ No newline at end of file
diff --git a/packages/kbn-esql-ast/src/antlr/esql_lexer.ts b/packages/kbn-esql-ast/src/antlr/esql_lexer.ts
index 5aa7fb2a8bf5c7..d10efdb06e4bbd 100644
--- a/packages/kbn-esql-ast/src/antlr/esql_lexer.ts
+++ b/packages/kbn-esql-ast/src/antlr/esql_lexer.ts
@@ -295,21 +295,21 @@ export default class esql_lexer extends Lexer {
 		"EXPR_LINE_COMMENT", "EXPR_MULTILINE_COMMENT", "EXPR_WS", "FROM_PIPE", 
 		"FROM_OPENING_BRACKET", "FROM_CLOSING_BRACKET", "FROM_COMMA", "FROM_ASSIGN", 
 		"FROM_QUOTED_STRING", "OPTIONS", "METADATA", "FROM_UNQUOTED_IDENTIFIER_PART", 
-		"FROM_UNQUOTED_IDENTIFIER", "FROM_QUOTED_IDENTIFIER", "FROM_LINE_COMMENT", 
-		"FROM_MULTILINE_COMMENT", "FROM_WS", "PROJECT_PIPE", "PROJECT_DOT", "PROJECT_COMMA", 
-		"UNQUOTED_ID_BODY_WITH_PATTERN", "UNQUOTED_ID_PATTERN", "ID_PATTERN", 
-		"PROJECT_LINE_COMMENT", "PROJECT_MULTILINE_COMMENT", "PROJECT_WS", "RENAME_PIPE", 
-		"RENAME_ASSIGN", "RENAME_COMMA", "RENAME_DOT", "AS", "RENAME_ID_PATTERN", 
-		"RENAME_LINE_COMMENT", "RENAME_MULTILINE_COMMENT", "RENAME_WS", "ENRICH_PIPE", 
-		"ENRICH_OPENING_BRACKET", "ON", "WITH", "ENRICH_POLICY_NAME_BODY", "ENRICH_POLICY_NAME", 
-		"ENRICH_QUOTED_IDENTIFIER", "ENRICH_MODE_UNQUOTED_VALUE", "ENRICH_LINE_COMMENT", 
-		"ENRICH_MULTILINE_COMMENT", "ENRICH_WS", "ENRICH_FIELD_PIPE", "ENRICH_FIELD_ASSIGN", 
-		"ENRICH_FIELD_COMMA", "ENRICH_FIELD_DOT", "ENRICH_FIELD_WITH", "ENRICH_FIELD_ID_PATTERN", 
-		"ENRICH_FIELD_QUOTED_IDENTIFIER", "ENRICH_FIELD_LINE_COMMENT", "ENRICH_FIELD_MULTILINE_COMMENT", 
-		"ENRICH_FIELD_WS", "MVEXPAND_PIPE", "MVEXPAND_DOT", "MVEXPAND_QUOTED_IDENTIFIER", 
-		"MVEXPAND_UNQUOTED_IDENTIFIER", "MVEXPAND_LINE_COMMENT", "MVEXPAND_MULTILINE_COMMENT", 
-		"MVEXPAND_WS", "SHOW_PIPE", "INFO", "SHOW_LINE_COMMENT", "SHOW_MULTILINE_COMMENT", 
-		"SHOW_WS", "META_PIPE", "FUNCTIONS", "META_LINE_COMMENT", "META_MULTILINE_COMMENT", 
+		"FROM_UNQUOTED_IDENTIFIER", "FROM_LINE_COMMENT", "FROM_MULTILINE_COMMENT", 
+		"FROM_WS", "PROJECT_PIPE", "PROJECT_DOT", "PROJECT_COMMA", "UNQUOTED_ID_BODY_WITH_PATTERN", 
+		"UNQUOTED_ID_PATTERN", "ID_PATTERN", "PROJECT_LINE_COMMENT", "PROJECT_MULTILINE_COMMENT", 
+		"PROJECT_WS", "RENAME_PIPE", "RENAME_ASSIGN", "RENAME_COMMA", "RENAME_DOT", 
+		"AS", "RENAME_ID_PATTERN", "RENAME_LINE_COMMENT", "RENAME_MULTILINE_COMMENT", 
+		"RENAME_WS", "ENRICH_PIPE", "ENRICH_OPENING_BRACKET", "ON", "WITH", "ENRICH_POLICY_NAME_BODY", 
+		"ENRICH_POLICY_NAME", "ENRICH_QUOTED_IDENTIFIER", "ENRICH_MODE_UNQUOTED_VALUE", 
+		"ENRICH_LINE_COMMENT", "ENRICH_MULTILINE_COMMENT", "ENRICH_WS", "ENRICH_FIELD_PIPE", 
+		"ENRICH_FIELD_ASSIGN", "ENRICH_FIELD_COMMA", "ENRICH_FIELD_DOT", "ENRICH_FIELD_WITH", 
+		"ENRICH_FIELD_ID_PATTERN", "ENRICH_FIELD_QUOTED_IDENTIFIER", "ENRICH_FIELD_LINE_COMMENT", 
+		"ENRICH_FIELD_MULTILINE_COMMENT", "ENRICH_FIELD_WS", "MVEXPAND_PIPE", 
+		"MVEXPAND_DOT", "MVEXPAND_QUOTED_IDENTIFIER", "MVEXPAND_UNQUOTED_IDENTIFIER", 
+		"MVEXPAND_LINE_COMMENT", "MVEXPAND_MULTILINE_COMMENT", "MVEXPAND_WS", 
+		"SHOW_PIPE", "INFO", "SHOW_LINE_COMMENT", "SHOW_MULTILINE_COMMENT", "SHOW_WS", 
+		"META_PIPE", "FUNCTIONS", "META_LINE_COMMENT", "META_MULTILINE_COMMENT", 
 		"META_WS", "SETTING_CLOSING_BRACKET", "COLON", "SETTING", "SETTING_LINE_COMMENT", 
 		"SETTTING_MULTILINE_COMMENT", "SETTING_WS",
 	];
@@ -332,7 +332,7 @@ export default class esql_lexer extends Lexer {
 
 	public get modeNames(): string[] { return esql_lexer.modeNames; }
 
-	public static readonly _serializedATN: number[] = [4,0,110,1203,6,-1,6,
+	public static readonly _serializedATN: number[] = [4,0,110,1197,6,-1,6,
 	-1,6,-1,6,-1,6,-1,6,-1,6,-1,6,-1,6,-1,6,-1,6,-1,6,-1,2,0,7,0,2,1,7,1,2,
 	2,7,2,2,3,7,3,2,4,7,4,2,5,7,5,2,6,7,6,2,7,7,7,2,8,7,8,2,9,7,9,2,10,7,10,
 	2,11,7,11,2,12,7,12,2,13,7,13,2,14,7,14,2,15,7,15,2,16,7,16,2,17,7,17,2,
@@ -357,387 +357,385 @@ export default class esql_lexer extends Lexer {
 	7,140,2,141,7,141,2,142,7,142,2,143,7,143,2,144,7,144,2,145,7,145,2,146,
 	7,146,2,147,7,147,2,148,7,148,2,149,7,149,2,150,7,150,2,151,7,151,2,152,
 	7,152,2,153,7,153,2,154,7,154,2,155,7,155,2,156,7,156,2,157,7,157,2,158,
-	7,158,2,159,7,159,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,1,1,1,1,1,1,
-	1,1,1,1,1,1,1,1,2,1,2,1,2,1,2,1,2,1,2,1,2,1,2,1,2,1,3,1,3,1,3,1,3,1,3,1,
-	3,1,3,1,4,1,4,1,4,1,4,1,4,1,4,1,4,1,4,1,4,1,4,1,5,1,5,1,5,1,5,1,5,1,5,1,
-	5,1,6,1,6,1,6,1,6,1,6,1,6,1,6,1,7,1,7,1,7,1,7,1,7,1,7,1,7,1,7,1,7,1,7,1,
-	7,1,7,1,7,1,7,1,8,1,8,1,8,1,8,1,8,1,8,1,8,1,9,1,9,1,9,1,9,1,9,1,9,1,9,1,
-	9,1,10,1,10,1,10,1,10,1,10,1,10,1,10,1,11,1,11,1,11,1,11,1,11,1,11,1,11,
-	1,11,1,11,1,11,1,11,1,11,1,12,1,12,1,12,1,12,1,12,1,12,1,12,1,12,1,12,1,
-	13,1,13,1,13,1,13,1,13,1,13,1,14,1,14,1,14,1,14,1,14,1,14,1,14,1,15,1,15,
-	1,15,1,15,1,15,1,15,1,15,1,16,1,16,1,16,1,16,1,16,1,16,1,16,1,16,1,17,1,
-	17,1,17,1,17,1,17,1,17,1,17,1,17,1,18,4,18,484,8,18,11,18,12,18,485,1,18,
-	1,18,1,19,1,19,1,19,1,19,5,19,494,8,19,10,19,12,19,497,9,19,1,19,3,19,500,
-	8,19,1,19,3,19,503,8,19,1,19,1,19,1,20,1,20,1,20,1,20,1,20,5,20,512,8,20,
-	10,20,12,20,515,9,20,1,20,1,20,1,20,1,20,1,20,1,21,4,21,523,8,21,11,21,
-	12,21,524,1,21,1,21,1,22,1,22,1,22,1,22,1,22,1,23,1,23,1,23,1,23,1,23,1,
-	24,1,24,1,24,1,24,1,25,1,25,1,25,1,25,1,26,1,26,1,26,1,26,1,27,1,27,1,27,
-	1,27,1,28,1,28,1,29,1,29,1,30,1,30,1,30,1,31,1,31,1,32,1,32,3,32,566,8,
-	32,1,32,4,32,569,8,32,11,32,12,32,570,1,33,1,33,1,34,1,34,1,35,1,35,1,35,
-	3,35,580,8,35,1,36,1,36,1,37,1,37,1,37,3,37,587,8,37,1,38,1,38,1,38,5,38,
-	592,8,38,10,38,12,38,595,9,38,1,38,1,38,1,38,1,38,1,38,1,38,5,38,603,8,
-	38,10,38,12,38,606,9,38,1,38,1,38,1,38,1,38,1,38,3,38,613,8,38,1,38,3,38,
-	616,8,38,3,38,618,8,38,1,39,4,39,621,8,39,11,39,12,39,622,1,40,4,40,626,
-	8,40,11,40,12,40,627,1,40,1,40,5,40,632,8,40,10,40,12,40,635,9,40,1,40,
-	1,40,4,40,639,8,40,11,40,12,40,640,1,40,4,40,644,8,40,11,40,12,40,645,1,
-	40,1,40,5,40,650,8,40,10,40,12,40,653,9,40,3,40,655,8,40,1,40,1,40,1,40,
-	1,40,4,40,661,8,40,11,40,12,40,662,1,40,1,40,3,40,667,8,40,1,41,1,41,1,
-	41,1,42,1,42,1,42,1,42,1,43,1,43,1,43,1,43,1,44,1,44,1,45,1,45,1,45,1,46,
-	1,46,1,47,1,47,1,47,1,47,1,47,1,48,1,48,1,49,1,49,1,49,1,49,1,49,1,49,1,
-	50,1,50,1,50,1,50,1,50,1,50,1,51,1,51,1,51,1,51,1,51,1,52,1,52,1,53,1,53,
-	1,53,1,54,1,54,1,54,1,55,1,55,1,55,1,55,1,55,1,56,1,56,1,56,1,56,1,57,1,
-	57,1,57,1,57,1,57,1,58,1,58,1,58,1,58,1,58,1,58,1,59,1,59,1,59,1,60,1,60,
-	1,61,1,61,1,61,1,61,1,61,1,61,1,62,1,62,1,63,1,63,1,63,1,63,1,63,1,64,1,
-	64,1,64,1,65,1,65,1,65,1,66,1,66,1,66,1,67,1,67,1,68,1,68,1,68,1,69,1,69,
-	1,70,1,70,1,70,1,71,1,71,1,72,1,72,1,73,1,73,1,74,1,74,1,75,1,75,1,76,1,
-	76,1,76,1,76,1,76,1,77,1,77,1,77,1,77,1,77,1,78,1,78,5,78,798,8,78,10,78,
-	12,78,801,9,78,1,78,1,78,3,78,805,8,78,1,78,4,78,808,8,78,11,78,12,78,809,
-	3,78,812,8,78,1,79,1,79,4,79,816,8,79,11,79,12,79,817,1,79,1,79,1,80,1,
-	80,1,81,1,81,1,81,1,81,1,82,1,82,1,82,1,82,1,83,1,83,1,83,1,83,1,84,1,84,
-	1,84,1,84,1,84,1,85,1,85,1,85,1,85,1,86,1,86,1,86,1,86,1,87,1,87,1,87,1,
-	87,1,88,1,88,1,88,1,88,1,89,1,89,1,89,1,89,1,90,1,90,1,90,1,90,1,90,1,90,
-	1,90,1,90,1,91,1,91,1,91,1,91,1,91,1,91,1,91,1,91,1,91,1,92,1,92,1,92,3,
-	92,881,8,92,1,93,4,93,884,8,93,11,93,12,93,885,1,94,1,94,1,94,1,94,1,95,
-	1,95,1,95,1,95,1,96,1,96,1,96,1,96,1,97,1,97,1,97,1,97,1,98,1,98,1,98,1,
-	98,1,98,1,99,1,99,1,99,1,99,1,100,1,100,1,100,1,100,1,101,1,101,1,101,1,
-	101,3,101,921,8,101,1,102,1,102,3,102,925,8,102,1,102,5,102,928,8,102,10,
-	102,12,102,931,9,102,1,102,1,102,3,102,935,8,102,1,102,4,102,938,8,102,
-	11,102,12,102,939,3,102,942,8,102,1,103,1,103,4,103,946,8,103,11,103,12,
-	103,947,1,104,1,104,1,104,1,104,1,105,1,105,1,105,1,105,1,106,1,106,1,106,
-	1,106,1,107,1,107,1,107,1,107,1,107,1,108,1,108,1,108,1,108,1,109,1,109,
-	1,109,1,109,1,110,1,110,1,110,1,110,1,111,1,111,1,111,1,112,1,112,1,112,
-	1,112,1,113,1,113,1,113,1,113,1,114,1,114,1,114,1,114,1,115,1,115,1,115,
-	1,115,1,116,1,116,1,116,1,116,1,116,1,117,1,117,1,117,1,117,1,117,1,118,
-	1,118,1,118,1,118,1,118,1,119,1,119,1,119,1,119,1,119,1,119,1,119,1,120,
-	1,120,1,121,4,121,1023,8,121,11,121,12,121,1024,1,121,1,121,3,121,1029,
-	8,121,1,121,4,121,1032,8,121,11,121,12,121,1033,1,122,1,122,1,122,1,122,
-	1,123,1,123,1,123,1,123,1,124,1,124,1,124,1,124,1,125,1,125,1,125,1,125,
-	1,126,1,126,1,126,1,126,1,127,1,127,1,127,1,127,1,127,1,127,1,128,1,128,
-	1,128,1,128,1,129,1,129,1,129,1,129,1,130,1,130,1,130,1,130,1,131,1,131,
-	1,131,1,131,1,132,1,132,1,132,1,132,1,133,1,133,1,133,1,133,1,134,1,134,
-	1,134,1,134,1,135,1,135,1,135,1,135,1,136,1,136,1,136,1,136,1,137,1,137,
-	1,137,1,137,1,137,1,138,1,138,1,138,1,138,1,139,1,139,1,139,1,139,1,140,
-	1,140,1,140,1,140,1,141,1,141,1,141,1,141,1,142,1,142,1,142,1,142,1,143,
-	1,143,1,143,1,143,1,144,1,144,1,144,1,144,1,144,1,145,1,145,1,145,1,145,
-	1,145,1,146,1,146,1,146,1,146,1,147,1,147,1,147,1,147,1,148,1,148,1,148,
-	1,148,1,149,1,149,1,149,1,149,1,149,1,150,1,150,1,150,1,150,1,150,1,150,
-	1,150,1,150,1,150,1,150,1,151,1,151,1,151,1,151,1,152,1,152,1,152,1,152,
-	1,153,1,153,1,153,1,153,1,154,1,154,1,154,1,154,1,154,1,155,1,155,1,156,
-	1,156,1,156,1,156,1,156,4,156,1188,8,156,11,156,12,156,1189,1,157,1,157,
-	1,157,1,157,1,158,1,158,1,158,1,158,1,159,1,159,1,159,1,159,2,513,604,0,
-	160,12,1,14,2,16,3,18,4,20,5,22,6,24,7,26,8,28,9,30,10,32,11,34,12,36,13,
-	38,14,40,15,42,16,44,17,46,18,48,19,50,20,52,21,54,22,56,0,58,0,60,23,62,
-	24,64,25,66,26,68,0,70,0,72,0,74,0,76,0,78,0,80,0,82,0,84,0,86,0,88,27,
-	90,28,92,29,94,30,96,31,98,32,100,33,102,34,104,35,106,36,108,37,110,38,
-	112,39,114,40,116,41,118,42,120,43,122,44,124,45,126,46,128,47,130,48,132,
-	49,134,50,136,51,138,52,140,53,142,54,144,55,146,56,148,57,150,58,152,59,
-	154,60,156,61,158,62,160,63,162,64,164,65,166,66,168,67,170,0,172,68,174,
-	69,176,70,178,71,180,0,182,0,184,0,186,0,188,0,190,0,192,72,194,73,196,
-	0,198,74,200,0,202,75,204,76,206,77,208,0,210,0,212,0,214,0,216,0,218,78,
-	220,79,222,80,224,81,226,0,228,0,230,0,232,0,234,82,236,0,238,83,240,84,
-	242,85,244,0,246,0,248,86,250,87,252,0,254,88,256,0,258,0,260,89,262,90,
-	264,91,266,0,268,0,270,0,272,0,274,0,276,0,278,0,280,92,282,93,284,94,286,
-	0,288,0,290,0,292,0,294,95,296,96,298,97,300,0,302,98,304,99,306,100,308,
-	101,310,0,312,102,314,103,316,104,318,105,320,0,322,106,324,107,326,108,
-	328,109,330,110,12,0,1,2,3,4,5,6,7,8,9,10,11,35,2,0,68,68,100,100,2,0,73,
-	73,105,105,2,0,83,83,115,115,2,0,69,69,101,101,2,0,67,67,99,99,2,0,84,84,
-	116,116,2,0,82,82,114,114,2,0,79,79,111,111,2,0,80,80,112,112,2,0,78,78,
-	110,110,2,0,72,72,104,104,2,0,86,86,118,118,2,0,65,65,97,97,2,0,76,76,108,
-	108,2,0,88,88,120,120,2,0,70,70,102,102,2,0,77,77,109,109,2,0,71,71,103,
-	103,2,0,75,75,107,107,2,0,87,87,119,119,6,0,9,10,13,13,32,32,47,47,91,91,
-	93,93,2,0,10,10,13,13,3,0,9,10,13,13,32,32,1,0,48,57,2,0,65,90,97,122,8,
-	0,34,34,78,78,82,82,84,84,92,92,110,110,114,114,116,116,4,0,10,10,13,13,
-	34,34,92,92,2,0,43,43,45,45,1,0,96,96,2,0,66,66,98,98,2,0,89,89,121,121,
-	2,0,85,85,117,117,10,0,9,10,13,13,32,32,44,44,47,47,61,61,91,91,93,93,96,
-	96,124,124,2,0,42,42,47,47,11,0,9,10,13,13,32,32,34,35,44,44,47,47,58,58,
-	60,60,62,63,92,92,124,124,1230,0,12,1,0,0,0,0,14,1,0,0,0,0,16,1,0,0,0,0,
-	18,1,0,0,0,0,20,1,0,0,0,0,22,1,0,0,0,0,24,1,0,0,0,0,26,1,0,0,0,0,28,1,0,
-	0,0,0,30,1,0,0,0,0,32,1,0,0,0,0,34,1,0,0,0,0,36,1,0,0,0,0,38,1,0,0,0,0,
-	40,1,0,0,0,0,42,1,0,0,0,0,44,1,0,0,0,0,46,1,0,0,0,0,48,1,0,0,0,0,50,1,0,
-	0,0,0,52,1,0,0,0,0,54,1,0,0,0,1,56,1,0,0,0,1,58,1,0,0,0,1,60,1,0,0,0,1,
-	62,1,0,0,0,1,64,1,0,0,0,2,66,1,0,0,0,2,88,1,0,0,0,2,90,1,0,0,0,2,92,1,0,
-	0,0,2,94,1,0,0,0,2,96,1,0,0,0,2,98,1,0,0,0,2,100,1,0,0,0,2,102,1,0,0,0,
-	2,104,1,0,0,0,2,106,1,0,0,0,2,108,1,0,0,0,2,110,1,0,0,0,2,112,1,0,0,0,2,
-	114,1,0,0,0,2,116,1,0,0,0,2,118,1,0,0,0,2,120,1,0,0,0,2,122,1,0,0,0,2,124,
-	1,0,0,0,2,126,1,0,0,0,2,128,1,0,0,0,2,130,1,0,0,0,2,132,1,0,0,0,2,134,1,
-	0,0,0,2,136,1,0,0,0,2,138,1,0,0,0,2,140,1,0,0,0,2,142,1,0,0,0,2,144,1,0,
-	0,0,2,146,1,0,0,0,2,148,1,0,0,0,2,150,1,0,0,0,2,152,1,0,0,0,2,154,1,0,0,
-	0,2,156,1,0,0,0,2,158,1,0,0,0,2,160,1,0,0,0,2,162,1,0,0,0,2,164,1,0,0,0,
-	2,166,1,0,0,0,2,168,1,0,0,0,2,172,1,0,0,0,2,174,1,0,0,0,2,176,1,0,0,0,2,
-	178,1,0,0,0,3,180,1,0,0,0,3,182,1,0,0,0,3,184,1,0,0,0,3,186,1,0,0,0,3,188,
-	1,0,0,0,3,190,1,0,0,0,3,192,1,0,0,0,3,194,1,0,0,0,3,198,1,0,0,0,3,200,1,
-	0,0,0,3,202,1,0,0,0,3,204,1,0,0,0,3,206,1,0,0,0,4,208,1,0,0,0,4,210,1,0,
-	0,0,4,212,1,0,0,0,4,218,1,0,0,0,4,220,1,0,0,0,4,222,1,0,0,0,4,224,1,0,0,
-	0,5,226,1,0,0,0,5,228,1,0,0,0,5,230,1,0,0,0,5,232,1,0,0,0,5,234,1,0,0,0,
-	5,236,1,0,0,0,5,238,1,0,0,0,5,240,1,0,0,0,5,242,1,0,0,0,6,244,1,0,0,0,6,
-	246,1,0,0,0,6,248,1,0,0,0,6,250,1,0,0,0,6,254,1,0,0,0,6,256,1,0,0,0,6,258,
-	1,0,0,0,6,260,1,0,0,0,6,262,1,0,0,0,6,264,1,0,0,0,7,266,1,0,0,0,7,268,1,
-	0,0,0,7,270,1,0,0,0,7,272,1,0,0,0,7,274,1,0,0,0,7,276,1,0,0,0,7,278,1,0,
-	0,0,7,280,1,0,0,0,7,282,1,0,0,0,7,284,1,0,0,0,8,286,1,0,0,0,8,288,1,0,0,
-	0,8,290,1,0,0,0,8,292,1,0,0,0,8,294,1,0,0,0,8,296,1,0,0,0,8,298,1,0,0,0,
-	9,300,1,0,0,0,9,302,1,0,0,0,9,304,1,0,0,0,9,306,1,0,0,0,9,308,1,0,0,0,10,
-	310,1,0,0,0,10,312,1,0,0,0,10,314,1,0,0,0,10,316,1,0,0,0,10,318,1,0,0,0,
-	11,320,1,0,0,0,11,322,1,0,0,0,11,324,1,0,0,0,11,326,1,0,0,0,11,328,1,0,
-	0,0,11,330,1,0,0,0,12,332,1,0,0,0,14,342,1,0,0,0,16,349,1,0,0,0,18,358,
-	1,0,0,0,20,365,1,0,0,0,22,375,1,0,0,0,24,382,1,0,0,0,26,389,1,0,0,0,28,
-	403,1,0,0,0,30,410,1,0,0,0,32,418,1,0,0,0,34,425,1,0,0,0,36,437,1,0,0,0,
-	38,446,1,0,0,0,40,452,1,0,0,0,42,459,1,0,0,0,44,466,1,0,0,0,46,474,1,0,
-	0,0,48,483,1,0,0,0,50,489,1,0,0,0,52,506,1,0,0,0,54,522,1,0,0,0,56,528,
-	1,0,0,0,58,533,1,0,0,0,60,538,1,0,0,0,62,542,1,0,0,0,64,546,1,0,0,0,66,
-	550,1,0,0,0,68,554,1,0,0,0,70,556,1,0,0,0,72,558,1,0,0,0,74,561,1,0,0,0,
-	76,563,1,0,0,0,78,572,1,0,0,0,80,574,1,0,0,0,82,579,1,0,0,0,84,581,1,0,
-	0,0,86,586,1,0,0,0,88,617,1,0,0,0,90,620,1,0,0,0,92,666,1,0,0,0,94,668,
-	1,0,0,0,96,671,1,0,0,0,98,675,1,0,0,0,100,679,1,0,0,0,102,681,1,0,0,0,104,
-	684,1,0,0,0,106,686,1,0,0,0,108,691,1,0,0,0,110,693,1,0,0,0,112,699,1,0,
-	0,0,114,705,1,0,0,0,116,710,1,0,0,0,118,712,1,0,0,0,120,715,1,0,0,0,122,
-	718,1,0,0,0,124,723,1,0,0,0,126,727,1,0,0,0,128,732,1,0,0,0,130,738,1,0,
-	0,0,132,741,1,0,0,0,134,743,1,0,0,0,136,749,1,0,0,0,138,751,1,0,0,0,140,
-	756,1,0,0,0,142,759,1,0,0,0,144,762,1,0,0,0,146,765,1,0,0,0,148,767,1,0,
-	0,0,150,770,1,0,0,0,152,772,1,0,0,0,154,775,1,0,0,0,156,777,1,0,0,0,158,
-	779,1,0,0,0,160,781,1,0,0,0,162,783,1,0,0,0,164,785,1,0,0,0,166,790,1,0,
-	0,0,168,811,1,0,0,0,170,813,1,0,0,0,172,821,1,0,0,0,174,823,1,0,0,0,176,
-	827,1,0,0,0,178,831,1,0,0,0,180,835,1,0,0,0,182,840,1,0,0,0,184,844,1,0,
-	0,0,186,848,1,0,0,0,188,852,1,0,0,0,190,856,1,0,0,0,192,860,1,0,0,0,194,
-	868,1,0,0,0,196,880,1,0,0,0,198,883,1,0,0,0,200,887,1,0,0,0,202,891,1,0,
-	0,0,204,895,1,0,0,0,206,899,1,0,0,0,208,903,1,0,0,0,210,908,1,0,0,0,212,
-	912,1,0,0,0,214,920,1,0,0,0,216,941,1,0,0,0,218,945,1,0,0,0,220,949,1,0,
-	0,0,222,953,1,0,0,0,224,957,1,0,0,0,226,961,1,0,0,0,228,966,1,0,0,0,230,
-	970,1,0,0,0,232,974,1,0,0,0,234,978,1,0,0,0,236,981,1,0,0,0,238,985,1,0,
-	0,0,240,989,1,0,0,0,242,993,1,0,0,0,244,997,1,0,0,0,246,1002,1,0,0,0,248,
-	1007,1,0,0,0,250,1012,1,0,0,0,252,1019,1,0,0,0,254,1028,1,0,0,0,256,1035,
-	1,0,0,0,258,1039,1,0,0,0,260,1043,1,0,0,0,262,1047,1,0,0,0,264,1051,1,0,
-	0,0,266,1055,1,0,0,0,268,1061,1,0,0,0,270,1065,1,0,0,0,272,1069,1,0,0,0,
-	274,1073,1,0,0,0,276,1077,1,0,0,0,278,1081,1,0,0,0,280,1085,1,0,0,0,282,
-	1089,1,0,0,0,284,1093,1,0,0,0,286,1097,1,0,0,0,288,1102,1,0,0,0,290,1106,
-	1,0,0,0,292,1110,1,0,0,0,294,1114,1,0,0,0,296,1118,1,0,0,0,298,1122,1,0,
-	0,0,300,1126,1,0,0,0,302,1131,1,0,0,0,304,1136,1,0,0,0,306,1140,1,0,0,0,
-	308,1144,1,0,0,0,310,1148,1,0,0,0,312,1153,1,0,0,0,314,1163,1,0,0,0,316,
-	1167,1,0,0,0,318,1171,1,0,0,0,320,1175,1,0,0,0,322,1180,1,0,0,0,324,1187,
-	1,0,0,0,326,1191,1,0,0,0,328,1195,1,0,0,0,330,1199,1,0,0,0,332,333,7,0,
-	0,0,333,334,7,1,0,0,334,335,7,2,0,0,335,336,7,2,0,0,336,337,7,3,0,0,337,
-	338,7,4,0,0,338,339,7,5,0,0,339,340,1,0,0,0,340,341,6,0,0,0,341,13,1,0,
-	0,0,342,343,7,0,0,0,343,344,7,6,0,0,344,345,7,7,0,0,345,346,7,8,0,0,346,
-	347,1,0,0,0,347,348,6,1,1,0,348,15,1,0,0,0,349,350,7,3,0,0,350,351,7,9,
-	0,0,351,352,7,6,0,0,352,353,7,1,0,0,353,354,7,4,0,0,354,355,7,10,0,0,355,
-	356,1,0,0,0,356,357,6,2,2,0,357,17,1,0,0,0,358,359,7,3,0,0,359,360,7,11,
-	0,0,360,361,7,12,0,0,361,362,7,13,0,0,362,363,1,0,0,0,363,364,6,3,0,0,364,
-	19,1,0,0,0,365,366,7,3,0,0,366,367,7,14,0,0,367,368,7,8,0,0,368,369,7,13,
-	0,0,369,370,7,12,0,0,370,371,7,1,0,0,371,372,7,9,0,0,372,373,1,0,0,0,373,
-	374,6,4,3,0,374,21,1,0,0,0,375,376,7,15,0,0,376,377,7,6,0,0,377,378,7,7,
-	0,0,378,379,7,16,0,0,379,380,1,0,0,0,380,381,6,5,4,0,381,23,1,0,0,0,382,
-	383,7,17,0,0,383,384,7,6,0,0,384,385,7,7,0,0,385,386,7,18,0,0,386,387,1,
-	0,0,0,387,388,6,6,0,0,388,25,1,0,0,0,389,390,7,1,0,0,390,391,7,9,0,0,391,
-	392,7,13,0,0,392,393,7,1,0,0,393,394,7,9,0,0,394,395,7,3,0,0,395,396,7,
-	2,0,0,396,397,7,5,0,0,397,398,7,12,0,0,398,399,7,5,0,0,399,400,7,2,0,0,
-	400,401,1,0,0,0,401,402,6,7,0,0,402,27,1,0,0,0,403,404,7,18,0,0,404,405,
-	7,3,0,0,405,406,7,3,0,0,406,407,7,8,0,0,407,408,1,0,0,0,408,409,6,8,1,0,
-	409,29,1,0,0,0,410,411,7,13,0,0,411,412,7,1,0,0,412,413,7,16,0,0,413,414,
-	7,1,0,0,414,415,7,5,0,0,415,416,1,0,0,0,416,417,6,9,0,0,417,31,1,0,0,0,
-	418,419,7,16,0,0,419,420,7,3,0,0,420,421,7,5,0,0,421,422,7,12,0,0,422,423,
-	1,0,0,0,423,424,6,10,5,0,424,33,1,0,0,0,425,426,7,16,0,0,426,427,7,11,0,
-	0,427,428,5,95,0,0,428,429,7,3,0,0,429,430,7,14,0,0,430,431,7,8,0,0,431,
-	432,7,12,0,0,432,433,7,9,0,0,433,434,7,0,0,0,434,435,1,0,0,0,435,436,6,
-	11,6,0,436,35,1,0,0,0,437,438,7,6,0,0,438,439,7,3,0,0,439,440,7,9,0,0,440,
-	441,7,12,0,0,441,442,7,16,0,0,442,443,7,3,0,0,443,444,1,0,0,0,444,445,6,
-	12,7,0,445,37,1,0,0,0,446,447,7,6,0,0,447,448,7,7,0,0,448,449,7,19,0,0,
-	449,450,1,0,0,0,450,451,6,13,0,0,451,39,1,0,0,0,452,453,7,2,0,0,453,454,
-	7,10,0,0,454,455,7,7,0,0,455,456,7,19,0,0,456,457,1,0,0,0,457,458,6,14,
-	8,0,458,41,1,0,0,0,459,460,7,2,0,0,460,461,7,7,0,0,461,462,7,6,0,0,462,
-	463,7,5,0,0,463,464,1,0,0,0,464,465,6,15,0,0,465,43,1,0,0,0,466,467,7,2,
-	0,0,467,468,7,5,0,0,468,469,7,12,0,0,469,470,7,5,0,0,470,471,7,2,0,0,471,
-	472,1,0,0,0,472,473,6,16,0,0,473,45,1,0,0,0,474,475,7,19,0,0,475,476,7,
-	10,0,0,476,477,7,3,0,0,477,478,7,6,0,0,478,479,7,3,0,0,479,480,1,0,0,0,
-	480,481,6,17,0,0,481,47,1,0,0,0,482,484,8,20,0,0,483,482,1,0,0,0,484,485,
-	1,0,0,0,485,483,1,0,0,0,485,486,1,0,0,0,486,487,1,0,0,0,487,488,6,18,0,
-	0,488,49,1,0,0,0,489,490,5,47,0,0,490,491,5,47,0,0,491,495,1,0,0,0,492,
-	494,8,21,0,0,493,492,1,0,0,0,494,497,1,0,0,0,495,493,1,0,0,0,495,496,1,
-	0,0,0,496,499,1,0,0,0,497,495,1,0,0,0,498,500,5,13,0,0,499,498,1,0,0,0,
-	499,500,1,0,0,0,500,502,1,0,0,0,501,503,5,10,0,0,502,501,1,0,0,0,502,503,
-	1,0,0,0,503,504,1,0,0,0,504,505,6,19,9,0,505,51,1,0,0,0,506,507,5,47,0,
-	0,507,508,5,42,0,0,508,513,1,0,0,0,509,512,3,52,20,0,510,512,9,0,0,0,511,
-	509,1,0,0,0,511,510,1,0,0,0,512,515,1,0,0,0,513,514,1,0,0,0,513,511,1,0,
-	0,0,514,516,1,0,0,0,515,513,1,0,0,0,516,517,5,42,0,0,517,518,5,47,0,0,518,
-	519,1,0,0,0,519,520,6,20,9,0,520,53,1,0,0,0,521,523,7,22,0,0,522,521,1,
-	0,0,0,523,524,1,0,0,0,524,522,1,0,0,0,524,525,1,0,0,0,525,526,1,0,0,0,526,
-	527,6,21,9,0,527,55,1,0,0,0,528,529,3,164,76,0,529,530,1,0,0,0,530,531,
-	6,22,10,0,531,532,6,22,11,0,532,57,1,0,0,0,533,534,3,66,27,0,534,535,1,
-	0,0,0,535,536,6,23,12,0,536,537,6,23,13,0,537,59,1,0,0,0,538,539,3,54,21,
-	0,539,540,1,0,0,0,540,541,6,24,9,0,541,61,1,0,0,0,542,543,3,50,19,0,543,
-	544,1,0,0,0,544,545,6,25,9,0,545,63,1,0,0,0,546,547,3,52,20,0,547,548,1,
-	0,0,0,548,549,6,26,9,0,549,65,1,0,0,0,550,551,5,124,0,0,551,552,1,0,0,0,
-	552,553,6,27,13,0,553,67,1,0,0,0,554,555,7,23,0,0,555,69,1,0,0,0,556,557,
-	7,24,0,0,557,71,1,0,0,0,558,559,5,92,0,0,559,560,7,25,0,0,560,73,1,0,0,
-	0,561,562,8,26,0,0,562,75,1,0,0,0,563,565,7,3,0,0,564,566,7,27,0,0,565,
-	564,1,0,0,0,565,566,1,0,0,0,566,568,1,0,0,0,567,569,3,68,28,0,568,567,1,
-	0,0,0,569,570,1,0,0,0,570,568,1,0,0,0,570,571,1,0,0,0,571,77,1,0,0,0,572,
-	573,5,64,0,0,573,79,1,0,0,0,574,575,5,96,0,0,575,81,1,0,0,0,576,580,8,28,
-	0,0,577,578,5,96,0,0,578,580,5,96,0,0,579,576,1,0,0,0,579,577,1,0,0,0,580,
-	83,1,0,0,0,581,582,5,95,0,0,582,85,1,0,0,0,583,587,3,70,29,0,584,587,3,
-	68,28,0,585,587,3,84,36,0,586,583,1,0,0,0,586,584,1,0,0,0,586,585,1,0,0,
-	0,587,87,1,0,0,0,588,593,5,34,0,0,589,592,3,72,30,0,590,592,3,74,31,0,591,
-	589,1,0,0,0,591,590,1,0,0,0,592,595,1,0,0,0,593,591,1,0,0,0,593,594,1,0,
-	0,0,594,596,1,0,0,0,595,593,1,0,0,0,596,618,5,34,0,0,597,598,5,34,0,0,598,
-	599,5,34,0,0,599,600,5,34,0,0,600,604,1,0,0,0,601,603,8,21,0,0,602,601,
-	1,0,0,0,603,606,1,0,0,0,604,605,1,0,0,0,604,602,1,0,0,0,605,607,1,0,0,0,
-	606,604,1,0,0,0,607,608,5,34,0,0,608,609,5,34,0,0,609,610,5,34,0,0,610,
-	612,1,0,0,0,611,613,5,34,0,0,612,611,1,0,0,0,612,613,1,0,0,0,613,615,1,
-	0,0,0,614,616,5,34,0,0,615,614,1,0,0,0,615,616,1,0,0,0,616,618,1,0,0,0,
-	617,588,1,0,0,0,617,597,1,0,0,0,618,89,1,0,0,0,619,621,3,68,28,0,620,619,
-	1,0,0,0,621,622,1,0,0,0,622,620,1,0,0,0,622,623,1,0,0,0,623,91,1,0,0,0,
-	624,626,3,68,28,0,625,624,1,0,0,0,626,627,1,0,0,0,627,625,1,0,0,0,627,628,
-	1,0,0,0,628,629,1,0,0,0,629,633,3,108,48,0,630,632,3,68,28,0,631,630,1,
-	0,0,0,632,635,1,0,0,0,633,631,1,0,0,0,633,634,1,0,0,0,634,667,1,0,0,0,635,
-	633,1,0,0,0,636,638,3,108,48,0,637,639,3,68,28,0,638,637,1,0,0,0,639,640,
-	1,0,0,0,640,638,1,0,0,0,640,641,1,0,0,0,641,667,1,0,0,0,642,644,3,68,28,
-	0,643,642,1,0,0,0,644,645,1,0,0,0,645,643,1,0,0,0,645,646,1,0,0,0,646,654,
-	1,0,0,0,647,651,3,108,48,0,648,650,3,68,28,0,649,648,1,0,0,0,650,653,1,
-	0,0,0,651,649,1,0,0,0,651,652,1,0,0,0,652,655,1,0,0,0,653,651,1,0,0,0,654,
-	647,1,0,0,0,654,655,1,0,0,0,655,656,1,0,0,0,656,657,3,76,32,0,657,667,1,
-	0,0,0,658,660,3,108,48,0,659,661,3,68,28,0,660,659,1,0,0,0,661,662,1,0,
-	0,0,662,660,1,0,0,0,662,663,1,0,0,0,663,664,1,0,0,0,664,665,3,76,32,0,665,
-	667,1,0,0,0,666,625,1,0,0,0,666,636,1,0,0,0,666,643,1,0,0,0,666,658,1,0,
-	0,0,667,93,1,0,0,0,668,669,7,29,0,0,669,670,7,30,0,0,670,95,1,0,0,0,671,
-	672,7,12,0,0,672,673,7,9,0,0,673,674,7,0,0,0,674,97,1,0,0,0,675,676,7,12,
-	0,0,676,677,7,2,0,0,677,678,7,4,0,0,678,99,1,0,0,0,679,680,5,61,0,0,680,
-	101,1,0,0,0,681,682,5,58,0,0,682,683,5,58,0,0,683,103,1,0,0,0,684,685,5,
-	44,0,0,685,105,1,0,0,0,686,687,7,0,0,0,687,688,7,3,0,0,688,689,7,2,0,0,
-	689,690,7,4,0,0,690,107,1,0,0,0,691,692,5,46,0,0,692,109,1,0,0,0,693,694,
-	7,15,0,0,694,695,7,12,0,0,695,696,7,13,0,0,696,697,7,2,0,0,697,698,7,3,
-	0,0,698,111,1,0,0,0,699,700,7,15,0,0,700,701,7,1,0,0,701,702,7,6,0,0,702,
-	703,7,2,0,0,703,704,7,5,0,0,704,113,1,0,0,0,705,706,7,13,0,0,706,707,7,
-	12,0,0,707,708,7,2,0,0,708,709,7,5,0,0,709,115,1,0,0,0,710,711,5,40,0,0,
-	711,117,1,0,0,0,712,713,7,1,0,0,713,714,7,9,0,0,714,119,1,0,0,0,715,716,
-	7,1,0,0,716,717,7,2,0,0,717,121,1,0,0,0,718,719,7,13,0,0,719,720,7,1,0,
-	0,720,721,7,18,0,0,721,722,7,3,0,0,722,123,1,0,0,0,723,724,7,9,0,0,724,
-	725,7,7,0,0,725,726,7,5,0,0,726,125,1,0,0,0,727,728,7,9,0,0,728,729,7,31,
-	0,0,729,730,7,13,0,0,730,731,7,13,0,0,731,127,1,0,0,0,732,733,7,9,0,0,733,
-	734,7,31,0,0,734,735,7,13,0,0,735,736,7,13,0,0,736,737,7,2,0,0,737,129,
-	1,0,0,0,738,739,7,7,0,0,739,740,7,6,0,0,740,131,1,0,0,0,741,742,5,63,0,
-	0,742,133,1,0,0,0,743,744,7,6,0,0,744,745,7,13,0,0,745,746,7,1,0,0,746,
-	747,7,18,0,0,747,748,7,3,0,0,748,135,1,0,0,0,749,750,5,41,0,0,750,137,1,
-	0,0,0,751,752,7,5,0,0,752,753,7,6,0,0,753,754,7,31,0,0,754,755,7,3,0,0,
-	755,139,1,0,0,0,756,757,5,61,0,0,757,758,5,61,0,0,758,141,1,0,0,0,759,760,
-	5,61,0,0,760,761,5,126,0,0,761,143,1,0,0,0,762,763,5,33,0,0,763,764,5,61,
-	0,0,764,145,1,0,0,0,765,766,5,60,0,0,766,147,1,0,0,0,767,768,5,60,0,0,768,
-	769,5,61,0,0,769,149,1,0,0,0,770,771,5,62,0,0,771,151,1,0,0,0,772,773,5,
-	62,0,0,773,774,5,61,0,0,774,153,1,0,0,0,775,776,5,43,0,0,776,155,1,0,0,
-	0,777,778,5,45,0,0,778,157,1,0,0,0,779,780,5,42,0,0,780,159,1,0,0,0,781,
-	782,5,47,0,0,782,161,1,0,0,0,783,784,5,37,0,0,784,163,1,0,0,0,785,786,5,
-	91,0,0,786,787,1,0,0,0,787,788,6,76,0,0,788,789,6,76,0,0,789,165,1,0,0,
-	0,790,791,5,93,0,0,791,792,1,0,0,0,792,793,6,77,13,0,793,794,6,77,13,0,
-	794,167,1,0,0,0,795,799,3,70,29,0,796,798,3,86,37,0,797,796,1,0,0,0,798,
-	801,1,0,0,0,799,797,1,0,0,0,799,800,1,0,0,0,800,812,1,0,0,0,801,799,1,0,
-	0,0,802,805,3,84,36,0,803,805,3,78,33,0,804,802,1,0,0,0,804,803,1,0,0,0,
-	805,807,1,0,0,0,806,808,3,86,37,0,807,806,1,0,0,0,808,809,1,0,0,0,809,807,
-	1,0,0,0,809,810,1,0,0,0,810,812,1,0,0,0,811,795,1,0,0,0,811,804,1,0,0,0,
-	812,169,1,0,0,0,813,815,3,80,34,0,814,816,3,82,35,0,815,814,1,0,0,0,816,
-	817,1,0,0,0,817,815,1,0,0,0,817,818,1,0,0,0,818,819,1,0,0,0,819,820,3,80,
-	34,0,820,171,1,0,0,0,821,822,3,170,79,0,822,173,1,0,0,0,823,824,3,50,19,
-	0,824,825,1,0,0,0,825,826,6,81,9,0,826,175,1,0,0,0,827,828,3,52,20,0,828,
-	829,1,0,0,0,829,830,6,82,9,0,830,177,1,0,0,0,831,832,3,54,21,0,832,833,
-	1,0,0,0,833,834,6,83,9,0,834,179,1,0,0,0,835,836,3,66,27,0,836,837,1,0,
-	0,0,837,838,6,84,12,0,838,839,6,84,13,0,839,181,1,0,0,0,840,841,3,164,76,
-	0,841,842,1,0,0,0,842,843,6,85,10,0,843,183,1,0,0,0,844,845,3,166,77,0,
-	845,846,1,0,0,0,846,847,6,86,14,0,847,185,1,0,0,0,848,849,3,104,46,0,849,
-	850,1,0,0,0,850,851,6,87,15,0,851,187,1,0,0,0,852,853,3,100,44,0,853,854,
-	1,0,0,0,854,855,6,88,16,0,855,189,1,0,0,0,856,857,3,88,38,0,857,858,1,0,
-	0,0,858,859,6,89,17,0,859,191,1,0,0,0,860,861,7,7,0,0,861,862,7,8,0,0,862,
-	863,7,5,0,0,863,864,7,1,0,0,864,865,7,7,0,0,865,866,7,9,0,0,866,867,7,2,
-	0,0,867,193,1,0,0,0,868,869,7,16,0,0,869,870,7,3,0,0,870,871,7,5,0,0,871,
-	872,7,12,0,0,872,873,7,0,0,0,873,874,7,12,0,0,874,875,7,5,0,0,875,876,7,
-	12,0,0,876,195,1,0,0,0,877,881,8,32,0,0,878,879,5,47,0,0,879,881,8,33,0,
-	0,880,877,1,0,0,0,880,878,1,0,0,0,881,197,1,0,0,0,882,884,3,196,92,0,883,
-	882,1,0,0,0,884,885,1,0,0,0,885,883,1,0,0,0,885,886,1,0,0,0,886,199,1,0,
-	0,0,887,888,3,172,80,0,888,889,1,0,0,0,889,890,6,94,18,0,890,201,1,0,0,
-	0,891,892,3,50,19,0,892,893,1,0,0,0,893,894,6,95,9,0,894,203,1,0,0,0,895,
-	896,3,52,20,0,896,897,1,0,0,0,897,898,6,96,9,0,898,205,1,0,0,0,899,900,
-	3,54,21,0,900,901,1,0,0,0,901,902,6,97,9,0,902,207,1,0,0,0,903,904,3,66,
-	27,0,904,905,1,0,0,0,905,906,6,98,12,0,906,907,6,98,13,0,907,209,1,0,0,
-	0,908,909,3,108,48,0,909,910,1,0,0,0,910,911,6,99,19,0,911,211,1,0,0,0,
-	912,913,3,104,46,0,913,914,1,0,0,0,914,915,6,100,15,0,915,213,1,0,0,0,916,
-	921,3,70,29,0,917,921,3,68,28,0,918,921,3,84,36,0,919,921,3,158,73,0,920,
-	916,1,0,0,0,920,917,1,0,0,0,920,918,1,0,0,0,920,919,1,0,0,0,921,215,1,0,
-	0,0,922,925,3,70,29,0,923,925,3,158,73,0,924,922,1,0,0,0,924,923,1,0,0,
-	0,925,929,1,0,0,0,926,928,3,214,101,0,927,926,1,0,0,0,928,931,1,0,0,0,929,
-	927,1,0,0,0,929,930,1,0,0,0,930,942,1,0,0,0,931,929,1,0,0,0,932,935,3,84,
-	36,0,933,935,3,78,33,0,934,932,1,0,0,0,934,933,1,0,0,0,935,937,1,0,0,0,
-	936,938,3,214,101,0,937,936,1,0,0,0,938,939,1,0,0,0,939,937,1,0,0,0,939,
-	940,1,0,0,0,940,942,1,0,0,0,941,924,1,0,0,0,941,934,1,0,0,0,942,217,1,0,
-	0,0,943,946,3,216,102,0,944,946,3,170,79,0,945,943,1,0,0,0,945,944,1,0,
-	0,0,946,947,1,0,0,0,947,945,1,0,0,0,947,948,1,0,0,0,948,219,1,0,0,0,949,
-	950,3,50,19,0,950,951,1,0,0,0,951,952,6,104,9,0,952,221,1,0,0,0,953,954,
-	3,52,20,0,954,955,1,0,0,0,955,956,6,105,9,0,956,223,1,0,0,0,957,958,3,54,
-	21,0,958,959,1,0,0,0,959,960,6,106,9,0,960,225,1,0,0,0,961,962,3,66,27,
-	0,962,963,1,0,0,0,963,964,6,107,12,0,964,965,6,107,13,0,965,227,1,0,0,0,
-	966,967,3,100,44,0,967,968,1,0,0,0,968,969,6,108,16,0,969,229,1,0,0,0,970,
-	971,3,104,46,0,971,972,1,0,0,0,972,973,6,109,15,0,973,231,1,0,0,0,974,975,
-	3,108,48,0,975,976,1,0,0,0,976,977,6,110,19,0,977,233,1,0,0,0,978,979,7,
-	12,0,0,979,980,7,2,0,0,980,235,1,0,0,0,981,982,3,218,103,0,982,983,1,0,
-	0,0,983,984,6,112,20,0,984,237,1,0,0,0,985,986,3,50,19,0,986,987,1,0,0,
-	0,987,988,6,113,9,0,988,239,1,0,0,0,989,990,3,52,20,0,990,991,1,0,0,0,991,
-	992,6,114,9,0,992,241,1,0,0,0,993,994,3,54,21,0,994,995,1,0,0,0,995,996,
-	6,115,9,0,996,243,1,0,0,0,997,998,3,66,27,0,998,999,1,0,0,0,999,1000,6,
-	116,12,0,1000,1001,6,116,13,0,1001,245,1,0,0,0,1002,1003,3,164,76,0,1003,
-	1004,1,0,0,0,1004,1005,6,117,10,0,1005,1006,6,117,21,0,1006,247,1,0,0,0,
-	1007,1008,7,7,0,0,1008,1009,7,9,0,0,1009,1010,1,0,0,0,1010,1011,6,118,22,
-	0,1011,249,1,0,0,0,1012,1013,7,19,0,0,1013,1014,7,1,0,0,1014,1015,7,5,0,
-	0,1015,1016,7,10,0,0,1016,1017,1,0,0,0,1017,1018,6,119,22,0,1018,251,1,
-	0,0,0,1019,1020,8,34,0,0,1020,253,1,0,0,0,1021,1023,3,252,120,0,1022,1021,
-	1,0,0,0,1023,1024,1,0,0,0,1024,1022,1,0,0,0,1024,1025,1,0,0,0,1025,1026,
-	1,0,0,0,1026,1027,3,322,155,0,1027,1029,1,0,0,0,1028,1022,1,0,0,0,1028,
-	1029,1,0,0,0,1029,1031,1,0,0,0,1030,1032,3,252,120,0,1031,1030,1,0,0,0,
-	1032,1033,1,0,0,0,1033,1031,1,0,0,0,1033,1034,1,0,0,0,1034,255,1,0,0,0,
-	1035,1036,3,172,80,0,1036,1037,1,0,0,0,1037,1038,6,122,18,0,1038,257,1,
-	0,0,0,1039,1040,3,254,121,0,1040,1041,1,0,0,0,1041,1042,6,123,23,0,1042,
-	259,1,0,0,0,1043,1044,3,50,19,0,1044,1045,1,0,0,0,1045,1046,6,124,9,0,1046,
-	261,1,0,0,0,1047,1048,3,52,20,0,1048,1049,1,0,0,0,1049,1050,6,125,9,0,1050,
-	263,1,0,0,0,1051,1052,3,54,21,0,1052,1053,1,0,0,0,1053,1054,6,126,9,0,1054,
-	265,1,0,0,0,1055,1056,3,66,27,0,1056,1057,1,0,0,0,1057,1058,6,127,12,0,
-	1058,1059,6,127,13,0,1059,1060,6,127,13,0,1060,267,1,0,0,0,1061,1062,3,
-	100,44,0,1062,1063,1,0,0,0,1063,1064,6,128,16,0,1064,269,1,0,0,0,1065,1066,
-	3,104,46,0,1066,1067,1,0,0,0,1067,1068,6,129,15,0,1068,271,1,0,0,0,1069,
-	1070,3,108,48,0,1070,1071,1,0,0,0,1071,1072,6,130,19,0,1072,273,1,0,0,0,
-	1073,1074,3,250,119,0,1074,1075,1,0,0,0,1075,1076,6,131,24,0,1076,275,1,
-	0,0,0,1077,1078,3,218,103,0,1078,1079,1,0,0,0,1079,1080,6,132,20,0,1080,
-	277,1,0,0,0,1081,1082,3,172,80,0,1082,1083,1,0,0,0,1083,1084,6,133,18,0,
-	1084,279,1,0,0,0,1085,1086,3,50,19,0,1086,1087,1,0,0,0,1087,1088,6,134,
-	9,0,1088,281,1,0,0,0,1089,1090,3,52,20,0,1090,1091,1,0,0,0,1091,1092,6,
-	135,9,0,1092,283,1,0,0,0,1093,1094,3,54,21,0,1094,1095,1,0,0,0,1095,1096,
-	6,136,9,0,1096,285,1,0,0,0,1097,1098,3,66,27,0,1098,1099,1,0,0,0,1099,1100,
-	6,137,12,0,1100,1101,6,137,13,0,1101,287,1,0,0,0,1102,1103,3,108,48,0,1103,
-	1104,1,0,0,0,1104,1105,6,138,19,0,1105,289,1,0,0,0,1106,1107,3,172,80,0,
-	1107,1108,1,0,0,0,1108,1109,6,139,18,0,1109,291,1,0,0,0,1110,1111,3,168,
-	78,0,1111,1112,1,0,0,0,1112,1113,6,140,25,0,1113,293,1,0,0,0,1114,1115,
-	3,50,19,0,1115,1116,1,0,0,0,1116,1117,6,141,9,0,1117,295,1,0,0,0,1118,1119,
-	3,52,20,0,1119,1120,1,0,0,0,1120,1121,6,142,9,0,1121,297,1,0,0,0,1122,1123,
-	3,54,21,0,1123,1124,1,0,0,0,1124,1125,6,143,9,0,1125,299,1,0,0,0,1126,1127,
-	3,66,27,0,1127,1128,1,0,0,0,1128,1129,6,144,12,0,1129,1130,6,144,13,0,1130,
-	301,1,0,0,0,1131,1132,7,1,0,0,1132,1133,7,9,0,0,1133,1134,7,15,0,0,1134,
-	1135,7,7,0,0,1135,303,1,0,0,0,1136,1137,3,50,19,0,1137,1138,1,0,0,0,1138,
-	1139,6,146,9,0,1139,305,1,0,0,0,1140,1141,3,52,20,0,1141,1142,1,0,0,0,1142,
-	1143,6,147,9,0,1143,307,1,0,0,0,1144,1145,3,54,21,0,1145,1146,1,0,0,0,1146,
-	1147,6,148,9,0,1147,309,1,0,0,0,1148,1149,3,66,27,0,1149,1150,1,0,0,0,1150,
-	1151,6,149,12,0,1151,1152,6,149,13,0,1152,311,1,0,0,0,1153,1154,7,15,0,
-	0,1154,1155,7,31,0,0,1155,1156,7,9,0,0,1156,1157,7,4,0,0,1157,1158,7,5,
-	0,0,1158,1159,7,1,0,0,1159,1160,7,7,0,0,1160,1161,7,9,0,0,1161,1162,7,2,
-	0,0,1162,313,1,0,0,0,1163,1164,3,50,19,0,1164,1165,1,0,0,0,1165,1166,6,
-	151,9,0,1166,315,1,0,0,0,1167,1168,3,52,20,0,1168,1169,1,0,0,0,1169,1170,
-	6,152,9,0,1170,317,1,0,0,0,1171,1172,3,54,21,0,1172,1173,1,0,0,0,1173,1174,
-	6,153,9,0,1174,319,1,0,0,0,1175,1176,3,166,77,0,1176,1177,1,0,0,0,1177,
-	1178,6,154,14,0,1178,1179,6,154,13,0,1179,321,1,0,0,0,1180,1181,5,58,0,
-	0,1181,323,1,0,0,0,1182,1188,3,78,33,0,1183,1188,3,68,28,0,1184,1188,3,
-	108,48,0,1185,1188,3,70,29,0,1186,1188,3,84,36,0,1187,1182,1,0,0,0,1187,
-	1183,1,0,0,0,1187,1184,1,0,0,0,1187,1185,1,0,0,0,1187,1186,1,0,0,0,1188,
-	1189,1,0,0,0,1189,1187,1,0,0,0,1189,1190,1,0,0,0,1190,325,1,0,0,0,1191,
-	1192,3,50,19,0,1192,1193,1,0,0,0,1193,1194,6,157,9,0,1194,327,1,0,0,0,1195,
-	1196,3,52,20,0,1196,1197,1,0,0,0,1197,1198,6,158,9,0,1198,329,1,0,0,0,1199,
-	1200,3,54,21,0,1200,1201,1,0,0,0,1201,1202,6,159,9,0,1202,331,1,0,0,0,58,
-	0,1,2,3,4,5,6,7,8,9,10,11,485,495,499,502,511,513,524,565,570,579,586,591,
-	593,604,612,615,617,622,627,633,640,645,651,654,662,666,799,804,809,811,
-	817,880,885,920,924,929,934,939,941,945,947,1024,1028,1033,1187,1189,26,
+	7,158,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,1,1,1,1,1,1,1,1,1,1,1,1,
+	1,1,2,1,2,1,2,1,2,1,2,1,2,1,2,1,2,1,2,1,3,1,3,1,3,1,3,1,3,1,3,1,3,1,4,1,
+	4,1,4,1,4,1,4,1,4,1,4,1,4,1,4,1,4,1,5,1,5,1,5,1,5,1,5,1,5,1,5,1,6,1,6,1,
+	6,1,6,1,6,1,6,1,6,1,7,1,7,1,7,1,7,1,7,1,7,1,7,1,7,1,7,1,7,1,7,1,7,1,7,1,
+	7,1,8,1,8,1,8,1,8,1,8,1,8,1,8,1,9,1,9,1,9,1,9,1,9,1,9,1,9,1,9,1,10,1,10,
+	1,10,1,10,1,10,1,10,1,10,1,11,1,11,1,11,1,11,1,11,1,11,1,11,1,11,1,11,1,
+	11,1,11,1,11,1,12,1,12,1,12,1,12,1,12,1,12,1,12,1,12,1,12,1,13,1,13,1,13,
+	1,13,1,13,1,13,1,14,1,14,1,14,1,14,1,14,1,14,1,14,1,15,1,15,1,15,1,15,1,
+	15,1,15,1,15,1,16,1,16,1,16,1,16,1,16,1,16,1,16,1,16,1,17,1,17,1,17,1,17,
+	1,17,1,17,1,17,1,17,1,18,4,18,482,8,18,11,18,12,18,483,1,18,1,18,1,19,1,
+	19,1,19,1,19,5,19,492,8,19,10,19,12,19,495,9,19,1,19,3,19,498,8,19,1,19,
+	3,19,501,8,19,1,19,1,19,1,20,1,20,1,20,1,20,1,20,5,20,510,8,20,10,20,12,
+	20,513,9,20,1,20,1,20,1,20,1,20,1,20,1,21,4,21,521,8,21,11,21,12,21,522,
+	1,21,1,21,1,22,1,22,1,22,1,22,1,22,1,23,1,23,1,23,1,23,1,23,1,24,1,24,1,
+	24,1,24,1,25,1,25,1,25,1,25,1,26,1,26,1,26,1,26,1,27,1,27,1,27,1,27,1,28,
+	1,28,1,29,1,29,1,30,1,30,1,30,1,31,1,31,1,32,1,32,3,32,564,8,32,1,32,4,
+	32,567,8,32,11,32,12,32,568,1,33,1,33,1,34,1,34,1,35,1,35,1,35,3,35,578,
+	8,35,1,36,1,36,1,37,1,37,1,37,3,37,585,8,37,1,38,1,38,1,38,5,38,590,8,38,
+	10,38,12,38,593,9,38,1,38,1,38,1,38,1,38,1,38,1,38,5,38,601,8,38,10,38,
+	12,38,604,9,38,1,38,1,38,1,38,1,38,1,38,3,38,611,8,38,1,38,3,38,614,8,38,
+	3,38,616,8,38,1,39,4,39,619,8,39,11,39,12,39,620,1,40,4,40,624,8,40,11,
+	40,12,40,625,1,40,1,40,5,40,630,8,40,10,40,12,40,633,9,40,1,40,1,40,4,40,
+	637,8,40,11,40,12,40,638,1,40,4,40,642,8,40,11,40,12,40,643,1,40,1,40,5,
+	40,648,8,40,10,40,12,40,651,9,40,3,40,653,8,40,1,40,1,40,1,40,1,40,4,40,
+	659,8,40,11,40,12,40,660,1,40,1,40,3,40,665,8,40,1,41,1,41,1,41,1,42,1,
+	42,1,42,1,42,1,43,1,43,1,43,1,43,1,44,1,44,1,45,1,45,1,45,1,46,1,46,1,47,
+	1,47,1,47,1,47,1,47,1,48,1,48,1,49,1,49,1,49,1,49,1,49,1,49,1,50,1,50,1,
+	50,1,50,1,50,1,50,1,51,1,51,1,51,1,51,1,51,1,52,1,52,1,53,1,53,1,53,1,54,
+	1,54,1,54,1,55,1,55,1,55,1,55,1,55,1,56,1,56,1,56,1,56,1,57,1,57,1,57,1,
+	57,1,57,1,58,1,58,1,58,1,58,1,58,1,58,1,59,1,59,1,59,1,60,1,60,1,61,1,61,
+	1,61,1,61,1,61,1,61,1,62,1,62,1,63,1,63,1,63,1,63,1,63,1,64,1,64,1,64,1,
+	65,1,65,1,65,1,66,1,66,1,66,1,67,1,67,1,68,1,68,1,68,1,69,1,69,1,70,1,70,
+	1,70,1,71,1,71,1,72,1,72,1,73,1,73,1,74,1,74,1,75,1,75,1,76,1,76,1,76,1,
+	76,1,76,1,77,1,77,1,77,1,77,1,77,1,78,1,78,5,78,796,8,78,10,78,12,78,799,
+	9,78,1,78,1,78,3,78,803,8,78,1,78,4,78,806,8,78,11,78,12,78,807,3,78,810,
+	8,78,1,79,1,79,4,79,814,8,79,11,79,12,79,815,1,79,1,79,1,80,1,80,1,81,1,
+	81,1,81,1,81,1,82,1,82,1,82,1,82,1,83,1,83,1,83,1,83,1,84,1,84,1,84,1,84,
+	1,84,1,85,1,85,1,85,1,85,1,86,1,86,1,86,1,86,1,87,1,87,1,87,1,87,1,88,1,
+	88,1,88,1,88,1,89,1,89,1,89,1,89,1,90,1,90,1,90,1,90,1,90,1,90,1,90,1,90,
+	1,91,1,91,1,91,1,91,1,91,1,91,1,91,1,91,1,91,1,92,1,92,1,92,3,92,879,8,
+	92,1,93,4,93,882,8,93,11,93,12,93,883,1,94,1,94,1,94,1,94,1,95,1,95,1,95,
+	1,95,1,96,1,96,1,96,1,96,1,97,1,97,1,97,1,97,1,97,1,98,1,98,1,98,1,98,1,
+	99,1,99,1,99,1,99,1,100,1,100,1,100,1,100,3,100,915,8,100,1,101,1,101,3,
+	101,919,8,101,1,101,5,101,922,8,101,10,101,12,101,925,9,101,1,101,1,101,
+	3,101,929,8,101,1,101,4,101,932,8,101,11,101,12,101,933,3,101,936,8,101,
+	1,102,1,102,4,102,940,8,102,11,102,12,102,941,1,103,1,103,1,103,1,103,1,
+	104,1,104,1,104,1,104,1,105,1,105,1,105,1,105,1,106,1,106,1,106,1,106,1,
+	106,1,107,1,107,1,107,1,107,1,108,1,108,1,108,1,108,1,109,1,109,1,109,1,
+	109,1,110,1,110,1,110,1,111,1,111,1,111,1,111,1,112,1,112,1,112,1,112,1,
+	113,1,113,1,113,1,113,1,114,1,114,1,114,1,114,1,115,1,115,1,115,1,115,1,
+	115,1,116,1,116,1,116,1,116,1,116,1,117,1,117,1,117,1,117,1,117,1,118,1,
+	118,1,118,1,118,1,118,1,118,1,118,1,119,1,119,1,120,4,120,1017,8,120,11,
+	120,12,120,1018,1,120,1,120,3,120,1023,8,120,1,120,4,120,1026,8,120,11,
+	120,12,120,1027,1,121,1,121,1,121,1,121,1,122,1,122,1,122,1,122,1,123,1,
+	123,1,123,1,123,1,124,1,124,1,124,1,124,1,125,1,125,1,125,1,125,1,126,1,
+	126,1,126,1,126,1,126,1,126,1,127,1,127,1,127,1,127,1,128,1,128,1,128,1,
+	128,1,129,1,129,1,129,1,129,1,130,1,130,1,130,1,130,1,131,1,131,1,131,1,
+	131,1,132,1,132,1,132,1,132,1,133,1,133,1,133,1,133,1,134,1,134,1,134,1,
+	134,1,135,1,135,1,135,1,135,1,136,1,136,1,136,1,136,1,136,1,137,1,137,1,
+	137,1,137,1,138,1,138,1,138,1,138,1,139,1,139,1,139,1,139,1,140,1,140,1,
+	140,1,140,1,141,1,141,1,141,1,141,1,142,1,142,1,142,1,142,1,143,1,143,1,
+	143,1,143,1,143,1,144,1,144,1,144,1,144,1,144,1,145,1,145,1,145,1,145,1,
+	146,1,146,1,146,1,146,1,147,1,147,1,147,1,147,1,148,1,148,1,148,1,148,1,
+	148,1,149,1,149,1,149,1,149,1,149,1,149,1,149,1,149,1,149,1,149,1,150,1,
+	150,1,150,1,150,1,151,1,151,1,151,1,151,1,152,1,152,1,152,1,152,1,153,1,
+	153,1,153,1,153,1,153,1,154,1,154,1,155,1,155,1,155,1,155,1,155,4,155,1182,
+	8,155,11,155,12,155,1183,1,156,1,156,1,156,1,156,1,157,1,157,1,157,1,157,
+	1,158,1,158,1,158,1,158,2,511,602,0,159,12,1,14,2,16,3,18,4,20,5,22,6,24,
+	7,26,8,28,9,30,10,32,11,34,12,36,13,38,14,40,15,42,16,44,17,46,18,48,19,
+	50,20,52,21,54,22,56,0,58,0,60,23,62,24,64,25,66,26,68,0,70,0,72,0,74,0,
+	76,0,78,0,80,0,82,0,84,0,86,0,88,27,90,28,92,29,94,30,96,31,98,32,100,33,
+	102,34,104,35,106,36,108,37,110,38,112,39,114,40,116,41,118,42,120,43,122,
+	44,124,45,126,46,128,47,130,48,132,49,134,50,136,51,138,52,140,53,142,54,
+	144,55,146,56,148,57,150,58,152,59,154,60,156,61,158,62,160,63,162,64,164,
+	65,166,66,168,67,170,0,172,68,174,69,176,70,178,71,180,0,182,0,184,0,186,
+	0,188,0,190,0,192,72,194,73,196,0,198,74,200,75,202,76,204,77,206,0,208,
+	0,210,0,212,0,214,0,216,78,218,79,220,80,222,81,224,0,226,0,228,0,230,0,
+	232,82,234,0,236,83,238,84,240,85,242,0,244,0,246,86,248,87,250,0,252,88,
+	254,0,256,0,258,89,260,90,262,91,264,0,266,0,268,0,270,0,272,0,274,0,276,
+	0,278,92,280,93,282,94,284,0,286,0,288,0,290,0,292,95,294,96,296,97,298,
+	0,300,98,302,99,304,100,306,101,308,0,310,102,312,103,314,104,316,105,318,
+	0,320,106,322,107,324,108,326,109,328,110,12,0,1,2,3,4,5,6,7,8,9,10,11,
+	35,2,0,68,68,100,100,2,0,73,73,105,105,2,0,83,83,115,115,2,0,69,69,101,
+	101,2,0,67,67,99,99,2,0,84,84,116,116,2,0,82,82,114,114,2,0,79,79,111,111,
+	2,0,80,80,112,112,2,0,78,78,110,110,2,0,72,72,104,104,2,0,86,86,118,118,
+	2,0,65,65,97,97,2,0,76,76,108,108,2,0,88,88,120,120,2,0,70,70,102,102,2,
+	0,77,77,109,109,2,0,71,71,103,103,2,0,75,75,107,107,2,0,87,87,119,119,6,
+	0,9,10,13,13,32,32,47,47,91,91,93,93,2,0,10,10,13,13,3,0,9,10,13,13,32,
+	32,1,0,48,57,2,0,65,90,97,122,8,0,34,34,78,78,82,82,84,84,92,92,110,110,
+	114,114,116,116,4,0,10,10,13,13,34,34,92,92,2,0,43,43,45,45,1,0,96,96,2,
+	0,66,66,98,98,2,0,89,89,121,121,2,0,85,85,117,117,10,0,9,10,13,13,32,32,
+	44,44,47,47,61,61,91,91,93,93,96,96,124,124,2,0,42,42,47,47,11,0,9,10,13,
+	13,32,32,34,35,44,44,47,47,58,58,60,60,62,63,92,92,124,124,1224,0,12,1,
+	0,0,0,0,14,1,0,0,0,0,16,1,0,0,0,0,18,1,0,0,0,0,20,1,0,0,0,0,22,1,0,0,0,
+	0,24,1,0,0,0,0,26,1,0,0,0,0,28,1,0,0,0,0,30,1,0,0,0,0,32,1,0,0,0,0,34,1,
+	0,0,0,0,36,1,0,0,0,0,38,1,0,0,0,0,40,1,0,0,0,0,42,1,0,0,0,0,44,1,0,0,0,
+	0,46,1,0,0,0,0,48,1,0,0,0,0,50,1,0,0,0,0,52,1,0,0,0,0,54,1,0,0,0,1,56,1,
+	0,0,0,1,58,1,0,0,0,1,60,1,0,0,0,1,62,1,0,0,0,1,64,1,0,0,0,2,66,1,0,0,0,
+	2,88,1,0,0,0,2,90,1,0,0,0,2,92,1,0,0,0,2,94,1,0,0,0,2,96,1,0,0,0,2,98,1,
+	0,0,0,2,100,1,0,0,0,2,102,1,0,0,0,2,104,1,0,0,0,2,106,1,0,0,0,2,108,1,0,
+	0,0,2,110,1,0,0,0,2,112,1,0,0,0,2,114,1,0,0,0,2,116,1,0,0,0,2,118,1,0,0,
+	0,2,120,1,0,0,0,2,122,1,0,0,0,2,124,1,0,0,0,2,126,1,0,0,0,2,128,1,0,0,0,
+	2,130,1,0,0,0,2,132,1,0,0,0,2,134,1,0,0,0,2,136,1,0,0,0,2,138,1,0,0,0,2,
+	140,1,0,0,0,2,142,1,0,0,0,2,144,1,0,0,0,2,146,1,0,0,0,2,148,1,0,0,0,2,150,
+	1,0,0,0,2,152,1,0,0,0,2,154,1,0,0,0,2,156,1,0,0,0,2,158,1,0,0,0,2,160,1,
+	0,0,0,2,162,1,0,0,0,2,164,1,0,0,0,2,166,1,0,0,0,2,168,1,0,0,0,2,172,1,0,
+	0,0,2,174,1,0,0,0,2,176,1,0,0,0,2,178,1,0,0,0,3,180,1,0,0,0,3,182,1,0,0,
+	0,3,184,1,0,0,0,3,186,1,0,0,0,3,188,1,0,0,0,3,190,1,0,0,0,3,192,1,0,0,0,
+	3,194,1,0,0,0,3,198,1,0,0,0,3,200,1,0,0,0,3,202,1,0,0,0,3,204,1,0,0,0,4,
+	206,1,0,0,0,4,208,1,0,0,0,4,210,1,0,0,0,4,216,1,0,0,0,4,218,1,0,0,0,4,220,
+	1,0,0,0,4,222,1,0,0,0,5,224,1,0,0,0,5,226,1,0,0,0,5,228,1,0,0,0,5,230,1,
+	0,0,0,5,232,1,0,0,0,5,234,1,0,0,0,5,236,1,0,0,0,5,238,1,0,0,0,5,240,1,0,
+	0,0,6,242,1,0,0,0,6,244,1,0,0,0,6,246,1,0,0,0,6,248,1,0,0,0,6,252,1,0,0,
+	0,6,254,1,0,0,0,6,256,1,0,0,0,6,258,1,0,0,0,6,260,1,0,0,0,6,262,1,0,0,0,
+	7,264,1,0,0,0,7,266,1,0,0,0,7,268,1,0,0,0,7,270,1,0,0,0,7,272,1,0,0,0,7,
+	274,1,0,0,0,7,276,1,0,0,0,7,278,1,0,0,0,7,280,1,0,0,0,7,282,1,0,0,0,8,284,
+	1,0,0,0,8,286,1,0,0,0,8,288,1,0,0,0,8,290,1,0,0,0,8,292,1,0,0,0,8,294,1,
+	0,0,0,8,296,1,0,0,0,9,298,1,0,0,0,9,300,1,0,0,0,9,302,1,0,0,0,9,304,1,0,
+	0,0,9,306,1,0,0,0,10,308,1,0,0,0,10,310,1,0,0,0,10,312,1,0,0,0,10,314,1,
+	0,0,0,10,316,1,0,0,0,11,318,1,0,0,0,11,320,1,0,0,0,11,322,1,0,0,0,11,324,
+	1,0,0,0,11,326,1,0,0,0,11,328,1,0,0,0,12,330,1,0,0,0,14,340,1,0,0,0,16,
+	347,1,0,0,0,18,356,1,0,0,0,20,363,1,0,0,0,22,373,1,0,0,0,24,380,1,0,0,0,
+	26,387,1,0,0,0,28,401,1,0,0,0,30,408,1,0,0,0,32,416,1,0,0,0,34,423,1,0,
+	0,0,36,435,1,0,0,0,38,444,1,0,0,0,40,450,1,0,0,0,42,457,1,0,0,0,44,464,
+	1,0,0,0,46,472,1,0,0,0,48,481,1,0,0,0,50,487,1,0,0,0,52,504,1,0,0,0,54,
+	520,1,0,0,0,56,526,1,0,0,0,58,531,1,0,0,0,60,536,1,0,0,0,62,540,1,0,0,0,
+	64,544,1,0,0,0,66,548,1,0,0,0,68,552,1,0,0,0,70,554,1,0,0,0,72,556,1,0,
+	0,0,74,559,1,0,0,0,76,561,1,0,0,0,78,570,1,0,0,0,80,572,1,0,0,0,82,577,
+	1,0,0,0,84,579,1,0,0,0,86,584,1,0,0,0,88,615,1,0,0,0,90,618,1,0,0,0,92,
+	664,1,0,0,0,94,666,1,0,0,0,96,669,1,0,0,0,98,673,1,0,0,0,100,677,1,0,0,
+	0,102,679,1,0,0,0,104,682,1,0,0,0,106,684,1,0,0,0,108,689,1,0,0,0,110,691,
+	1,0,0,0,112,697,1,0,0,0,114,703,1,0,0,0,116,708,1,0,0,0,118,710,1,0,0,0,
+	120,713,1,0,0,0,122,716,1,0,0,0,124,721,1,0,0,0,126,725,1,0,0,0,128,730,
+	1,0,0,0,130,736,1,0,0,0,132,739,1,0,0,0,134,741,1,0,0,0,136,747,1,0,0,0,
+	138,749,1,0,0,0,140,754,1,0,0,0,142,757,1,0,0,0,144,760,1,0,0,0,146,763,
+	1,0,0,0,148,765,1,0,0,0,150,768,1,0,0,0,152,770,1,0,0,0,154,773,1,0,0,0,
+	156,775,1,0,0,0,158,777,1,0,0,0,160,779,1,0,0,0,162,781,1,0,0,0,164,783,
+	1,0,0,0,166,788,1,0,0,0,168,809,1,0,0,0,170,811,1,0,0,0,172,819,1,0,0,0,
+	174,821,1,0,0,0,176,825,1,0,0,0,178,829,1,0,0,0,180,833,1,0,0,0,182,838,
+	1,0,0,0,184,842,1,0,0,0,186,846,1,0,0,0,188,850,1,0,0,0,190,854,1,0,0,0,
+	192,858,1,0,0,0,194,866,1,0,0,0,196,878,1,0,0,0,198,881,1,0,0,0,200,885,
+	1,0,0,0,202,889,1,0,0,0,204,893,1,0,0,0,206,897,1,0,0,0,208,902,1,0,0,0,
+	210,906,1,0,0,0,212,914,1,0,0,0,214,935,1,0,0,0,216,939,1,0,0,0,218,943,
+	1,0,0,0,220,947,1,0,0,0,222,951,1,0,0,0,224,955,1,0,0,0,226,960,1,0,0,0,
+	228,964,1,0,0,0,230,968,1,0,0,0,232,972,1,0,0,0,234,975,1,0,0,0,236,979,
+	1,0,0,0,238,983,1,0,0,0,240,987,1,0,0,0,242,991,1,0,0,0,244,996,1,0,0,0,
+	246,1001,1,0,0,0,248,1006,1,0,0,0,250,1013,1,0,0,0,252,1022,1,0,0,0,254,
+	1029,1,0,0,0,256,1033,1,0,0,0,258,1037,1,0,0,0,260,1041,1,0,0,0,262,1045,
+	1,0,0,0,264,1049,1,0,0,0,266,1055,1,0,0,0,268,1059,1,0,0,0,270,1063,1,0,
+	0,0,272,1067,1,0,0,0,274,1071,1,0,0,0,276,1075,1,0,0,0,278,1079,1,0,0,0,
+	280,1083,1,0,0,0,282,1087,1,0,0,0,284,1091,1,0,0,0,286,1096,1,0,0,0,288,
+	1100,1,0,0,0,290,1104,1,0,0,0,292,1108,1,0,0,0,294,1112,1,0,0,0,296,1116,
+	1,0,0,0,298,1120,1,0,0,0,300,1125,1,0,0,0,302,1130,1,0,0,0,304,1134,1,0,
+	0,0,306,1138,1,0,0,0,308,1142,1,0,0,0,310,1147,1,0,0,0,312,1157,1,0,0,0,
+	314,1161,1,0,0,0,316,1165,1,0,0,0,318,1169,1,0,0,0,320,1174,1,0,0,0,322,
+	1181,1,0,0,0,324,1185,1,0,0,0,326,1189,1,0,0,0,328,1193,1,0,0,0,330,331,
+	7,0,0,0,331,332,7,1,0,0,332,333,7,2,0,0,333,334,7,2,0,0,334,335,7,3,0,0,
+	335,336,7,4,0,0,336,337,7,5,0,0,337,338,1,0,0,0,338,339,6,0,0,0,339,13,
+	1,0,0,0,340,341,7,0,0,0,341,342,7,6,0,0,342,343,7,7,0,0,343,344,7,8,0,0,
+	344,345,1,0,0,0,345,346,6,1,1,0,346,15,1,0,0,0,347,348,7,3,0,0,348,349,
+	7,9,0,0,349,350,7,6,0,0,350,351,7,1,0,0,351,352,7,4,0,0,352,353,7,10,0,
+	0,353,354,1,0,0,0,354,355,6,2,2,0,355,17,1,0,0,0,356,357,7,3,0,0,357,358,
+	7,11,0,0,358,359,7,12,0,0,359,360,7,13,0,0,360,361,1,0,0,0,361,362,6,3,
+	0,0,362,19,1,0,0,0,363,364,7,3,0,0,364,365,7,14,0,0,365,366,7,8,0,0,366,
+	367,7,13,0,0,367,368,7,12,0,0,368,369,7,1,0,0,369,370,7,9,0,0,370,371,1,
+	0,0,0,371,372,6,4,3,0,372,21,1,0,0,0,373,374,7,15,0,0,374,375,7,6,0,0,375,
+	376,7,7,0,0,376,377,7,16,0,0,377,378,1,0,0,0,378,379,6,5,4,0,379,23,1,0,
+	0,0,380,381,7,17,0,0,381,382,7,6,0,0,382,383,7,7,0,0,383,384,7,18,0,0,384,
+	385,1,0,0,0,385,386,6,6,0,0,386,25,1,0,0,0,387,388,7,1,0,0,388,389,7,9,
+	0,0,389,390,7,13,0,0,390,391,7,1,0,0,391,392,7,9,0,0,392,393,7,3,0,0,393,
+	394,7,2,0,0,394,395,7,5,0,0,395,396,7,12,0,0,396,397,7,5,0,0,397,398,7,
+	2,0,0,398,399,1,0,0,0,399,400,6,7,0,0,400,27,1,0,0,0,401,402,7,18,0,0,402,
+	403,7,3,0,0,403,404,7,3,0,0,404,405,7,8,0,0,405,406,1,0,0,0,406,407,6,8,
+	1,0,407,29,1,0,0,0,408,409,7,13,0,0,409,410,7,1,0,0,410,411,7,16,0,0,411,
+	412,7,1,0,0,412,413,7,5,0,0,413,414,1,0,0,0,414,415,6,9,0,0,415,31,1,0,
+	0,0,416,417,7,16,0,0,417,418,7,3,0,0,418,419,7,5,0,0,419,420,7,12,0,0,420,
+	421,1,0,0,0,421,422,6,10,5,0,422,33,1,0,0,0,423,424,7,16,0,0,424,425,7,
+	11,0,0,425,426,5,95,0,0,426,427,7,3,0,0,427,428,7,14,0,0,428,429,7,8,0,
+	0,429,430,7,12,0,0,430,431,7,9,0,0,431,432,7,0,0,0,432,433,1,0,0,0,433,
+	434,6,11,6,0,434,35,1,0,0,0,435,436,7,6,0,0,436,437,7,3,0,0,437,438,7,9,
+	0,0,438,439,7,12,0,0,439,440,7,16,0,0,440,441,7,3,0,0,441,442,1,0,0,0,442,
+	443,6,12,7,0,443,37,1,0,0,0,444,445,7,6,0,0,445,446,7,7,0,0,446,447,7,19,
+	0,0,447,448,1,0,0,0,448,449,6,13,0,0,449,39,1,0,0,0,450,451,7,2,0,0,451,
+	452,7,10,0,0,452,453,7,7,0,0,453,454,7,19,0,0,454,455,1,0,0,0,455,456,6,
+	14,8,0,456,41,1,0,0,0,457,458,7,2,0,0,458,459,7,7,0,0,459,460,7,6,0,0,460,
+	461,7,5,0,0,461,462,1,0,0,0,462,463,6,15,0,0,463,43,1,0,0,0,464,465,7,2,
+	0,0,465,466,7,5,0,0,466,467,7,12,0,0,467,468,7,5,0,0,468,469,7,2,0,0,469,
+	470,1,0,0,0,470,471,6,16,0,0,471,45,1,0,0,0,472,473,7,19,0,0,473,474,7,
+	10,0,0,474,475,7,3,0,0,475,476,7,6,0,0,476,477,7,3,0,0,477,478,1,0,0,0,
+	478,479,6,17,0,0,479,47,1,0,0,0,480,482,8,20,0,0,481,480,1,0,0,0,482,483,
+	1,0,0,0,483,481,1,0,0,0,483,484,1,0,0,0,484,485,1,0,0,0,485,486,6,18,0,
+	0,486,49,1,0,0,0,487,488,5,47,0,0,488,489,5,47,0,0,489,493,1,0,0,0,490,
+	492,8,21,0,0,491,490,1,0,0,0,492,495,1,0,0,0,493,491,1,0,0,0,493,494,1,
+	0,0,0,494,497,1,0,0,0,495,493,1,0,0,0,496,498,5,13,0,0,497,496,1,0,0,0,
+	497,498,1,0,0,0,498,500,1,0,0,0,499,501,5,10,0,0,500,499,1,0,0,0,500,501,
+	1,0,0,0,501,502,1,0,0,0,502,503,6,19,9,0,503,51,1,0,0,0,504,505,5,47,0,
+	0,505,506,5,42,0,0,506,511,1,0,0,0,507,510,3,52,20,0,508,510,9,0,0,0,509,
+	507,1,0,0,0,509,508,1,0,0,0,510,513,1,0,0,0,511,512,1,0,0,0,511,509,1,0,
+	0,0,512,514,1,0,0,0,513,511,1,0,0,0,514,515,5,42,0,0,515,516,5,47,0,0,516,
+	517,1,0,0,0,517,518,6,20,9,0,518,53,1,0,0,0,519,521,7,22,0,0,520,519,1,
+	0,0,0,521,522,1,0,0,0,522,520,1,0,0,0,522,523,1,0,0,0,523,524,1,0,0,0,524,
+	525,6,21,9,0,525,55,1,0,0,0,526,527,3,164,76,0,527,528,1,0,0,0,528,529,
+	6,22,10,0,529,530,6,22,11,0,530,57,1,0,0,0,531,532,3,66,27,0,532,533,1,
+	0,0,0,533,534,6,23,12,0,534,535,6,23,13,0,535,59,1,0,0,0,536,537,3,54,21,
+	0,537,538,1,0,0,0,538,539,6,24,9,0,539,61,1,0,0,0,540,541,3,50,19,0,541,
+	542,1,0,0,0,542,543,6,25,9,0,543,63,1,0,0,0,544,545,3,52,20,0,545,546,1,
+	0,0,0,546,547,6,26,9,0,547,65,1,0,0,0,548,549,5,124,0,0,549,550,1,0,0,0,
+	550,551,6,27,13,0,551,67,1,0,0,0,552,553,7,23,0,0,553,69,1,0,0,0,554,555,
+	7,24,0,0,555,71,1,0,0,0,556,557,5,92,0,0,557,558,7,25,0,0,558,73,1,0,0,
+	0,559,560,8,26,0,0,560,75,1,0,0,0,561,563,7,3,0,0,562,564,7,27,0,0,563,
+	562,1,0,0,0,563,564,1,0,0,0,564,566,1,0,0,0,565,567,3,68,28,0,566,565,1,
+	0,0,0,567,568,1,0,0,0,568,566,1,0,0,0,568,569,1,0,0,0,569,77,1,0,0,0,570,
+	571,5,64,0,0,571,79,1,0,0,0,572,573,5,96,0,0,573,81,1,0,0,0,574,578,8,28,
+	0,0,575,576,5,96,0,0,576,578,5,96,0,0,577,574,1,0,0,0,577,575,1,0,0,0,578,
+	83,1,0,0,0,579,580,5,95,0,0,580,85,1,0,0,0,581,585,3,70,29,0,582,585,3,
+	68,28,0,583,585,3,84,36,0,584,581,1,0,0,0,584,582,1,0,0,0,584,583,1,0,0,
+	0,585,87,1,0,0,0,586,591,5,34,0,0,587,590,3,72,30,0,588,590,3,74,31,0,589,
+	587,1,0,0,0,589,588,1,0,0,0,590,593,1,0,0,0,591,589,1,0,0,0,591,592,1,0,
+	0,0,592,594,1,0,0,0,593,591,1,0,0,0,594,616,5,34,0,0,595,596,5,34,0,0,596,
+	597,5,34,0,0,597,598,5,34,0,0,598,602,1,0,0,0,599,601,8,21,0,0,600,599,
+	1,0,0,0,601,604,1,0,0,0,602,603,1,0,0,0,602,600,1,0,0,0,603,605,1,0,0,0,
+	604,602,1,0,0,0,605,606,5,34,0,0,606,607,5,34,0,0,607,608,5,34,0,0,608,
+	610,1,0,0,0,609,611,5,34,0,0,610,609,1,0,0,0,610,611,1,0,0,0,611,613,1,
+	0,0,0,612,614,5,34,0,0,613,612,1,0,0,0,613,614,1,0,0,0,614,616,1,0,0,0,
+	615,586,1,0,0,0,615,595,1,0,0,0,616,89,1,0,0,0,617,619,3,68,28,0,618,617,
+	1,0,0,0,619,620,1,0,0,0,620,618,1,0,0,0,620,621,1,0,0,0,621,91,1,0,0,0,
+	622,624,3,68,28,0,623,622,1,0,0,0,624,625,1,0,0,0,625,623,1,0,0,0,625,626,
+	1,0,0,0,626,627,1,0,0,0,627,631,3,108,48,0,628,630,3,68,28,0,629,628,1,
+	0,0,0,630,633,1,0,0,0,631,629,1,0,0,0,631,632,1,0,0,0,632,665,1,0,0,0,633,
+	631,1,0,0,0,634,636,3,108,48,0,635,637,3,68,28,0,636,635,1,0,0,0,637,638,
+	1,0,0,0,638,636,1,0,0,0,638,639,1,0,0,0,639,665,1,0,0,0,640,642,3,68,28,
+	0,641,640,1,0,0,0,642,643,1,0,0,0,643,641,1,0,0,0,643,644,1,0,0,0,644,652,
+	1,0,0,0,645,649,3,108,48,0,646,648,3,68,28,0,647,646,1,0,0,0,648,651,1,
+	0,0,0,649,647,1,0,0,0,649,650,1,0,0,0,650,653,1,0,0,0,651,649,1,0,0,0,652,
+	645,1,0,0,0,652,653,1,0,0,0,653,654,1,0,0,0,654,655,3,76,32,0,655,665,1,
+	0,0,0,656,658,3,108,48,0,657,659,3,68,28,0,658,657,1,0,0,0,659,660,1,0,
+	0,0,660,658,1,0,0,0,660,661,1,0,0,0,661,662,1,0,0,0,662,663,3,76,32,0,663,
+	665,1,0,0,0,664,623,1,0,0,0,664,634,1,0,0,0,664,641,1,0,0,0,664,656,1,0,
+	0,0,665,93,1,0,0,0,666,667,7,29,0,0,667,668,7,30,0,0,668,95,1,0,0,0,669,
+	670,7,12,0,0,670,671,7,9,0,0,671,672,7,0,0,0,672,97,1,0,0,0,673,674,7,12,
+	0,0,674,675,7,2,0,0,675,676,7,4,0,0,676,99,1,0,0,0,677,678,5,61,0,0,678,
+	101,1,0,0,0,679,680,5,58,0,0,680,681,5,58,0,0,681,103,1,0,0,0,682,683,5,
+	44,0,0,683,105,1,0,0,0,684,685,7,0,0,0,685,686,7,3,0,0,686,687,7,2,0,0,
+	687,688,7,4,0,0,688,107,1,0,0,0,689,690,5,46,0,0,690,109,1,0,0,0,691,692,
+	7,15,0,0,692,693,7,12,0,0,693,694,7,13,0,0,694,695,7,2,0,0,695,696,7,3,
+	0,0,696,111,1,0,0,0,697,698,7,15,0,0,698,699,7,1,0,0,699,700,7,6,0,0,700,
+	701,7,2,0,0,701,702,7,5,0,0,702,113,1,0,0,0,703,704,7,13,0,0,704,705,7,
+	12,0,0,705,706,7,2,0,0,706,707,7,5,0,0,707,115,1,0,0,0,708,709,5,40,0,0,
+	709,117,1,0,0,0,710,711,7,1,0,0,711,712,7,9,0,0,712,119,1,0,0,0,713,714,
+	7,1,0,0,714,715,7,2,0,0,715,121,1,0,0,0,716,717,7,13,0,0,717,718,7,1,0,
+	0,718,719,7,18,0,0,719,720,7,3,0,0,720,123,1,0,0,0,721,722,7,9,0,0,722,
+	723,7,7,0,0,723,724,7,5,0,0,724,125,1,0,0,0,725,726,7,9,0,0,726,727,7,31,
+	0,0,727,728,7,13,0,0,728,729,7,13,0,0,729,127,1,0,0,0,730,731,7,9,0,0,731,
+	732,7,31,0,0,732,733,7,13,0,0,733,734,7,13,0,0,734,735,7,2,0,0,735,129,
+	1,0,0,0,736,737,7,7,0,0,737,738,7,6,0,0,738,131,1,0,0,0,739,740,5,63,0,
+	0,740,133,1,0,0,0,741,742,7,6,0,0,742,743,7,13,0,0,743,744,7,1,0,0,744,
+	745,7,18,0,0,745,746,7,3,0,0,746,135,1,0,0,0,747,748,5,41,0,0,748,137,1,
+	0,0,0,749,750,7,5,0,0,750,751,7,6,0,0,751,752,7,31,0,0,752,753,7,3,0,0,
+	753,139,1,0,0,0,754,755,5,61,0,0,755,756,5,61,0,0,756,141,1,0,0,0,757,758,
+	5,61,0,0,758,759,5,126,0,0,759,143,1,0,0,0,760,761,5,33,0,0,761,762,5,61,
+	0,0,762,145,1,0,0,0,763,764,5,60,0,0,764,147,1,0,0,0,765,766,5,60,0,0,766,
+	767,5,61,0,0,767,149,1,0,0,0,768,769,5,62,0,0,769,151,1,0,0,0,770,771,5,
+	62,0,0,771,772,5,61,0,0,772,153,1,0,0,0,773,774,5,43,0,0,774,155,1,0,0,
+	0,775,776,5,45,0,0,776,157,1,0,0,0,777,778,5,42,0,0,778,159,1,0,0,0,779,
+	780,5,47,0,0,780,161,1,0,0,0,781,782,5,37,0,0,782,163,1,0,0,0,783,784,5,
+	91,0,0,784,785,1,0,0,0,785,786,6,76,0,0,786,787,6,76,0,0,787,165,1,0,0,
+	0,788,789,5,93,0,0,789,790,1,0,0,0,790,791,6,77,13,0,791,792,6,77,13,0,
+	792,167,1,0,0,0,793,797,3,70,29,0,794,796,3,86,37,0,795,794,1,0,0,0,796,
+	799,1,0,0,0,797,795,1,0,0,0,797,798,1,0,0,0,798,810,1,0,0,0,799,797,1,0,
+	0,0,800,803,3,84,36,0,801,803,3,78,33,0,802,800,1,0,0,0,802,801,1,0,0,0,
+	803,805,1,0,0,0,804,806,3,86,37,0,805,804,1,0,0,0,806,807,1,0,0,0,807,805,
+	1,0,0,0,807,808,1,0,0,0,808,810,1,0,0,0,809,793,1,0,0,0,809,802,1,0,0,0,
+	810,169,1,0,0,0,811,813,3,80,34,0,812,814,3,82,35,0,813,812,1,0,0,0,814,
+	815,1,0,0,0,815,813,1,0,0,0,815,816,1,0,0,0,816,817,1,0,0,0,817,818,3,80,
+	34,0,818,171,1,0,0,0,819,820,3,170,79,0,820,173,1,0,0,0,821,822,3,50,19,
+	0,822,823,1,0,0,0,823,824,6,81,9,0,824,175,1,0,0,0,825,826,3,52,20,0,826,
+	827,1,0,0,0,827,828,6,82,9,0,828,177,1,0,0,0,829,830,3,54,21,0,830,831,
+	1,0,0,0,831,832,6,83,9,0,832,179,1,0,0,0,833,834,3,66,27,0,834,835,1,0,
+	0,0,835,836,6,84,12,0,836,837,6,84,13,0,837,181,1,0,0,0,838,839,3,164,76,
+	0,839,840,1,0,0,0,840,841,6,85,10,0,841,183,1,0,0,0,842,843,3,166,77,0,
+	843,844,1,0,0,0,844,845,6,86,14,0,845,185,1,0,0,0,846,847,3,104,46,0,847,
+	848,1,0,0,0,848,849,6,87,15,0,849,187,1,0,0,0,850,851,3,100,44,0,851,852,
+	1,0,0,0,852,853,6,88,16,0,853,189,1,0,0,0,854,855,3,88,38,0,855,856,1,0,
+	0,0,856,857,6,89,17,0,857,191,1,0,0,0,858,859,7,7,0,0,859,860,7,8,0,0,860,
+	861,7,5,0,0,861,862,7,1,0,0,862,863,7,7,0,0,863,864,7,9,0,0,864,865,7,2,
+	0,0,865,193,1,0,0,0,866,867,7,16,0,0,867,868,7,3,0,0,868,869,7,5,0,0,869,
+	870,7,12,0,0,870,871,7,0,0,0,871,872,7,12,0,0,872,873,7,5,0,0,873,874,7,
+	12,0,0,874,195,1,0,0,0,875,879,8,32,0,0,876,877,5,47,0,0,877,879,8,33,0,
+	0,878,875,1,0,0,0,878,876,1,0,0,0,879,197,1,0,0,0,880,882,3,196,92,0,881,
+	880,1,0,0,0,882,883,1,0,0,0,883,881,1,0,0,0,883,884,1,0,0,0,884,199,1,0,
+	0,0,885,886,3,50,19,0,886,887,1,0,0,0,887,888,6,94,9,0,888,201,1,0,0,0,
+	889,890,3,52,20,0,890,891,1,0,0,0,891,892,6,95,9,0,892,203,1,0,0,0,893,
+	894,3,54,21,0,894,895,1,0,0,0,895,896,6,96,9,0,896,205,1,0,0,0,897,898,
+	3,66,27,0,898,899,1,0,0,0,899,900,6,97,12,0,900,901,6,97,13,0,901,207,1,
+	0,0,0,902,903,3,108,48,0,903,904,1,0,0,0,904,905,6,98,18,0,905,209,1,0,
+	0,0,906,907,3,104,46,0,907,908,1,0,0,0,908,909,6,99,15,0,909,211,1,0,0,
+	0,910,915,3,70,29,0,911,915,3,68,28,0,912,915,3,84,36,0,913,915,3,158,73,
+	0,914,910,1,0,0,0,914,911,1,0,0,0,914,912,1,0,0,0,914,913,1,0,0,0,915,213,
+	1,0,0,0,916,919,3,70,29,0,917,919,3,158,73,0,918,916,1,0,0,0,918,917,1,
+	0,0,0,919,923,1,0,0,0,920,922,3,212,100,0,921,920,1,0,0,0,922,925,1,0,0,
+	0,923,921,1,0,0,0,923,924,1,0,0,0,924,936,1,0,0,0,925,923,1,0,0,0,926,929,
+	3,84,36,0,927,929,3,78,33,0,928,926,1,0,0,0,928,927,1,0,0,0,929,931,1,0,
+	0,0,930,932,3,212,100,0,931,930,1,0,0,0,932,933,1,0,0,0,933,931,1,0,0,0,
+	933,934,1,0,0,0,934,936,1,0,0,0,935,918,1,0,0,0,935,928,1,0,0,0,936,215,
+	1,0,0,0,937,940,3,214,101,0,938,940,3,170,79,0,939,937,1,0,0,0,939,938,
+	1,0,0,0,940,941,1,0,0,0,941,939,1,0,0,0,941,942,1,0,0,0,942,217,1,0,0,0,
+	943,944,3,50,19,0,944,945,1,0,0,0,945,946,6,103,9,0,946,219,1,0,0,0,947,
+	948,3,52,20,0,948,949,1,0,0,0,949,950,6,104,9,0,950,221,1,0,0,0,951,952,
+	3,54,21,0,952,953,1,0,0,0,953,954,6,105,9,0,954,223,1,0,0,0,955,956,3,66,
+	27,0,956,957,1,0,0,0,957,958,6,106,12,0,958,959,6,106,13,0,959,225,1,0,
+	0,0,960,961,3,100,44,0,961,962,1,0,0,0,962,963,6,107,16,0,963,227,1,0,0,
+	0,964,965,3,104,46,0,965,966,1,0,0,0,966,967,6,108,15,0,967,229,1,0,0,0,
+	968,969,3,108,48,0,969,970,1,0,0,0,970,971,6,109,18,0,971,231,1,0,0,0,972,
+	973,7,12,0,0,973,974,7,2,0,0,974,233,1,0,0,0,975,976,3,216,102,0,976,977,
+	1,0,0,0,977,978,6,111,19,0,978,235,1,0,0,0,979,980,3,50,19,0,980,981,1,
+	0,0,0,981,982,6,112,9,0,982,237,1,0,0,0,983,984,3,52,20,0,984,985,1,0,0,
+	0,985,986,6,113,9,0,986,239,1,0,0,0,987,988,3,54,21,0,988,989,1,0,0,0,989,
+	990,6,114,9,0,990,241,1,0,0,0,991,992,3,66,27,0,992,993,1,0,0,0,993,994,
+	6,115,12,0,994,995,6,115,13,0,995,243,1,0,0,0,996,997,3,164,76,0,997,998,
+	1,0,0,0,998,999,6,116,10,0,999,1000,6,116,20,0,1000,245,1,0,0,0,1001,1002,
+	7,7,0,0,1002,1003,7,9,0,0,1003,1004,1,0,0,0,1004,1005,6,117,21,0,1005,247,
+	1,0,0,0,1006,1007,7,19,0,0,1007,1008,7,1,0,0,1008,1009,7,5,0,0,1009,1010,
+	7,10,0,0,1010,1011,1,0,0,0,1011,1012,6,118,21,0,1012,249,1,0,0,0,1013,1014,
+	8,34,0,0,1014,251,1,0,0,0,1015,1017,3,250,119,0,1016,1015,1,0,0,0,1017,
+	1018,1,0,0,0,1018,1016,1,0,0,0,1018,1019,1,0,0,0,1019,1020,1,0,0,0,1020,
+	1021,3,320,154,0,1021,1023,1,0,0,0,1022,1016,1,0,0,0,1022,1023,1,0,0,0,
+	1023,1025,1,0,0,0,1024,1026,3,250,119,0,1025,1024,1,0,0,0,1026,1027,1,0,
+	0,0,1027,1025,1,0,0,0,1027,1028,1,0,0,0,1028,253,1,0,0,0,1029,1030,3,172,
+	80,0,1030,1031,1,0,0,0,1031,1032,6,121,22,0,1032,255,1,0,0,0,1033,1034,
+	3,252,120,0,1034,1035,1,0,0,0,1035,1036,6,122,23,0,1036,257,1,0,0,0,1037,
+	1038,3,50,19,0,1038,1039,1,0,0,0,1039,1040,6,123,9,0,1040,259,1,0,0,0,1041,
+	1042,3,52,20,0,1042,1043,1,0,0,0,1043,1044,6,124,9,0,1044,261,1,0,0,0,1045,
+	1046,3,54,21,0,1046,1047,1,0,0,0,1047,1048,6,125,9,0,1048,263,1,0,0,0,1049,
+	1050,3,66,27,0,1050,1051,1,0,0,0,1051,1052,6,126,12,0,1052,1053,6,126,13,
+	0,1053,1054,6,126,13,0,1054,265,1,0,0,0,1055,1056,3,100,44,0,1056,1057,
+	1,0,0,0,1057,1058,6,127,16,0,1058,267,1,0,0,0,1059,1060,3,104,46,0,1060,
+	1061,1,0,0,0,1061,1062,6,128,15,0,1062,269,1,0,0,0,1063,1064,3,108,48,0,
+	1064,1065,1,0,0,0,1065,1066,6,129,18,0,1066,271,1,0,0,0,1067,1068,3,248,
+	118,0,1068,1069,1,0,0,0,1069,1070,6,130,24,0,1070,273,1,0,0,0,1071,1072,
+	3,216,102,0,1072,1073,1,0,0,0,1073,1074,6,131,19,0,1074,275,1,0,0,0,1075,
+	1076,3,172,80,0,1076,1077,1,0,0,0,1077,1078,6,132,22,0,1078,277,1,0,0,0,
+	1079,1080,3,50,19,0,1080,1081,1,0,0,0,1081,1082,6,133,9,0,1082,279,1,0,
+	0,0,1083,1084,3,52,20,0,1084,1085,1,0,0,0,1085,1086,6,134,9,0,1086,281,
+	1,0,0,0,1087,1088,3,54,21,0,1088,1089,1,0,0,0,1089,1090,6,135,9,0,1090,
+	283,1,0,0,0,1091,1092,3,66,27,0,1092,1093,1,0,0,0,1093,1094,6,136,12,0,
+	1094,1095,6,136,13,0,1095,285,1,0,0,0,1096,1097,3,108,48,0,1097,1098,1,
+	0,0,0,1098,1099,6,137,18,0,1099,287,1,0,0,0,1100,1101,3,172,80,0,1101,1102,
+	1,0,0,0,1102,1103,6,138,22,0,1103,289,1,0,0,0,1104,1105,3,168,78,0,1105,
+	1106,1,0,0,0,1106,1107,6,139,25,0,1107,291,1,0,0,0,1108,1109,3,50,19,0,
+	1109,1110,1,0,0,0,1110,1111,6,140,9,0,1111,293,1,0,0,0,1112,1113,3,52,20,
+	0,1113,1114,1,0,0,0,1114,1115,6,141,9,0,1115,295,1,0,0,0,1116,1117,3,54,
+	21,0,1117,1118,1,0,0,0,1118,1119,6,142,9,0,1119,297,1,0,0,0,1120,1121,3,
+	66,27,0,1121,1122,1,0,0,0,1122,1123,6,143,12,0,1123,1124,6,143,13,0,1124,
+	299,1,0,0,0,1125,1126,7,1,0,0,1126,1127,7,9,0,0,1127,1128,7,15,0,0,1128,
+	1129,7,7,0,0,1129,301,1,0,0,0,1130,1131,3,50,19,0,1131,1132,1,0,0,0,1132,
+	1133,6,145,9,0,1133,303,1,0,0,0,1134,1135,3,52,20,0,1135,1136,1,0,0,0,1136,
+	1137,6,146,9,0,1137,305,1,0,0,0,1138,1139,3,54,21,0,1139,1140,1,0,0,0,1140,
+	1141,6,147,9,0,1141,307,1,0,0,0,1142,1143,3,66,27,0,1143,1144,1,0,0,0,1144,
+	1145,6,148,12,0,1145,1146,6,148,13,0,1146,309,1,0,0,0,1147,1148,7,15,0,
+	0,1148,1149,7,31,0,0,1149,1150,7,9,0,0,1150,1151,7,4,0,0,1151,1152,7,5,
+	0,0,1152,1153,7,1,0,0,1153,1154,7,7,0,0,1154,1155,7,9,0,0,1155,1156,7,2,
+	0,0,1156,311,1,0,0,0,1157,1158,3,50,19,0,1158,1159,1,0,0,0,1159,1160,6,
+	150,9,0,1160,313,1,0,0,0,1161,1162,3,52,20,0,1162,1163,1,0,0,0,1163,1164,
+	6,151,9,0,1164,315,1,0,0,0,1165,1166,3,54,21,0,1166,1167,1,0,0,0,1167,1168,
+	6,152,9,0,1168,317,1,0,0,0,1169,1170,3,166,77,0,1170,1171,1,0,0,0,1171,
+	1172,6,153,14,0,1172,1173,6,153,13,0,1173,319,1,0,0,0,1174,1175,5,58,0,
+	0,1175,321,1,0,0,0,1176,1182,3,78,33,0,1177,1182,3,68,28,0,1178,1182,3,
+	108,48,0,1179,1182,3,70,29,0,1180,1182,3,84,36,0,1181,1176,1,0,0,0,1181,
+	1177,1,0,0,0,1181,1178,1,0,0,0,1181,1179,1,0,0,0,1181,1180,1,0,0,0,1182,
+	1183,1,0,0,0,1183,1181,1,0,0,0,1183,1184,1,0,0,0,1184,323,1,0,0,0,1185,
+	1186,3,50,19,0,1186,1187,1,0,0,0,1187,1188,6,156,9,0,1188,325,1,0,0,0,1189,
+	1190,3,52,20,0,1190,1191,1,0,0,0,1191,1192,6,157,9,0,1192,327,1,0,0,0,1193,
+	1194,3,54,21,0,1194,1195,1,0,0,0,1195,1196,6,158,9,0,1196,329,1,0,0,0,58,
+	0,1,2,3,4,5,6,7,8,9,10,11,483,493,497,500,509,511,522,563,568,577,584,589,
+	591,602,610,613,615,620,625,631,638,643,649,652,660,664,797,802,807,809,
+	815,878,883,914,918,923,928,933,935,939,941,1018,1022,1027,1181,1183,26,
 	5,2,0,5,4,0,5,6,0,5,1,0,5,3,0,5,10,0,5,8,0,5,5,0,5,9,0,0,1,0,7,65,0,5,0,
-	0,7,26,0,4,0,0,7,66,0,7,35,0,7,33,0,7,27,0,7,68,0,7,37,0,7,78,0,5,11,0,
-	5,7,0,7,88,0,7,87,0,7,67,0];
+	0,7,26,0,4,0,0,7,66,0,7,35,0,7,33,0,7,27,0,7,37,0,7,78,0,5,11,0,5,7,0,7,
+	68,0,7,88,0,7,87,0,7,67,0];
 
 	private static __ATN: ATN;
 	public static get _ATN(): ATN {
diff --git a/packages/kbn-esql-ast/src/antlr/esql_parser.g4 b/packages/kbn-esql-ast/src/antlr/esql_parser.g4
index 5a245f91f45207..6f445b0df17307 100644
--- a/packages/kbn-esql-ast/src/antlr/esql_parser.g4
+++ b/packages/kbn-esql-ast/src/antlr/esql_parser.g4
@@ -118,7 +118,6 @@ fromCommand
 
 fromIdentifier
     : FROM_UNQUOTED_IDENTIFIER
-    | QUOTED_IDENTIFIER
     ;
 
 fromOptions
diff --git a/packages/kbn-esql-ast/src/antlr/esql_parser.interp b/packages/kbn-esql-ast/src/antlr/esql_parser.interp
index b4a8e60dd69aa1..2b887065985d3c 100644
--- a/packages/kbn-esql-ast/src/antlr/esql_parser.interp
+++ b/packages/kbn-esql-ast/src/antlr/esql_parser.interp
@@ -282,4 +282,4 @@ enrichWithClause
 
 
 atn:
-[4, 1, 110, 543, 2, 0, 7, 0, 2, 1, 7, 1, 2, 2, 7, 2, 2, 3, 7, 3, 2, 4, 7, 4, 2, 5, 7, 5, 2, 6, 7, 6, 2, 7, 7, 7, 2, 8, 7, 8, 2, 9, 7, 9, 2, 10, 7, 10, 2, 11, 7, 11, 2, 12, 7, 12, 2, 13, 7, 13, 2, 14, 7, 14, 2, 15, 7, 15, 2, 16, 7, 16, 2, 17, 7, 17, 2, 18, 7, 18, 2, 19, 7, 19, 2, 20, 7, 20, 2, 21, 7, 21, 2, 22, 7, 22, 2, 23, 7, 23, 2, 24, 7, 24, 2, 25, 7, 25, 2, 26, 7, 26, 2, 27, 7, 27, 2, 28, 7, 28, 2, 29, 7, 29, 2, 30, 7, 30, 2, 31, 7, 31, 2, 32, 7, 32, 2, 33, 7, 33, 2, 34, 7, 34, 2, 35, 7, 35, 2, 36, 7, 36, 2, 37, 7, 37, 2, 38, 7, 38, 2, 39, 7, 39, 2, 40, 7, 40, 2, 41, 7, 41, 2, 42, 7, 42, 2, 43, 7, 43, 2, 44, 7, 44, 2, 45, 7, 45, 2, 46, 7, 46, 2, 47, 7, 47, 2, 48, 7, 48, 2, 49, 7, 49, 2, 50, 7, 50, 2, 51, 7, 51, 2, 52, 7, 52, 2, 53, 7, 53, 1, 0, 1, 0, 1, 0, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 5, 1, 118, 8, 1, 10, 1, 12, 1, 121, 9, 1, 1, 2, 1, 2, 1, 2, 1, 2, 1, 2, 3, 2, 128, 8, 2, 1, 3, 1, 3, 1, 3, 1, 3, 1, 3, 1, 3, 1, 3, 1, 3, 1, 3, 1, 3, 1, 3, 1, 3, 1, 3, 3, 3, 143, 8, 3, 1, 4, 1, 4, 1, 4, 1, 5, 1, 5, 1, 5, 1, 5, 1, 5, 1, 5, 1, 5, 3, 5, 155, 8, 5, 1, 5, 1, 5, 1, 5, 1, 5, 1, 5, 5, 5, 162, 8, 5, 10, 5, 12, 5, 165, 9, 5, 1, 5, 1, 5, 1, 5, 1, 5, 1, 5, 3, 5, 172, 8, 5, 1, 5, 1, 5, 3, 5, 176, 8, 5, 1, 5, 1, 5, 1, 5, 1, 5, 1, 5, 1, 5, 5, 5, 184, 8, 5, 10, 5, 12, 5, 187, 9, 5, 1, 6, 1, 6, 3, 6, 191, 8, 6, 1, 6, 1, 6, 1, 6, 1, 6, 1, 6, 3, 6, 198, 8, 6, 1, 6, 1, 6, 1, 6, 3, 6, 203, 8, 6, 1, 7, 1, 7, 1, 7, 1, 7, 1, 7, 3, 7, 210, 8, 7, 1, 8, 1, 8, 1, 8, 1, 8, 3, 8, 216, 8, 8, 1, 8, 1, 8, 1, 8, 1, 8, 1, 8, 1, 8, 5, 8, 224, 8, 8, 10, 8, 12, 8, 227, 9, 8, 1, 9, 1, 9, 1, 9, 1, 9, 1, 9, 1, 9, 1, 9, 1, 9, 3, 9, 237, 8, 9, 1, 9, 1, 9, 1, 9, 5, 9, 242, 8, 9, 10, 9, 12, 9, 245, 9, 9, 1, 10, 1, 10, 1, 10, 1, 10, 1, 10, 1, 10, 5, 10, 253, 8, 10, 10, 10, 12, 10, 256, 9, 10, 3, 10, 258, 8, 10, 1, 10, 1, 10, 1, 11, 1, 11, 1, 12, 1, 12, 1, 12, 1, 13, 1, 13, 1, 13, 5, 13, 270, 8, 13, 10, 13, 12, 13, 273, 9, 13, 1, 14, 1, 14, 1, 14, 1, 14, 1, 14, 3, 14, 280, 8, 14, 1, 15, 1, 15, 1, 15, 1, 15, 5, 15, 286, 8, 15, 10, 15, 12, 15, 289, 9, 15, 1, 15, 3, 15, 292, 8, 15, 1, 15, 3, 15, 295, 8, 15, 1, 16, 1, 16, 1, 17, 1, 17, 1, 17, 1, 17, 5, 17, 303, 8, 17, 10, 17, 12, 17, 306, 9, 17, 1, 18, 1, 18, 1, 18, 1, 18, 1, 19, 1, 19, 3, 19, 314, 8, 19, 1, 20, 1, 20, 1, 20, 1, 20, 5, 20, 320, 8, 20, 10, 20, 12, 20, 323, 9, 20, 1, 21, 1, 21, 1, 21, 1, 21, 1, 22, 1, 22, 1, 22, 1, 23, 1, 23, 3, 23, 334, 8, 23, 1, 23, 1, 23, 3, 23, 338, 8, 23, 1, 24, 1, 24, 1, 24, 1, 24, 3, 24, 344, 8, 24, 1, 25, 1, 25, 1, 25, 5, 25, 349, 8, 25, 10, 25, 12, 25, 352, 9, 25, 1, 26, 1, 26, 1, 26, 5, 26, 357, 8, 26, 10, 26, 12, 26, 360, 9, 26, 1, 27, 1, 27, 1, 28, 1, 28, 1, 29, 1, 29, 1, 29, 1, 29, 1, 29, 1, 29, 1, 29, 1, 29, 1, 29, 1, 29, 1, 29, 1, 29, 1, 29, 5, 29, 379, 8, 29, 10, 29, 12, 29, 382, 9, 29, 1, 29, 1, 29, 1, 29, 1, 29, 1, 29, 1, 29, 5, 29, 390, 8, 29, 10, 29, 12, 29, 393, 9, 29, 1, 29, 1, 29, 1, 29, 1, 29, 1, 29, 1, 29, 5, 29, 401, 8, 29, 10, 29, 12, 29, 404, 9, 29, 1, 29, 1, 29, 3, 29, 408, 8, 29, 1, 30, 1, 30, 1, 30, 1, 31, 1, 31, 1, 31, 1, 31, 5, 31, 417, 8, 31, 10, 31, 12, 31, 420, 9, 31, 1, 32, 1, 32, 3, 32, 424, 8, 32, 1, 32, 1, 32, 3, 32, 428, 8, 32, 1, 33, 1, 33, 1, 33, 1, 33, 5, 33, 434, 8, 33, 10, 33, 12, 33, 437, 9, 33, 1, 34, 1, 34, 1, 34, 1, 34, 5, 34, 443, 8, 34, 10, 34, 12, 34, 446, 9, 34, 1, 35, 1, 35, 1, 35, 1, 35, 5, 35, 452, 8, 35, 10, 35, 12, 35, 455, 9, 35, 1, 36, 1, 36, 1, 36, 1, 36, 1, 37, 1, 37, 1, 37, 1, 37, 3, 37, 465, 8, 37, 1, 38, 1, 38, 1, 38, 1, 38, 1, 39, 1, 39, 1, 39, 1, 40, 1, 40, 1, 40, 5, 40, 477, 8, 40, 10, 40, 12, 40, 480, 9, 40, 1, 41, 1, 41, 1, 41, 1, 41, 1, 42, 1, 42, 1, 43, 1, 43, 3, 43, 490, 8, 43, 1, 44, 3, 44, 493, 8, 44, 1, 44, 1, 44, 1, 45, 3, 45, 498, 8, 45, 1, 45, 1, 45, 1, 46, 1, 46, 1, 47, 1, 47, 1, 48, 1, 48, 1, 48, 1, 49, 1, 49, 1, 49, 1, 49, 1, 50, 1, 50, 1, 50, 1, 51, 1, 51, 1, 51, 1, 52, 1, 52, 1, 52, 1, 52, 3, 52, 523, 8, 52, 1, 52, 1, 52, 1, 52, 1, 52, 5, 52, 529, 8, 52, 10, 52, 12, 52, 532, 9, 52, 3, 52, 534, 8, 52, 1, 53, 1, 53, 1, 53, 3, 53, 539, 8, 53, 1, 53, 1, 53, 1, 53, 0, 4, 2, 10, 16, 18, 54, 0, 2, 4, 6, 8, 10, 12, 14, 16, 18, 20, 22, 24, 26, 28, 30, 32, 34, 36, 38, 40, 42, 44, 46, 48, 50, 52, 54, 56, 58, 60, 62, 64, 66, 68, 70, 72, 74, 76, 78, 80, 82, 84, 86, 88, 90, 92, 94, 96, 98, 100, 102, 104, 106, 0, 8, 1, 0, 60, 61, 1, 0, 62, 64, 2, 0, 68, 68, 74, 74, 1, 0, 67, 68, 2, 0, 32, 32, 36, 36, 1, 0, 39, 40, 2, 0, 38, 38, 52, 52, 2, 0, 53, 53, 55, 59, 568, 0, 108, 1, 0, 0, 0, 2, 111, 1, 0, 0, 0, 4, 127, 1, 0, 0, 0, 6, 142, 1, 0, 0, 0, 8, 144, 1, 0, 0, 0, 10, 175, 1, 0, 0, 0, 12, 202, 1, 0, 0, 0, 14, 209, 1, 0, 0, 0, 16, 215, 1, 0, 0, 0, 18, 236, 1, 0, 0, 0, 20, 246, 1, 0, 0, 0, 22, 261, 1, 0, 0, 0, 24, 263, 1, 0, 0, 0, 26, 266, 1, 0, 0, 0, 28, 279, 1, 0, 0, 0, 30, 281, 1, 0, 0, 0, 32, 296, 1, 0, 0, 0, 34, 298, 1, 0, 0, 0, 36, 307, 1, 0, 0, 0, 38, 313, 1, 0, 0, 0, 40, 315, 1, 0, 0, 0, 42, 324, 1, 0, 0, 0, 44, 328, 1, 0, 0, 0, 46, 331, 1, 0, 0, 0, 48, 339, 1, 0, 0, 0, 50, 345, 1, 0, 0, 0, 52, 353, 1, 0, 0, 0, 54, 361, 1, 0, 0, 0, 56, 363, 1, 0, 0, 0, 58, 407, 1, 0, 0, 0, 60, 409, 1, 0, 0, 0, 62, 412, 1, 0, 0, 0, 64, 421, 1, 0, 0, 0, 66, 429, 1, 0, 0, 0, 68, 438, 1, 0, 0, 0, 70, 447, 1, 0, 0, 0, 72, 456, 1, 0, 0, 0, 74, 460, 1, 0, 0, 0, 76, 466, 1, 0, 0, 0, 78, 470, 1, 0, 0, 0, 80, 473, 1, 0, 0, 0, 82, 481, 1, 0, 0, 0, 84, 485, 1, 0, 0, 0, 86, 489, 1, 0, 0, 0, 88, 492, 1, 0, 0, 0, 90, 497, 1, 0, 0, 0, 92, 501, 1, 0, 0, 0, 94, 503, 1, 0, 0, 0, 96, 505, 1, 0, 0, 0, 98, 508, 1, 0, 0, 0, 100, 512, 1, 0, 0, 0, 102, 515, 1, 0, 0, 0, 104, 518, 1, 0, 0, 0, 106, 538, 1, 0, 0, 0, 108, 109, 3, 2, 1, 0, 109, 110, 5, 0, 0, 1, 110, 1, 1, 0, 0, 0, 111, 112, 6, 1, -1, 0, 112, 113, 3, 4, 2, 0, 113, 119, 1, 0, 0, 0, 114, 115, 10, 1, 0, 0, 115, 116, 5, 26, 0, 0, 116, 118, 3, 6, 3, 0, 117, 114, 1, 0, 0, 0, 118, 121, 1, 0, 0, 0, 119, 117, 1, 0, 0, 0, 119, 120, 1, 0, 0, 0, 120, 3, 1, 0, 0, 0, 121, 119, 1, 0, 0, 0, 122, 128, 3, 96, 48, 0, 123, 128, 3, 30, 15, 0, 124, 128, 3, 24, 12, 0, 125, 128, 3, 100, 50, 0, 126, 128, 3, 102, 51, 0, 127, 122, 1, 0, 0, 0, 127, 123, 1, 0, 0, 0, 127, 124, 1, 0, 0, 0, 127, 125, 1, 0, 0, 0, 127, 126, 1, 0, 0, 0, 128, 5, 1, 0, 0, 0, 129, 143, 3, 44, 22, 0, 130, 143, 3, 48, 24, 0, 131, 143, 3, 60, 30, 0, 132, 143, 3, 66, 33, 0, 133, 143, 3, 62, 31, 0, 134, 143, 3, 46, 23, 0, 135, 143, 3, 8, 4, 0, 136, 143, 3, 68, 34, 0, 137, 143, 3, 70, 35, 0, 138, 143, 3, 74, 37, 0, 139, 143, 3, 76, 38, 0, 140, 143, 3, 104, 52, 0, 141, 143, 3, 78, 39, 0, 142, 129, 1, 0, 0, 0, 142, 130, 1, 0, 0, 0, 142, 131, 1, 0, 0, 0, 142, 132, 1, 0, 0, 0, 142, 133, 1, 0, 0, 0, 142, 134, 1, 0, 0, 0, 142, 135, 1, 0, 0, 0, 142, 136, 1, 0, 0, 0, 142, 137, 1, 0, 0, 0, 142, 138, 1, 0, 0, 0, 142, 139, 1, 0, 0, 0, 142, 140, 1, 0, 0, 0, 142, 141, 1, 0, 0, 0, 143, 7, 1, 0, 0, 0, 144, 145, 5, 18, 0, 0, 145, 146, 3, 10, 5, 0, 146, 9, 1, 0, 0, 0, 147, 148, 6, 5, -1, 0, 148, 149, 5, 45, 0, 0, 149, 176, 3, 10, 5, 7, 150, 176, 3, 14, 7, 0, 151, 176, 3, 12, 6, 0, 152, 154, 3, 14, 7, 0, 153, 155, 5, 45, 0, 0, 154, 153, 1, 0, 0, 0, 154, 155, 1, 0, 0, 0, 155, 156, 1, 0, 0, 0, 156, 157, 5, 42, 0, 0, 157, 158, 5, 41, 0, 0, 158, 163, 3, 14, 7, 0, 159, 160, 5, 35, 0, 0, 160, 162, 3, 14, 7, 0, 161, 159, 1, 0, 0, 0, 162, 165, 1, 0, 0, 0, 163, 161, 1, 0, 0, 0, 163, 164, 1, 0, 0, 0, 164, 166, 1, 0, 0, 0, 165, 163, 1, 0, 0, 0, 166, 167, 5, 51, 0, 0, 167, 176, 1, 0, 0, 0, 168, 169, 3, 14, 7, 0, 169, 171, 5, 43, 0, 0, 170, 172, 5, 45, 0, 0, 171, 170, 1, 0, 0, 0, 171, 172, 1, 0, 0, 0, 172, 173, 1, 0, 0, 0, 173, 174, 5, 46, 0, 0, 174, 176, 1, 0, 0, 0, 175, 147, 1, 0, 0, 0, 175, 150, 1, 0, 0, 0, 175, 151, 1, 0, 0, 0, 175, 152, 1, 0, 0, 0, 175, 168, 1, 0, 0, 0, 176, 185, 1, 0, 0, 0, 177, 178, 10, 4, 0, 0, 178, 179, 5, 31, 0, 0, 179, 184, 3, 10, 5, 5, 180, 181, 10, 3, 0, 0, 181, 182, 5, 48, 0, 0, 182, 184, 3, 10, 5, 4, 183, 177, 1, 0, 0, 0, 183, 180, 1, 0, 0, 0, 184, 187, 1, 0, 0, 0, 185, 183, 1, 0, 0, 0, 185, 186, 1, 0, 0, 0, 186, 11, 1, 0, 0, 0, 187, 185, 1, 0, 0, 0, 188, 190, 3, 14, 7, 0, 189, 191, 5, 45, 0, 0, 190, 189, 1, 0, 0, 0, 190, 191, 1, 0, 0, 0, 191, 192, 1, 0, 0, 0, 192, 193, 5, 44, 0, 0, 193, 194, 3, 92, 46, 0, 194, 203, 1, 0, 0, 0, 195, 197, 3, 14, 7, 0, 196, 198, 5, 45, 0, 0, 197, 196, 1, 0, 0, 0, 197, 198, 1, 0, 0, 0, 198, 199, 1, 0, 0, 0, 199, 200, 5, 50, 0, 0, 200, 201, 3, 92, 46, 0, 201, 203, 1, 0, 0, 0, 202, 188, 1, 0, 0, 0, 202, 195, 1, 0, 0, 0, 203, 13, 1, 0, 0, 0, 204, 210, 3, 16, 8, 0, 205, 206, 3, 16, 8, 0, 206, 207, 3, 94, 47, 0, 207, 208, 3, 16, 8, 0, 208, 210, 1, 0, 0, 0, 209, 204, 1, 0, 0, 0, 209, 205, 1, 0, 0, 0, 210, 15, 1, 0, 0, 0, 211, 212, 6, 8, -1, 0, 212, 216, 3, 18, 9, 0, 213, 214, 7, 0, 0, 0, 214, 216, 3, 16, 8, 3, 215, 211, 1, 0, 0, 0, 215, 213, 1, 0, 0, 0, 216, 225, 1, 0, 0, 0, 217, 218, 10, 2, 0, 0, 218, 219, 7, 1, 0, 0, 219, 224, 3, 16, 8, 3, 220, 221, 10, 1, 0, 0, 221, 222, 7, 0, 0, 0, 222, 224, 3, 16, 8, 2, 223, 217, 1, 0, 0, 0, 223, 220, 1, 0, 0, 0, 224, 227, 1, 0, 0, 0, 225, 223, 1, 0, 0, 0, 225, 226, 1, 0, 0, 0, 226, 17, 1, 0, 0, 0, 227, 225, 1, 0, 0, 0, 228, 229, 6, 9, -1, 0, 229, 237, 3, 58, 29, 0, 230, 237, 3, 50, 25, 0, 231, 237, 3, 20, 10, 0, 232, 233, 5, 41, 0, 0, 233, 234, 3, 10, 5, 0, 234, 235, 5, 51, 0, 0, 235, 237, 1, 0, 0, 0, 236, 228, 1, 0, 0, 0, 236, 230, 1, 0, 0, 0, 236, 231, 1, 0, 0, 0, 236, 232, 1, 0, 0, 0, 237, 243, 1, 0, 0, 0, 238, 239, 10, 1, 0, 0, 239, 240, 5, 34, 0, 0, 240, 242, 3, 22, 11, 0, 241, 238, 1, 0, 0, 0, 242, 245, 1, 0, 0, 0, 243, 241, 1, 0, 0, 0, 243, 244, 1, 0, 0, 0, 244, 19, 1, 0, 0, 0, 245, 243, 1, 0, 0, 0, 246, 247, 3, 54, 27, 0, 247, 257, 5, 41, 0, 0, 248, 258, 5, 62, 0, 0, 249, 254, 3, 10, 5, 0, 250, 251, 5, 35, 0, 0, 251, 253, 3, 10, 5, 0, 252, 250, 1, 0, 0, 0, 253, 256, 1, 0, 0, 0, 254, 252, 1, 0, 0, 0, 254, 255, 1, 0, 0, 0, 255, 258, 1, 0, 0, 0, 256, 254, 1, 0, 0, 0, 257, 248, 1, 0, 0, 0, 257, 249, 1, 0, 0, 0, 257, 258, 1, 0, 0, 0, 258, 259, 1, 0, 0, 0, 259, 260, 5, 51, 0, 0, 260, 21, 1, 0, 0, 0, 261, 262, 3, 54, 27, 0, 262, 23, 1, 0, 0, 0, 263, 264, 5, 14, 0, 0, 264, 265, 3, 26, 13, 0, 265, 25, 1, 0, 0, 0, 266, 271, 3, 28, 14, 0, 267, 268, 5, 35, 0, 0, 268, 270, 3, 28, 14, 0, 269, 267, 1, 0, 0, 0, 270, 273, 1, 0, 0, 0, 271, 269, 1, 0, 0, 0, 271, 272, 1, 0, 0, 0, 272, 27, 1, 0, 0, 0, 273, 271, 1, 0, 0, 0, 274, 280, 3, 10, 5, 0, 275, 276, 3, 50, 25, 0, 276, 277, 5, 33, 0, 0, 277, 278, 3, 10, 5, 0, 278, 280, 1, 0, 0, 0, 279, 274, 1, 0, 0, 0, 279, 275, 1, 0, 0, 0, 280, 29, 1, 0, 0, 0, 281, 282, 5, 6, 0, 0, 282, 287, 3, 32, 16, 0, 283, 284, 5, 35, 0, 0, 284, 286, 3, 32, 16, 0, 285, 283, 1, 0, 0, 0, 286, 289, 1, 0, 0, 0, 287, 285, 1, 0, 0, 0, 287, 288, 1, 0, 0, 0, 288, 291, 1, 0, 0, 0, 289, 287, 1, 0, 0, 0, 290, 292, 3, 38, 19, 0, 291, 290, 1, 0, 0, 0, 291, 292, 1, 0, 0, 0, 292, 294, 1, 0, 0, 0, 293, 295, 3, 34, 17, 0, 294, 293, 1, 0, 0, 0, 294, 295, 1, 0, 0, 0, 295, 31, 1, 0, 0, 0, 296, 297, 7, 2, 0, 0, 297, 33, 1, 0, 0, 0, 298, 299, 5, 72, 0, 0, 299, 304, 3, 36, 18, 0, 300, 301, 5, 35, 0, 0, 301, 303, 3, 36, 18, 0, 302, 300, 1, 0, 0, 0, 303, 306, 1, 0, 0, 0, 304, 302, 1, 0, 0, 0, 304, 305, 1, 0, 0, 0, 305, 35, 1, 0, 0, 0, 306, 304, 1, 0, 0, 0, 307, 308, 3, 92, 46, 0, 308, 309, 5, 33, 0, 0, 309, 310, 3, 92, 46, 0, 310, 37, 1, 0, 0, 0, 311, 314, 3, 40, 20, 0, 312, 314, 3, 42, 21, 0, 313, 311, 1, 0, 0, 0, 313, 312, 1, 0, 0, 0, 314, 39, 1, 0, 0, 0, 315, 316, 5, 73, 0, 0, 316, 321, 3, 32, 16, 0, 317, 318, 5, 35, 0, 0, 318, 320, 3, 32, 16, 0, 319, 317, 1, 0, 0, 0, 320, 323, 1, 0, 0, 0, 321, 319, 1, 0, 0, 0, 321, 322, 1, 0, 0, 0, 322, 41, 1, 0, 0, 0, 323, 321, 1, 0, 0, 0, 324, 325, 5, 65, 0, 0, 325, 326, 3, 40, 20, 0, 326, 327, 5, 66, 0, 0, 327, 43, 1, 0, 0, 0, 328, 329, 5, 4, 0, 0, 329, 330, 3, 26, 13, 0, 330, 45, 1, 0, 0, 0, 331, 333, 5, 17, 0, 0, 332, 334, 3, 26, 13, 0, 333, 332, 1, 0, 0, 0, 333, 334, 1, 0, 0, 0, 334, 337, 1, 0, 0, 0, 335, 336, 5, 30, 0, 0, 336, 338, 3, 26, 13, 0, 337, 335, 1, 0, 0, 0, 337, 338, 1, 0, 0, 0, 338, 47, 1, 0, 0, 0, 339, 340, 5, 8, 0, 0, 340, 343, 3, 26, 13, 0, 341, 342, 5, 30, 0, 0, 342, 344, 3, 26, 13, 0, 343, 341, 1, 0, 0, 0, 343, 344, 1, 0, 0, 0, 344, 49, 1, 0, 0, 0, 345, 350, 3, 54, 27, 0, 346, 347, 5, 37, 0, 0, 347, 349, 3, 54, 27, 0, 348, 346, 1, 0, 0, 0, 349, 352, 1, 0, 0, 0, 350, 348, 1, 0, 0, 0, 350, 351, 1, 0, 0, 0, 351, 51, 1, 0, 0, 0, 352, 350, 1, 0, 0, 0, 353, 358, 3, 56, 28, 0, 354, 355, 5, 37, 0, 0, 355, 357, 3, 56, 28, 0, 356, 354, 1, 0, 0, 0, 357, 360, 1, 0, 0, 0, 358, 356, 1, 0, 0, 0, 358, 359, 1, 0, 0, 0, 359, 53, 1, 0, 0, 0, 360, 358, 1, 0, 0, 0, 361, 362, 7, 3, 0, 0, 362, 55, 1, 0, 0, 0, 363, 364, 5, 78, 0, 0, 364, 57, 1, 0, 0, 0, 365, 408, 5, 46, 0, 0, 366, 367, 3, 90, 45, 0, 367, 368, 5, 67, 0, 0, 368, 408, 1, 0, 0, 0, 369, 408, 3, 88, 44, 0, 370, 408, 3, 90, 45, 0, 371, 408, 3, 84, 42, 0, 372, 408, 5, 49, 0, 0, 373, 408, 3, 92, 46, 0, 374, 375, 5, 65, 0, 0, 375, 380, 3, 86, 43, 0, 376, 377, 5, 35, 0, 0, 377, 379, 3, 86, 43, 0, 378, 376, 1, 0, 0, 0, 379, 382, 1, 0, 0, 0, 380, 378, 1, 0, 0, 0, 380, 381, 1, 0, 0, 0, 381, 383, 1, 0, 0, 0, 382, 380, 1, 0, 0, 0, 383, 384, 5, 66, 0, 0, 384, 408, 1, 0, 0, 0, 385, 386, 5, 65, 0, 0, 386, 391, 3, 84, 42, 0, 387, 388, 5, 35, 0, 0, 388, 390, 3, 84, 42, 0, 389, 387, 1, 0, 0, 0, 390, 393, 1, 0, 0, 0, 391, 389, 1, 0, 0, 0, 391, 392, 1, 0, 0, 0, 392, 394, 1, 0, 0, 0, 393, 391, 1, 0, 0, 0, 394, 395, 5, 66, 0, 0, 395, 408, 1, 0, 0, 0, 396, 397, 5, 65, 0, 0, 397, 402, 3, 92, 46, 0, 398, 399, 5, 35, 0, 0, 399, 401, 3, 92, 46, 0, 400, 398, 1, 0, 0, 0, 401, 404, 1, 0, 0, 0, 402, 400, 1, 0, 0, 0, 402, 403, 1, 0, 0, 0, 403, 405, 1, 0, 0, 0, 404, 402, 1, 0, 0, 0, 405, 406, 5, 66, 0, 0, 406, 408, 1, 0, 0, 0, 407, 365, 1, 0, 0, 0, 407, 366, 1, 0, 0, 0, 407, 369, 1, 0, 0, 0, 407, 370, 1, 0, 0, 0, 407, 371, 1, 0, 0, 0, 407, 372, 1, 0, 0, 0, 407, 373, 1, 0, 0, 0, 407, 374, 1, 0, 0, 0, 407, 385, 1, 0, 0, 0, 407, 396, 1, 0, 0, 0, 408, 59, 1, 0, 0, 0, 409, 410, 5, 10, 0, 0, 410, 411, 5, 28, 0, 0, 411, 61, 1, 0, 0, 0, 412, 413, 5, 16, 0, 0, 413, 418, 3, 64, 32, 0, 414, 415, 5, 35, 0, 0, 415, 417, 3, 64, 32, 0, 416, 414, 1, 0, 0, 0, 417, 420, 1, 0, 0, 0, 418, 416, 1, 0, 0, 0, 418, 419, 1, 0, 0, 0, 419, 63, 1, 0, 0, 0, 420, 418, 1, 0, 0, 0, 421, 423, 3, 10, 5, 0, 422, 424, 7, 4, 0, 0, 423, 422, 1, 0, 0, 0, 423, 424, 1, 0, 0, 0, 424, 427, 1, 0, 0, 0, 425, 426, 5, 47, 0, 0, 426, 428, 7, 5, 0, 0, 427, 425, 1, 0, 0, 0, 427, 428, 1, 0, 0, 0, 428, 65, 1, 0, 0, 0, 429, 430, 5, 9, 0, 0, 430, 435, 3, 52, 26, 0, 431, 432, 5, 35, 0, 0, 432, 434, 3, 52, 26, 0, 433, 431, 1, 0, 0, 0, 434, 437, 1, 0, 0, 0, 435, 433, 1, 0, 0, 0, 435, 436, 1, 0, 0, 0, 436, 67, 1, 0, 0, 0, 437, 435, 1, 0, 0, 0, 438, 439, 5, 2, 0, 0, 439, 444, 3, 52, 26, 0, 440, 441, 5, 35, 0, 0, 441, 443, 3, 52, 26, 0, 442, 440, 1, 0, 0, 0, 443, 446, 1, 0, 0, 0, 444, 442, 1, 0, 0, 0, 444, 445, 1, 0, 0, 0, 445, 69, 1, 0, 0, 0, 446, 444, 1, 0, 0, 0, 447, 448, 5, 13, 0, 0, 448, 453, 3, 72, 36, 0, 449, 450, 5, 35, 0, 0, 450, 452, 3, 72, 36, 0, 451, 449, 1, 0, 0, 0, 452, 455, 1, 0, 0, 0, 453, 451, 1, 0, 0, 0, 453, 454, 1, 0, 0, 0, 454, 71, 1, 0, 0, 0, 455, 453, 1, 0, 0, 0, 456, 457, 3, 52, 26, 0, 457, 458, 5, 82, 0, 0, 458, 459, 3, 52, 26, 0, 459, 73, 1, 0, 0, 0, 460, 461, 5, 1, 0, 0, 461, 462, 3, 18, 9, 0, 462, 464, 3, 92, 46, 0, 463, 465, 3, 80, 40, 0, 464, 463, 1, 0, 0, 0, 464, 465, 1, 0, 0, 0, 465, 75, 1, 0, 0, 0, 466, 467, 5, 7, 0, 0, 467, 468, 3, 18, 9, 0, 468, 469, 3, 92, 46, 0, 469, 77, 1, 0, 0, 0, 470, 471, 5, 12, 0, 0, 471, 472, 3, 50, 25, 0, 472, 79, 1, 0, 0, 0, 473, 478, 3, 82, 41, 0, 474, 475, 5, 35, 0, 0, 475, 477, 3, 82, 41, 0, 476, 474, 1, 0, 0, 0, 477, 480, 1, 0, 0, 0, 478, 476, 1, 0, 0, 0, 478, 479, 1, 0, 0, 0, 479, 81, 1, 0, 0, 0, 480, 478, 1, 0, 0, 0, 481, 482, 3, 54, 27, 0, 482, 483, 5, 33, 0, 0, 483, 484, 3, 58, 29, 0, 484, 83, 1, 0, 0, 0, 485, 486, 7, 6, 0, 0, 486, 85, 1, 0, 0, 0, 487, 490, 3, 88, 44, 0, 488, 490, 3, 90, 45, 0, 489, 487, 1, 0, 0, 0, 489, 488, 1, 0, 0, 0, 490, 87, 1, 0, 0, 0, 491, 493, 7, 0, 0, 0, 492, 491, 1, 0, 0, 0, 492, 493, 1, 0, 0, 0, 493, 494, 1, 0, 0, 0, 494, 495, 5, 29, 0, 0, 495, 89, 1, 0, 0, 0, 496, 498, 7, 0, 0, 0, 497, 496, 1, 0, 0, 0, 497, 498, 1, 0, 0, 0, 498, 499, 1, 0, 0, 0, 499, 500, 5, 28, 0, 0, 500, 91, 1, 0, 0, 0, 501, 502, 5, 27, 0, 0, 502, 93, 1, 0, 0, 0, 503, 504, 7, 7, 0, 0, 504, 95, 1, 0, 0, 0, 505, 506, 5, 5, 0, 0, 506, 507, 3, 98, 49, 0, 507, 97, 1, 0, 0, 0, 508, 509, 5, 65, 0, 0, 509, 510, 3, 2, 1, 0, 510, 511, 5, 66, 0, 0, 511, 99, 1, 0, 0, 0, 512, 513, 5, 15, 0, 0, 513, 514, 5, 98, 0, 0, 514, 101, 1, 0, 0, 0, 515, 516, 5, 11, 0, 0, 516, 517, 5, 102, 0, 0, 517, 103, 1, 0, 0, 0, 518, 519, 5, 3, 0, 0, 519, 522, 5, 88, 0, 0, 520, 521, 5, 86, 0, 0, 521, 523, 3, 52, 26, 0, 522, 520, 1, 0, 0, 0, 522, 523, 1, 0, 0, 0, 523, 533, 1, 0, 0, 0, 524, 525, 5, 87, 0, 0, 525, 530, 3, 106, 53, 0, 526, 527, 5, 35, 0, 0, 527, 529, 3, 106, 53, 0, 528, 526, 1, 0, 0, 0, 529, 532, 1, 0, 0, 0, 530, 528, 1, 0, 0, 0, 530, 531, 1, 0, 0, 0, 531, 534, 1, 0, 0, 0, 532, 530, 1, 0, 0, 0, 533, 524, 1, 0, 0, 0, 533, 534, 1, 0, 0, 0, 534, 105, 1, 0, 0, 0, 535, 536, 3, 52, 26, 0, 536, 537, 5, 33, 0, 0, 537, 539, 1, 0, 0, 0, 538, 535, 1, 0, 0, 0, 538, 539, 1, 0, 0, 0, 539, 540, 1, 0, 0, 0, 540, 541, 3, 52, 26, 0, 541, 107, 1, 0, 0, 0, 52, 119, 127, 142, 154, 163, 171, 175, 183, 185, 190, 197, 202, 209, 215, 223, 225, 236, 243, 254, 257, 271, 279, 287, 291, 294, 304, 313, 321, 333, 337, 343, 350, 358, 380, 391, 402, 407, 418, 423, 427, 435, 444, 453, 464, 478, 489, 492, 497, 522, 530, 533, 538]
\ No newline at end of file
+[4, 1, 110, 543, 2, 0, 7, 0, 2, 1, 7, 1, 2, 2, 7, 2, 2, 3, 7, 3, 2, 4, 7, 4, 2, 5, 7, 5, 2, 6, 7, 6, 2, 7, 7, 7, 2, 8, 7, 8, 2, 9, 7, 9, 2, 10, 7, 10, 2, 11, 7, 11, 2, 12, 7, 12, 2, 13, 7, 13, 2, 14, 7, 14, 2, 15, 7, 15, 2, 16, 7, 16, 2, 17, 7, 17, 2, 18, 7, 18, 2, 19, 7, 19, 2, 20, 7, 20, 2, 21, 7, 21, 2, 22, 7, 22, 2, 23, 7, 23, 2, 24, 7, 24, 2, 25, 7, 25, 2, 26, 7, 26, 2, 27, 7, 27, 2, 28, 7, 28, 2, 29, 7, 29, 2, 30, 7, 30, 2, 31, 7, 31, 2, 32, 7, 32, 2, 33, 7, 33, 2, 34, 7, 34, 2, 35, 7, 35, 2, 36, 7, 36, 2, 37, 7, 37, 2, 38, 7, 38, 2, 39, 7, 39, 2, 40, 7, 40, 2, 41, 7, 41, 2, 42, 7, 42, 2, 43, 7, 43, 2, 44, 7, 44, 2, 45, 7, 45, 2, 46, 7, 46, 2, 47, 7, 47, 2, 48, 7, 48, 2, 49, 7, 49, 2, 50, 7, 50, 2, 51, 7, 51, 2, 52, 7, 52, 2, 53, 7, 53, 1, 0, 1, 0, 1, 0, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 5, 1, 118, 8, 1, 10, 1, 12, 1, 121, 9, 1, 1, 2, 1, 2, 1, 2, 1, 2, 1, 2, 3, 2, 128, 8, 2, 1, 3, 1, 3, 1, 3, 1, 3, 1, 3, 1, 3, 1, 3, 1, 3, 1, 3, 1, 3, 1, 3, 1, 3, 1, 3, 3, 3, 143, 8, 3, 1, 4, 1, 4, 1, 4, 1, 5, 1, 5, 1, 5, 1, 5, 1, 5, 1, 5, 1, 5, 3, 5, 155, 8, 5, 1, 5, 1, 5, 1, 5, 1, 5, 1, 5, 5, 5, 162, 8, 5, 10, 5, 12, 5, 165, 9, 5, 1, 5, 1, 5, 1, 5, 1, 5, 1, 5, 3, 5, 172, 8, 5, 1, 5, 1, 5, 3, 5, 176, 8, 5, 1, 5, 1, 5, 1, 5, 1, 5, 1, 5, 1, 5, 5, 5, 184, 8, 5, 10, 5, 12, 5, 187, 9, 5, 1, 6, 1, 6, 3, 6, 191, 8, 6, 1, 6, 1, 6, 1, 6, 1, 6, 1, 6, 3, 6, 198, 8, 6, 1, 6, 1, 6, 1, 6, 3, 6, 203, 8, 6, 1, 7, 1, 7, 1, 7, 1, 7, 1, 7, 3, 7, 210, 8, 7, 1, 8, 1, 8, 1, 8, 1, 8, 3, 8, 216, 8, 8, 1, 8, 1, 8, 1, 8, 1, 8, 1, 8, 1, 8, 5, 8, 224, 8, 8, 10, 8, 12, 8, 227, 9, 8, 1, 9, 1, 9, 1, 9, 1, 9, 1, 9, 1, 9, 1, 9, 1, 9, 3, 9, 237, 8, 9, 1, 9, 1, 9, 1, 9, 5, 9, 242, 8, 9, 10, 9, 12, 9, 245, 9, 9, 1, 10, 1, 10, 1, 10, 1, 10, 1, 10, 1, 10, 5, 10, 253, 8, 10, 10, 10, 12, 10, 256, 9, 10, 3, 10, 258, 8, 10, 1, 10, 1, 10, 1, 11, 1, 11, 1, 12, 1, 12, 1, 12, 1, 13, 1, 13, 1, 13, 5, 13, 270, 8, 13, 10, 13, 12, 13, 273, 9, 13, 1, 14, 1, 14, 1, 14, 1, 14, 1, 14, 3, 14, 280, 8, 14, 1, 15, 1, 15, 1, 15, 1, 15, 5, 15, 286, 8, 15, 10, 15, 12, 15, 289, 9, 15, 1, 15, 3, 15, 292, 8, 15, 1, 15, 3, 15, 295, 8, 15, 1, 16, 1, 16, 1, 17, 1, 17, 1, 17, 1, 17, 5, 17, 303, 8, 17, 10, 17, 12, 17, 306, 9, 17, 1, 18, 1, 18, 1, 18, 1, 18, 1, 19, 1, 19, 3, 19, 314, 8, 19, 1, 20, 1, 20, 1, 20, 1, 20, 5, 20, 320, 8, 20, 10, 20, 12, 20, 323, 9, 20, 1, 21, 1, 21, 1, 21, 1, 21, 1, 22, 1, 22, 1, 22, 1, 23, 1, 23, 3, 23, 334, 8, 23, 1, 23, 1, 23, 3, 23, 338, 8, 23, 1, 24, 1, 24, 1, 24, 1, 24, 3, 24, 344, 8, 24, 1, 25, 1, 25, 1, 25, 5, 25, 349, 8, 25, 10, 25, 12, 25, 352, 9, 25, 1, 26, 1, 26, 1, 26, 5, 26, 357, 8, 26, 10, 26, 12, 26, 360, 9, 26, 1, 27, 1, 27, 1, 28, 1, 28, 1, 29, 1, 29, 1, 29, 1, 29, 1, 29, 1, 29, 1, 29, 1, 29, 1, 29, 1, 29, 1, 29, 1, 29, 1, 29, 5, 29, 379, 8, 29, 10, 29, 12, 29, 382, 9, 29, 1, 29, 1, 29, 1, 29, 1, 29, 1, 29, 1, 29, 5, 29, 390, 8, 29, 10, 29, 12, 29, 393, 9, 29, 1, 29, 1, 29, 1, 29, 1, 29, 1, 29, 1, 29, 5, 29, 401, 8, 29, 10, 29, 12, 29, 404, 9, 29, 1, 29, 1, 29, 3, 29, 408, 8, 29, 1, 30, 1, 30, 1, 30, 1, 31, 1, 31, 1, 31, 1, 31, 5, 31, 417, 8, 31, 10, 31, 12, 31, 420, 9, 31, 1, 32, 1, 32, 3, 32, 424, 8, 32, 1, 32, 1, 32, 3, 32, 428, 8, 32, 1, 33, 1, 33, 1, 33, 1, 33, 5, 33, 434, 8, 33, 10, 33, 12, 33, 437, 9, 33, 1, 34, 1, 34, 1, 34, 1, 34, 5, 34, 443, 8, 34, 10, 34, 12, 34, 446, 9, 34, 1, 35, 1, 35, 1, 35, 1, 35, 5, 35, 452, 8, 35, 10, 35, 12, 35, 455, 9, 35, 1, 36, 1, 36, 1, 36, 1, 36, 1, 37, 1, 37, 1, 37, 1, 37, 3, 37, 465, 8, 37, 1, 38, 1, 38, 1, 38, 1, 38, 1, 39, 1, 39, 1, 39, 1, 40, 1, 40, 1, 40, 5, 40, 477, 8, 40, 10, 40, 12, 40, 480, 9, 40, 1, 41, 1, 41, 1, 41, 1, 41, 1, 42, 1, 42, 1, 43, 1, 43, 3, 43, 490, 8, 43, 1, 44, 3, 44, 493, 8, 44, 1, 44, 1, 44, 1, 45, 3, 45, 498, 8, 45, 1, 45, 1, 45, 1, 46, 1, 46, 1, 47, 1, 47, 1, 48, 1, 48, 1, 48, 1, 49, 1, 49, 1, 49, 1, 49, 1, 50, 1, 50, 1, 50, 1, 51, 1, 51, 1, 51, 1, 52, 1, 52, 1, 52, 1, 52, 3, 52, 523, 8, 52, 1, 52, 1, 52, 1, 52, 1, 52, 5, 52, 529, 8, 52, 10, 52, 12, 52, 532, 9, 52, 3, 52, 534, 8, 52, 1, 53, 1, 53, 1, 53, 3, 53, 539, 8, 53, 1, 53, 1, 53, 1, 53, 0, 4, 2, 10, 16, 18, 54, 0, 2, 4, 6, 8, 10, 12, 14, 16, 18, 20, 22, 24, 26, 28, 30, 32, 34, 36, 38, 40, 42, 44, 46, 48, 50, 52, 54, 56, 58, 60, 62, 64, 66, 68, 70, 72, 74, 76, 78, 80, 82, 84, 86, 88, 90, 92, 94, 96, 98, 100, 102, 104, 106, 0, 7, 1, 0, 60, 61, 1, 0, 62, 64, 1, 0, 67, 68, 2, 0, 32, 32, 36, 36, 1, 0, 39, 40, 2, 0, 38, 38, 52, 52, 2, 0, 53, 53, 55, 59, 568, 0, 108, 1, 0, 0, 0, 2, 111, 1, 0, 0, 0, 4, 127, 1, 0, 0, 0, 6, 142, 1, 0, 0, 0, 8, 144, 1, 0, 0, 0, 10, 175, 1, 0, 0, 0, 12, 202, 1, 0, 0, 0, 14, 209, 1, 0, 0, 0, 16, 215, 1, 0, 0, 0, 18, 236, 1, 0, 0, 0, 20, 246, 1, 0, 0, 0, 22, 261, 1, 0, 0, 0, 24, 263, 1, 0, 0, 0, 26, 266, 1, 0, 0, 0, 28, 279, 1, 0, 0, 0, 30, 281, 1, 0, 0, 0, 32, 296, 1, 0, 0, 0, 34, 298, 1, 0, 0, 0, 36, 307, 1, 0, 0, 0, 38, 313, 1, 0, 0, 0, 40, 315, 1, 0, 0, 0, 42, 324, 1, 0, 0, 0, 44, 328, 1, 0, 0, 0, 46, 331, 1, 0, 0, 0, 48, 339, 1, 0, 0, 0, 50, 345, 1, 0, 0, 0, 52, 353, 1, 0, 0, 0, 54, 361, 1, 0, 0, 0, 56, 363, 1, 0, 0, 0, 58, 407, 1, 0, 0, 0, 60, 409, 1, 0, 0, 0, 62, 412, 1, 0, 0, 0, 64, 421, 1, 0, 0, 0, 66, 429, 1, 0, 0, 0, 68, 438, 1, 0, 0, 0, 70, 447, 1, 0, 0, 0, 72, 456, 1, 0, 0, 0, 74, 460, 1, 0, 0, 0, 76, 466, 1, 0, 0, 0, 78, 470, 1, 0, 0, 0, 80, 473, 1, 0, 0, 0, 82, 481, 1, 0, 0, 0, 84, 485, 1, 0, 0, 0, 86, 489, 1, 0, 0, 0, 88, 492, 1, 0, 0, 0, 90, 497, 1, 0, 0, 0, 92, 501, 1, 0, 0, 0, 94, 503, 1, 0, 0, 0, 96, 505, 1, 0, 0, 0, 98, 508, 1, 0, 0, 0, 100, 512, 1, 0, 0, 0, 102, 515, 1, 0, 0, 0, 104, 518, 1, 0, 0, 0, 106, 538, 1, 0, 0, 0, 108, 109, 3, 2, 1, 0, 109, 110, 5, 0, 0, 1, 110, 1, 1, 0, 0, 0, 111, 112, 6, 1, -1, 0, 112, 113, 3, 4, 2, 0, 113, 119, 1, 0, 0, 0, 114, 115, 10, 1, 0, 0, 115, 116, 5, 26, 0, 0, 116, 118, 3, 6, 3, 0, 117, 114, 1, 0, 0, 0, 118, 121, 1, 0, 0, 0, 119, 117, 1, 0, 0, 0, 119, 120, 1, 0, 0, 0, 120, 3, 1, 0, 0, 0, 121, 119, 1, 0, 0, 0, 122, 128, 3, 96, 48, 0, 123, 128, 3, 30, 15, 0, 124, 128, 3, 24, 12, 0, 125, 128, 3, 100, 50, 0, 126, 128, 3, 102, 51, 0, 127, 122, 1, 0, 0, 0, 127, 123, 1, 0, 0, 0, 127, 124, 1, 0, 0, 0, 127, 125, 1, 0, 0, 0, 127, 126, 1, 0, 0, 0, 128, 5, 1, 0, 0, 0, 129, 143, 3, 44, 22, 0, 130, 143, 3, 48, 24, 0, 131, 143, 3, 60, 30, 0, 132, 143, 3, 66, 33, 0, 133, 143, 3, 62, 31, 0, 134, 143, 3, 46, 23, 0, 135, 143, 3, 8, 4, 0, 136, 143, 3, 68, 34, 0, 137, 143, 3, 70, 35, 0, 138, 143, 3, 74, 37, 0, 139, 143, 3, 76, 38, 0, 140, 143, 3, 104, 52, 0, 141, 143, 3, 78, 39, 0, 142, 129, 1, 0, 0, 0, 142, 130, 1, 0, 0, 0, 142, 131, 1, 0, 0, 0, 142, 132, 1, 0, 0, 0, 142, 133, 1, 0, 0, 0, 142, 134, 1, 0, 0, 0, 142, 135, 1, 0, 0, 0, 142, 136, 1, 0, 0, 0, 142, 137, 1, 0, 0, 0, 142, 138, 1, 0, 0, 0, 142, 139, 1, 0, 0, 0, 142, 140, 1, 0, 0, 0, 142, 141, 1, 0, 0, 0, 143, 7, 1, 0, 0, 0, 144, 145, 5, 18, 0, 0, 145, 146, 3, 10, 5, 0, 146, 9, 1, 0, 0, 0, 147, 148, 6, 5, -1, 0, 148, 149, 5, 45, 0, 0, 149, 176, 3, 10, 5, 7, 150, 176, 3, 14, 7, 0, 151, 176, 3, 12, 6, 0, 152, 154, 3, 14, 7, 0, 153, 155, 5, 45, 0, 0, 154, 153, 1, 0, 0, 0, 154, 155, 1, 0, 0, 0, 155, 156, 1, 0, 0, 0, 156, 157, 5, 42, 0, 0, 157, 158, 5, 41, 0, 0, 158, 163, 3, 14, 7, 0, 159, 160, 5, 35, 0, 0, 160, 162, 3, 14, 7, 0, 161, 159, 1, 0, 0, 0, 162, 165, 1, 0, 0, 0, 163, 161, 1, 0, 0, 0, 163, 164, 1, 0, 0, 0, 164, 166, 1, 0, 0, 0, 165, 163, 1, 0, 0, 0, 166, 167, 5, 51, 0, 0, 167, 176, 1, 0, 0, 0, 168, 169, 3, 14, 7, 0, 169, 171, 5, 43, 0, 0, 170, 172, 5, 45, 0, 0, 171, 170, 1, 0, 0, 0, 171, 172, 1, 0, 0, 0, 172, 173, 1, 0, 0, 0, 173, 174, 5, 46, 0, 0, 174, 176, 1, 0, 0, 0, 175, 147, 1, 0, 0, 0, 175, 150, 1, 0, 0, 0, 175, 151, 1, 0, 0, 0, 175, 152, 1, 0, 0, 0, 175, 168, 1, 0, 0, 0, 176, 185, 1, 0, 0, 0, 177, 178, 10, 4, 0, 0, 178, 179, 5, 31, 0, 0, 179, 184, 3, 10, 5, 5, 180, 181, 10, 3, 0, 0, 181, 182, 5, 48, 0, 0, 182, 184, 3, 10, 5, 4, 183, 177, 1, 0, 0, 0, 183, 180, 1, 0, 0, 0, 184, 187, 1, 0, 0, 0, 185, 183, 1, 0, 0, 0, 185, 186, 1, 0, 0, 0, 186, 11, 1, 0, 0, 0, 187, 185, 1, 0, 0, 0, 188, 190, 3, 14, 7, 0, 189, 191, 5, 45, 0, 0, 190, 189, 1, 0, 0, 0, 190, 191, 1, 0, 0, 0, 191, 192, 1, 0, 0, 0, 192, 193, 5, 44, 0, 0, 193, 194, 3, 92, 46, 0, 194, 203, 1, 0, 0, 0, 195, 197, 3, 14, 7, 0, 196, 198, 5, 45, 0, 0, 197, 196, 1, 0, 0, 0, 197, 198, 1, 0, 0, 0, 198, 199, 1, 0, 0, 0, 199, 200, 5, 50, 0, 0, 200, 201, 3, 92, 46, 0, 201, 203, 1, 0, 0, 0, 202, 188, 1, 0, 0, 0, 202, 195, 1, 0, 0, 0, 203, 13, 1, 0, 0, 0, 204, 210, 3, 16, 8, 0, 205, 206, 3, 16, 8, 0, 206, 207, 3, 94, 47, 0, 207, 208, 3, 16, 8, 0, 208, 210, 1, 0, 0, 0, 209, 204, 1, 0, 0, 0, 209, 205, 1, 0, 0, 0, 210, 15, 1, 0, 0, 0, 211, 212, 6, 8, -1, 0, 212, 216, 3, 18, 9, 0, 213, 214, 7, 0, 0, 0, 214, 216, 3, 16, 8, 3, 215, 211, 1, 0, 0, 0, 215, 213, 1, 0, 0, 0, 216, 225, 1, 0, 0, 0, 217, 218, 10, 2, 0, 0, 218, 219, 7, 1, 0, 0, 219, 224, 3, 16, 8, 3, 220, 221, 10, 1, 0, 0, 221, 222, 7, 0, 0, 0, 222, 224, 3, 16, 8, 2, 223, 217, 1, 0, 0, 0, 223, 220, 1, 0, 0, 0, 224, 227, 1, 0, 0, 0, 225, 223, 1, 0, 0, 0, 225, 226, 1, 0, 0, 0, 226, 17, 1, 0, 0, 0, 227, 225, 1, 0, 0, 0, 228, 229, 6, 9, -1, 0, 229, 237, 3, 58, 29, 0, 230, 237, 3, 50, 25, 0, 231, 237, 3, 20, 10, 0, 232, 233, 5, 41, 0, 0, 233, 234, 3, 10, 5, 0, 234, 235, 5, 51, 0, 0, 235, 237, 1, 0, 0, 0, 236, 228, 1, 0, 0, 0, 236, 230, 1, 0, 0, 0, 236, 231, 1, 0, 0, 0, 236, 232, 1, 0, 0, 0, 237, 243, 1, 0, 0, 0, 238, 239, 10, 1, 0, 0, 239, 240, 5, 34, 0, 0, 240, 242, 3, 22, 11, 0, 241, 238, 1, 0, 0, 0, 242, 245, 1, 0, 0, 0, 243, 241, 1, 0, 0, 0, 243, 244, 1, 0, 0, 0, 244, 19, 1, 0, 0, 0, 245, 243, 1, 0, 0, 0, 246, 247, 3, 54, 27, 0, 247, 257, 5, 41, 0, 0, 248, 258, 5, 62, 0, 0, 249, 254, 3, 10, 5, 0, 250, 251, 5, 35, 0, 0, 251, 253, 3, 10, 5, 0, 252, 250, 1, 0, 0, 0, 253, 256, 1, 0, 0, 0, 254, 252, 1, 0, 0, 0, 254, 255, 1, 0, 0, 0, 255, 258, 1, 0, 0, 0, 256, 254, 1, 0, 0, 0, 257, 248, 1, 0, 0, 0, 257, 249, 1, 0, 0, 0, 257, 258, 1, 0, 0, 0, 258, 259, 1, 0, 0, 0, 259, 260, 5, 51, 0, 0, 260, 21, 1, 0, 0, 0, 261, 262, 3, 54, 27, 0, 262, 23, 1, 0, 0, 0, 263, 264, 5, 14, 0, 0, 264, 265, 3, 26, 13, 0, 265, 25, 1, 0, 0, 0, 266, 271, 3, 28, 14, 0, 267, 268, 5, 35, 0, 0, 268, 270, 3, 28, 14, 0, 269, 267, 1, 0, 0, 0, 270, 273, 1, 0, 0, 0, 271, 269, 1, 0, 0, 0, 271, 272, 1, 0, 0, 0, 272, 27, 1, 0, 0, 0, 273, 271, 1, 0, 0, 0, 274, 280, 3, 10, 5, 0, 275, 276, 3, 50, 25, 0, 276, 277, 5, 33, 0, 0, 277, 278, 3, 10, 5, 0, 278, 280, 1, 0, 0, 0, 279, 274, 1, 0, 0, 0, 279, 275, 1, 0, 0, 0, 280, 29, 1, 0, 0, 0, 281, 282, 5, 6, 0, 0, 282, 287, 3, 32, 16, 0, 283, 284, 5, 35, 0, 0, 284, 286, 3, 32, 16, 0, 285, 283, 1, 0, 0, 0, 286, 289, 1, 0, 0, 0, 287, 285, 1, 0, 0, 0, 287, 288, 1, 0, 0, 0, 288, 291, 1, 0, 0, 0, 289, 287, 1, 0, 0, 0, 290, 292, 3, 38, 19, 0, 291, 290, 1, 0, 0, 0, 291, 292, 1, 0, 0, 0, 292, 294, 1, 0, 0, 0, 293, 295, 3, 34, 17, 0, 294, 293, 1, 0, 0, 0, 294, 295, 1, 0, 0, 0, 295, 31, 1, 0, 0, 0, 296, 297, 5, 74, 0, 0, 297, 33, 1, 0, 0, 0, 298, 299, 5, 72, 0, 0, 299, 304, 3, 36, 18, 0, 300, 301, 5, 35, 0, 0, 301, 303, 3, 36, 18, 0, 302, 300, 1, 0, 0, 0, 303, 306, 1, 0, 0, 0, 304, 302, 1, 0, 0, 0, 304, 305, 1, 0, 0, 0, 305, 35, 1, 0, 0, 0, 306, 304, 1, 0, 0, 0, 307, 308, 3, 92, 46, 0, 308, 309, 5, 33, 0, 0, 309, 310, 3, 92, 46, 0, 310, 37, 1, 0, 0, 0, 311, 314, 3, 40, 20, 0, 312, 314, 3, 42, 21, 0, 313, 311, 1, 0, 0, 0, 313, 312, 1, 0, 0, 0, 314, 39, 1, 0, 0, 0, 315, 316, 5, 73, 0, 0, 316, 321, 3, 32, 16, 0, 317, 318, 5, 35, 0, 0, 318, 320, 3, 32, 16, 0, 319, 317, 1, 0, 0, 0, 320, 323, 1, 0, 0, 0, 321, 319, 1, 0, 0, 0, 321, 322, 1, 0, 0, 0, 322, 41, 1, 0, 0, 0, 323, 321, 1, 0, 0, 0, 324, 325, 5, 65, 0, 0, 325, 326, 3, 40, 20, 0, 326, 327, 5, 66, 0, 0, 327, 43, 1, 0, 0, 0, 328, 329, 5, 4, 0, 0, 329, 330, 3, 26, 13, 0, 330, 45, 1, 0, 0, 0, 331, 333, 5, 17, 0, 0, 332, 334, 3, 26, 13, 0, 333, 332, 1, 0, 0, 0, 333, 334, 1, 0, 0, 0, 334, 337, 1, 0, 0, 0, 335, 336, 5, 30, 0, 0, 336, 338, 3, 26, 13, 0, 337, 335, 1, 0, 0, 0, 337, 338, 1, 0, 0, 0, 338, 47, 1, 0, 0, 0, 339, 340, 5, 8, 0, 0, 340, 343, 3, 26, 13, 0, 341, 342, 5, 30, 0, 0, 342, 344, 3, 26, 13, 0, 343, 341, 1, 0, 0, 0, 343, 344, 1, 0, 0, 0, 344, 49, 1, 0, 0, 0, 345, 350, 3, 54, 27, 0, 346, 347, 5, 37, 0, 0, 347, 349, 3, 54, 27, 0, 348, 346, 1, 0, 0, 0, 349, 352, 1, 0, 0, 0, 350, 348, 1, 0, 0, 0, 350, 351, 1, 0, 0, 0, 351, 51, 1, 0, 0, 0, 352, 350, 1, 0, 0, 0, 353, 358, 3, 56, 28, 0, 354, 355, 5, 37, 0, 0, 355, 357, 3, 56, 28, 0, 356, 354, 1, 0, 0, 0, 357, 360, 1, 0, 0, 0, 358, 356, 1, 0, 0, 0, 358, 359, 1, 0, 0, 0, 359, 53, 1, 0, 0, 0, 360, 358, 1, 0, 0, 0, 361, 362, 7, 2, 0, 0, 362, 55, 1, 0, 0, 0, 363, 364, 5, 78, 0, 0, 364, 57, 1, 0, 0, 0, 365, 408, 5, 46, 0, 0, 366, 367, 3, 90, 45, 0, 367, 368, 5, 67, 0, 0, 368, 408, 1, 0, 0, 0, 369, 408, 3, 88, 44, 0, 370, 408, 3, 90, 45, 0, 371, 408, 3, 84, 42, 0, 372, 408, 5, 49, 0, 0, 373, 408, 3, 92, 46, 0, 374, 375, 5, 65, 0, 0, 375, 380, 3, 86, 43, 0, 376, 377, 5, 35, 0, 0, 377, 379, 3, 86, 43, 0, 378, 376, 1, 0, 0, 0, 379, 382, 1, 0, 0, 0, 380, 378, 1, 0, 0, 0, 380, 381, 1, 0, 0, 0, 381, 383, 1, 0, 0, 0, 382, 380, 1, 0, 0, 0, 383, 384, 5, 66, 0, 0, 384, 408, 1, 0, 0, 0, 385, 386, 5, 65, 0, 0, 386, 391, 3, 84, 42, 0, 387, 388, 5, 35, 0, 0, 388, 390, 3, 84, 42, 0, 389, 387, 1, 0, 0, 0, 390, 393, 1, 0, 0, 0, 391, 389, 1, 0, 0, 0, 391, 392, 1, 0, 0, 0, 392, 394, 1, 0, 0, 0, 393, 391, 1, 0, 0, 0, 394, 395, 5, 66, 0, 0, 395, 408, 1, 0, 0, 0, 396, 397, 5, 65, 0, 0, 397, 402, 3, 92, 46, 0, 398, 399, 5, 35, 0, 0, 399, 401, 3, 92, 46, 0, 400, 398, 1, 0, 0, 0, 401, 404, 1, 0, 0, 0, 402, 400, 1, 0, 0, 0, 402, 403, 1, 0, 0, 0, 403, 405, 1, 0, 0, 0, 404, 402, 1, 0, 0, 0, 405, 406, 5, 66, 0, 0, 406, 408, 1, 0, 0, 0, 407, 365, 1, 0, 0, 0, 407, 366, 1, 0, 0, 0, 407, 369, 1, 0, 0, 0, 407, 370, 1, 0, 0, 0, 407, 371, 1, 0, 0, 0, 407, 372, 1, 0, 0, 0, 407, 373, 1, 0, 0, 0, 407, 374, 1, 0, 0, 0, 407, 385, 1, 0, 0, 0, 407, 396, 1, 0, 0, 0, 408, 59, 1, 0, 0, 0, 409, 410, 5, 10, 0, 0, 410, 411, 5, 28, 0, 0, 411, 61, 1, 0, 0, 0, 412, 413, 5, 16, 0, 0, 413, 418, 3, 64, 32, 0, 414, 415, 5, 35, 0, 0, 415, 417, 3, 64, 32, 0, 416, 414, 1, 0, 0, 0, 417, 420, 1, 0, 0, 0, 418, 416, 1, 0, 0, 0, 418, 419, 1, 0, 0, 0, 419, 63, 1, 0, 0, 0, 420, 418, 1, 0, 0, 0, 421, 423, 3, 10, 5, 0, 422, 424, 7, 3, 0, 0, 423, 422, 1, 0, 0, 0, 423, 424, 1, 0, 0, 0, 424, 427, 1, 0, 0, 0, 425, 426, 5, 47, 0, 0, 426, 428, 7, 4, 0, 0, 427, 425, 1, 0, 0, 0, 427, 428, 1, 0, 0, 0, 428, 65, 1, 0, 0, 0, 429, 430, 5, 9, 0, 0, 430, 435, 3, 52, 26, 0, 431, 432, 5, 35, 0, 0, 432, 434, 3, 52, 26, 0, 433, 431, 1, 0, 0, 0, 434, 437, 1, 0, 0, 0, 435, 433, 1, 0, 0, 0, 435, 436, 1, 0, 0, 0, 436, 67, 1, 0, 0, 0, 437, 435, 1, 0, 0, 0, 438, 439, 5, 2, 0, 0, 439, 444, 3, 52, 26, 0, 440, 441, 5, 35, 0, 0, 441, 443, 3, 52, 26, 0, 442, 440, 1, 0, 0, 0, 443, 446, 1, 0, 0, 0, 444, 442, 1, 0, 0, 0, 444, 445, 1, 0, 0, 0, 445, 69, 1, 0, 0, 0, 446, 444, 1, 0, 0, 0, 447, 448, 5, 13, 0, 0, 448, 453, 3, 72, 36, 0, 449, 450, 5, 35, 0, 0, 450, 452, 3, 72, 36, 0, 451, 449, 1, 0, 0, 0, 452, 455, 1, 0, 0, 0, 453, 451, 1, 0, 0, 0, 453, 454, 1, 0, 0, 0, 454, 71, 1, 0, 0, 0, 455, 453, 1, 0, 0, 0, 456, 457, 3, 52, 26, 0, 457, 458, 5, 82, 0, 0, 458, 459, 3, 52, 26, 0, 459, 73, 1, 0, 0, 0, 460, 461, 5, 1, 0, 0, 461, 462, 3, 18, 9, 0, 462, 464, 3, 92, 46, 0, 463, 465, 3, 80, 40, 0, 464, 463, 1, 0, 0, 0, 464, 465, 1, 0, 0, 0, 465, 75, 1, 0, 0, 0, 466, 467, 5, 7, 0, 0, 467, 468, 3, 18, 9, 0, 468, 469, 3, 92, 46, 0, 469, 77, 1, 0, 0, 0, 470, 471, 5, 12, 0, 0, 471, 472, 3, 50, 25, 0, 472, 79, 1, 0, 0, 0, 473, 478, 3, 82, 41, 0, 474, 475, 5, 35, 0, 0, 475, 477, 3, 82, 41, 0, 476, 474, 1, 0, 0, 0, 477, 480, 1, 0, 0, 0, 478, 476, 1, 0, 0, 0, 478, 479, 1, 0, 0, 0, 479, 81, 1, 0, 0, 0, 480, 478, 1, 0, 0, 0, 481, 482, 3, 54, 27, 0, 482, 483, 5, 33, 0, 0, 483, 484, 3, 58, 29, 0, 484, 83, 1, 0, 0, 0, 485, 486, 7, 5, 0, 0, 486, 85, 1, 0, 0, 0, 487, 490, 3, 88, 44, 0, 488, 490, 3, 90, 45, 0, 489, 487, 1, 0, 0, 0, 489, 488, 1, 0, 0, 0, 490, 87, 1, 0, 0, 0, 491, 493, 7, 0, 0, 0, 492, 491, 1, 0, 0, 0, 492, 493, 1, 0, 0, 0, 493, 494, 1, 0, 0, 0, 494, 495, 5, 29, 0, 0, 495, 89, 1, 0, 0, 0, 496, 498, 7, 0, 0, 0, 497, 496, 1, 0, 0, 0, 497, 498, 1, 0, 0, 0, 498, 499, 1, 0, 0, 0, 499, 500, 5, 28, 0, 0, 500, 91, 1, 0, 0, 0, 501, 502, 5, 27, 0, 0, 502, 93, 1, 0, 0, 0, 503, 504, 7, 6, 0, 0, 504, 95, 1, 0, 0, 0, 505, 506, 5, 5, 0, 0, 506, 507, 3, 98, 49, 0, 507, 97, 1, 0, 0, 0, 508, 509, 5, 65, 0, 0, 509, 510, 3, 2, 1, 0, 510, 511, 5, 66, 0, 0, 511, 99, 1, 0, 0, 0, 512, 513, 5, 15, 0, 0, 513, 514, 5, 98, 0, 0, 514, 101, 1, 0, 0, 0, 515, 516, 5, 11, 0, 0, 516, 517, 5, 102, 0, 0, 517, 103, 1, 0, 0, 0, 518, 519, 5, 3, 0, 0, 519, 522, 5, 88, 0, 0, 520, 521, 5, 86, 0, 0, 521, 523, 3, 52, 26, 0, 522, 520, 1, 0, 0, 0, 522, 523, 1, 0, 0, 0, 523, 533, 1, 0, 0, 0, 524, 525, 5, 87, 0, 0, 525, 530, 3, 106, 53, 0, 526, 527, 5, 35, 0, 0, 527, 529, 3, 106, 53, 0, 528, 526, 1, 0, 0, 0, 529, 532, 1, 0, 0, 0, 530, 528, 1, 0, 0, 0, 530, 531, 1, 0, 0, 0, 531, 534, 1, 0, 0, 0, 532, 530, 1, 0, 0, 0, 533, 524, 1, 0, 0, 0, 533, 534, 1, 0, 0, 0, 534, 105, 1, 0, 0, 0, 535, 536, 3, 52, 26, 0, 536, 537, 5, 33, 0, 0, 537, 539, 1, 0, 0, 0, 538, 535, 1, 0, 0, 0, 538, 539, 1, 0, 0, 0, 539, 540, 1, 0, 0, 0, 540, 541, 3, 52, 26, 0, 541, 107, 1, 0, 0, 0, 52, 119, 127, 142, 154, 163, 171, 175, 183, 185, 190, 197, 202, 209, 215, 223, 225, 236, 243, 254, 257, 271, 279, 287, 291, 294, 304, 313, 321, 333, 337, 343, 350, 358, 380, 391, 402, 407, 418, 423, 427, 435, 444, 453, 464, 478, 489, 492, 497, 522, 530, 533, 538]
\ No newline at end of file
diff --git a/packages/kbn-esql-ast/src/antlr/esql_parser.ts b/packages/kbn-esql-ast/src/antlr/esql_parser.ts
index 19b9a742ae2285..f8151aae343e80 100644
--- a/packages/kbn-esql-ast/src/antlr/esql_parser.ts
+++ b/packages/kbn-esql-ast/src/antlr/esql_parser.ts
@@ -1484,19 +1484,11 @@ export default class esql_parser extends Parser {
 	public fromIdentifier(): FromIdentifierContext {
 		let localctx: FromIdentifierContext = new FromIdentifierContext(this, this._ctx, this.state);
 		this.enterRule(localctx, 32, esql_parser.RULE_fromIdentifier);
-		let _la: number;
 		try {
 			this.enterOuterAlt(localctx, 1);
 			{
 			this.state = 296;
-			_la = this._input.LA(1);
-			if(!(_la===68 || _la===74)) {
-			this._errHandler.recoverInline(this);
-			}
-			else {
-				this._errHandler.reportMatch(this);
-			    this.consume();
-			}
+			this.match(esql_parser.FROM_UNQUOTED_IDENTIFIER);
 			}
 		}
 		catch (re) {
@@ -3125,140 +3117,140 @@ export default class esql_parser extends Parser {
 	532,9,52,3,52,534,8,52,1,53,1,53,1,53,3,53,539,8,53,1,53,1,53,1,53,0,4,
 	2,10,16,18,54,0,2,4,6,8,10,12,14,16,18,20,22,24,26,28,30,32,34,36,38,40,
 	42,44,46,48,50,52,54,56,58,60,62,64,66,68,70,72,74,76,78,80,82,84,86,88,
-	90,92,94,96,98,100,102,104,106,0,8,1,0,60,61,1,0,62,64,2,0,68,68,74,74,
-	1,0,67,68,2,0,32,32,36,36,1,0,39,40,2,0,38,38,52,52,2,0,53,53,55,59,568,
-	0,108,1,0,0,0,2,111,1,0,0,0,4,127,1,0,0,0,6,142,1,0,0,0,8,144,1,0,0,0,10,
-	175,1,0,0,0,12,202,1,0,0,0,14,209,1,0,0,0,16,215,1,0,0,0,18,236,1,0,0,0,
-	20,246,1,0,0,0,22,261,1,0,0,0,24,263,1,0,0,0,26,266,1,0,0,0,28,279,1,0,
-	0,0,30,281,1,0,0,0,32,296,1,0,0,0,34,298,1,0,0,0,36,307,1,0,0,0,38,313,
-	1,0,0,0,40,315,1,0,0,0,42,324,1,0,0,0,44,328,1,0,0,0,46,331,1,0,0,0,48,
-	339,1,0,0,0,50,345,1,0,0,0,52,353,1,0,0,0,54,361,1,0,0,0,56,363,1,0,0,0,
-	58,407,1,0,0,0,60,409,1,0,0,0,62,412,1,0,0,0,64,421,1,0,0,0,66,429,1,0,
-	0,0,68,438,1,0,0,0,70,447,1,0,0,0,72,456,1,0,0,0,74,460,1,0,0,0,76,466,
-	1,0,0,0,78,470,1,0,0,0,80,473,1,0,0,0,82,481,1,0,0,0,84,485,1,0,0,0,86,
-	489,1,0,0,0,88,492,1,0,0,0,90,497,1,0,0,0,92,501,1,0,0,0,94,503,1,0,0,0,
-	96,505,1,0,0,0,98,508,1,0,0,0,100,512,1,0,0,0,102,515,1,0,0,0,104,518,1,
-	0,0,0,106,538,1,0,0,0,108,109,3,2,1,0,109,110,5,0,0,1,110,1,1,0,0,0,111,
-	112,6,1,-1,0,112,113,3,4,2,0,113,119,1,0,0,0,114,115,10,1,0,0,115,116,5,
-	26,0,0,116,118,3,6,3,0,117,114,1,0,0,0,118,121,1,0,0,0,119,117,1,0,0,0,
-	119,120,1,0,0,0,120,3,1,0,0,0,121,119,1,0,0,0,122,128,3,96,48,0,123,128,
-	3,30,15,0,124,128,3,24,12,0,125,128,3,100,50,0,126,128,3,102,51,0,127,122,
-	1,0,0,0,127,123,1,0,0,0,127,124,1,0,0,0,127,125,1,0,0,0,127,126,1,0,0,0,
-	128,5,1,0,0,0,129,143,3,44,22,0,130,143,3,48,24,0,131,143,3,60,30,0,132,
-	143,3,66,33,0,133,143,3,62,31,0,134,143,3,46,23,0,135,143,3,8,4,0,136,143,
-	3,68,34,0,137,143,3,70,35,0,138,143,3,74,37,0,139,143,3,76,38,0,140,143,
-	3,104,52,0,141,143,3,78,39,0,142,129,1,0,0,0,142,130,1,0,0,0,142,131,1,
-	0,0,0,142,132,1,0,0,0,142,133,1,0,0,0,142,134,1,0,0,0,142,135,1,0,0,0,142,
-	136,1,0,0,0,142,137,1,0,0,0,142,138,1,0,0,0,142,139,1,0,0,0,142,140,1,0,
-	0,0,142,141,1,0,0,0,143,7,1,0,0,0,144,145,5,18,0,0,145,146,3,10,5,0,146,
-	9,1,0,0,0,147,148,6,5,-1,0,148,149,5,45,0,0,149,176,3,10,5,7,150,176,3,
-	14,7,0,151,176,3,12,6,0,152,154,3,14,7,0,153,155,5,45,0,0,154,153,1,0,0,
-	0,154,155,1,0,0,0,155,156,1,0,0,0,156,157,5,42,0,0,157,158,5,41,0,0,158,
-	163,3,14,7,0,159,160,5,35,0,0,160,162,3,14,7,0,161,159,1,0,0,0,162,165,
-	1,0,0,0,163,161,1,0,0,0,163,164,1,0,0,0,164,166,1,0,0,0,165,163,1,0,0,0,
-	166,167,5,51,0,0,167,176,1,0,0,0,168,169,3,14,7,0,169,171,5,43,0,0,170,
-	172,5,45,0,0,171,170,1,0,0,0,171,172,1,0,0,0,172,173,1,0,0,0,173,174,5,
-	46,0,0,174,176,1,0,0,0,175,147,1,0,0,0,175,150,1,0,0,0,175,151,1,0,0,0,
-	175,152,1,0,0,0,175,168,1,0,0,0,176,185,1,0,0,0,177,178,10,4,0,0,178,179,
-	5,31,0,0,179,184,3,10,5,5,180,181,10,3,0,0,181,182,5,48,0,0,182,184,3,10,
-	5,4,183,177,1,0,0,0,183,180,1,0,0,0,184,187,1,0,0,0,185,183,1,0,0,0,185,
-	186,1,0,0,0,186,11,1,0,0,0,187,185,1,0,0,0,188,190,3,14,7,0,189,191,5,45,
-	0,0,190,189,1,0,0,0,190,191,1,0,0,0,191,192,1,0,0,0,192,193,5,44,0,0,193,
-	194,3,92,46,0,194,203,1,0,0,0,195,197,3,14,7,0,196,198,5,45,0,0,197,196,
-	1,0,0,0,197,198,1,0,0,0,198,199,1,0,0,0,199,200,5,50,0,0,200,201,3,92,46,
-	0,201,203,1,0,0,0,202,188,1,0,0,0,202,195,1,0,0,0,203,13,1,0,0,0,204,210,
-	3,16,8,0,205,206,3,16,8,0,206,207,3,94,47,0,207,208,3,16,8,0,208,210,1,
-	0,0,0,209,204,1,0,0,0,209,205,1,0,0,0,210,15,1,0,0,0,211,212,6,8,-1,0,212,
-	216,3,18,9,0,213,214,7,0,0,0,214,216,3,16,8,3,215,211,1,0,0,0,215,213,1,
-	0,0,0,216,225,1,0,0,0,217,218,10,2,0,0,218,219,7,1,0,0,219,224,3,16,8,3,
-	220,221,10,1,0,0,221,222,7,0,0,0,222,224,3,16,8,2,223,217,1,0,0,0,223,220,
-	1,0,0,0,224,227,1,0,0,0,225,223,1,0,0,0,225,226,1,0,0,0,226,17,1,0,0,0,
-	227,225,1,0,0,0,228,229,6,9,-1,0,229,237,3,58,29,0,230,237,3,50,25,0,231,
-	237,3,20,10,0,232,233,5,41,0,0,233,234,3,10,5,0,234,235,5,51,0,0,235,237,
-	1,0,0,0,236,228,1,0,0,0,236,230,1,0,0,0,236,231,1,0,0,0,236,232,1,0,0,0,
-	237,243,1,0,0,0,238,239,10,1,0,0,239,240,5,34,0,0,240,242,3,22,11,0,241,
-	238,1,0,0,0,242,245,1,0,0,0,243,241,1,0,0,0,243,244,1,0,0,0,244,19,1,0,
-	0,0,245,243,1,0,0,0,246,247,3,54,27,0,247,257,5,41,0,0,248,258,5,62,0,0,
-	249,254,3,10,5,0,250,251,5,35,0,0,251,253,3,10,5,0,252,250,1,0,0,0,253,
-	256,1,0,0,0,254,252,1,0,0,0,254,255,1,0,0,0,255,258,1,0,0,0,256,254,1,0,
-	0,0,257,248,1,0,0,0,257,249,1,0,0,0,257,258,1,0,0,0,258,259,1,0,0,0,259,
-	260,5,51,0,0,260,21,1,0,0,0,261,262,3,54,27,0,262,23,1,0,0,0,263,264,5,
-	14,0,0,264,265,3,26,13,0,265,25,1,0,0,0,266,271,3,28,14,0,267,268,5,35,
-	0,0,268,270,3,28,14,0,269,267,1,0,0,0,270,273,1,0,0,0,271,269,1,0,0,0,271,
-	272,1,0,0,0,272,27,1,0,0,0,273,271,1,0,0,0,274,280,3,10,5,0,275,276,3,50,
-	25,0,276,277,5,33,0,0,277,278,3,10,5,0,278,280,1,0,0,0,279,274,1,0,0,0,
-	279,275,1,0,0,0,280,29,1,0,0,0,281,282,5,6,0,0,282,287,3,32,16,0,283,284,
-	5,35,0,0,284,286,3,32,16,0,285,283,1,0,0,0,286,289,1,0,0,0,287,285,1,0,
-	0,0,287,288,1,0,0,0,288,291,1,0,0,0,289,287,1,0,0,0,290,292,3,38,19,0,291,
-	290,1,0,0,0,291,292,1,0,0,0,292,294,1,0,0,0,293,295,3,34,17,0,294,293,1,
-	0,0,0,294,295,1,0,0,0,295,31,1,0,0,0,296,297,7,2,0,0,297,33,1,0,0,0,298,
-	299,5,72,0,0,299,304,3,36,18,0,300,301,5,35,0,0,301,303,3,36,18,0,302,300,
-	1,0,0,0,303,306,1,0,0,0,304,302,1,0,0,0,304,305,1,0,0,0,305,35,1,0,0,0,
-	306,304,1,0,0,0,307,308,3,92,46,0,308,309,5,33,0,0,309,310,3,92,46,0,310,
-	37,1,0,0,0,311,314,3,40,20,0,312,314,3,42,21,0,313,311,1,0,0,0,313,312,
-	1,0,0,0,314,39,1,0,0,0,315,316,5,73,0,0,316,321,3,32,16,0,317,318,5,35,
-	0,0,318,320,3,32,16,0,319,317,1,0,0,0,320,323,1,0,0,0,321,319,1,0,0,0,321,
-	322,1,0,0,0,322,41,1,0,0,0,323,321,1,0,0,0,324,325,5,65,0,0,325,326,3,40,
-	20,0,326,327,5,66,0,0,327,43,1,0,0,0,328,329,5,4,0,0,329,330,3,26,13,0,
-	330,45,1,0,0,0,331,333,5,17,0,0,332,334,3,26,13,0,333,332,1,0,0,0,333,334,
-	1,0,0,0,334,337,1,0,0,0,335,336,5,30,0,0,336,338,3,26,13,0,337,335,1,0,
-	0,0,337,338,1,0,0,0,338,47,1,0,0,0,339,340,5,8,0,0,340,343,3,26,13,0,341,
-	342,5,30,0,0,342,344,3,26,13,0,343,341,1,0,0,0,343,344,1,0,0,0,344,49,1,
-	0,0,0,345,350,3,54,27,0,346,347,5,37,0,0,347,349,3,54,27,0,348,346,1,0,
-	0,0,349,352,1,0,0,0,350,348,1,0,0,0,350,351,1,0,0,0,351,51,1,0,0,0,352,
-	350,1,0,0,0,353,358,3,56,28,0,354,355,5,37,0,0,355,357,3,56,28,0,356,354,
-	1,0,0,0,357,360,1,0,0,0,358,356,1,0,0,0,358,359,1,0,0,0,359,53,1,0,0,0,
-	360,358,1,0,0,0,361,362,7,3,0,0,362,55,1,0,0,0,363,364,5,78,0,0,364,57,
-	1,0,0,0,365,408,5,46,0,0,366,367,3,90,45,0,367,368,5,67,0,0,368,408,1,0,
-	0,0,369,408,3,88,44,0,370,408,3,90,45,0,371,408,3,84,42,0,372,408,5,49,
-	0,0,373,408,3,92,46,0,374,375,5,65,0,0,375,380,3,86,43,0,376,377,5,35,0,
-	0,377,379,3,86,43,0,378,376,1,0,0,0,379,382,1,0,0,0,380,378,1,0,0,0,380,
-	381,1,0,0,0,381,383,1,0,0,0,382,380,1,0,0,0,383,384,5,66,0,0,384,408,1,
-	0,0,0,385,386,5,65,0,0,386,391,3,84,42,0,387,388,5,35,0,0,388,390,3,84,
-	42,0,389,387,1,0,0,0,390,393,1,0,0,0,391,389,1,0,0,0,391,392,1,0,0,0,392,
-	394,1,0,0,0,393,391,1,0,0,0,394,395,5,66,0,0,395,408,1,0,0,0,396,397,5,
-	65,0,0,397,402,3,92,46,0,398,399,5,35,0,0,399,401,3,92,46,0,400,398,1,0,
-	0,0,401,404,1,0,0,0,402,400,1,0,0,0,402,403,1,0,0,0,403,405,1,0,0,0,404,
-	402,1,0,0,0,405,406,5,66,0,0,406,408,1,0,0,0,407,365,1,0,0,0,407,366,1,
-	0,0,0,407,369,1,0,0,0,407,370,1,0,0,0,407,371,1,0,0,0,407,372,1,0,0,0,407,
-	373,1,0,0,0,407,374,1,0,0,0,407,385,1,0,0,0,407,396,1,0,0,0,408,59,1,0,
-	0,0,409,410,5,10,0,0,410,411,5,28,0,0,411,61,1,0,0,0,412,413,5,16,0,0,413,
-	418,3,64,32,0,414,415,5,35,0,0,415,417,3,64,32,0,416,414,1,0,0,0,417,420,
-	1,0,0,0,418,416,1,0,0,0,418,419,1,0,0,0,419,63,1,0,0,0,420,418,1,0,0,0,
-	421,423,3,10,5,0,422,424,7,4,0,0,423,422,1,0,0,0,423,424,1,0,0,0,424,427,
-	1,0,0,0,425,426,5,47,0,0,426,428,7,5,0,0,427,425,1,0,0,0,427,428,1,0,0,
-	0,428,65,1,0,0,0,429,430,5,9,0,0,430,435,3,52,26,0,431,432,5,35,0,0,432,
-	434,3,52,26,0,433,431,1,0,0,0,434,437,1,0,0,0,435,433,1,0,0,0,435,436,1,
-	0,0,0,436,67,1,0,0,0,437,435,1,0,0,0,438,439,5,2,0,0,439,444,3,52,26,0,
-	440,441,5,35,0,0,441,443,3,52,26,0,442,440,1,0,0,0,443,446,1,0,0,0,444,
-	442,1,0,0,0,444,445,1,0,0,0,445,69,1,0,0,0,446,444,1,0,0,0,447,448,5,13,
-	0,0,448,453,3,72,36,0,449,450,5,35,0,0,450,452,3,72,36,0,451,449,1,0,0,
-	0,452,455,1,0,0,0,453,451,1,0,0,0,453,454,1,0,0,0,454,71,1,0,0,0,455,453,
-	1,0,0,0,456,457,3,52,26,0,457,458,5,82,0,0,458,459,3,52,26,0,459,73,1,0,
-	0,0,460,461,5,1,0,0,461,462,3,18,9,0,462,464,3,92,46,0,463,465,3,80,40,
-	0,464,463,1,0,0,0,464,465,1,0,0,0,465,75,1,0,0,0,466,467,5,7,0,0,467,468,
-	3,18,9,0,468,469,3,92,46,0,469,77,1,0,0,0,470,471,5,12,0,0,471,472,3,50,
-	25,0,472,79,1,0,0,0,473,478,3,82,41,0,474,475,5,35,0,0,475,477,3,82,41,
-	0,476,474,1,0,0,0,477,480,1,0,0,0,478,476,1,0,0,0,478,479,1,0,0,0,479,81,
-	1,0,0,0,480,478,1,0,0,0,481,482,3,54,27,0,482,483,5,33,0,0,483,484,3,58,
-	29,0,484,83,1,0,0,0,485,486,7,6,0,0,486,85,1,0,0,0,487,490,3,88,44,0,488,
-	490,3,90,45,0,489,487,1,0,0,0,489,488,1,0,0,0,490,87,1,0,0,0,491,493,7,
-	0,0,0,492,491,1,0,0,0,492,493,1,0,0,0,493,494,1,0,0,0,494,495,5,29,0,0,
-	495,89,1,0,0,0,496,498,7,0,0,0,497,496,1,0,0,0,497,498,1,0,0,0,498,499,
-	1,0,0,0,499,500,5,28,0,0,500,91,1,0,0,0,501,502,5,27,0,0,502,93,1,0,0,0,
-	503,504,7,7,0,0,504,95,1,0,0,0,505,506,5,5,0,0,506,507,3,98,49,0,507,97,
-	1,0,0,0,508,509,5,65,0,0,509,510,3,2,1,0,510,511,5,66,0,0,511,99,1,0,0,
-	0,512,513,5,15,0,0,513,514,5,98,0,0,514,101,1,0,0,0,515,516,5,11,0,0,516,
-	517,5,102,0,0,517,103,1,0,0,0,518,519,5,3,0,0,519,522,5,88,0,0,520,521,
-	5,86,0,0,521,523,3,52,26,0,522,520,1,0,0,0,522,523,1,0,0,0,523,533,1,0,
-	0,0,524,525,5,87,0,0,525,530,3,106,53,0,526,527,5,35,0,0,527,529,3,106,
-	53,0,528,526,1,0,0,0,529,532,1,0,0,0,530,528,1,0,0,0,530,531,1,0,0,0,531,
-	534,1,0,0,0,532,530,1,0,0,0,533,524,1,0,0,0,533,534,1,0,0,0,534,105,1,0,
-	0,0,535,536,3,52,26,0,536,537,5,33,0,0,537,539,1,0,0,0,538,535,1,0,0,0,
-	538,539,1,0,0,0,539,540,1,0,0,0,540,541,3,52,26,0,541,107,1,0,0,0,52,119,
-	127,142,154,163,171,175,183,185,190,197,202,209,215,223,225,236,243,254,
-	257,271,279,287,291,294,304,313,321,333,337,343,350,358,380,391,402,407,
-	418,423,427,435,444,453,464,478,489,492,497,522,530,533,538];
+	90,92,94,96,98,100,102,104,106,0,7,1,0,60,61,1,0,62,64,1,0,67,68,2,0,32,
+	32,36,36,1,0,39,40,2,0,38,38,52,52,2,0,53,53,55,59,568,0,108,1,0,0,0,2,
+	111,1,0,0,0,4,127,1,0,0,0,6,142,1,0,0,0,8,144,1,0,0,0,10,175,1,0,0,0,12,
+	202,1,0,0,0,14,209,1,0,0,0,16,215,1,0,0,0,18,236,1,0,0,0,20,246,1,0,0,0,
+	22,261,1,0,0,0,24,263,1,0,0,0,26,266,1,0,0,0,28,279,1,0,0,0,30,281,1,0,
+	0,0,32,296,1,0,0,0,34,298,1,0,0,0,36,307,1,0,0,0,38,313,1,0,0,0,40,315,
+	1,0,0,0,42,324,1,0,0,0,44,328,1,0,0,0,46,331,1,0,0,0,48,339,1,0,0,0,50,
+	345,1,0,0,0,52,353,1,0,0,0,54,361,1,0,0,0,56,363,1,0,0,0,58,407,1,0,0,0,
+	60,409,1,0,0,0,62,412,1,0,0,0,64,421,1,0,0,0,66,429,1,0,0,0,68,438,1,0,
+	0,0,70,447,1,0,0,0,72,456,1,0,0,0,74,460,1,0,0,0,76,466,1,0,0,0,78,470,
+	1,0,0,0,80,473,1,0,0,0,82,481,1,0,0,0,84,485,1,0,0,0,86,489,1,0,0,0,88,
+	492,1,0,0,0,90,497,1,0,0,0,92,501,1,0,0,0,94,503,1,0,0,0,96,505,1,0,0,0,
+	98,508,1,0,0,0,100,512,1,0,0,0,102,515,1,0,0,0,104,518,1,0,0,0,106,538,
+	1,0,0,0,108,109,3,2,1,0,109,110,5,0,0,1,110,1,1,0,0,0,111,112,6,1,-1,0,
+	112,113,3,4,2,0,113,119,1,0,0,0,114,115,10,1,0,0,115,116,5,26,0,0,116,118,
+	3,6,3,0,117,114,1,0,0,0,118,121,1,0,0,0,119,117,1,0,0,0,119,120,1,0,0,0,
+	120,3,1,0,0,0,121,119,1,0,0,0,122,128,3,96,48,0,123,128,3,30,15,0,124,128,
+	3,24,12,0,125,128,3,100,50,0,126,128,3,102,51,0,127,122,1,0,0,0,127,123,
+	1,0,0,0,127,124,1,0,0,0,127,125,1,0,0,0,127,126,1,0,0,0,128,5,1,0,0,0,129,
+	143,3,44,22,0,130,143,3,48,24,0,131,143,3,60,30,0,132,143,3,66,33,0,133,
+	143,3,62,31,0,134,143,3,46,23,0,135,143,3,8,4,0,136,143,3,68,34,0,137,143,
+	3,70,35,0,138,143,3,74,37,0,139,143,3,76,38,0,140,143,3,104,52,0,141,143,
+	3,78,39,0,142,129,1,0,0,0,142,130,1,0,0,0,142,131,1,0,0,0,142,132,1,0,0,
+	0,142,133,1,0,0,0,142,134,1,0,0,0,142,135,1,0,0,0,142,136,1,0,0,0,142,137,
+	1,0,0,0,142,138,1,0,0,0,142,139,1,0,0,0,142,140,1,0,0,0,142,141,1,0,0,0,
+	143,7,1,0,0,0,144,145,5,18,0,0,145,146,3,10,5,0,146,9,1,0,0,0,147,148,6,
+	5,-1,0,148,149,5,45,0,0,149,176,3,10,5,7,150,176,3,14,7,0,151,176,3,12,
+	6,0,152,154,3,14,7,0,153,155,5,45,0,0,154,153,1,0,0,0,154,155,1,0,0,0,155,
+	156,1,0,0,0,156,157,5,42,0,0,157,158,5,41,0,0,158,163,3,14,7,0,159,160,
+	5,35,0,0,160,162,3,14,7,0,161,159,1,0,0,0,162,165,1,0,0,0,163,161,1,0,0,
+	0,163,164,1,0,0,0,164,166,1,0,0,0,165,163,1,0,0,0,166,167,5,51,0,0,167,
+	176,1,0,0,0,168,169,3,14,7,0,169,171,5,43,0,0,170,172,5,45,0,0,171,170,
+	1,0,0,0,171,172,1,0,0,0,172,173,1,0,0,0,173,174,5,46,0,0,174,176,1,0,0,
+	0,175,147,1,0,0,0,175,150,1,0,0,0,175,151,1,0,0,0,175,152,1,0,0,0,175,168,
+	1,0,0,0,176,185,1,0,0,0,177,178,10,4,0,0,178,179,5,31,0,0,179,184,3,10,
+	5,5,180,181,10,3,0,0,181,182,5,48,0,0,182,184,3,10,5,4,183,177,1,0,0,0,
+	183,180,1,0,0,0,184,187,1,0,0,0,185,183,1,0,0,0,185,186,1,0,0,0,186,11,
+	1,0,0,0,187,185,1,0,0,0,188,190,3,14,7,0,189,191,5,45,0,0,190,189,1,0,0,
+	0,190,191,1,0,0,0,191,192,1,0,0,0,192,193,5,44,0,0,193,194,3,92,46,0,194,
+	203,1,0,0,0,195,197,3,14,7,0,196,198,5,45,0,0,197,196,1,0,0,0,197,198,1,
+	0,0,0,198,199,1,0,0,0,199,200,5,50,0,0,200,201,3,92,46,0,201,203,1,0,0,
+	0,202,188,1,0,0,0,202,195,1,0,0,0,203,13,1,0,0,0,204,210,3,16,8,0,205,206,
+	3,16,8,0,206,207,3,94,47,0,207,208,3,16,8,0,208,210,1,0,0,0,209,204,1,0,
+	0,0,209,205,1,0,0,0,210,15,1,0,0,0,211,212,6,8,-1,0,212,216,3,18,9,0,213,
+	214,7,0,0,0,214,216,3,16,8,3,215,211,1,0,0,0,215,213,1,0,0,0,216,225,1,
+	0,0,0,217,218,10,2,0,0,218,219,7,1,0,0,219,224,3,16,8,3,220,221,10,1,0,
+	0,221,222,7,0,0,0,222,224,3,16,8,2,223,217,1,0,0,0,223,220,1,0,0,0,224,
+	227,1,0,0,0,225,223,1,0,0,0,225,226,1,0,0,0,226,17,1,0,0,0,227,225,1,0,
+	0,0,228,229,6,9,-1,0,229,237,3,58,29,0,230,237,3,50,25,0,231,237,3,20,10,
+	0,232,233,5,41,0,0,233,234,3,10,5,0,234,235,5,51,0,0,235,237,1,0,0,0,236,
+	228,1,0,0,0,236,230,1,0,0,0,236,231,1,0,0,0,236,232,1,0,0,0,237,243,1,0,
+	0,0,238,239,10,1,0,0,239,240,5,34,0,0,240,242,3,22,11,0,241,238,1,0,0,0,
+	242,245,1,0,0,0,243,241,1,0,0,0,243,244,1,0,0,0,244,19,1,0,0,0,245,243,
+	1,0,0,0,246,247,3,54,27,0,247,257,5,41,0,0,248,258,5,62,0,0,249,254,3,10,
+	5,0,250,251,5,35,0,0,251,253,3,10,5,0,252,250,1,0,0,0,253,256,1,0,0,0,254,
+	252,1,0,0,0,254,255,1,0,0,0,255,258,1,0,0,0,256,254,1,0,0,0,257,248,1,0,
+	0,0,257,249,1,0,0,0,257,258,1,0,0,0,258,259,1,0,0,0,259,260,5,51,0,0,260,
+	21,1,0,0,0,261,262,3,54,27,0,262,23,1,0,0,0,263,264,5,14,0,0,264,265,3,
+	26,13,0,265,25,1,0,0,0,266,271,3,28,14,0,267,268,5,35,0,0,268,270,3,28,
+	14,0,269,267,1,0,0,0,270,273,1,0,0,0,271,269,1,0,0,0,271,272,1,0,0,0,272,
+	27,1,0,0,0,273,271,1,0,0,0,274,280,3,10,5,0,275,276,3,50,25,0,276,277,5,
+	33,0,0,277,278,3,10,5,0,278,280,1,0,0,0,279,274,1,0,0,0,279,275,1,0,0,0,
+	280,29,1,0,0,0,281,282,5,6,0,0,282,287,3,32,16,0,283,284,5,35,0,0,284,286,
+	3,32,16,0,285,283,1,0,0,0,286,289,1,0,0,0,287,285,1,0,0,0,287,288,1,0,0,
+	0,288,291,1,0,0,0,289,287,1,0,0,0,290,292,3,38,19,0,291,290,1,0,0,0,291,
+	292,1,0,0,0,292,294,1,0,0,0,293,295,3,34,17,0,294,293,1,0,0,0,294,295,1,
+	0,0,0,295,31,1,0,0,0,296,297,5,74,0,0,297,33,1,0,0,0,298,299,5,72,0,0,299,
+	304,3,36,18,0,300,301,5,35,0,0,301,303,3,36,18,0,302,300,1,0,0,0,303,306,
+	1,0,0,0,304,302,1,0,0,0,304,305,1,0,0,0,305,35,1,0,0,0,306,304,1,0,0,0,
+	307,308,3,92,46,0,308,309,5,33,0,0,309,310,3,92,46,0,310,37,1,0,0,0,311,
+	314,3,40,20,0,312,314,3,42,21,0,313,311,1,0,0,0,313,312,1,0,0,0,314,39,
+	1,0,0,0,315,316,5,73,0,0,316,321,3,32,16,0,317,318,5,35,0,0,318,320,3,32,
+	16,0,319,317,1,0,0,0,320,323,1,0,0,0,321,319,1,0,0,0,321,322,1,0,0,0,322,
+	41,1,0,0,0,323,321,1,0,0,0,324,325,5,65,0,0,325,326,3,40,20,0,326,327,5,
+	66,0,0,327,43,1,0,0,0,328,329,5,4,0,0,329,330,3,26,13,0,330,45,1,0,0,0,
+	331,333,5,17,0,0,332,334,3,26,13,0,333,332,1,0,0,0,333,334,1,0,0,0,334,
+	337,1,0,0,0,335,336,5,30,0,0,336,338,3,26,13,0,337,335,1,0,0,0,337,338,
+	1,0,0,0,338,47,1,0,0,0,339,340,5,8,0,0,340,343,3,26,13,0,341,342,5,30,0,
+	0,342,344,3,26,13,0,343,341,1,0,0,0,343,344,1,0,0,0,344,49,1,0,0,0,345,
+	350,3,54,27,0,346,347,5,37,0,0,347,349,3,54,27,0,348,346,1,0,0,0,349,352,
+	1,0,0,0,350,348,1,0,0,0,350,351,1,0,0,0,351,51,1,0,0,0,352,350,1,0,0,0,
+	353,358,3,56,28,0,354,355,5,37,0,0,355,357,3,56,28,0,356,354,1,0,0,0,357,
+	360,1,0,0,0,358,356,1,0,0,0,358,359,1,0,0,0,359,53,1,0,0,0,360,358,1,0,
+	0,0,361,362,7,2,0,0,362,55,1,0,0,0,363,364,5,78,0,0,364,57,1,0,0,0,365,
+	408,5,46,0,0,366,367,3,90,45,0,367,368,5,67,0,0,368,408,1,0,0,0,369,408,
+	3,88,44,0,370,408,3,90,45,0,371,408,3,84,42,0,372,408,5,49,0,0,373,408,
+	3,92,46,0,374,375,5,65,0,0,375,380,3,86,43,0,376,377,5,35,0,0,377,379,3,
+	86,43,0,378,376,1,0,0,0,379,382,1,0,0,0,380,378,1,0,0,0,380,381,1,0,0,0,
+	381,383,1,0,0,0,382,380,1,0,0,0,383,384,5,66,0,0,384,408,1,0,0,0,385,386,
+	5,65,0,0,386,391,3,84,42,0,387,388,5,35,0,0,388,390,3,84,42,0,389,387,1,
+	0,0,0,390,393,1,0,0,0,391,389,1,0,0,0,391,392,1,0,0,0,392,394,1,0,0,0,393,
+	391,1,0,0,0,394,395,5,66,0,0,395,408,1,0,0,0,396,397,5,65,0,0,397,402,3,
+	92,46,0,398,399,5,35,0,0,399,401,3,92,46,0,400,398,1,0,0,0,401,404,1,0,
+	0,0,402,400,1,0,0,0,402,403,1,0,0,0,403,405,1,0,0,0,404,402,1,0,0,0,405,
+	406,5,66,0,0,406,408,1,0,0,0,407,365,1,0,0,0,407,366,1,0,0,0,407,369,1,
+	0,0,0,407,370,1,0,0,0,407,371,1,0,0,0,407,372,1,0,0,0,407,373,1,0,0,0,407,
+	374,1,0,0,0,407,385,1,0,0,0,407,396,1,0,0,0,408,59,1,0,0,0,409,410,5,10,
+	0,0,410,411,5,28,0,0,411,61,1,0,0,0,412,413,5,16,0,0,413,418,3,64,32,0,
+	414,415,5,35,0,0,415,417,3,64,32,0,416,414,1,0,0,0,417,420,1,0,0,0,418,
+	416,1,0,0,0,418,419,1,0,0,0,419,63,1,0,0,0,420,418,1,0,0,0,421,423,3,10,
+	5,0,422,424,7,3,0,0,423,422,1,0,0,0,423,424,1,0,0,0,424,427,1,0,0,0,425,
+	426,5,47,0,0,426,428,7,4,0,0,427,425,1,0,0,0,427,428,1,0,0,0,428,65,1,0,
+	0,0,429,430,5,9,0,0,430,435,3,52,26,0,431,432,5,35,0,0,432,434,3,52,26,
+	0,433,431,1,0,0,0,434,437,1,0,0,0,435,433,1,0,0,0,435,436,1,0,0,0,436,67,
+	1,0,0,0,437,435,1,0,0,0,438,439,5,2,0,0,439,444,3,52,26,0,440,441,5,35,
+	0,0,441,443,3,52,26,0,442,440,1,0,0,0,443,446,1,0,0,0,444,442,1,0,0,0,444,
+	445,1,0,0,0,445,69,1,0,0,0,446,444,1,0,0,0,447,448,5,13,0,0,448,453,3,72,
+	36,0,449,450,5,35,0,0,450,452,3,72,36,0,451,449,1,0,0,0,452,455,1,0,0,0,
+	453,451,1,0,0,0,453,454,1,0,0,0,454,71,1,0,0,0,455,453,1,0,0,0,456,457,
+	3,52,26,0,457,458,5,82,0,0,458,459,3,52,26,0,459,73,1,0,0,0,460,461,5,1,
+	0,0,461,462,3,18,9,0,462,464,3,92,46,0,463,465,3,80,40,0,464,463,1,0,0,
+	0,464,465,1,0,0,0,465,75,1,0,0,0,466,467,5,7,0,0,467,468,3,18,9,0,468,469,
+	3,92,46,0,469,77,1,0,0,0,470,471,5,12,0,0,471,472,3,50,25,0,472,79,1,0,
+	0,0,473,478,3,82,41,0,474,475,5,35,0,0,475,477,3,82,41,0,476,474,1,0,0,
+	0,477,480,1,0,0,0,478,476,1,0,0,0,478,479,1,0,0,0,479,81,1,0,0,0,480,478,
+	1,0,0,0,481,482,3,54,27,0,482,483,5,33,0,0,483,484,3,58,29,0,484,83,1,0,
+	0,0,485,486,7,5,0,0,486,85,1,0,0,0,487,490,3,88,44,0,488,490,3,90,45,0,
+	489,487,1,0,0,0,489,488,1,0,0,0,490,87,1,0,0,0,491,493,7,0,0,0,492,491,
+	1,0,0,0,492,493,1,0,0,0,493,494,1,0,0,0,494,495,5,29,0,0,495,89,1,0,0,0,
+	496,498,7,0,0,0,497,496,1,0,0,0,497,498,1,0,0,0,498,499,1,0,0,0,499,500,
+	5,28,0,0,500,91,1,0,0,0,501,502,5,27,0,0,502,93,1,0,0,0,503,504,7,6,0,0,
+	504,95,1,0,0,0,505,506,5,5,0,0,506,507,3,98,49,0,507,97,1,0,0,0,508,509,
+	5,65,0,0,509,510,3,2,1,0,510,511,5,66,0,0,511,99,1,0,0,0,512,513,5,15,0,
+	0,513,514,5,98,0,0,514,101,1,0,0,0,515,516,5,11,0,0,516,517,5,102,0,0,517,
+	103,1,0,0,0,518,519,5,3,0,0,519,522,5,88,0,0,520,521,5,86,0,0,521,523,3,
+	52,26,0,522,520,1,0,0,0,522,523,1,0,0,0,523,533,1,0,0,0,524,525,5,87,0,
+	0,525,530,3,106,53,0,526,527,5,35,0,0,527,529,3,106,53,0,528,526,1,0,0,
+	0,529,532,1,0,0,0,530,528,1,0,0,0,530,531,1,0,0,0,531,534,1,0,0,0,532,530,
+	1,0,0,0,533,524,1,0,0,0,533,534,1,0,0,0,534,105,1,0,0,0,535,536,3,52,26,
+	0,536,537,5,33,0,0,537,539,1,0,0,0,538,535,1,0,0,0,538,539,1,0,0,0,539,
+	540,1,0,0,0,540,541,3,52,26,0,541,107,1,0,0,0,52,119,127,142,154,163,171,
+	175,183,185,190,197,202,209,215,223,225,236,243,254,257,271,279,287,291,
+	294,304,313,321,333,337,343,350,358,380,391,402,407,418,423,427,435,444,
+	453,464,478,489,492,497,522,530,533,538];
 
 	private static __ATN: ATN;
 	public static get _ATN(): ATN {
@@ -4191,9 +4183,6 @@ export class FromIdentifierContext extends ParserRuleContext {
 	public FROM_UNQUOTED_IDENTIFIER(): TerminalNode {
 		return this.getToken(esql_parser.FROM_UNQUOTED_IDENTIFIER, 0);
 	}
-	public QUOTED_IDENTIFIER(): TerminalNode {
-		return this.getToken(esql_parser.QUOTED_IDENTIFIER, 0);
-	}
     public get ruleIndex(): number {
     	return esql_parser.RULE_fromIdentifier;
 	}
diff --git a/packages/kbn-esql-ast/src/ast_helpers.ts b/packages/kbn-esql-ast/src/ast_helpers.ts
index 0b3c3eff25ada7..d2ac5a026e3167 100644
--- a/packages/kbn-esql-ast/src/ast_helpers.ts
+++ b/packages/kbn-esql-ast/src/ast_helpers.ts
@@ -212,13 +212,13 @@ export function computeLocationExtends(fn: ESQLFunction) {
 
 /* SCRIPT_MARKER_START */
 function getQuotedText(ctx: ParserRuleContext) {
-  return [67 /* esql_parser.QUOTED_IDENTIFIER */]
+  return [27 /* esql_parser.QUOTED_STRING */, 68 /* esql_parser.QUOTED_IDENTIFIER */]
     .map((keyCode) => ctx.getToken(keyCode, 0))
     .filter(nonNullable)[0];
 }
 
 function getUnquotedText(ctx: ParserRuleContext) {
-  return [66 /* esql_parser.UNQUOTED_IDENTIFIER */, 72 /* esql_parser.FROM_UNQUOTED_IDENTIFIER */]
+  return [67 /* esql_parser.UNQUOTED_IDENTIFIER */, 74 /* esql_parser.FROM_UNQUOTED_IDENTIFIER */]
     .map((keyCode) => ctx.getToken(keyCode, 0))
     .filter(nonNullable)[0];
 }
@@ -238,11 +238,13 @@ function safeBackticksRemoval(text: string | undefined) {
 }
 
 export function sanitizeIdentifierString(ctx: ParserRuleContext) {
-  return (
+  const result =
     getUnquotedText(ctx)?.getText() ||
     safeBackticksRemoval(getQuotedText(ctx)?.getText()) ||
-    safeBackticksRemoval(ctx.getText()) // for some reason some quoted text is not detected correctly by the parser
-  );
+    safeBackticksRemoval(ctx.getText()); // for some reason some quoted text is not detected correctly by the parser
+
+  // TODO - understand why <missing null> is now returned as the match text for the FROM command
+  return result === '<missing null>' ? '' : result;
 }
 
 export function wrapIdentifierAsArray<T extends ParserRuleContext>(identifierCtx: T | T[]): T[] {
diff --git a/packages/kbn-esql-ast/src/ast_walker.ts b/packages/kbn-esql-ast/src/ast_walker.ts
index 433bc4a46435a1..8e4c8ce8f9c092 100644
--- a/packages/kbn-esql-ast/src/ast_walker.ts
+++ b/packages/kbn-esql-ast/src/ast_walker.ts
@@ -87,9 +87,9 @@ import type {
 } from './types';
 
 export function collectAllSourceIdentifiers(ctx: FromCommandContext): ESQLAstItem[] {
-  return ctx
-    .getTypedRuleContexts(FromIdentifierContext)
-    .map((sourceCtx) => createSource(sourceCtx));
+  const fromContexts = ctx.getTypedRuleContexts(FromIdentifierContext);
+
+  return fromContexts.map((sourceCtx) => createSource(sourceCtx));
 }
 
 function extractIdentifiers(
diff --git a/packages/kbn-esql-utils/index.ts b/packages/kbn-esql-utils/index.ts
index 029b7aab48db12..f3203cba662cf3 100644
--- a/packages/kbn-esql-utils/index.ts
+++ b/packages/kbn-esql-utils/index.ts
@@ -17,6 +17,7 @@ export {
   appendToESQLQuery,
   appendWhereClauseToESQLQuery,
   getESQLQueryColumns,
+  getESQLQueryColumnsRaw,
   TextBasedLanguages,
 } from './src';
 
diff --git a/packages/kbn-esql-utils/src/index.ts b/packages/kbn-esql-utils/src/index.ts
index 373223419b22d6..0b62f2aedc58d5 100644
--- a/packages/kbn-esql-utils/src/index.ts
+++ b/packages/kbn-esql-utils/src/index.ts
@@ -16,4 +16,4 @@ export {
   removeDropCommandsFromESQLQuery,
 } from './utils/query_parsing_helpers';
 export { appendToESQLQuery, appendWhereClauseToESQLQuery } from './utils/append_to_query';
-export { getESQLQueryColumns } from './utils/run_query';
+export { getESQLQueryColumns, getESQLQueryColumnsRaw } from './utils/run_query';
diff --git a/packages/kbn-esql-utils/src/utils/run_query.ts b/packages/kbn-esql-utils/src/utils/run_query.ts
index d94d2e07e5a532..099b4b876b943b 100644
--- a/packages/kbn-esql-utils/src/utils/run_query.ts
+++ b/packages/kbn-esql-utils/src/utils/run_query.ts
@@ -5,10 +5,11 @@
  * in compliance with, at your election, the Elastic License 2.0 or the Server
  * Side Public License, v 1.
  */
+import { i18n } from '@kbn/i18n';
 import type { DatatableColumn } from '@kbn/expressions-plugin/common';
 import type { ISearchGeneric } from '@kbn/search-types';
 import { esFieldTypeToKibanaFieldType } from '@kbn/field-types';
-import type { ESQLSearchReponse } from '@kbn/es-types';
+import type { ESQLColumn, ESQLSearchReponse } from '@kbn/es-types';
 import { lastValueFrom } from 'rxjs';
 import { ESQL_LATEST_VERSION } from '../../constants';
 
@@ -21,32 +22,77 @@ export async function getESQLQueryColumns({
   search: ISearchGeneric;
   signal?: AbortSignal;
 }): Promise<DatatableColumn[]> {
-  const response = await lastValueFrom(
-    search(
-      {
-        params: {
-          query: `${esqlQuery} | limit 0`,
-          version: ESQL_LATEST_VERSION,
+  try {
+    const response = await lastValueFrom(
+      search(
+        {
+          params: {
+            query: `${esqlQuery} | limit 0`,
+            version: ESQL_LATEST_VERSION,
+          },
         },
-      },
-      {
-        abortSignal: signal,
-        strategy: 'esql_async',
-      }
-    )
-  );
+        {
+          abortSignal: signal,
+          strategy: 'esql_async',
+        }
+      )
+    );
 
-  const columns =
-    (response.rawResponse as unknown as ESQLSearchReponse).columns?.map(({ name, type }) => {
-      const kibanaType = esFieldTypeToKibanaFieldType(type);
-      const column = {
-        id: name,
-        name,
-        meta: { type: kibanaType, esType: type },
-      } as DatatableColumn;
+    const columns =
+      (response.rawResponse as unknown as ESQLSearchReponse).columns?.map(({ name, type }) => {
+        const kibanaType = esFieldTypeToKibanaFieldType(type);
+        const column = {
+          id: name,
+          name,
+          meta: { type: kibanaType, esType: type },
+        } as DatatableColumn;
 
-      return column;
-    }) ?? [];
+        return column;
+      }) ?? [];
 
-  return columns;
+    return columns;
+  } catch (error) {
+    throw new Error(
+      i18n.translate('esqlUtils.columnsErrorMsg', {
+        defaultMessage: 'Unable to load columns. {errorMessage}',
+        values: { errorMessage: error.message },
+      })
+    );
+  }
+}
+
+export async function getESQLQueryColumnsRaw({
+  esqlQuery,
+  search,
+  signal,
+}: {
+  esqlQuery: string;
+  search: ISearchGeneric;
+  signal?: AbortSignal;
+}): Promise<ESQLColumn[]> {
+  try {
+    const response = await lastValueFrom(
+      search(
+        {
+          params: {
+            query: `${esqlQuery} | limit 0`,
+            version: ESQL_LATEST_VERSION,
+          },
+        },
+        {
+          abortSignal: signal,
+          strategy: 'esql_async',
+        }
+      )
+    );
+
+    return (response.rawResponse as unknown as ESQLSearchReponse).columns ?? [];
+  } catch (error) {
+    throw new Error(
+      i18n.translate('esqlUtils.columnsErrorMsg', {
+        defaultMessage: 'Unable to load columns. {errorMessage}',
+        values: { errorMessage: error.message },
+      })
+    );
+  }
 }
diff --git a/packages/kbn-esql-utils/tsconfig.json b/packages/kbn-esql-utils/tsconfig.json
index dcd3a6da1795b8..a6470bec40ee16 100644
--- a/packages/kbn-esql-utils/tsconfig.json
+++ b/packages/kbn-esql-utils/tsconfig.json
@@ -23,6 +23,7 @@
     "@kbn/search-types",
     "@kbn/expressions-plugin",
     "@kbn/field-types",
-    "@kbn/es-types"
+    "@kbn/es-types",
+    "@kbn/i18n"
   ]
 }
diff --git a/packages/kbn-esql-validation-autocomplete/src/autocomplete/autocomplete.test.ts b/packages/kbn-esql-validation-autocomplete/src/autocomplete/autocomplete.test.ts
index 02d609c9a9a171..6cac6d45f7f752 100644
--- a/packages/kbn-esql-validation-autocomplete/src/autocomplete/autocomplete.test.ts
+++ b/packages/kbn-esql-validation-autocomplete/src/autocomplete/autocomplete.test.ts
@@ -109,6 +109,8 @@ function getFunctionSignaturesByReturnType(
   const list = [];
   if (agg) {
     list.push(...statsAggregationFunctionDefinitions);
+    // right now all grouping functions are agg functions too
+    list.push(...groupingFunctionDefinitions);
   }
   if (grouping) {
     list.push(...groupingFunctionDefinitions);
@@ -120,7 +122,10 @@ function getFunctionSignaturesByReturnType(
   if (builtin) {
     list.push(...builtinFunctions.filter(({ name }) => (skipAssign ? name !== '=' : true)));
   }
-  return list
+
+  const deduped = Array.from(new Set(list));
+
+  return deduped
     .filter(({ signatures, ignoreAsSuggestion, supportedCommands, supportedOptions, name }) => {
       if (ignoreAsSuggestion) {
         return false;
@@ -727,12 +732,22 @@ describe('autocomplete', () => {
       ...allEvaFunctions,
       ...allGroupingFunctions,
     ]);
+
+    // expect "bucket" NOT to be suggested for its own parameter
+    testSuggestions(
+      'from a | stats by bucket(',
+      [
+        ...getFieldNamesByType(['number', 'date']),
+        ...getFunctionSignaturesByReturnType('eval', ['date', 'number'], { evalMath: true }),
+      ].map((field) => `${field},`)
+    );
+
     testSuggestions('from a | stats avg(b) by numberField % 2 ', [',', '|']);
 
     testSuggestions(
       'from a | stats round(',
       [
-        ...getFunctionSignaturesByReturnType('stats', 'number', { agg: true }),
+        ...getFunctionSignaturesByReturnType('stats', 'number', { agg: true, grouping: true }),
         ...getFieldNamesByType('number'),
         ...getFunctionSignaturesByReturnType('eval', 'number', { evalMath: true }, undefined, [
           'round',
diff --git a/packages/kbn-esql-validation-autocomplete/src/autocomplete/autocomplete.ts b/packages/kbn-esql-validation-autocomplete/src/autocomplete/autocomplete.ts
index d45ffcde9c8a27..067abb3fca05c6 100644
--- a/packages/kbn-esql-validation-autocomplete/src/autocomplete/autocomplete.ts
+++ b/packages/kbn-esql-validation-autocomplete/src/autocomplete/autocomplete.ts
@@ -1106,12 +1106,16 @@ async function getFunctionArgsSuggestions(
     new Set(
       fnDefinition.signatures.reduce<string[]>((acc, signature) => {
         const p = signature.params[argIndex];
-        const _suggestions: string[] =
-          p && p.literalSuggestions
-            ? p.literalSuggestions
-            : p && p.literalOptions
-            ? p.literalOptions
-            : [];
+        if (!p) {
+          return acc;
+        }
+
+        const _suggestions: string[] = p.literalSuggestions
+          ? p.literalSuggestions
+          : p.literalOptions
+          ? p.literalOptions
+          : [];
+
         return acc.concat(_suggestions);
       }, [] as string[])
     )
@@ -1147,9 +1151,14 @@ async function getFunctionArgsSuggestions(
         ? Math.max(command.args.length - 1, 0)
         : commandArgIndex;
 
+    const finalCommandArg = command.args[finalCommandArgIndex];
+
     const fnToIgnore = [];
     // just ignore the current function
-    if (command.name !== 'stats') {
+    if (
+      command.name !== 'stats' ||
+      (isOptionItem(finalCommandArg) && finalCommandArg.name === 'by')
+    ) {
       fnToIgnore.push(node.name);
     } else {
       fnToIgnore.push(
diff --git a/packages/kbn-esql-validation-autocomplete/src/definitions/aggs.ts b/packages/kbn-esql-validation-autocomplete/src/definitions/aggs.ts
index 6ee79c64b3f017..cafaf2d09fa971 100644
--- a/packages/kbn-esql-validation-autocomplete/src/definitions/aggs.ts
+++ b/packages/kbn-esql-validation-autocomplete/src/definitions/aggs.ts
@@ -7,7 +7,7 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import type { FunctionDefinition } from './types';
+import type { FunctionDefinition, FunctionParameterType } from './types';
 
 function createNumericAggDefinition({
   name,
@@ -16,7 +16,12 @@ function createNumericAggDefinition({
 }: {
   name: string;
   description: string;
-  args?: Array<{ name: string; type: string; value: string; constantOnly?: boolean }>;
+  args?: Array<{
+    name: string;
+    type: FunctionParameterType;
+    value: string;
+    constantOnly?: boolean;
+  }>;
 }): FunctionDefinition {
   const extraParamsExample = args.length ? `, ${args.map(({ value }) => value).join(',')}` : '';
   return {
@@ -82,7 +87,7 @@ export const statsAggregationFunctionDefinitions: FunctionDefinition[] = [
         defaultMessage: 'Returns the n percentile of a field.',
       }
     ),
-    args: [{ name: 'percentile', type: 'number', value: '90', constantOnly: true }],
+    args: [{ name: 'percentile', type: 'number' as const, value: '90', constantOnly: true }],
   },
 ]
   .map(createNumericAggDefinition)
diff --git a/packages/kbn-esql-validation-autocomplete/src/definitions/builtin.ts b/packages/kbn-esql-validation-autocomplete/src/definitions/builtin.ts
index 20adda63602dfe..67fe23bada50fc 100644
--- a/packages/kbn-esql-validation-autocomplete/src/definitions/builtin.ts
+++ b/packages/kbn-esql-validation-autocomplete/src/definitions/builtin.ts
@@ -7,11 +7,14 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import type { FunctionDefinition } from './types';
+import type { FunctionDefinition, FunctionParameterType, FunctionReturnType } from './types';
 
 function createMathDefinition(
   name: string,
-  types: Array<string | string[]>,
+  types: Array<
+    | (FunctionParameterType & FunctionReturnType)
+    | [FunctionParameterType, FunctionParameterType, FunctionReturnType]
+  >,
   description: string,
   validate?: FunctionDefinition['validate']
 ): FunctionDefinition {
@@ -28,7 +31,7 @@ function createMathDefinition(
             { name: 'left', type: type[0] },
             { name: 'right', type: type[1] },
           ],
-          returnType: /literal/.test(type[0]) ? type[1] : type[0],
+          returnType: type[2],
         };
       }
       return {
@@ -91,20 +94,35 @@ function createComparisonDefinition(
         ],
         returnType: 'boolean',
       },
-      ...['date', 'number'].flatMap((type) => [
+      {
+        params: [
+          { name: 'left', type: 'version' },
+          { name: 'right', type: 'version' },
+        ],
+        returnType: 'boolean',
+      },
+      // constant strings okay because of implicit casting for
+      // string to version and ip
+      //
+      // boolean casting is handled on the specific comparison function
+      // that support booleans
+      //
+      // date casting is handled in the validation routine since it's a
+      // general rule. Look in compareLiteralType()
+      ...(['ip', 'version'] as const).flatMap((type) => [
         {
           params: [
             { name: 'left', type },
-            { name: 'right', type: 'string', constantOnly: true },
+            { name: 'right', type: 'string' as const, constantOnly: true },
           ],
-          returnType: 'boolean',
+          returnType: 'boolean' as const,
         },
         {
           params: [
-            { name: 'right', type: 'string', constantOnly: true },
+            { name: 'right', type: 'string' as const, constantOnly: true },
             { name: 'right', type },
           ],
-          returnType: 'boolean',
+          returnType: 'boolean' as const,
         },
       ]),
       ...extraSignatures,
@@ -112,17 +130,17 @@ function createComparisonDefinition(
   };
 }
 
-export const builtinFunctions: FunctionDefinition[] = [
+export const mathFunctions: FunctionDefinition[] = [
   createMathDefinition(
     '+',
-    ['number', ['date', 'time_literal'], ['time_literal', 'date']],
+    ['number', ['date', 'time_literal', 'date'], ['time_literal', 'date', 'date']],
     i18n.translate('kbn-esql-validation-autocomplete.esql.definition.addDoc', {
       defaultMessage: 'Add (+)',
     })
   ),
   createMathDefinition(
     '-',
-    ['number', ['date', 'time_literal'], ['time_literal', 'date']],
+    ['number', ['date', 'time_literal', 'date'], ['time_literal', 'date', 'date']],
     i18n.translate('kbn-esql-validation-autocomplete.esql.definition.subtractDoc', {
       defaultMessage: 'Subtract (-)',
     })
@@ -200,175 +218,128 @@ export const builtinFunctions: FunctionDefinition[] = [
       return messages;
     }
   ),
-  ...[
-    {
-      name: '==',
-      description: i18n.translate('kbn-esql-validation-autocomplete.esql.definition.equalToDoc', {
-        defaultMessage: 'Equal to',
-      }),
-      extraSignatures: [
-        {
-          params: [
-            { name: 'left', type: 'boolean' },
-            { name: 'right', type: 'boolean' },
-          ],
-          returnType: 'boolean',
-        },
-      ],
-    },
-    {
-      name: '!=',
-      description: i18n.translate(
-        'kbn-esql-validation-autocomplete.esql.definition.notEqualToDoc',
-        {
-          defaultMessage: 'Not equal to',
-        }
-      ),
-      extraSignatures: [
-        {
-          params: [
-            { name: 'left', type: 'boolean' },
-            { name: 'right', type: 'boolean' },
-          ],
-          returnType: 'boolean',
-        },
-      ],
-    },
-    {
-      name: '<',
-      description: i18n.translate('kbn-esql-validation-autocomplete.esql.definition.lessThanDoc', {
-        defaultMessage: 'Less than',
-      }),
-    },
-    {
-      name: '>',
-      description: i18n.translate(
-        'kbn-esql-validation-autocomplete.esql.definition.greaterThanDoc',
-        {
-          defaultMessage: 'Greater than',
-        }
-      ),
-    },
-    {
-      name: '<=',
-      description: i18n.translate(
-        'kbn-esql-validation-autocomplete.esql.definition.lessThanOrEqualToDoc',
-        {
-          defaultMessage: 'Less than or equal to',
-        }
-      ),
-    },
-    {
-      name: '>=',
-      description: i18n.translate(
-        'kbn-esql-validation-autocomplete.esql.definition.greaterThanOrEqualToDoc',
-        {
-          defaultMessage: 'Greater than or equal to',
-        }
-      ),
-    },
-  ].map((op): FunctionDefinition => createComparisonDefinition(op)),
-  ...[
-    // Skip the insensitive case equality until it gets restored back
-    // new special comparison operator for strings only
-    // {
-    //   name: '=~',
-    //   description: i18n.translate('kbn-esql-validation-autocomplete.esql.definition.equalToCaseInsensitiveDoc', {
-    //     defaultMessage: 'Case insensitive equality',
-    //   }),
-    // },
-    {
-      name: 'like',
-      description: i18n.translate('kbn-esql-validation-autocomplete.esql.definition.likeDoc', {
-        defaultMessage: 'Filter data based on string patterns',
-      }),
-    },
-    { name: 'not_like', description: '' },
-    {
-      name: 'rlike',
-      description: i18n.translate('kbn-esql-validation-autocomplete.esql.definition.rlikeDoc', {
-        defaultMessage: 'Filter data based on string regular expressions',
-      }),
-    },
-    { name: 'not_rlike', description: '' },
-  ].map<FunctionDefinition>(({ name, description }) => ({
-    type: 'builtin' as const,
-    ignoreAsSuggestion: /not/.test(name),
-    name,
-    description,
-    supportedCommands: ['eval', 'where', 'row', 'sort'],
-    supportedOptions: ['by'],
-    signatures: [
+];
+
+const comparisonFunctions: FunctionDefinition[] = [
+  {
+    name: '==',
+    description: i18n.translate('kbn-esql-validation-autocomplete.esql.definition.equalToDoc', {
+      defaultMessage: 'Equal to',
+    }),
+    extraSignatures: [
       {
         params: [
-          { name: 'left', type: 'string' },
-          { name: 'right', type: 'string' },
+          { name: 'left', type: 'boolean' as const },
+          { name: 'right', type: 'boolean' as const },
         ],
-        returnType: 'boolean',
+        returnType: 'boolean' as const,
       },
-    ],
-  })),
-  ...[
-    {
-      name: 'in',
-      description: i18n.translate('kbn-esql-validation-autocomplete.esql.definition.inDoc', {
-        defaultMessage:
-          'Tests if the value an expression takes is contained in a list of other expressions',
-      }),
-    },
-    { name: 'not_in', description: '' },
-  ].map<FunctionDefinition>(({ name, description }) => ({
-    type: 'builtin',
-    ignoreAsSuggestion: /not/.test(name),
-    name,
-    description,
-    supportedCommands: ['eval', 'where', 'row', 'sort'],
-    signatures: [
+      // constant strings okay because of implicit casting
       {
         params: [
-          { name: 'left', type: 'number' },
-          { name: 'right', type: 'number[]' },
+          { name: 'left', type: 'boolean' as const },
+          { name: 'right', type: 'string' as const, constantOnly: true },
         ],
-        returnType: 'boolean',
+        returnType: 'boolean' as const,
       },
       {
         params: [
-          { name: 'left', type: 'string' },
-          { name: 'right', type: 'string[]' },
+          { name: 'right', type: 'string' as const, constantOnly: true },
+          { name: 'right', type: 'boolean' as const },
         ],
-        returnType: 'boolean',
+        returnType: 'boolean' as const,
       },
+    ],
+  },
+  {
+    name: '!=',
+    description: i18n.translate('kbn-esql-validation-autocomplete.esql.definition.notEqualToDoc', {
+      defaultMessage: 'Not equal to',
+    }),
+    extraSignatures: [
       {
         params: [
-          { name: 'left', type: 'boolean' },
-          { name: 'right', type: 'boolean[]' },
+          { name: 'left', type: 'boolean' as const },
+          { name: 'right', type: 'boolean' as const },
         ],
-        returnType: 'boolean',
+        returnType: 'boolean' as const,
       },
+      // constant strings okay because of implicit casting
       {
         params: [
-          { name: 'left', type: 'date' },
-          { name: 'right', type: 'date[]' },
+          { name: 'left', type: 'boolean' as const },
+          { name: 'right', type: 'string' as const, constantOnly: true },
         ],
-        returnType: 'boolean',
+        returnType: 'boolean' as const,
+      },
+      {
+        params: [
+          { name: 'right', type: 'string' as const, constantOnly: true },
+          { name: 'right', type: 'boolean' as const },
+        ],
+        returnType: 'boolean' as const,
       },
     ],
-  })),
-  ...[
-    {
-      name: 'and',
-      description: i18n.translate('kbn-esql-validation-autocomplete.esql.definition.andDoc', {
-        defaultMessage: 'and',
-      }),
-    },
-    {
-      name: 'or',
-      description: i18n.translate('kbn-esql-validation-autocomplete.esql.definition.orDoc', {
-        defaultMessage: 'or',
-      }),
-    },
-  ].map(({ name, description }) => ({
+  },
+  {
+    name: '<',
+    description: i18n.translate('kbn-esql-validation-autocomplete.esql.definition.lessThanDoc', {
+      defaultMessage: 'Less than',
+    }),
+  },
+  {
+    name: '>',
+    description: i18n.translate('kbn-esql-validation-autocomplete.esql.definition.greaterThanDoc', {
+      defaultMessage: 'Greater than',
+    }),
+  },
+  {
+    name: '<=',
+    description: i18n.translate(
+      'kbn-esql-validation-autocomplete.esql.definition.lessThanOrEqualToDoc',
+      {
+        defaultMessage: 'Less than or equal to',
+      }
+    ),
+  },
+  {
+    name: '>=',
+    description: i18n.translate(
+      'kbn-esql-validation-autocomplete.esql.definition.greaterThanOrEqualToDoc',
+      {
+        defaultMessage: 'Greater than or equal to',
+      }
+    ),
+  },
+].map((op): FunctionDefinition => createComparisonDefinition(op));
+
+const likeFunctions: FunctionDefinition[] = [
+  // Skip the insensitive case equality until it gets restored back
+  // new special comparison operator for strings only
+  // {
+  //   name: '=~',
+  //   description: i18n.translate('kbn-esql-validation-autocomplete.esql.definition.equalToCaseInsensitiveDoc', {
+  //     defaultMessage: 'Case insensitive equality',
+  //   }),
+  // },
+  {
+    name: 'like',
+    description: i18n.translate('kbn-esql-validation-autocomplete.esql.definition.likeDoc', {
+      defaultMessage: 'Filter data based on string patterns',
+    }),
+  },
+  { name: 'not_like', description: '' },
+  {
+    name: 'rlike',
+    description: i18n.translate('kbn-esql-validation-autocomplete.esql.definition.rlikeDoc', {
+      defaultMessage: 'Filter data based on string regular expressions',
+    }),
+  },
+  { name: 'not_rlike', description: '' },
+].map(({ name, description }) => {
+  const def: FunctionDefinition = {
     type: 'builtin' as const,
+    ignoreAsSuggestion: /not/.test(name),
     name,
     description,
     supportedCommands: ['eval', 'where', 'row', 'sort'],
@@ -376,34 +347,166 @@ export const builtinFunctions: FunctionDefinition[] = [
     signatures: [
       {
         params: [
-          { name: 'left', type: 'boolean' },
-          { name: 'right', type: 'boolean' },
-        ],
-        returnType: 'boolean',
-      },
-      {
-        params: [
-          { name: 'left', type: 'null' },
-          { name: 'right', type: 'boolean' },
-        ],
-        returnType: 'boolean',
-      },
-      {
-        params: [
-          { name: 'left', type: 'boolean' },
-          { name: 'right', type: 'null' },
-        ],
-        returnType: 'boolean',
-      },
-      {
-        params: [
-          { name: 'left', type: 'null' },
-          { name: 'right', type: 'null' },
+          { name: 'left', type: 'string' as const },
+          { name: 'right', type: 'string' as const },
         ],
         returnType: 'boolean',
       },
     ],
-  })),
+  };
+
+  return def;
+});
+
+const inFunctions: FunctionDefinition[] = [
+  {
+    name: 'in',
+    description: i18n.translate('kbn-esql-validation-autocomplete.esql.definition.inDoc', {
+      defaultMessage:
+        'Tests if the value an expression takes is contained in a list of other expressions',
+    }),
+  },
+  { name: 'not_in', description: '' },
+].map<FunctionDefinition>(({ name, description }) => ({
+  // set all arrays to type "any" for now
+  // this only applies to the "in" operator
+  // e.g. "foo" in ( "foo", "bar" )
+  //
+  // we did this because the "in" operator now supports
+  // mixed-type arrays like ( "1.2.3", versionVar )
+  // because of implicit casting.
+  //
+  // we need to revisit with more robust validation
+  type: 'builtin',
+  ignoreAsSuggestion: /not/.test(name),
+  name,
+  description,
+  supportedCommands: ['eval', 'where', 'row', 'sort'],
+  signatures: [
+    {
+      params: [
+        { name: 'left', type: 'number' },
+
+        { name: 'right', type: 'any[]' },
+      ],
+      returnType: 'boolean',
+    },
+    {
+      params: [
+        { name: 'left', type: 'string' },
+        { name: 'right', type: 'any[]' },
+      ],
+      returnType: 'boolean',
+    },
+    {
+      params: [
+        { name: 'left', type: 'boolean' },
+        { name: 'right', type: 'any[]' },
+      ],
+      returnType: 'boolean',
+    },
+    {
+      params: [
+        { name: 'left', type: 'date' },
+        { name: 'right', type: 'any[]' },
+      ],
+      returnType: 'boolean',
+    },
+    {
+      params: [
+        { name: 'left', type: 'version' },
+        { name: 'right', type: 'any[]' },
+      ],
+      returnType: 'boolean',
+    },
+    {
+      params: [
+        { name: 'left', type: 'ip' },
+        { name: 'right', type: 'any[]' },
+      ],
+      returnType: 'boolean',
+    },
+  ],
+}));
+
+const logicFunctions: FunctionDefinition[] = [
+  {
+    name: 'and',
+    description: i18n.translate('kbn-esql-validation-autocomplete.esql.definition.andDoc', {
+      defaultMessage: 'and',
+    }),
+  },
+  {
+    name: 'or',
+    description: i18n.translate('kbn-esql-validation-autocomplete.esql.definition.orDoc', {
+      defaultMessage: 'or',
+    }),
+  },
+].map(({ name, description }) => ({
+  type: 'builtin' as const,
+  name,
+  description,
+  supportedCommands: ['eval', 'where', 'row', 'sort'],
+  supportedOptions: ['by'],
+  signatures: [
+    {
+      params: [
+        { name: 'left', type: 'boolean' as const },
+        { name: 'right', type: 'boolean' as const },
+      ],
+      returnType: 'boolean',
+    },
+    {
+      params: [
+        { name: 'left', type: 'null' },
+        { name: 'right', type: 'boolean' },
+      ],
+      returnType: 'boolean',
+    },
+    {
+      params: [
+        { name: 'left', type: 'boolean' },
+        { name: 'right', type: 'null' },
+      ],
+      returnType: 'boolean',
+    },
+    {
+      params: [
+        { name: 'left', type: 'null' },
+        { name: 'right', type: 'null' },
+      ],
+      returnType: 'boolean',
+    },
+  ],
+}));
+
+const nullFunctions: FunctionDefinition[] = [
+  {
+    name: 'is null',
+    description: i18n.translate('kbn-esql-validation-autocomplete.esql.definition.isNullDoc', {
+      defaultMessage: 'Predicate for NULL comparison: returns true if the value is NULL',
+    }),
+  },
+  {
+    name: 'is not null',
+    description: i18n.translate('kbn-esql-validation-autocomplete.esql.definition.isNotNullDoc', {
+      defaultMessage: 'Predicate for NULL comparison: returns true if the value is not NULL',
+    }),
+  },
+].map<FunctionDefinition>(({ name, description }) => ({
+  type: 'builtin',
+  name,
+  description,
+  supportedCommands: ['eval', 'where', 'row', 'sort'],
+  signatures: [
+    {
+      params: [{ name: 'left', type: 'any' }],
+      returnType: 'boolean',
+    },
+  ],
+}));
+
+const otherDefinitions: FunctionDefinition[] = [
   {
     type: 'builtin' as const,
     name: 'not',
@@ -419,31 +522,6 @@ export const builtinFunctions: FunctionDefinition[] = [
       },
     ],
   },
-  ...[
-    {
-      name: 'is null',
-      description: i18n.translate('kbn-esql-validation-autocomplete.esql.definition.isNullDoc', {
-        defaultMessage: 'Predicate for NULL comparison: returns true if the value is NULL',
-      }),
-    },
-    {
-      name: 'is not null',
-      description: i18n.translate('kbn-esql-validation-autocomplete.esql.definition.isNotNullDoc', {
-        defaultMessage: 'Predicate for NULL comparison: returns true if the value is not NULL',
-      }),
-    },
-  ].map<FunctionDefinition>(({ name, description }) => ({
-    type: 'builtin',
-    name,
-    description,
-    supportedCommands: ['eval', 'where', 'row', 'sort'],
-    signatures: [
-      {
-        params: [{ name: 'left', type: 'any' }],
-        returnType: 'boolean',
-      },
-    ],
-  })),
   {
     type: 'builtin' as const,
     name: '=',
@@ -491,3 +569,13 @@ export const builtinFunctions: FunctionDefinition[] = [
     ],
   },
 ];
+
+export const builtinFunctions: FunctionDefinition[] = [
+  ...mathFunctions,
+  ...comparisonFunctions,
+  ...likeFunctions,
+  ...inFunctions,
+  ...logicFunctions,
+  ...nullFunctions,
+  ...otherDefinitions,
+];
diff --git a/packages/kbn-esql-validation-autocomplete/src/definitions/commands.ts b/packages/kbn-esql-validation-autocomplete/src/definitions/commands.ts
index 861d18110d08fa..414c0fa6a8a9a0 100644
--- a/packages/kbn-esql-validation-autocomplete/src/definitions/commands.ts
+++ b/packages/kbn-esql-validation-autocomplete/src/definitions/commands.ts
@@ -134,6 +134,8 @@ export const commandDefinitions: CommandDefinition[] = [
         }
 
         function checkAggExistence(arg: ESQLFunction): boolean {
+          // TODO the grouping function check may not
+          // hold true for all future cases
           if (isAggFunction(arg)) {
             return true;
           }
@@ -172,6 +174,8 @@ export const commandDefinitions: CommandDefinition[] = [
           // * or if it's a builtin function, then all operands are agg functions or literals
           // * or if it's a eval function then all arguments are agg functions or literals
           function checkFunctionContent(arg: ESQLFunction) {
+            // TODO the grouping function check may not
+            // hold true for all future cases
             if (isAggFunction(arg)) {
               return true;
             }
diff --git a/packages/kbn-esql-validation-autocomplete/src/definitions/functions.ts b/packages/kbn-esql-validation-autocomplete/src/definitions/functions.ts
index bfa718353f6b25..7347f4d18953e4 100644
--- a/packages/kbn-esql-validation-autocomplete/src/definitions/functions.ts
+++ b/packages/kbn-esql-validation-autocomplete/src/definitions/functions.ts
@@ -40,8 +40,10 @@ const dateDiffSuggestions = [
   'year',
   'quarter',
   'month',
-  'week',
+  'dayofyear',
   'day',
+  'week',
+  'weekday',
   'hour',
   'minute',
   'second',
@@ -109,10 +111,10 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     signatures: [
       {
         params: [
-          { name: 'field', type: 'number' },
-          { name: 'decimals', type: 'number', optional: true },
+          { name: 'field', type: 'number' as const },
+          { name: 'decimals', type: 'number' as const, optional: true },
         ],
-        returnType: 'number',
+        returnType: 'number' as const,
         examples: [
           `from index | eval round_value = round(field)`,
           `from index | eval round_value = round(field, 2)`,
@@ -128,8 +130,8 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     }),
     signatures: [
       {
-        params: [{ name: 'field', type: 'number' }],
-        returnType: 'number',
+        params: [{ name: 'field', type: 'number' as const }],
+        returnType: 'number' as const,
         examples: [`from index | eval s = signum(field)`],
       },
     ],
@@ -141,8 +143,8 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     }),
     signatures: [
       {
-        params: [{ name: 'field', type: 'number' }],
-        returnType: 'number',
+        params: [{ name: 'field', type: 'number' as const }],
+        returnType: 'number' as const,
         examples: [`from index | eval abs_value = abs(field)`],
       },
     ],
@@ -154,8 +156,8 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     }),
     signatures: [
       {
-        params: [{ name: 'field', type: 'number' }],
-        returnType: 'number',
+        params: [{ name: 'field', type: 'number' as const }],
+        returnType: 'number' as const,
         examples: [`from index | eval ceil_value = ceil(field)`],
       },
     ],
@@ -167,8 +169,8 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     }),
     signatures: [
       {
-        params: [{ name: 'field', type: 'number' }],
-        returnType: 'number',
+        params: [{ name: 'field', type: 'number' as const }],
+        returnType: 'number' as const,
         examples: [`from index | eval log10_value = log10(field)`],
       },
     ],
@@ -183,10 +185,10 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     signatures: [
       {
         params: [
-          { name: 'baseOrField', type: 'number' },
-          { name: 'field', type: 'number', optional: true },
+          { name: 'baseOrField', type: 'number' as const },
+          { name: 'field', type: 'number' as const, optional: true },
         ],
-        returnType: 'number',
+        returnType: 'number' as const,
         examples: [
           `from index | eval log2_value = log(2, field)`,
           `from index | eval loge_value = log(field)`,
@@ -204,10 +206,10 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     signatures: [
       {
         params: [
-          { name: 'field', type: 'number' },
-          { name: 'exponent', type: 'number' },
+          { name: 'field', type: 'number' as const },
+          { name: 'exponent', type: 'number' as const },
         ],
-        returnType: 'number',
+        returnType: 'number' as const,
         examples: ['from index | eval s = POW(field, exponent)'],
       },
     ],
@@ -219,9 +221,9 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     }),
     signatures: [
       {
-        params: [{ name: 'field', type: 'string' }],
+        params: [{ name: 'field', type: 'string' as const }],
         minParams: 2,
-        returnType: 'string',
+        returnType: 'string' as const,
         examples: ['from index | eval concatenated = concat(field1, "-", field2)'],
       },
     ],
@@ -235,11 +237,11 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     signatures: [
       {
         params: [
-          { name: 'field', type: 'string' },
-          { name: 'regexp', type: 'string' },
-          { name: 'replacement', type: 'string' },
+          { name: 'field', type: 'string' as const },
+          { name: 'regexp', type: 'string' as const },
+          { name: 'replacement', type: 'string' as const },
         ],
-        returnType: 'string',
+        returnType: 'string' as const,
         examples: ['from index | eval newStr = replace(field, "Hello", "World")'],
       },
     ],
@@ -253,11 +255,11 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     signatures: [
       {
         params: [
-          { name: 'field', type: 'string' },
-          { name: 'startIndex', type: 'number' },
-          { name: 'endIndex', type: 'number' },
+          { name: 'field', type: 'string' as const },
+          { name: 'startIndex', type: 'number' as const },
+          { name: 'endIndex', type: 'number' as const },
         ],
-        returnType: 'string',
+        returnType: 'string' as const,
         examples: ['from index | eval new_string = substring(field, 1, 3)'],
       },
     ],
@@ -269,8 +271,8 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     }),
     signatures: [
       {
-        params: [{ name: 'field', type: 'string' }],
-        returnType: 'string',
+        params: [{ name: 'field', type: 'string' as const }],
+        returnType: 'string' as const,
         examples: ['from index | eval to_lower(field1)'],
       },
     ],
@@ -282,8 +284,8 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     }),
     signatures: [
       {
-        params: [{ name: 'field', type: 'string' }],
-        returnType: 'string',
+        params: [{ name: 'field', type: 'string' as const }],
+        returnType: 'string' as const,
         examples: ['from index | eval to_upper(field1)'],
       },
     ],
@@ -295,8 +297,8 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     }),
     signatures: [
       {
-        params: [{ name: 'field', type: 'string' }],
-        returnType: 'string',
+        params: [{ name: 'field', type: 'string' as const }],
+        returnType: 'string' as const,
         examples: ['from index | eval new_string = trim(field)'],
       },
     ],
@@ -310,10 +312,10 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     signatures: [
       {
         params: [
-          { name: 'field', type: 'string' },
-          { name: 'prefix', type: 'string' },
+          { name: 'field', type: 'string' as const },
+          { name: 'prefix', type: 'string' as const },
         ],
-        returnType: 'boolean',
+        returnType: 'boolean' as const,
         examples: ['from index | eval starts_with_a = starts_with(field, "a")'],
       },
     ],
@@ -327,10 +329,10 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     signatures: [
       {
         params: [
-          { name: 'field', type: 'string' },
-          { name: 'prefix', type: 'string' },
+          { name: 'field', type: 'string' as const },
+          { name: 'prefix', type: 'string' as const },
         ],
-        returnType: 'boolean',
+        returnType: 'boolean' as const,
         examples: ['from index | eval ends_with_a = ends_with(field, "a")'],
       },
     ],
@@ -343,10 +345,10 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     signatures: [
       {
         params: [
-          { name: 'words', type: 'string' },
-          { name: 'separator', type: 'string' },
+          { name: 'words', type: 'string' as const },
+          { name: 'separator', type: 'string' as const },
         ],
-        returnType: 'string',
+        returnType: 'string' as const,
         examples: [`ROW words="foo;bar;baz;qux;quux;corge" | EVAL word = SPLIT(words, ";")`],
       },
     ],
@@ -359,8 +361,8 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     }),
     signatures: [
       {
-        params: [{ name: 'field', type: 'any' }],
-        returnType: 'string',
+        params: [{ name: 'field', type: 'any' as const }],
+        returnType: 'string' as const,
         examples: [`from index" | EVAL string = to_string(field)`],
       },
     ],
@@ -373,8 +375,8 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     }),
     signatures: [
       {
-        params: [{ name: 'field', type: 'any' }],
-        returnType: 'boolean',
+        params: [{ name: 'field', type: 'any' as const }],
+        returnType: 'boolean' as const,
         examples: [`from index" | EVAL bool = to_boolean(field)`],
       },
     ],
@@ -389,8 +391,8 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     ),
     signatures: [
       {
-        params: [{ name: 'field', type: 'any' }],
-        returnType: 'cartesian_point',
+        params: [{ name: 'field', type: 'any' as const }],
+        returnType: 'cartesian_point' as const,
         examples: [`from index | EVAL point = to_cartesianpoint(field)`],
       },
     ],
@@ -405,8 +407,8 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     ),
     signatures: [
       {
-        params: [{ name: 'field', type: 'any' }],
-        returnType: 'cartesian_shape',
+        params: [{ name: 'field', type: 'any' as const }],
+        returnType: 'cartesian_shape' as const,
         examples: [`from index | EVAL cartesianshape = to_cartesianshape(field)`],
       },
     ],
@@ -419,8 +421,8 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     }),
     signatures: [
       {
-        params: [{ name: 'field', type: 'any' }],
-        returnType: 'date',
+        params: [{ name: 'field', type: 'any' as const }],
+        returnType: 'date' as const,
         examples: [`from index" | EVAL datetime = to_datetime(field)`],
       },
     ],
@@ -432,8 +434,8 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     }),
     signatures: [
       {
-        params: [{ name: 'field', type: 'number' }],
-        returnType: 'number',
+        params: [{ name: 'field', type: 'number' as const }],
+        returnType: 'number' as const,
         examples: [`from index | eval degrees = to_degrees(field)`],
       },
     ],
@@ -446,8 +448,8 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     }),
     signatures: [
       {
-        params: [{ name: 'field', type: 'any' }],
-        returnType: 'number',
+        params: [{ name: 'field', type: 'any' as const }],
+        returnType: 'number' as const,
         examples: [`from index | EVAL double = to_double(field)`],
       },
     ],
@@ -459,8 +461,8 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     }),
     signatures: [
       {
-        params: [{ name: 'field', type: 'any' }],
-        returnType: 'geo_point',
+        params: [{ name: 'field', type: 'any' as const }],
+        returnType: 'geo_point' as const,
         examples: [`from index | EVAL geopoint = to_geopoint(field)`],
       },
     ],
@@ -472,8 +474,8 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     }),
     signatures: [
       {
-        params: [{ name: 'field', type: 'any' }],
-        returnType: 'geo_shape',
+        params: [{ name: 'field', type: 'any' as const }],
+        returnType: 'geo_shape' as const,
         examples: [`from index | EVAL geoshape = to_geoshape(field)`],
       },
     ],
@@ -486,8 +488,8 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     }),
     signatures: [
       {
-        params: [{ name: 'field', type: 'any' }],
-        returnType: 'number',
+        params: [{ name: 'field', type: 'any' as const }],
+        returnType: 'number' as const,
         examples: [`from index | EVAL integer = to_integer(field)`],
       },
     ],
@@ -499,8 +501,8 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     }),
     signatures: [
       {
-        params: [{ name: 'field', type: 'any' }],
-        returnType: 'number',
+        params: [{ name: 'field', type: 'any' as const }],
+        returnType: 'number' as const,
         examples: [`from index | EVAL long = to_long(field)`],
       },
     ],
@@ -512,8 +514,8 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     }),
     signatures: [
       {
-        params: [{ name: 'field', type: 'number' }],
-        returnType: 'number',
+        params: [{ name: 'field', type: 'number' as const }],
+        returnType: 'number' as const,
         examples: [`from index | eval radians = to_radians(field)`],
       },
     ],
@@ -529,8 +531,8 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     ),
     signatures: [
       {
-        params: [{ name: 'field', type: 'any' }],
-        returnType: 'number',
+        params: [{ name: 'field', type: 'any' as const }],
+        returnType: 'number' as const,
         examples: [`from index | EVAL unsigned_long = to_unsigned_long(field)`],
       },
     ],
@@ -542,8 +544,8 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     }),
     signatures: [
       {
-        params: [{ name: 'field', type: 'any' }],
-        returnType: 'ip',
+        params: [{ name: 'field', type: 'any' as const }],
+        returnType: 'ip' as const,
         examples: [`from index | EVAL ip = to_ip(field)`],
       },
     ],
@@ -556,8 +558,8 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     }),
     signatures: [
       {
-        params: [{ name: 'field', type: 'string' }],
-        returnType: 'string',
+        params: [{ name: 'field', type: 'string' as const }],
+        returnType: 'version' as const,
         examples: [`from index | EVAL version = to_version(stringField)`],
       },
     ],
@@ -575,11 +577,11 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
         params: [
           {
             name: 'date_part',
-            type: 'chrono_literal',
+            type: 'chrono_literal' as const,
           },
-          { name: 'field', type: 'date' },
+          { name: 'field', type: 'date' as const },
         ],
-        returnType: 'number',
+        returnType: 'number' as const,
         examples: [
           `ROW date = DATE_PARSE("yyyy-MM-dd", "2022-05-06") | EVAL year = DATE_EXTRACT("year", date)`,
         ],
@@ -596,56 +598,14 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
         params: [
           {
             name: 'unit',
-            type: 'string',
-            literalOptions: dateDiffOptions,
-            literalSuggestions: dateDiffSuggestions,
-          },
-          { name: 'startTimestamp', type: 'date' },
-          { name: 'endTimestamp', type: 'date' },
-        ],
-        returnType: 'number',
-        examples: [],
-      },
-      {
-        params: [
-          {
-            name: 'unit',
-            type: 'string',
-            literalOptions: dateDiffOptions,
-            literalSuggestions: dateDiffSuggestions,
-          },
-          { name: 'startTimestamp', type: 'string', constantOnly: true },
-          { name: 'endTimestamp', type: 'date' },
-        ],
-        returnType: 'number',
-        examples: [],
-      },
-      {
-        params: [
-          {
-            name: 'unit',
-            type: 'string',
-            literalOptions: dateDiffOptions,
-            literalSuggestions: dateDiffSuggestions,
-          },
-          { name: 'startTimestamp', type: 'date' },
-          { name: 'endTimestamp', type: 'string', constantOnly: true },
-        ],
-        returnType: 'number',
-        examples: [],
-      },
-      {
-        params: [
-          {
-            name: 'unit',
-            type: 'string',
+            type: 'string' as const,
             literalOptions: dateDiffOptions,
             literalSuggestions: dateDiffSuggestions,
           },
-          { name: 'startTimestamp', type: 'string', constantOnly: true },
-          { name: 'endTimestamp', type: 'string', constantOnly: true },
+          { name: 'startTimestamp', type: 'date' as const },
+          { name: 'endTimestamp', type: 'date' as const },
         ],
-        returnType: 'number',
+        returnType: 'number' as const,
         examples: [],
       },
     ],
@@ -658,10 +618,10 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     signatures: [
       {
         params: [
-          { name: 'field', type: 'date' },
-          { name: 'format_string', type: 'string', optional: true },
+          { name: 'field', type: 'date' as const },
+          { name: 'format_string', type: 'string' as const, optional: true },
         ],
-        returnType: 'string',
+        returnType: 'string' as const,
         examples: ['from index | eval hired = date_format("YYYY-MM-dd", hire_date)'],
       },
     ],
@@ -674,10 +634,10 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     signatures: [
       {
         params: [
-          { name: 'time', type: 'time_literal' },
-          { name: 'field', type: 'date' },
+          { name: 'time', type: 'time_literal' as const },
+          { name: 'field', type: 'date' as const },
         ],
-        returnType: 'date',
+        returnType: 'date' as const,
         examples: [`from index | eval year_hired = DATE_TRUNC(1 year, hire_date)`],
       },
     ],
@@ -690,10 +650,10 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     signatures: [
       {
         params: [
-          { name: 'field', type: 'string' },
-          { name: 'format_string', type: 'string' },
+          { name: 'field', type: 'string' as const },
+          { name: 'format_string', type: 'string' as const },
         ],
-        returnType: 'date',
+        returnType: 'date' as const,
         examples: [
           `from index | eval year_hired = date_parse("yyyy-MM-dd'T'HH:mm:ss.SSS'Z'", hire_date)`,
         ],
@@ -709,11 +669,11 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     signatures: [
       {
         params: [
-          { name: 'condition', type: 'boolean' },
-          { name: 'value', type: 'any' },
+          { name: 'condition', type: 'boolean' as const },
+          { name: 'value', type: 'any' as const },
         ],
         minParams: 2,
-        returnType: 'any',
+        returnType: 'any' as const,
         examples: [
           `from index | eval type = case(languages <= 1, "monolingual", languages <= 2, "bilingual", "polyglot")`,
         ],
@@ -727,8 +687,8 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     }),
     signatures: [
       {
-        params: [{ name: 'field', type: 'string' }],
-        returnType: 'number',
+        params: [{ name: 'field', type: 'string' as const }],
+        returnType: 'number' as const,
         examples: [`from index | eval fn_length = length(field)`],
       },
     ],
@@ -740,8 +700,8 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     }),
     signatures: [
       {
-        params: [{ name: 'field', type: 'number' }],
-        returnType: 'number',
+        params: [{ name: 'field', type: 'number' as const }],
+        returnType: 'number' as const,
         examples: [`from index | eval acos = acos(field)`],
       },
     ],
@@ -753,8 +713,8 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     }),
     signatures: [
       {
-        params: [{ name: 'field', type: 'number' }],
-        returnType: 'number',
+        params: [{ name: 'field', type: 'number' as const }],
+        returnType: 'number' as const,
         examples: [`from index | eval asin = asin(field)`],
       },
     ],
@@ -766,8 +726,8 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     }),
     signatures: [
       {
-        params: [{ name: 'field', type: 'number' }],
-        returnType: 'number',
+        params: [{ name: 'field', type: 'number' as const }],
+        returnType: 'number' as const,
         examples: [`from index | eval atan = atan(field)`],
       },
     ],
@@ -781,10 +741,10 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     signatures: [
       {
         params: [
-          { name: 'x', type: 'number' },
-          { name: 'y', type: 'number' },
+          { name: 'x', type: 'number' as const },
+          { name: 'y', type: 'number' as const },
         ],
-        returnType: 'number',
+        returnType: 'number' as const,
         examples: [`from index | eval atan2 = atan2(x, y)`],
       },
     ],
@@ -796,9 +756,9 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     }),
     signatures: [
       {
-        params: [{ name: 'field', type: 'any' }],
+        params: [{ name: 'field', type: 'any' as const }],
         minParams: 1,
-        returnType: 'any',
+        returnType: 'any' as const,
         examples: [`ROW a=null, b="b" | EVAL COALESCE(a, b)`],
       },
     ],
@@ -810,8 +770,8 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     }),
     signatures: [
       {
-        params: [{ name: 'field', type: 'number' }],
-        returnType: 'number',
+        params: [{ name: 'field', type: 'number' as const }],
+        returnType: 'number' as const,
         examples: [`from index | eval cos = cos(field)`],
       },
     ],
@@ -823,8 +783,8 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     }),
     signatures: [
       {
-        params: [{ name: 'field', type: 'number' }],
-        returnType: 'number',
+        params: [{ name: 'field', type: 'number' as const }],
+        returnType: 'number' as const,
         examples: [`from index | eval cosh = cosh(field)`],
       },
     ],
@@ -836,8 +796,8 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     }),
     signatures: [
       {
-        params: [{ name: 'field', type: 'number' }],
-        returnType: 'number',
+        params: [{ name: 'field', type: 'number' as const }],
+        returnType: 'number' as const,
         examples: [`from index | eval a = floor(field)`],
       },
     ],
@@ -849,9 +809,9 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     }),
     signatures: [
       {
-        params: [{ name: 'field', type: 'any' }],
+        params: [{ name: 'field', type: 'any' as const }],
         minParams: 1,
-        returnType: 'any',
+        returnType: 'any' as const,
         examples: [`ROW a = 10, b = 20 | EVAL g = GREATEST(a, b)`],
       },
     ],
@@ -863,9 +823,9 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     }),
     signatures: [
       {
-        params: [{ name: 'first', type: 'any' }],
+        params: [{ name: 'first', type: 'any' as const }],
         minParams: 1,
-        returnType: 'any',
+        returnType: 'any' as const,
         examples: ['from index | eval l = least(a, b)'],
       },
     ],
@@ -879,10 +839,10 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     signatures: [
       {
         params: [
-          { name: 'field', type: 'string' },
-          { name: 'length', type: 'number' },
+          { name: 'field', type: 'string' as const },
+          { name: 'length', type: 'number' as const },
         ],
-        returnType: 'string',
+        returnType: 'string' as const,
         examples: [`from index | eval substr = left(field, 3)`],
       },
     ],
@@ -894,8 +854,8 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     }),
     signatures: [
       {
-        params: [{ name: 'field', type: 'string' }],
-        returnType: 'string',
+        params: [{ name: 'field', type: 'string' as const }],
+        returnType: 'string' as const,
         examples: [`ROW message = "   some text  "| EVAL message = LTRIM(message)`],
       },
     ],
@@ -908,7 +868,7 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     signatures: [
       {
         params: [],
-        returnType: 'date',
+        returnType: 'date' as const,
         examples: [`ROW current_date = NOW()`],
       },
     ],
@@ -922,10 +882,10 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     signatures: [
       {
         params: [
-          { name: 'field', type: 'string' },
-          { name: 'length', type: 'number' },
+          { name: 'field', type: 'string' as const },
+          { name: 'length', type: 'number' as const },
         ],
-        returnType: 'string',
+        returnType: 'string' as const,
         examples: [`from index | eval string = right(field, 3)`],
       },
     ],
@@ -937,8 +897,8 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     }),
     signatures: [
       {
-        params: [{ name: 'field', type: 'string' }],
-        returnType: 'string',
+        params: [{ name: 'field', type: 'string' as const }],
+        returnType: 'string' as const,
         examples: [`ROW message = "   some text  " | EVAL message = RTRIM(message)`],
       },
     ],
@@ -950,8 +910,8 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     }),
     signatures: [
       {
-        params: [{ name: 'field', type: 'number' }],
-        returnType: 'number',
+        params: [{ name: 'field', type: 'number' as const }],
+        returnType: 'number' as const,
         examples: [`ROW a=1.8 | EVAL sin=SIN(a)`],
       },
     ],
@@ -963,8 +923,8 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     }),
     signatures: [
       {
-        params: [{ name: 'field', type: 'number' }],
-        returnType: 'number',
+        params: [{ name: 'field', type: 'number' as const }],
+        returnType: 'number' as const,
         examples: [`ROW a=1.8 | EVAL sinh=SINH(a)`],
       },
     ],
@@ -976,8 +936,8 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     }),
     signatures: [
       {
-        params: [{ name: 'field', type: 'number' }],
-        returnType: 'number',
+        params: [{ name: 'field', type: 'number' as const }],
+        returnType: 'number' as const,
         examples: [`ROW d = 100.0 | EVAL s = SQRT(d)`],
       },
     ],
@@ -989,8 +949,8 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     }),
     signatures: [
       {
-        params: [{ name: 'field', type: 'number' }],
-        returnType: 'number',
+        params: [{ name: 'field', type: 'number' as const }],
+        returnType: 'number' as const,
         examples: [`ROW a=1.8 | EVAL tan=TAN(a)`],
       },
     ],
@@ -1002,8 +962,8 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     }),
     signatures: [
       {
-        params: [{ name: 'field', type: 'number' }],
-        returnType: 'number',
+        params: [{ name: 'field', type: 'number' as const }],
+        returnType: 'number' as const,
         examples: [`ROW a=1.8 | EVAL tanh=TANH(a)`],
       },
     ],
@@ -1018,10 +978,10 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
       {
         minParams: 2,
         params: [
-          { name: 'ip', type: 'ip' },
-          { name: 'cidr_block', type: 'string' },
+          { name: 'ip', type: 'ip' as const },
+          { name: 'cidr_block', type: 'string' as const },
         ],
-        returnType: 'boolean',
+        returnType: 'boolean' as const,
         examples: [
           'from index | where cidr_match(ip_field, "127.0.0.1/30")',
           'from index | eval cidr="10.0.0.0/8" | where cidr_match(ip_field, "127.0.0.1/30", cidr)',
@@ -1037,15 +997,15 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     signatures: [
       {
         params: [
-          { name: 'field', type: 'any' },
+          { name: 'field', type: 'any' as const },
           {
             name: 'order',
-            type: 'string',
+            type: 'string' as const,
             optional: true,
             literalOptions: ['asc', 'desc'],
           },
         ],
-        returnType: 'any',
+        returnType: 'any' as const,
         examples: [
           'row a = [4, 2, -3, 2] | eval sorted = mv_sort(a)',
           'row a = ["b", "c", "a"] | sorted = mv_sort(a, "DESC")',
@@ -1061,8 +1021,8 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     }),
     signatures: [
       {
-        params: [{ name: 'multivalue', type: 'number' }],
-        returnType: 'number',
+        params: [{ name: 'multivalue', type: 'number' as const }],
+        returnType: 'number' as const,
         examples: ['row a = [1, 2, 3] | eval mv_avg(a)'],
       },
     ],
@@ -1076,10 +1036,10 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     signatures: [
       {
         params: [
-          { name: 'multivalue', type: 'string' },
-          { name: 'delimeter', type: 'string' },
+          { name: 'multivalue', type: 'string' as const },
+          { name: 'delimeter', type: 'string' as const },
         ],
-        returnType: 'string',
+        returnType: 'string' as const,
         examples: ['row a = ["1", "2", "3"] | eval mv_concat(a, ", ")'],
       },
     ],
@@ -1092,8 +1052,8 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     }),
     signatures: [
       {
-        params: [{ name: 'multivalue', type: 'any' }],
-        returnType: 'number',
+        params: [{ name: 'multivalue', type: 'any' as const }],
+        returnType: 'number' as const,
         examples: ['row a = [1, 2, 3] | eval mv_count(a)'],
       },
     ],
@@ -1105,8 +1065,8 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     }),
     signatures: [
       {
-        params: [{ name: 'multivalue', type: 'any' }],
-        returnType: 'any',
+        params: [{ name: 'multivalue', type: 'any' as const }],
+        returnType: 'any' as const,
         examples: ['row a = [2, 2, 3] | eval mv_dedupe(a)'],
       },
     ],
@@ -1119,8 +1079,8 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     }),
     signatures: [
       {
-        params: [{ name: 'multivalue', type: 'any' }],
-        returnType: 'any',
+        params: [{ name: 'multivalue', type: 'any' as const }],
+        returnType: 'any' as const,
         examples: ['row a = [1, 2, 3] | eval one = mv_first(a)'],
       },
     ],
@@ -1133,8 +1093,8 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     }),
     signatures: [
       {
-        params: [{ name: 'multivalue', type: 'any' }],
-        returnType: 'any',
+        params: [{ name: 'multivalue', type: 'any' as const }],
+        returnType: 'any' as const,
         examples: ['row a = [1, 2, 3] | eval three = mv_last(a)'],
       },
     ],
@@ -1147,8 +1107,8 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     }),
     signatures: [
       {
-        params: [{ name: 'multivalue', type: 'any' }],
-        returnType: 'any',
+        params: [{ name: 'multivalue', type: 'any' as const }],
+        returnType: 'any' as const,
         examples: ['row a = [1, 2, 3] | eval mv_max(a)'],
       },
     ],
@@ -1161,8 +1121,8 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     }),
     signatures: [
       {
-        params: [{ name: 'multivalue', type: 'any' }],
-        returnType: 'any',
+        params: [{ name: 'multivalue', type: 'any' as const }],
+        returnType: 'any' as const,
         examples: ['row a = [1, 2, 3] | eval mv_min(a)'],
       },
     ],
@@ -1175,8 +1135,8 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     }),
     signatures: [
       {
-        params: [{ name: 'multivalue', type: 'number' }],
-        returnType: 'number',
+        params: [{ name: 'multivalue', type: 'number' as const }],
+        returnType: 'number' as const,
         examples: ['row a = [1, 2, 3] | eval mv_median(a)'],
       },
     ],
@@ -1189,8 +1149,8 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     }),
     signatures: [
       {
-        params: [{ name: 'multivalue', type: 'number' }],
-        returnType: 'number',
+        params: [{ name: 'multivalue', type: 'number' as const }],
+        returnType: 'number' as const,
         examples: ['row a = [1, 2, 3] | eval mv_sum(a)'],
       },
     ],
@@ -1204,11 +1164,11 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     signatures: [
       {
         params: [
-          { name: 'multivalue', type: 'any' },
-          { name: 'start', type: 'number' },
-          { name: 'end', type: 'number' },
+          { name: 'multivalue', type: 'any' as const },
+          { name: 'start', type: 'number' as const },
+          { name: 'end', type: 'number' as const },
         ],
-        returnType: 'number',
+        returnType: 'number' as const,
         examples: ['row a = [1, 2, 2, 3] | eval a1 = mv_slice(a, 1), a2 = mv_slice(a, 2, 3)'],
       },
     ],
@@ -1222,11 +1182,11 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     signatures: [
       {
         params: [
-          { name: 'mvLeft', type: 'string' },
-          { name: 'mvRight', type: 'string' },
-          { name: 'delim', type: 'string' },
+          { name: 'mvLeft', type: 'string' as const },
+          { name: 'mvRight', type: 'string' as const },
+          { name: 'delim', type: 'string' as const },
         ],
-        returnType: 'string',
+        returnType: 'string' as const,
         examples: [
           'ROW a = ["x", "y", "z"], b = ["1", "2"] \n| EVAL c = mv_zip(a, b, "-") \n| KEEP a, b, c',
         ],
@@ -1241,7 +1201,7 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     signatures: [
       {
         params: [],
-        returnType: 'number',
+        returnType: 'number' as const,
         examples: ['row a = 1 | eval pi()'],
       },
     ],
@@ -1254,7 +1214,7 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     signatures: [
       {
         params: [],
-        returnType: 'number',
+        returnType: 'number' as const,
         examples: ['row a = 1 | eval e()'],
       },
     ],
@@ -1267,7 +1227,7 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
     signatures: [
       {
         params: [],
-        returnType: 'number',
+        returnType: 'number' as const,
         examples: ['row a = 1 | eval tau()'],
       },
     ],
@@ -1283,112 +1243,112 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
         params: [
           {
             name: 'geomA',
-            type: 'geo_point',
+            type: 'geo_point' as const,
           },
           {
             name: 'geomB',
-            type: 'geo_point',
+            type: 'geo_point' as const,
           },
         ],
-        returnType: 'boolean',
+        returnType: 'boolean' as const,
         examples: ['from index | eval st_contains(geometryA, geometryB)'],
       },
       {
         params: [
           {
             name: 'geomA',
-            type: 'geo_point',
+            type: 'geo_point' as const,
           },
           {
             name: 'geomB',
-            type: 'geo_shape',
+            type: 'geo_shape' as const,
           },
         ],
-        returnType: 'boolean',
+        returnType: 'boolean' as const,
         examples: ['from index | eval st_contains(geometryA, geometryB)'],
       },
       {
         params: [
           {
             name: 'geomA',
-            type: 'geo_shape',
+            type: 'geo_shape' as const,
           },
           {
             name: 'geomB',
-            type: 'geo_point',
+            type: 'geo_point' as const,
           },
         ],
-        returnType: 'boolean',
+        returnType: 'boolean' as const,
         examples: ['from index | eval st_contains(geometryA, geometryB)'],
       },
       {
         params: [
           {
             name: 'geomA',
-            type: 'geo_shape',
+            type: 'geo_shape' as const,
           },
           {
             name: 'geomB',
-            type: 'geo_shape',
+            type: 'geo_shape' as const,
           },
         ],
-        returnType: 'boolean',
+        returnType: 'boolean' as const,
         examples: ['from index | eval st_contains(geometryA, geometryB)'],
       },
       {
         params: [
           {
             name: 'geomA',
-            type: 'cartesian_point',
+            type: 'cartesian_point' as const,
           },
           {
             name: 'geomB',
-            type: 'cartesian_point',
+            type: 'cartesian_point' as const,
           },
         ],
-        returnType: 'boolean',
+        returnType: 'boolean' as const,
         examples: ['from index | eval st_contains(geometryA, geometryB)'],
       },
       {
         params: [
           {
             name: 'geomA',
-            type: 'cartesian_point',
+            type: 'cartesian_point' as const,
           },
           {
             name: 'geomB',
-            type: 'cartesian_shape',
+            type: 'cartesian_shape' as const,
           },
         ],
-        returnType: 'boolean',
+        returnType: 'boolean' as const,
         examples: ['from index | eval st_contains(geometryA, geometryB)'],
       },
       {
         params: [
           {
             name: 'geomA',
-            type: 'cartesian_shape',
+            type: 'cartesian_shape' as const,
           },
           {
             name: 'geomB',
-            type: 'cartesian_point',
+            type: 'cartesian_point' as const,
           },
         ],
-        returnType: 'boolean',
+        returnType: 'boolean' as const,
         examples: ['from index | eval st_contains(geometryA, geometryB)'],
       },
       {
         params: [
           {
             name: 'geomA',
-            type: 'cartesian_shape',
+            type: 'cartesian_shape' as const,
           },
           {
             name: 'geomB',
-            type: 'cartesian_shape',
+            type: 'cartesian_shape' as const,
           },
         ],
-        returnType: 'boolean',
+        returnType: 'boolean' as const,
         examples: ['from index | eval st_contains(geometryA, geometryB)'],
       },
     ],
@@ -1403,112 +1363,112 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
         params: [
           {
             name: 'geomA',
-            type: 'geo_point',
+            type: 'geo_point' as const,
           },
           {
             name: 'geomB',
-            type: 'geo_point',
+            type: 'geo_point' as const,
           },
         ],
-        returnType: 'boolean',
+        returnType: 'boolean' as const,
         examples: ['from index | eval st_within(geometryA, geometryB)'],
       },
       {
         params: [
           {
             name: 'geomA',
-            type: 'geo_point',
+            type: 'geo_point' as const,
           },
           {
             name: 'geomB',
-            type: 'geo_shape',
+            type: 'geo_shape' as const,
           },
         ],
-        returnType: 'boolean',
+        returnType: 'boolean' as const,
         examples: ['from index | eval st_within(geometryA, geometryB)'],
       },
       {
         params: [
           {
             name: 'geomA',
-            type: 'geo_shape',
+            type: 'geo_shape' as const,
           },
           {
             name: 'geomB',
-            type: 'geo_point',
+            type: 'geo_point' as const,
           },
         ],
-        returnType: 'boolean',
+        returnType: 'boolean' as const,
         examples: ['from index | eval st_within(geometryA, geometryB)'],
       },
       {
         params: [
           {
             name: 'geomA',
-            type: 'geo_shape',
+            type: 'geo_shape' as const,
           },
           {
             name: 'geomB',
-            type: 'geo_shape',
+            type: 'geo_shape' as const,
           },
         ],
-        returnType: 'boolean',
+        returnType: 'boolean' as const,
         examples: ['from index | eval st_within(geometryA, geometryB)'],
       },
       {
         params: [
           {
             name: 'geomA',
-            type: 'cartesian_point',
+            type: 'cartesian_point' as const,
           },
           {
             name: 'geomB',
-            type: 'cartesian_point',
+            type: 'cartesian_point' as const,
           },
         ],
-        returnType: 'boolean',
+        returnType: 'boolean' as const,
         examples: ['from index | eval st_within(geometryA, geometryB)'],
       },
       {
         params: [
           {
             name: 'geomA',
-            type: 'cartesian_point',
+            type: 'cartesian_point' as const,
           },
           {
             name: 'geomB',
-            type: 'cartesian_shape',
+            type: 'cartesian_shape' as const,
           },
         ],
-        returnType: 'boolean',
+        returnType: 'boolean' as const,
         examples: ['from index | eval st_within(geometryA, geometryB)'],
       },
       {
         params: [
           {
             name: 'geomA',
-            type: 'cartesian_shape',
+            type: 'cartesian_shape' as const,
           },
           {
             name: 'geomB',
-            type: 'cartesian_point',
+            type: 'cartesian_point' as const,
           },
         ],
-        returnType: 'boolean',
+        returnType: 'boolean' as const,
         examples: ['from index | eval st_within(geometryA, geometryB)'],
       },
       {
         params: [
           {
             name: 'geomA',
-            type: 'cartesian_shape',
+            type: 'cartesian_shape' as const,
           },
           {
             name: 'geomB',
-            type: 'cartesian_shape',
+            type: 'cartesian_shape' as const,
           },
         ],
-        returnType: 'boolean',
+        returnType: 'boolean' as const,
         examples: ['from index | eval st_within(geometryA, geometryB)'],
       },
     ],
@@ -1523,112 +1483,112 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
         params: [
           {
             name: 'geomA',
-            type: 'geo_point',
+            type: 'geo_point' as const,
           },
           {
             name: 'geomB',
-            type: 'geo_point',
+            type: 'geo_point' as const,
           },
         ],
-        returnType: 'boolean',
+        returnType: 'boolean' as const,
         examples: ['from index | eval st_disjoint(geometryA, geometryB)'],
       },
       {
         params: [
           {
             name: 'geomA',
-            type: 'geo_point',
+            type: 'geo_point' as const,
           },
           {
             name: 'geomB',
-            type: 'geo_shape',
+            type: 'geo_shape' as const,
           },
         ],
-        returnType: 'boolean',
+        returnType: 'boolean' as const,
         examples: ['from index | eval st_disjoint(geometryA, geometryB)'],
       },
       {
         params: [
           {
             name: 'geomA',
-            type: 'geo_shape',
+            type: 'geo_shape' as const,
           },
           {
             name: 'geomB',
-            type: 'geo_point',
+            type: 'geo_point' as const,
           },
         ],
-        returnType: 'boolean',
+        returnType: 'boolean' as const,
         examples: ['from index | eval st_disjoint(geometryA, geometryB)'],
       },
       {
         params: [
           {
             name: 'geomA',
-            type: 'geo_shape',
+            type: 'geo_shape' as const,
           },
           {
             name: 'geomB',
-            type: 'geo_shape',
+            type: 'geo_shape' as const,
           },
         ],
-        returnType: 'boolean',
+        returnType: 'boolean' as const,
         examples: ['from index | eval st_disjoint(geometryA, geometryB)'],
       },
       {
         params: [
           {
             name: 'geomA',
-            type: 'cartesian_point',
+            type: 'cartesian_point' as const,
           },
           {
             name: 'geomB',
-            type: 'cartesian_point',
+            type: 'cartesian_point' as const,
           },
         ],
-        returnType: 'boolean',
+        returnType: 'boolean' as const,
         examples: ['from index | eval st_disjoint(geometryA, geometryB)'],
       },
       {
         params: [
           {
             name: 'geomA',
-            type: 'cartesian_point',
+            type: 'cartesian_point' as const,
           },
           {
             name: 'geomB',
-            type: 'cartesian_shape',
+            type: 'cartesian_shape' as const,
           },
         ],
-        returnType: 'boolean',
+        returnType: 'boolean' as const,
         examples: ['from index | eval st_disjoint(geometryA, geometryB)'],
       },
       {
         params: [
           {
             name: 'geomA',
-            type: 'cartesian_shape',
+            type: 'cartesian_shape' as const,
           },
           {
             name: 'geomB',
-            type: 'cartesian_point',
+            type: 'cartesian_point' as const,
           },
         ],
-        returnType: 'boolean',
+        returnType: 'boolean' as const,
         examples: ['from index | eval st_disjoint(geometryA, geometryB)'],
       },
       {
         params: [
           {
             name: 'geomA',
-            type: 'cartesian_shape',
+            type: 'cartesian_shape' as const,
           },
           {
             name: 'geomB',
-            type: 'cartesian_shape',
+            type: 'cartesian_shape' as const,
           },
         ],
-        returnType: 'boolean',
+        returnType: 'boolean' as const,
         examples: ['from index | eval st_disjoint(geometryA, geometryB)'],
       },
     ],
@@ -1647,112 +1607,112 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
         params: [
           {
             name: 'geomA',
-            type: 'geo_point',
+            type: 'geo_point' as const,
           },
           {
             name: 'geomB',
-            type: 'geo_point',
+            type: 'geo_point' as const,
           },
         ],
-        returnType: 'boolean',
+        returnType: 'boolean' as const,
         examples: ['from index | eval st_intersects(geometryA, geometryB)'],
       },
       {
         params: [
           {
             name: 'geomA',
-            type: 'geo_point',
+            type: 'geo_point' as const,
           },
           {
             name: 'geomB',
-            type: 'geo_shape',
+            type: 'geo_shape' as const,
           },
         ],
-        returnType: 'boolean',
+        returnType: 'boolean' as const,
         examples: ['from index | eval st_intersects(geometryA, geometryB)'],
       },
       {
         params: [
           {
             name: 'geomA',
-            type: 'geo_shape',
+            type: 'geo_shape' as const,
           },
           {
             name: 'geomB',
-            type: 'geo_point',
+            type: 'geo_point' as const,
           },
         ],
-        returnType: 'boolean',
+        returnType: 'boolean' as const,
         examples: ['from index | eval st_intersects(geometryA, geometryB)'],
       },
       {
         params: [
           {
             name: 'geomA',
-            type: 'geo_shape',
+            type: 'geo_shape' as const,
           },
           {
             name: 'geomB',
-            type: 'geo_shape',
+            type: 'geo_shape' as const,
           },
         ],
-        returnType: 'boolean',
+        returnType: 'boolean' as const,
         examples: ['from index | eval st_intersects(geometryA, geometryB)'],
       },
       {
         params: [
           {
             name: 'geomA',
-            type: 'cartesian_point',
+            type: 'cartesian_point' as const,
           },
           {
             name: 'geomB',
-            type: 'cartesian_point',
+            type: 'cartesian_point' as const,
           },
         ],
-        returnType: 'boolean',
+        returnType: 'boolean' as const,
         examples: ['from index | eval st_intersects(geometryA, geometryB)'],
       },
       {
         params: [
           {
             name: 'geomA',
-            type: 'cartesian_point',
+            type: 'cartesian_point' as const,
           },
           {
             name: 'geomB',
-            type: 'cartesian_shape',
+            type: 'cartesian_shape' as const,
           },
         ],
-        returnType: 'boolean',
+        returnType: 'boolean' as const,
         examples: ['from index | eval st_intersects(geometryA, geometryB)'],
       },
       {
         params: [
           {
             name: 'geomA',
-            type: 'cartesian_shape',
+            type: 'cartesian_shape' as const,
           },
           {
             name: 'geomB',
-            type: 'cartesian_point',
+            type: 'cartesian_point' as const,
           },
         ],
-        returnType: 'boolean',
+        returnType: 'boolean' as const,
         examples: ['from index | eval st_intersects(geometryA, geometryB)'],
       },
       {
         params: [
           {
             name: 'geomA',
-            type: 'cartesian_shape',
+            type: 'cartesian_shape' as const,
           },
           {
             name: 'geomB',
-            type: 'cartesian_shape',
+            type: 'cartesian_shape' as const,
           },
         ],
-        returnType: 'boolean',
+        returnType: 'boolean' as const,
         examples: ['from index | eval st_intersects(geometryA, geometryB)'],
       },
     ],
@@ -1768,20 +1728,20 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
         params: [
           {
             name: 'point',
-            type: 'geo_point',
+            type: 'geo_point' as const,
           },
         ],
-        returnType: 'boolean',
+        returnType: 'boolean' as const,
         examples: ['from index | eval st_x(point)'],
       },
       {
         params: [
           {
             name: 'point',
-            type: 'cartesian_point',
+            type: 'cartesian_point' as const,
           },
         ],
-        returnType: 'boolean',
+        returnType: 'boolean' as const,
         examples: ['from index | eval st_x(point)'],
       },
     ],
@@ -1797,20 +1757,20 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [
         params: [
           {
             name: 'point',
-            type: 'geo_point',
+            type: 'geo_point' as const,
           },
         ],
-        returnType: 'boolean',
+        returnType: 'boolean' as const,
         examples: ['from index | eval st_y(point)'],
       },
       {
         params: [
           {
             name: 'point',
-            type: 'cartesian_point',
+            type: 'cartesian_point' as const,
           },
         ],
-        returnType: 'boolean',
+        returnType: 'boolean' as const,
         examples: ['from index | eval st_y(point)'],
       },
     ],
diff --git a/packages/kbn-esql-validation-autocomplete/src/definitions/grouping.ts b/packages/kbn-esql-validation-autocomplete/src/definitions/grouping.ts
index 612b898d4c6c6a..fc725cbe0b4291 100644
--- a/packages/kbn-esql-validation-autocomplete/src/definitions/grouping.ts
+++ b/packages/kbn-esql-validation-autocomplete/src/definitions/grouping.ts
@@ -16,8 +16,9 @@ export const groupingFunctionDefinitions: FunctionDefinition[] = [
     description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.autoBucketDoc', {
       defaultMessage: `Automatically bucket dates based on a given range and bucket target.`,
     }),
-    type: 'grouping',
-    supportedCommands: [],
+    // type agg because it can also be used as an aggregation...
+    type: 'agg',
+    supportedCommands: ['stats'],
     supportedOptions: ['by'],
     signatures: [
       {
@@ -31,7 +32,7 @@ export const groupingFunctionDefinitions: FunctionDefinition[] = [
       {
         params: [
           { name: 'field', type: 'number' },
-          { name: 'buckets', type: 'time_literal', constantOnly: true },
+          { name: 'buckets', type: 'number', constantOnly: true },
         ],
         returnType: 'number',
         examples: ['from index | eval hd = bucket(bytes, 1 hour)'],
diff --git a/packages/kbn-esql-validation-autocomplete/src/definitions/types.ts b/packages/kbn-esql-validation-autocomplete/src/definitions/types.ts
index 0ae892bf98fa65..0a614620ac08b6 100644
--- a/packages/kbn-esql-validation-autocomplete/src/definitions/types.ts
+++ b/packages/kbn-esql-validation-autocomplete/src/definitions/types.ts
@@ -8,8 +8,43 @@
 
 import type { ESQLCommand, ESQLCommandOption, ESQLFunction, ESQLMessage } from '@kbn/esql-ast';
 
+export type FunctionParameterType =
+  | 'number'
+  | 'date'
+  | 'string'
+  | 'boolean'
+  | 'null'
+  | 'any'
+  | 'ip'
+  | 'chrono_literal'
+  | 'time_literal'
+  | 'cartesian_point'
+  | 'cartesian_shape'
+  | 'geo_point'
+  | 'geo_shape'
+  | 'version'
+  | 'number[]'
+  | 'string[]'
+  | 'boolean[]'
+  | 'any[]'
+  | 'date[]';
+
+export type FunctionReturnType =
+  | 'number'
+  | 'date'
+  | 'any'
+  | 'boolean'
+  | 'string'
+  | 'cartesian_point'
+  | 'cartesian_shape'
+  | 'geo_point'
+  | 'geo_shape'
+  | 'ip'
+  | 'version'
+  | 'void';
+
 export interface FunctionDefinition {
-  type: 'builtin' | 'agg' | 'eval' | 'grouping';
+  type: 'builtin' | 'agg' | 'eval';
   ignoreAsSuggestion?: boolean;
   name: string;
   alias?: string[];
@@ -19,7 +54,7 @@ export interface FunctionDefinition {
   signatures: Array<{
     params: Array<{
       name: string;
-      type: string;
+      type: FunctionParameterType;
       optional?: boolean;
       noNestingFunctions?: boolean;
       supportsWildcard?: boolean;
@@ -52,7 +87,7 @@ export interface FunctionDefinition {
       literalSuggestions?: string[];
     }>;
     minParams?: number;
-    returnType: string;
+    returnType: FunctionReturnType;
     examples?: string[];
   }>;
   validate?: (fnDef: ESQLFunction) => ESQLMessage[];
diff --git a/packages/kbn-esql-validation-autocomplete/src/shared/helpers.ts b/packages/kbn-esql-validation-autocomplete/src/shared/helpers.ts
index 868e8f3f9212a7..5689b81c1b54d1 100644
--- a/packages/kbn-esql-validation-autocomplete/src/shared/helpers.ts
+++ b/packages/kbn-esql-validation-autocomplete/src/shared/helpers.ts
@@ -37,6 +37,8 @@ import type {
   CommandOptionsDefinition,
   FunctionArgSignature,
   FunctionDefinition,
+  FunctionParameterType,
+  FunctionReturnType,
   SignatureArgType,
 } from '../definitions/types';
 import type { ESQLRealField, ESQLVariable, ReferenceMaps } from '../validation/types';
@@ -214,14 +216,18 @@ export function getCommandOption(optionName: CommandOptionsDefinition['name']) {
   );
 }
 
-function compareLiteralType(argTypes: string, item: ESQLLiteral) {
+function compareLiteralType(argType: string, item: ESQLLiteral) {
   if (item.literalType !== 'string') {
-    return argTypes === item.literalType;
+    if (argType === item.literalType) {
+      return true;
+    }
+    return false;
   }
-  if (argTypes === 'chrono_literal') {
+  if (argType === 'chrono_literal') {
     return chronoLiterals.some(({ name }) => name === item.text);
   }
-  return argTypes === item.literalType;
+  // date-type parameters accept string literals because of ES auto-casting
+  return ['string', 'date'].includes(argType);
 }
 
 export function getColumnHit(
@@ -238,11 +244,19 @@ export function isArrayType(type: string) {
   return ARRAY_REGEXP.test(type);
 }
 
+const arrayToSingularMap: Map<FunctionParameterType, FunctionParameterType> = new Map([
+  ['number[]', 'number'],
+  ['date[]', 'date'],
+  ['boolean[]', 'boolean'],
+  ['string[]', 'string'],
+  ['any[]', 'any'],
+]);
+
 /**
  * Given an array type for example `string[]` it will return `string`
  */
-export function extractSingularType(type: string) {
-  return type.replace(ARRAY_REGEXP, '');
+export function extractSingularType(type: FunctionParameterType): FunctionParameterType {
+  return arrayToSingularMap.get(type) ?? type;
 }
 
 export function createMapFromList<T extends { name: string }>(arr: T[]): Map<string, T> {
@@ -274,10 +288,14 @@ export function printFunctionSignature(arg: ESQLFunction): string {
             ...fnDef?.signatures[0],
             params: arg.args.map((innerArg) =>
               Array.isArray(innerArg)
-                ? { name: `InnerArgument[]`, type: '' }
-                : { name: innerArg.text, type: innerArg.type }
+                ? { name: `InnerArgument[]`, type: 'any' as const }
+                : // this cast isn't actually correct, but we're abusing the
+                  // getFunctionSignatures API anyways
+                  { name: innerArg.text, type: innerArg.type as FunctionParameterType }
             ),
-            returnType: '',
+            // this cast isn't actually correct, but we're abusing the
+            // getFunctionSignatures API anyways
+            returnType: '' as FunctionReturnType,
           },
         ],
       },
diff --git a/packages/kbn-esql-validation-autocomplete/src/validation/esql_validation_meta_tests.json b/packages/kbn-esql-validation-autocomplete/src/validation/esql_validation_meta_tests.json
index 40738d519679b9..2320f11d4a1ab2 100644
--- a/packages/kbn-esql-validation-autocomplete/src/validation/esql_validation_meta_tests.json
+++ b/packages/kbn-esql-validation-autocomplete/src/validation/esql_validation_meta_tests.json
@@ -20,6 +20,10 @@
       "name": "booleanField",
       "type": "boolean"
     },
+    {
+      "name": "versionField",
+      "type": "version"
+    },
     {
       "name": "ipField",
       "type": "ip"
@@ -179,14 +183,14 @@
     {
       "query": "from ",
       "error": [
-        "SyntaxError: missing {QUOTED_IDENTIFIER, FROM_UNQUOTED_IDENTIFIER} at '<EOF>'"
+        "SyntaxError: missing FROM_UNQUOTED_IDENTIFIER at '<EOF>'"
       ],
       "warning": []
     },
     {
       "query": "from index,",
       "error": [
-        "SyntaxError: missing {QUOTED_IDENTIFIER, FROM_UNQUOTED_IDENTIFIER} at '<EOF>'"
+        "SyntaxError: missing FROM_UNQUOTED_IDENTIFIER at '<EOF>'"
       ],
       "warning": []
     },
@@ -213,11 +217,6 @@
       "error": [],
       "warning": []
     },
-    {
-      "query": "from `index`",
-      "error": [],
-      "warning": []
-    },
     {
       "query": "from index, other_index",
       "error": [],
@@ -634,30 +633,22 @@
     },
     {
       "query": "row var = 1 in (\"a\", \"b\", \"c\")",
-      "error": [
-        "Argument of [in] must be [number[]], found value [(\"a\", \"b\", \"c\")] type [(string, string, string)]"
-      ],
+      "error": [],
       "warning": []
     },
     {
       "query": "row var = 5 in (\"a\", \"b\", \"c\")",
-      "error": [
-        "Argument of [in] must be [number[]], found value [(\"a\", \"b\", \"c\")] type [(string, string, string)]"
-      ],
+      "error": [],
       "warning": []
     },
     {
       "query": "row var = 5 not in (\"a\", \"b\", \"c\")",
-      "error": [
-        "Argument of [not_in] must be [number[]], found value [(\"a\", \"b\", \"c\")] type [(string, string, string)]"
-      ],
+      "error": [],
       "warning": []
     },
     {
       "query": "row var = 5 not in (1, 2, 3, \"a\")",
-      "error": [
-        "Argument of [not_in] must be [number[]], found value [(1, 2, 3, \"a\")] type [(number, number, number, string)]"
-      ],
+      "error": [],
       "warning": []
     },
     {
@@ -952,19 +943,6 @@
       "error": [],
       "warning": []
     },
-    {
-      "query": "row var = date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", to_datetime(\"a\"))",
-      "error": [],
-      "warning": []
-    },
-    {
-      "query": "row var = date_extract(\"a\", \"a\")",
-      "error": [
-        "Argument of [date_extract] must be [chrono_literal], found value [\"a\"] type [string]",
-        "Argument of [date_extract] must be [date], found value [\"a\"] type [string]"
-      ],
-      "warning": []
-    },
     {
       "query": "row var = date_format(now(), \"a\")",
       "error": [],
@@ -975,19 +953,6 @@
       "error": [],
       "warning": []
     },
-    {
-      "query": "row var = date_format(to_datetime(\"a\"), to_string(\"a\"))",
-      "error": [],
-      "warning": []
-    },
-    {
-      "query": "row var = date_format(\"a\", 5)",
-      "error": [
-        "Argument of [date_format] must be [date], found value [\"a\"] type [string]",
-        "Argument of [date_format] must be [string], found value [5] type [number]"
-      ],
-      "warning": []
-    },
     {
       "query": "row var = date_parse(\"a\", \"a\")",
       "error": [],
@@ -1021,19 +986,6 @@
       "error": [],
       "warning": []
     },
-    {
-      "query": "row var = date_trunc(1 year, to_datetime(\"a\"))",
-      "error": [],
-      "warning": []
-    },
-    {
-      "query": "row var = date_trunc(\"a\", \"a\")",
-      "error": [
-        "Argument of [date_trunc] must be [time_literal], found value [\"a\"] type [string]",
-        "Argument of [date_trunc] must be [date], found value [\"a\"] type [string]"
-      ],
-      "warning": []
-    },
     {
       "query": "row var = e()",
       "error": [],
@@ -2955,16 +2907,6 @@
       "error": [],
       "warning": []
     },
-    {
-      "query": "row var = 42 > \"2022\"",
-      "error": [],
-      "warning": []
-    },
-    {
-      "query": "row var = \"2022\" > 42",
-      "error": [],
-      "warning": []
-    },
     {
       "query": "row var = 5 >= 0",
       "error": [],
@@ -3015,16 +2957,6 @@
       "error": [],
       "warning": []
     },
-    {
-      "query": "row var = 42 >= \"2022\"",
-      "error": [],
-      "warning": []
-    },
-    {
-      "query": "row var = \"2022\" >= 42",
-      "error": [],
-      "warning": []
-    },
     {
       "query": "row var = 5 < 0",
       "error": [],
@@ -3075,16 +3007,6 @@
       "error": [],
       "warning": []
     },
-    {
-      "query": "row var = 42 < \"2022\"",
-      "error": [],
-      "warning": []
-    },
-    {
-      "query": "row var = \"2022\" < 42",
-      "error": [],
-      "warning": []
-    },
     {
       "query": "row var = 5 <= 0",
       "error": [],
@@ -3135,16 +3057,6 @@
       "error": [],
       "warning": []
     },
-    {
-      "query": "row var = 42 <= \"2022\"",
-      "error": [],
-      "warning": []
-    },
-    {
-      "query": "row var = \"2022\" <= 42",
-      "error": [],
-      "warning": []
-    },
     {
       "query": "row var = 5 == 0",
       "error": [],
@@ -3192,16 +3104,6 @@
       "error": [],
       "warning": []
     },
-    {
-      "query": "row var = 42 == \"2022\"",
-      "error": [],
-      "warning": []
-    },
-    {
-      "query": "row var = \"2022\" == 42",
-      "error": [],
-      "warning": []
-    },
     {
       "query": "row var = 5 != 0",
       "error": [],
@@ -3249,16 +3151,6 @@
       "error": [],
       "warning": []
     },
-    {
-      "query": "row var = 42 != \"2022\"",
-      "error": [],
-      "warning": []
-    },
-    {
-      "query": "row var = \"2022\" != 42",
-      "error": [],
-      "warning": []
-    },
     {
       "query": "row var = 1 + 1",
       "error": [],
@@ -5382,58 +5274,6 @@
       "error": [],
       "warning": []
     },
-    {
-      "query": "from a_index | where numberField > stringField",
-      "error": [
-        "Argument of [>] must be [number], found value [stringField] type [string]"
-      ],
-      "warning": []
-    },
-    {
-      "query": "from a_index | where stringField > numberField",
-      "error": [
-        "Argument of [>] must be [number], found value [stringField] type [string]"
-      ],
-      "warning": []
-    },
-    {
-      "query": "from a_index | where numberField > \"2022\"",
-      "error": [],
-      "warning": []
-    },
-    {
-      "query": "from a_index | where dateField > stringField",
-      "error": [
-        "Argument of [>] must be [string], found value [dateField] type [date]"
-      ],
-      "warning": []
-    },
-    {
-      "query": "from a_index | where stringField > dateField",
-      "error": [
-        "Argument of [>] must be [string], found value [dateField] type [date]"
-      ],
-      "warning": []
-    },
-    {
-      "query": "from a_index | where dateField > \"2022\"",
-      "error": [],
-      "warning": []
-    },
-    {
-      "query": "from a_index | where stringField > 0",
-      "error": [
-        "Argument of [>] must be [number], found value [stringField] type [string]"
-      ],
-      "warning": []
-    },
-    {
-      "query": "from a_index | where stringField > now()",
-      "error": [
-        "Argument of [>] must be [string], found value [now()] type [date]"
-      ],
-      "warning": []
-    },
     {
       "query": "from a_index | where numberField >= 0",
       "error": [],
@@ -5488,396 +5328,188 @@
       "warning": []
     },
     {
-      "query": "from a_index | where numberField >= stringField",
-      "error": [
-        "Argument of [>=] must be [number], found value [stringField] type [string]"
-      ],
+      "query": "from a_index | where numberField < 0",
+      "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | where stringField >= numberField",
-      "error": [
-        "Argument of [>=] must be [number], found value [stringField] type [string]"
-      ],
+      "query": "from a_index | where NOT numberField < 0",
+      "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | where numberField >= \"2022\"",
+      "query": "from a_index | where (numberField < 0)",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | where dateField >= stringField",
-      "error": [
-        "Argument of [>=] must be [string], found value [dateField] type [date]"
-      ],
+      "query": "from a_index | where (NOT (numberField < 0))",
+      "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | where stringField >= dateField",
-      "error": [
-        "Argument of [>=] must be [string], found value [dateField] type [date]"
-      ],
+      "query": "from a_index | where 1 < 0",
+      "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | where dateField >= \"2022\"",
+      "query": "from a_index | where stringField < stringField",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | where stringField >= 0",
-      "error": [
-        "Argument of [>=] must be [number], found value [stringField] type [string]"
-      ],
+      "query": "from a_index | where numberField < numberField",
+      "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | where stringField >= now()",
-      "error": [
-        "Argument of [>=] must be [string], found value [now()] type [date]"
-      ],
+      "query": "from a_index | where dateField < dateField",
+      "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | where numberField < 0",
-      "error": [],
+      "query": "from a_index | where booleanField < booleanField",
+      "error": [
+        "Argument of [<] must be [number], found value [booleanField] type [boolean]",
+        "Argument of [<] must be [number], found value [booleanField] type [boolean]"
+      ],
       "warning": []
     },
     {
-      "query": "from a_index | where NOT numberField < 0",
+      "query": "from a_index | where ipField < ipField",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | where (numberField < 0)",
+      "query": "from a_index | where numberField <= 0",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | where (NOT (numberField < 0))",
+      "query": "from a_index | where NOT numberField <= 0",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | where 1 < 0",
+      "query": "from a_index | where (numberField <= 0)",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | where stringField < stringField",
+      "query": "from a_index | where (NOT (numberField <= 0))",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | where numberField < numberField",
+      "query": "from a_index | where 1 <= 0",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | where dateField < dateField",
+      "query": "from a_index | where stringField <= stringField",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | where booleanField < booleanField",
-      "error": [
-        "Argument of [<] must be [number], found value [booleanField] type [boolean]",
-        "Argument of [<] must be [number], found value [booleanField] type [boolean]"
-      ],
+      "query": "from a_index | where numberField <= numberField",
+      "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | where ipField < ipField",
+      "query": "from a_index | where dateField <= dateField",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | where numberField < stringField",
+      "query": "from a_index | where booleanField <= booleanField",
       "error": [
-        "Argument of [<] must be [number], found value [stringField] type [string]"
+        "Argument of [<=] must be [number], found value [booleanField] type [boolean]",
+        "Argument of [<=] must be [number], found value [booleanField] type [boolean]"
       ],
       "warning": []
     },
     {
-      "query": "from a_index | where stringField < numberField",
-      "error": [
-        "Argument of [<] must be [number], found value [stringField] type [string]"
-      ],
+      "query": "from a_index | where ipField <= ipField",
+      "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | where numberField < \"2022\"",
+      "query": "from a_index | where numberField == 0",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | where dateField < stringField",
-      "error": [
-        "Argument of [<] must be [string], found value [dateField] type [date]"
-      ],
+      "query": "from a_index | where NOT numberField == 0",
+      "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | where stringField < dateField",
-      "error": [
-        "Argument of [<] must be [string], found value [dateField] type [date]"
-      ],
+      "query": "from a_index | where (numberField == 0)",
+      "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | where dateField < \"2022\"",
+      "query": "from a_index | where (NOT (numberField == 0))",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | where stringField < 0",
-      "error": [
-        "Argument of [<] must be [number], found value [stringField] type [string]"
-      ],
+      "query": "from a_index | where 1 == 0",
+      "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | where stringField < now()",
-      "error": [
-        "Argument of [<] must be [string], found value [now()] type [date]"
-      ],
+      "query": "from a_index | where stringField == stringField",
+      "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | where numberField <= 0",
+      "query": "from a_index | where numberField == numberField",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | where NOT numberField <= 0",
+      "query": "from a_index | where dateField == dateField",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | where (numberField <= 0)",
+      "query": "from a_index | where booleanField == booleanField",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | where (NOT (numberField <= 0))",
+      "query": "from a_index | where ipField == ipField",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | where 1 <= 0",
+      "query": "from a_index | where numberField != 0",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | where stringField <= stringField",
+      "query": "from a_index | where NOT numberField != 0",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | where numberField <= numberField",
+      "query": "from a_index | where (numberField != 0)",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | where dateField <= dateField",
+      "query": "from a_index | where (NOT (numberField != 0))",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | where booleanField <= booleanField",
-      "error": [
-        "Argument of [<=] must be [number], found value [booleanField] type [boolean]",
-        "Argument of [<=] must be [number], found value [booleanField] type [boolean]"
-      ],
+      "query": "from a_index | where 1 != 0",
+      "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | where ipField <= ipField",
-      "error": [],
-      "warning": []
-    },
-    {
-      "query": "from a_index | where numberField <= stringField",
-      "error": [
-        "Argument of [<=] must be [number], found value [stringField] type [string]"
-      ],
-      "warning": []
-    },
-    {
-      "query": "from a_index | where stringField <= numberField",
-      "error": [
-        "Argument of [<=] must be [number], found value [stringField] type [string]"
-      ],
-      "warning": []
-    },
-    {
-      "query": "from a_index | where numberField <= \"2022\"",
-      "error": [],
-      "warning": []
-    },
-    {
-      "query": "from a_index | where dateField <= stringField",
-      "error": [
-        "Argument of [<=] must be [string], found value [dateField] type [date]"
-      ],
-      "warning": []
-    },
-    {
-      "query": "from a_index | where stringField <= dateField",
-      "error": [
-        "Argument of [<=] must be [string], found value [dateField] type [date]"
-      ],
-      "warning": []
-    },
-    {
-      "query": "from a_index | where dateField <= \"2022\"",
-      "error": [],
-      "warning": []
-    },
-    {
-      "query": "from a_index | where stringField <= 0",
-      "error": [
-        "Argument of [<=] must be [number], found value [stringField] type [string]"
-      ],
-      "warning": []
-    },
-    {
-      "query": "from a_index | where stringField <= now()",
-      "error": [
-        "Argument of [<=] must be [string], found value [now()] type [date]"
-      ],
-      "warning": []
-    },
-    {
-      "query": "from a_index | where numberField == 0",
-      "error": [],
-      "warning": []
-    },
-    {
-      "query": "from a_index | where NOT numberField == 0",
-      "error": [],
-      "warning": []
-    },
-    {
-      "query": "from a_index | where (numberField == 0)",
-      "error": [],
-      "warning": []
-    },
-    {
-      "query": "from a_index | where (NOT (numberField == 0))",
-      "error": [],
-      "warning": []
-    },
-    {
-      "query": "from a_index | where 1 == 0",
-      "error": [],
-      "warning": []
-    },
-    {
-      "query": "from a_index | where stringField == stringField",
-      "error": [],
-      "warning": []
-    },
-    {
-      "query": "from a_index | where numberField == numberField",
-      "error": [],
-      "warning": []
-    },
-    {
-      "query": "from a_index | where dateField == dateField",
-      "error": [],
-      "warning": []
-    },
-    {
-      "query": "from a_index | where booleanField == booleanField",
-      "error": [],
-      "warning": []
-    },
-    {
-      "query": "from a_index | where ipField == ipField",
-      "error": [],
-      "warning": []
-    },
-    {
-      "query": "from a_index | where numberField == stringField",
-      "error": [
-        "Argument of [==] must be [number], found value [stringField] type [string]"
-      ],
-      "warning": []
-    },
-    {
-      "query": "from a_index | where stringField == numberField",
-      "error": [
-        "Argument of [==] must be [number], found value [stringField] type [string]"
-      ],
-      "warning": []
-    },
-    {
-      "query": "from a_index | where numberField == \"2022\"",
-      "error": [],
-      "warning": []
-    },
-    {
-      "query": "from a_index | where dateField == stringField",
-      "error": [
-        "Argument of [==] must be [string], found value [dateField] type [date]"
-      ],
-      "warning": []
-    },
-    {
-      "query": "from a_index | where stringField == dateField",
-      "error": [
-        "Argument of [==] must be [string], found value [dateField] type [date]"
-      ],
-      "warning": []
-    },
-    {
-      "query": "from a_index | where dateField == \"2022\"",
-      "error": [],
-      "warning": []
-    },
-    {
-      "query": "from a_index | where stringField == 0",
-      "error": [
-        "Argument of [==] must be [number], found value [stringField] type [string]"
-      ],
-      "warning": []
-    },
-    {
-      "query": "from a_index | where stringField == now()",
-      "error": [
-        "Argument of [==] must be [string], found value [now()] type [date]"
-      ],
-      "warning": []
-    },
-    {
-      "query": "from a_index | where numberField != 0",
-      "error": [],
-      "warning": []
-    },
-    {
-      "query": "from a_index | where NOT numberField != 0",
-      "error": [],
-      "warning": []
-    },
-    {
-      "query": "from a_index | where (numberField != 0)",
-      "error": [],
-      "warning": []
-    },
-    {
-      "query": "from a_index | where (NOT (numberField != 0))",
-      "error": [],
-      "warning": []
-    },
-    {
-      "query": "from a_index | where 1 != 0",
-      "error": [],
-      "warning": []
-    },
-    {
-      "query": "from a_index | where stringField != stringField",
+      "query": "from a_index | where stringField != stringField",
       "error": [],
       "warning": []
     },
@@ -5901,58 +5533,6 @@
       "error": [],
       "warning": []
     },
-    {
-      "query": "from a_index | where numberField != stringField",
-      "error": [
-        "Argument of [!=] must be [number], found value [stringField] type [string]"
-      ],
-      "warning": []
-    },
-    {
-      "query": "from a_index | where stringField != numberField",
-      "error": [
-        "Argument of [!=] must be [number], found value [stringField] type [string]"
-      ],
-      "warning": []
-    },
-    {
-      "query": "from a_index | where numberField != \"2022\"",
-      "error": [],
-      "warning": []
-    },
-    {
-      "query": "from a_index | where dateField != stringField",
-      "error": [
-        "Argument of [!=] must be [string], found value [dateField] type [date]"
-      ],
-      "warning": []
-    },
-    {
-      "query": "from a_index | where stringField != dateField",
-      "error": [
-        "Argument of [!=] must be [string], found value [dateField] type [date]"
-      ],
-      "warning": []
-    },
-    {
-      "query": "from a_index | where dateField != \"2022\"",
-      "error": [],
-      "warning": []
-    },
-    {
-      "query": "from a_index | where stringField != 0",
-      "error": [
-        "Argument of [!=] must be [number], found value [stringField] type [string]"
-      ],
-      "warning": []
-    },
-    {
-      "query": "from a_index | where stringField != now()",
-      "error": [
-        "Argument of [!=] must be [string], found value [now()] type [date]"
-      ],
-      "warning": []
-    },
     {
       "query": "from a_index | where - numberField > 0",
       "error": [],
@@ -6589,6 +6169,46 @@
       "error": [],
       "warning": []
     },
+    {
+      "query": "from a_index | where versionField IS NULL",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | where versionField IS null",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | where versionField is null",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | where versionField is NULL",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | where versionField IS NOT NULL",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | where versionField IS NOT null",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | where versionField IS not NULL",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | where versionField Is nOt NuLL",
+      "error": [],
+      "warning": []
+    },
     {
       "query": "from a_index | where ipField IS NULL",
       "error": [],
@@ -7476,18 +7096,6 @@
       ],
       "warning": []
     },
-    {
-      "query": "from a_index | where length(to_version(stringField)) > 0",
-      "error": [],
-      "warning": []
-    },
-    {
-      "query": "from a_index | where length(to_version(numberField)) > 0",
-      "error": [
-        "Argument of [to_version] must be [string], found value [numberField] type [number]"
-      ],
-      "warning": []
-    },
     {
       "query": "from a_index | where length(trim(stringField)) > 0",
       "error": [],
@@ -7732,22 +7340,57 @@
       "warning": []
     },
     {
-      "query": "from a_index | eval ipField IS NULL",
+      "query": "from a_index | eval versionField IS NULL",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | eval ipField IS null",
+      "query": "from a_index | eval versionField IS null",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | eval ipField is null",
+      "query": "from a_index | eval versionField is null",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | eval ipField is NULL",
+      "query": "from a_index | eval versionField is NULL",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval versionField IS NOT NULL",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval versionField IS NOT null",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval versionField IS not NULL",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval ipField IS NULL",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval ipField IS null",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval ipField is null",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval ipField is NULL",
       "error": [],
       "warning": []
     },
@@ -9121,6 +8764,37 @@
       ],
       "warning": []
     },
+    {
+      "query": "from a_index | eval var = date_diff(\"year\", dateField, dateField)",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval date_diff(\"year\", dateField, dateField)",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval var = date_diff(\"year\", to_datetime(stringField), to_datetime(stringField))",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval date_diff(numberField, stringField, stringField)",
+      "error": [
+        "Argument of [date_diff] must be [string], found value [numberField] type [number]",
+        "Argument of [date_diff] must be [date], found value [stringField] type [string]",
+        "Argument of [date_diff] must be [date], found value [stringField] type [string]"
+      ],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval date_diff(\"year\", dateField, dateField, extraArg)",
+      "error": [
+        "Error: [date_diff] function expects exactly 3 arguments, got 4."
+      ],
+      "warning": []
+    },
     {
       "query": "from a_index | eval var = date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", dateField)",
       "error": [],
@@ -12009,7 +11683,9 @@
     },
     {
       "query": "from a_index | eval numberField > \"2022\"",
-      "error": [],
+      "error": [
+        "Argument of [>] must be [number], found value [\"2022\"] type [string]"
+      ],
       "warning": []
     },
     {
@@ -12026,25 +11702,64 @@
       ],
       "warning": []
     },
+    {
+      "query": "from a_index | eval stringField > 0",
+      "error": [
+        "Argument of [>] must be [number], found value [stringField] type [string]"
+      ],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval stringField > now()",
+      "error": [
+        "Argument of [>] must be [string], found value [now()] type [date]"
+      ],
+      "warning": []
+    },
     {
       "query": "from a_index | eval dateField > \"2022\"",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | eval stringField > 0",
+      "query": "from a_index | eval \"2022\" > dateField",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval versionField > \"1.2.3\"",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval \"1.2.3\" > versionField",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval booleanField > \"true\"",
       "error": [
-        "Argument of [>] must be [number], found value [stringField] type [string]"
+        "Argument of [>] must be [string], found value [booleanField] type [boolean]"
       ],
       "warning": []
     },
     {
-      "query": "from a_index | eval stringField > now()",
+      "query": "from a_index | eval \"true\" > booleanField",
       "error": [
-        "Argument of [>] must be [string], found value [now()] type [date]"
+        "Argument of [>] must be [string], found value [booleanField] type [boolean]"
       ],
       "warning": []
     },
+    {
+      "query": "from a_index | eval ipField > \"136.36.3.205\"",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval \"136.36.3.205\" > ipField",
+      "error": [],
+      "warning": []
+    },
     {
       "query": "from a_index | eval numberField >= 0",
       "error": [],
@@ -12113,353 +11828,672 @@
       "warning": []
     },
     {
-      "query": "from a_index | eval numberField >= \"2022\"",
+      "query": "from a_index | eval numberField >= \"2022\"",
+      "error": [
+        "Argument of [>=] must be [number], found value [\"2022\"] type [string]"
+      ],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval dateField >= stringField",
+      "error": [
+        "Argument of [>=] must be [string], found value [dateField] type [date]"
+      ],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval stringField >= dateField",
+      "error": [
+        "Argument of [>=] must be [string], found value [dateField] type [date]"
+      ],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval stringField >= 0",
+      "error": [
+        "Argument of [>=] must be [number], found value [stringField] type [string]"
+      ],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval stringField >= now()",
+      "error": [
+        "Argument of [>=] must be [string], found value [now()] type [date]"
+      ],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval dateField >= \"2022\"",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval \"2022\" >= dateField",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval versionField >= \"1.2.3\"",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval \"1.2.3\" >= versionField",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval booleanField >= \"true\"",
+      "error": [
+        "Argument of [>=] must be [string], found value [booleanField] type [boolean]"
+      ],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval \"true\" >= booleanField",
+      "error": [
+        "Argument of [>=] must be [string], found value [booleanField] type [boolean]"
+      ],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval ipField >= \"136.36.3.205\"",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval \"136.36.3.205\" >= ipField",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval numberField < 0",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval NOT numberField < 0",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval (numberField < 0)",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval (NOT (numberField < 0))",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval 1 < 0",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval stringField < stringField",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval numberField < numberField",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval dateField < dateField",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval booleanField < booleanField",
+      "error": [
+        "Argument of [<] must be [number], found value [booleanField] type [boolean]",
+        "Argument of [<] must be [number], found value [booleanField] type [boolean]"
+      ],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval ipField < ipField",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval numberField < stringField",
+      "error": [
+        "Argument of [<] must be [number], found value [stringField] type [string]"
+      ],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval stringField < numberField",
+      "error": [
+        "Argument of [<] must be [number], found value [stringField] type [string]"
+      ],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval numberField < \"2022\"",
+      "error": [
+        "Argument of [<] must be [number], found value [\"2022\"] type [string]"
+      ],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval dateField < stringField",
+      "error": [
+        "Argument of [<] must be [string], found value [dateField] type [date]"
+      ],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval stringField < dateField",
+      "error": [
+        "Argument of [<] must be [string], found value [dateField] type [date]"
+      ],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval stringField < 0",
+      "error": [
+        "Argument of [<] must be [number], found value [stringField] type [string]"
+      ],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval stringField < now()",
+      "error": [
+        "Argument of [<] must be [string], found value [now()] type [date]"
+      ],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval dateField < \"2022\"",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval \"2022\" < dateField",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval versionField < \"1.2.3\"",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval \"1.2.3\" < versionField",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval booleanField < \"true\"",
+      "error": [
+        "Argument of [<] must be [string], found value [booleanField] type [boolean]"
+      ],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval \"true\" < booleanField",
+      "error": [
+        "Argument of [<] must be [string], found value [booleanField] type [boolean]"
+      ],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval ipField < \"136.36.3.205\"",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval \"136.36.3.205\" < ipField",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval numberField <= 0",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval NOT numberField <= 0",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval (numberField <= 0)",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval (NOT (numberField <= 0))",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval 1 <= 0",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval stringField <= stringField",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval numberField <= numberField",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval dateField <= dateField",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval booleanField <= booleanField",
+      "error": [
+        "Argument of [<=] must be [number], found value [booleanField] type [boolean]",
+        "Argument of [<=] must be [number], found value [booleanField] type [boolean]"
+      ],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval ipField <= ipField",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval numberField <= stringField",
+      "error": [
+        "Argument of [<=] must be [number], found value [stringField] type [string]"
+      ],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval stringField <= numberField",
+      "error": [
+        "Argument of [<=] must be [number], found value [stringField] type [string]"
+      ],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval numberField <= \"2022\"",
+      "error": [
+        "Argument of [<=] must be [number], found value [\"2022\"] type [string]"
+      ],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval dateField <= stringField",
+      "error": [
+        "Argument of [<=] must be [string], found value [dateField] type [date]"
+      ],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval stringField <= dateField",
+      "error": [
+        "Argument of [<=] must be [string], found value [dateField] type [date]"
+      ],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval stringField <= 0",
+      "error": [
+        "Argument of [<=] must be [number], found value [stringField] type [string]"
+      ],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval stringField <= now()",
+      "error": [
+        "Argument of [<=] must be [string], found value [now()] type [date]"
+      ],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval dateField <= \"2022\"",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval \"2022\" <= dateField",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval versionField <= \"1.2.3\"",
+      "error": [],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval \"1.2.3\" <= versionField",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | eval dateField >= stringField",
+      "query": "from a_index | eval booleanField <= \"true\"",
       "error": [
-        "Argument of [>=] must be [string], found value [dateField] type [date]"
+        "Argument of [<=] must be [string], found value [booleanField] type [boolean]"
       ],
       "warning": []
     },
     {
-      "query": "from a_index | eval stringField >= dateField",
+      "query": "from a_index | eval \"true\" <= booleanField",
       "error": [
-        "Argument of [>=] must be [string], found value [dateField] type [date]"
+        "Argument of [<=] must be [string], found value [booleanField] type [boolean]"
       ],
       "warning": []
     },
     {
-      "query": "from a_index | eval dateField >= \"2022\"",
+      "query": "from a_index | eval ipField <= \"136.36.3.205\"",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | eval stringField >= 0",
-      "error": [
-        "Argument of [>=] must be [number], found value [stringField] type [string]"
-      ],
-      "warning": []
-    },
-    {
-      "query": "from a_index | eval stringField >= now()",
-      "error": [
-        "Argument of [>=] must be [string], found value [now()] type [date]"
-      ],
+      "query": "from a_index | eval \"136.36.3.205\" <= ipField",
+      "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | eval numberField < 0",
+      "query": "from a_index | eval numberField == 0",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | eval NOT numberField < 0",
+      "query": "from a_index | eval NOT numberField == 0",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | eval (numberField < 0)",
+      "query": "from a_index | eval (numberField == 0)",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | eval (NOT (numberField < 0))",
+      "query": "from a_index | eval (NOT (numberField == 0))",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | eval 1 < 0",
+      "query": "from a_index | eval 1 == 0",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | eval stringField < stringField",
+      "query": "from a_index | eval stringField == stringField",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | eval numberField < numberField",
+      "query": "from a_index | eval numberField == numberField",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | eval dateField < dateField",
+      "query": "from a_index | eval dateField == dateField",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | eval booleanField < booleanField",
-      "error": [
-        "Argument of [<] must be [number], found value [booleanField] type [boolean]",
-        "Argument of [<] must be [number], found value [booleanField] type [boolean]"
-      ],
+      "query": "from a_index | eval booleanField == booleanField",
+      "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | eval ipField < ipField",
+      "query": "from a_index | eval ipField == ipField",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | eval numberField < stringField",
+      "query": "from a_index | eval numberField == stringField",
       "error": [
-        "Argument of [<] must be [number], found value [stringField] type [string]"
+        "Argument of [==] must be [number], found value [stringField] type [string]"
       ],
       "warning": []
     },
     {
-      "query": "from a_index | eval stringField < numberField",
+      "query": "from a_index | eval stringField == numberField",
       "error": [
-        "Argument of [<] must be [number], found value [stringField] type [string]"
+        "Argument of [==] must be [number], found value [stringField] type [string]"
       ],
       "warning": []
     },
     {
-      "query": "from a_index | eval numberField < \"2022\"",
-      "error": [],
+      "query": "from a_index | eval numberField == \"2022\"",
+      "error": [
+        "Argument of [==] must be [number], found value [\"2022\"] type [string]"
+      ],
       "warning": []
     },
     {
-      "query": "from a_index | eval dateField < stringField",
+      "query": "from a_index | eval dateField == stringField",
       "error": [
-        "Argument of [<] must be [string], found value [dateField] type [date]"
+        "Argument of [==] must be [string], found value [dateField] type [date]"
       ],
       "warning": []
     },
     {
-      "query": "from a_index | eval stringField < dateField",
+      "query": "from a_index | eval stringField == dateField",
       "error": [
-        "Argument of [<] must be [string], found value [dateField] type [date]"
+        "Argument of [==] must be [string], found value [dateField] type [date]"
       ],
       "warning": []
     },
     {
-      "query": "from a_index | eval dateField < \"2022\"",
-      "error": [],
+      "query": "from a_index | eval stringField == 0",
+      "error": [
+        "Argument of [==] must be [number], found value [stringField] type [string]"
+      ],
       "warning": []
     },
     {
-      "query": "from a_index | eval stringField < 0",
+      "query": "from a_index | eval stringField == now()",
       "error": [
-        "Argument of [<] must be [number], found value [stringField] type [string]"
+        "Argument of [==] must be [string], found value [now()] type [date]"
       ],
       "warning": []
     },
     {
-      "query": "from a_index | eval stringField < now()",
-      "error": [
-        "Argument of [<] must be [string], found value [now()] type [date]"
-      ],
+      "query": "from a_index | eval dateField == \"2022\"",
+      "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | eval numberField <= 0",
+      "query": "from a_index | eval \"2022\" == dateField",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | eval NOT numberField <= 0",
+      "query": "from a_index | eval versionField == \"1.2.3\"",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | eval (numberField <= 0)",
+      "query": "from a_index | eval \"1.2.3\" == versionField",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | eval (NOT (numberField <= 0))",
+      "query": "from a_index | eval booleanField == \"true\"",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | eval 1 <= 0",
+      "query": "from a_index | eval \"true\" == booleanField",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | eval stringField <= stringField",
+      "query": "from a_index | eval ipField == \"136.36.3.205\"",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | eval numberField <= numberField",
+      "query": "from a_index | eval \"136.36.3.205\" == ipField",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | eval dateField <= dateField",
+      "query": "from a_index | eval numberField != 0",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | eval booleanField <= booleanField",
-      "error": [
-        "Argument of [<=] must be [number], found value [booleanField] type [boolean]",
-        "Argument of [<=] must be [number], found value [booleanField] type [boolean]"
-      ],
+      "query": "from a_index | eval NOT numberField != 0",
+      "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | eval ipField <= ipField",
+      "query": "from a_index | eval (numberField != 0)",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | eval numberField <= stringField",
-      "error": [
-        "Argument of [<=] must be [number], found value [stringField] type [string]"
-      ],
+      "query": "from a_index | eval (NOT (numberField != 0))",
+      "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | eval stringField <= numberField",
-      "error": [
-        "Argument of [<=] must be [number], found value [stringField] type [string]"
-      ],
+      "query": "from a_index | eval 1 != 0",
+      "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | eval numberField <= \"2022\"",
+      "query": "from a_index | eval stringField != stringField",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | eval dateField <= stringField",
-      "error": [
-        "Argument of [<=] must be [string], found value [dateField] type [date]"
-      ],
+      "query": "from a_index | eval numberField != numberField",
+      "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | eval stringField <= dateField",
-      "error": [
-        "Argument of [<=] must be [string], found value [dateField] type [date]"
-      ],
+      "query": "from a_index | eval dateField != dateField",
+      "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | eval dateField <= \"2022\"",
+      "query": "from a_index | eval booleanField != booleanField",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | eval stringField <= 0",
-      "error": [
-        "Argument of [<=] must be [number], found value [stringField] type [string]"
-      ],
+      "query": "from a_index | eval ipField != ipField",
+      "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | eval stringField <= now()",
+      "query": "from a_index | eval numberField != stringField",
       "error": [
-        "Argument of [<=] must be [string], found value [now()] type [date]"
+        "Argument of [!=] must be [number], found value [stringField] type [string]"
       ],
       "warning": []
     },
     {
-      "query": "from a_index | eval numberField == 0",
-      "error": [],
+      "query": "from a_index | eval stringField != numberField",
+      "error": [
+        "Argument of [!=] must be [number], found value [stringField] type [string]"
+      ],
       "warning": []
     },
     {
-      "query": "from a_index | eval NOT numberField == 0",
-      "error": [],
+      "query": "from a_index | eval numberField != \"2022\"",
+      "error": [
+        "Argument of [!=] must be [number], found value [\"2022\"] type [string]"
+      ],
       "warning": []
     },
     {
-      "query": "from a_index | eval (numberField == 0)",
-      "error": [],
+      "query": "from a_index | eval dateField != stringField",
+      "error": [
+        "Argument of [!=] must be [string], found value [dateField] type [date]"
+      ],
       "warning": []
     },
     {
-      "query": "from a_index | eval (NOT (numberField == 0))",
-      "error": [],
+      "query": "from a_index | eval stringField != dateField",
+      "error": [
+        "Argument of [!=] must be [string], found value [dateField] type [date]"
+      ],
       "warning": []
     },
     {
-      "query": "from a_index | eval 1 == 0",
-      "error": [],
+      "query": "from a_index | eval stringField != 0",
+      "error": [
+        "Argument of [!=] must be [number], found value [stringField] type [string]"
+      ],
       "warning": []
     },
     {
-      "query": "from a_index | eval stringField == stringField",
-      "error": [],
+      "query": "from a_index | eval stringField != now()",
+      "error": [
+        "Argument of [!=] must be [string], found value [now()] type [date]"
+      ],
       "warning": []
     },
     {
-      "query": "from a_index | eval numberField == numberField",
+      "query": "from a_index | eval dateField != \"2022\"",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | eval dateField == dateField",
+      "query": "from a_index | eval \"2022\" != dateField",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | eval booleanField == booleanField",
+      "query": "from a_index | eval versionField != \"1.2.3\"",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | eval ipField == ipField",
+      "query": "from a_index | eval \"1.2.3\" != versionField",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | eval numberField == stringField",
-      "error": [
-        "Argument of [==] must be [number], found value [stringField] type [string]"
-      ],
+      "query": "from a_index | eval booleanField != \"true\"",
+      "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | eval stringField == numberField",
-      "error": [
-        "Argument of [==] must be [number], found value [stringField] type [string]"
-      ],
+      "query": "from a_index | eval \"true\" != booleanField",
+      "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | eval numberField == \"2022\"",
+      "query": "from a_index | eval ipField != \"136.36.3.205\"",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | eval dateField == stringField",
-      "error": [
-        "Argument of [==] must be [string], found value [dateField] type [date]"
-      ],
+      "query": "from a_index | eval \"136.36.3.205\" != ipField",
+      "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | eval stringField == dateField",
-      "error": [
-        "Argument of [==] must be [string], found value [dateField] type [date]"
-      ],
+      "query": "from a_index | eval versionField in (\"1.2.3\", \"4.5.6\", to_version(\"2.3.2\"))",
+      "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | eval dateField == \"2022\"",
+      "query": "from a_index | eval dateField in (\"2023-12-12\", \"2024-12-12\", date_parse(\"yyyy-MM-dd\", \"2025-12-12\"))",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | eval stringField == 0",
-      "error": [
-        "Argument of [==] must be [number], found value [stringField] type [string]"
-      ],
+      "query": "from a_index | eval booleanField in (\"true\", \"false\", false)",
+      "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | eval stringField == now()",
-      "error": [
-        "Argument of [==] must be [string], found value [now()] type [date]"
-      ],
+      "query": "from a_index | eval ipField in (\"136.36.3.205\", \"136.36.3.206\", to_ip(\"136.36.3.207\"))",
+      "error": [],
       "warning": []
     },
     {
@@ -12484,6 +12518,20 @@
       ],
       "warning": []
     },
+    {
+      "query": "from a_index | eval 1 + \"1\"",
+      "error": [
+        "Argument of [+] must be [number], found value [\"1\"] type [string]"
+      ],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval \"1\" + 1",
+      "error": [
+        "Argument of [+] must be [number], found value [\"1\"] type [string]"
+      ],
+      "warning": []
+    },
     {
       "query": "from a_index | eval numberField - 1",
       "error": [],
@@ -12506,6 +12554,20 @@
       ],
       "warning": []
     },
+    {
+      "query": "from a_index | eval 1 - \"1\"",
+      "error": [
+        "Argument of [-] must be [number], found value [\"1\"] type [string]"
+      ],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval \"1\" - 1",
+      "error": [
+        "Argument of [-] must be [number], found value [\"1\"] type [string]"
+      ],
+      "warning": []
+    },
     {
       "query": "from a_index | eval numberField * 1",
       "error": [],
@@ -12529,6 +12591,20 @@
       ],
       "warning": []
     },
+    {
+      "query": "from a_index | eval 1 * \"1\"",
+      "error": [
+        "Argument of [*] must be [number], found value [\"1\"] type [string]"
+      ],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval \"1\" * 1",
+      "error": [
+        "Argument of [*] must be [number], found value [\"1\"] type [string]"
+      ],
+      "warning": []
+    },
     {
       "query": "from a_index | eval numberField / 1",
       "error": [],
@@ -12552,6 +12628,20 @@
       ],
       "warning": []
     },
+    {
+      "query": "from a_index | eval 1 / \"1\"",
+      "error": [
+        "Argument of [/] must be [number], found value [\"1\"] type [string]"
+      ],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval \"1\" / 1",
+      "error": [
+        "Argument of [/] must be [number], found value [\"1\"] type [string]"
+      ],
+      "warning": []
+    },
     {
       "query": "from a_index | eval numberField % 1",
       "error": [],
@@ -12575,6 +12665,20 @@
       ],
       "warning": []
     },
+    {
+      "query": "from a_index | eval 1 % \"1\"",
+      "error": [
+        "Argument of [%] must be [number], found value [\"1\"] type [string]"
+      ],
+      "warning": []
+    },
+    {
+      "query": "from a_index | eval \"1\" % 1",
+      "error": [
+        "Argument of [%] must be [number], found value [\"1\"] type [string]"
+      ],
+      "warning": []
+    },
     {
       "query": "from a_index | eval 1/0",
       "error": [],
@@ -12760,30 +12864,22 @@
     },
     {
       "query": "from a_index | eval 1 in (\"a\", \"b\", \"c\")",
-      "error": [
-        "Argument of [in] must be [number[]], found value [(\"a\", \"b\", \"c\")] type [(string, string, string)]"
-      ],
+      "error": [],
       "warning": []
     },
     {
       "query": "from a_index | eval numberField in (\"a\", \"b\", \"c\")",
-      "error": [
-        "Argument of [in] must be [number[]], found value [(\"a\", \"b\", \"c\")] type [(string, string, string)]"
-      ],
+      "error": [],
       "warning": []
     },
     {
       "query": "from a_index | eval numberField not in (\"a\", \"b\", \"c\")",
-      "error": [
-        "Argument of [not_in] must be [number[]], found value [(\"a\", \"b\", \"c\")] type [(string, string, string)]"
-      ],
+      "error": [],
       "warning": []
     },
     {
       "query": "from a_index | eval numberField not in (1, 2, 3, stringField)",
-      "error": [
-        "Argument of [not_in] must be [number[]], found value [(1, 2, 3, stringField)] type [(number, number, number, string)]"
-      ],
+      "error": [],
       "warning": []
     },
     {
@@ -15778,17 +15874,19 @@
       "warning": []
     },
     {
-      "query": "from a_index | stats by bucket(numberField, 1 year)",
+      "query": "from a_index | stats by bucket(numberField, 5)",
       "error": [],
       "warning": []
     },
     {
-      "query": "from a_index | stats by bucket(numberField, 1 year)",
-      "error": [],
+      "query": "from a_index | stats by bucket(numberField, numberField)",
+      "error": [
+        "Argument of [bucket] must be a constant, received [numberField]"
+      ],
       "warning": []
     },
     {
-      "query": "from a_index | stats by bin(numberField, 1 year)",
+      "query": "from a_index | stats by bin(numberField, 5)",
       "error": [],
       "warning": []
     },
diff --git a/packages/kbn-esql-validation-autocomplete/src/validation/validation.test.ts b/packages/kbn-esql-validation-autocomplete/src/validation/validation.test.ts
index 578d3e9d79b6a3..c37ea71ef1be4b 100644
--- a/packages/kbn-esql-validation-autocomplete/src/validation/validation.test.ts
+++ b/packages/kbn-esql-validation-autocomplete/src/validation/validation.test.ts
@@ -24,6 +24,7 @@ const fieldTypes = [
   'number',
   'date',
   'boolean',
+  'version',
   'ip',
   'string',
   'cartesian_point',
@@ -400,11 +401,9 @@ describe('validation logic', () => {
       testErrorsAndWarnings('f', [
         `SyntaxError: mismatched input 'f' expecting {'explain', 'from', 'meta', 'row', 'show'}`,
       ]);
-      testErrorsAndWarnings(`from `, [
-        "SyntaxError: missing {QUOTED_IDENTIFIER, FROM_UNQUOTED_IDENTIFIER} at '<EOF>'",
-      ]);
+      testErrorsAndWarnings(`from `, ["SyntaxError: missing FROM_UNQUOTED_IDENTIFIER at '<EOF>'"]);
       testErrorsAndWarnings(`from index,`, [
-        "SyntaxError: missing {QUOTED_IDENTIFIER, FROM_UNQUOTED_IDENTIFIER} at '<EOF>'",
+        "SyntaxError: missing FROM_UNQUOTED_IDENTIFIER at '<EOF>'",
       ]);
       testErrorsAndWarnings(`from assignment = 1`, [
         "SyntaxError: mismatched input '=' expecting <EOF>",
@@ -413,7 +412,10 @@ describe('validation logic', () => {
       testErrorsAndWarnings(`from index`, []);
       testErrorsAndWarnings(`FROM index`, []);
       testErrorsAndWarnings(`FrOm index`, []);
-      testErrorsAndWarnings('from `index`', []);
+      testErrorsAndWarnings('from `index`', [
+        "SyntaxError: token recognition error at: '`'",
+        "SyntaxError: token recognition error at: '`'",
+      ]);
 
       testErrorsAndWarnings(`from index, other_index`, []);
       testErrorsAndWarnings(`from index, missingIndex`, ['Unknown index [missingIndex]']);
@@ -548,16 +550,16 @@ describe('validation logic', () => {
       testErrorsAndWarnings('row var = "a" in ("a", "b", "c")', []);
       testErrorsAndWarnings('row var = "a" not in ("a", "b", "c")', []);
       testErrorsAndWarnings('row var = 1 in ("a", "b", "c")', [
-        'Argument of [in] must be [number[]], found value [("a", "b", "c")] type [(string, string, string)]',
+        // 'Argument of [in] must be [number[]], found value [("a", "b", "c")] type [(string, string, string)]',
       ]);
       testErrorsAndWarnings('row var = 5 in ("a", "b", "c")', [
-        'Argument of [in] must be [number[]], found value [("a", "b", "c")] type [(string, string, string)]',
+        // 'Argument of [in] must be [number[]], found value [("a", "b", "c")] type [(string, string, string)]',
       ]);
       testErrorsAndWarnings('row var = 5 not in ("a", "b", "c")', [
-        'Argument of [not_in] must be [number[]], found value [("a", "b", "c")] type [(string, string, string)]',
+        // 'Argument of [not_in] must be [number[]], found value [("a", "b", "c")] type [(string, string, string)]',
       ]);
       testErrorsAndWarnings('row var = 5 not in (1, 2, 3, "a")', [
-        'Argument of [not_in] must be [number[]], found value [(1, 2, 3, "a")] type [(number, number, number, string)]',
+        // 'Argument of [not_in] must be [number[]], found value [(1, 2, 3, "a")] type [(number, number, number, string)]',
       ]);
 
       // test that "and" and "or" accept null... not sure if this is the best place or not...
@@ -622,7 +624,17 @@ describe('validation logic', () => {
           // the right error message
           if (
             params.every(({ type }) => type !== 'any') &&
-            !['to_version', 'mv_sort', 'date_diff'].includes(name)
+            ![
+              'to_version',
+              'mv_sort',
+              // skip the date functions because the row tests always throw in
+              // a string literal and expect it to be invalid for the date functions
+              // but it's always valid because ES will parse it as a date
+              'date_diff',
+              'date_extract',
+              'date_format',
+              'date_trunc',
+            ].includes(name)
           ) {
             // now test nested functions
             const fieldMappingWithNestedFunctions = getFieldMapping(params, {
@@ -678,10 +690,7 @@ describe('validation logic', () => {
                 `Argument of [${op}] must be [number], found value [false] type [boolean]`,
               ]
         );
-        for (const [valueTypeA, valueTypeB] of [
-          ['now()', '"2022"'],
-          ['42', '"2022"'],
-        ]) {
+        for (const [valueTypeA, valueTypeB] of [['now()', '"2022"']]) {
           testErrorsAndWarnings(`row var = ${valueTypeA} ${op} ${valueTypeB}`, []);
           testErrorsAndWarnings(`row var = ${valueTypeB} ${op} ${valueTypeA}`, []);
         }
@@ -1112,31 +1121,6 @@ describe('validation logic', () => {
                 ]
           );
         }
-
-        // Implicit casting of literal values tests
-        testErrorsAndWarnings(`from a_index | where numberField ${op} stringField`, [
-          `Argument of [${op}] must be [number], found value [stringField] type [string]`,
-        ]);
-        testErrorsAndWarnings(`from a_index | where stringField ${op} numberField`, [
-          `Argument of [${op}] must be [number], found value [stringField] type [string]`,
-        ]);
-        testErrorsAndWarnings(`from a_index | where numberField ${op} "2022"`, []);
-
-        testErrorsAndWarnings(`from a_index | where dateField ${op} stringField`, [
-          `Argument of [${op}] must be [string], found value [dateField] type [date]`,
-        ]);
-        testErrorsAndWarnings(`from a_index | where stringField ${op} dateField`, [
-          `Argument of [${op}] must be [string], found value [dateField] type [date]`,
-        ]);
-        testErrorsAndWarnings(`from a_index | where dateField ${op} "2022"`, []);
-
-        // Check that the implicit cast doesn't apply for fields
-        testErrorsAndWarnings(`from a_index | where stringField ${op} 0`, [
-          `Argument of [${op}] must be [number], found value [stringField] type [string]`,
-        ]);
-        testErrorsAndWarnings(`from a_index | where stringField ${op} now()`, [
-          `Argument of [${op}] must be [string], found value [now()] type [date]`,
-        ]);
       }
 
       for (const nesting of NESTED_DEPTHS) {
@@ -1289,7 +1273,6 @@ describe('validation logic', () => {
         );
       });
       for (const { name, signatures, ...rest } of numericOrStringFunctions) {
-        if (name === 'date_diff') continue; // date_diff is hard to test
         const supportedSignatures = signatures.filter(({ returnType }) =>
           // TODO — not sure why the tests have this limitation... seems like any type
           // that can be part of a boolean expression should be allowed in a where clause
@@ -1489,7 +1472,6 @@ describe('validation logic', () => {
       }
 
       for (const { name, alias, signatures, ...defRest } of evalFunctionsDefinitions) {
-        if (name === 'date_diff') continue; // date_diff is hard to test
         for (const { params, ...signRest } of signatures) {
           const fieldMapping = getFieldMapping(params);
           testErrorsAndWarnings(
@@ -1561,7 +1543,7 @@ describe('validation logic', () => {
           // the right error message
           if (
             params.every(({ type }) => type !== 'any') &&
-            !['to_version', 'mv_sort', 'date_diff'].includes(name)
+            !['to_version', 'mv_sort'].includes(name)
           ) {
             // now test nested functions
             const fieldMappingWithNestedFunctions = getFieldMapping(params, {
@@ -1700,7 +1682,7 @@ describe('validation logic', () => {
           'Log of a negative number results in null: -20',
         ]
       );
-      for (const op of ['>', '>=', '<', '<=', '==']) {
+      for (const op of ['>', '>=', '<', '<=', '==', '!=']) {
         testErrorsAndWarnings(`from a_index | eval numberField ${op} 0`, []);
         testErrorsAndWarnings(`from a_index | eval NOT numberField ${op} 0`, []);
         testErrorsAndWarnings(`from a_index | eval (numberField ${op} 0)`, []);
@@ -1724,7 +1706,9 @@ describe('validation logic', () => {
         testErrorsAndWarnings(`from a_index | eval stringField ${op} numberField`, [
           `Argument of [${op}] must be [number], found value [stringField] type [string]`,
         ]);
-        testErrorsAndWarnings(`from a_index | eval numberField ${op} "2022"`, []);
+        testErrorsAndWarnings(`from a_index | eval numberField ${op} "2022"`, [
+          `Argument of [${op}] must be [number], found value ["2022"] type [string]`,
+        ]);
 
         testErrorsAndWarnings(`from a_index | eval dateField ${op} stringField`, [
           `Argument of [${op}] must be [string], found value [dateField] type [date]`,
@@ -1732,7 +1716,6 @@ describe('validation logic', () => {
         testErrorsAndWarnings(`from a_index | eval stringField ${op} dateField`, [
           `Argument of [${op}] must be [string], found value [dateField] type [date]`,
         ]);
-        testErrorsAndWarnings(`from a_index | eval dateField ${op} "2022"`, []);
 
         // Check that the implicit cast doesn't apply for fields
         testErrorsAndWarnings(`from a_index | eval stringField ${op} 0`, [
@@ -1741,7 +1724,45 @@ describe('validation logic', () => {
         testErrorsAndWarnings(`from a_index | eval stringField ${op} now()`, [
           `Argument of [${op}] must be [string], found value [now()] type [date]`,
         ]);
+
+        testErrorsAndWarnings(`from a_index | eval dateField ${op} "2022"`, []);
+        testErrorsAndWarnings(`from a_index | eval "2022" ${op} dateField`, []);
+
+        testErrorsAndWarnings(`from a_index | eval versionField ${op} "1.2.3"`, []);
+        testErrorsAndWarnings(`from a_index | eval "1.2.3" ${op} versionField`, []);
+
+        testErrorsAndWarnings(
+          `from a_index | eval booleanField ${op} "true"`,
+          ['==', '!='].includes(op)
+            ? []
+            : [`Argument of [${op}] must be [string], found value [booleanField] type [boolean]`]
+        );
+        testErrorsAndWarnings(
+          `from a_index | eval "true" ${op} booleanField`,
+          ['==', '!='].includes(op)
+            ? []
+            : [`Argument of [${op}] must be [string], found value [booleanField] type [boolean]`]
+        );
+
+        testErrorsAndWarnings(`from a_index | eval ipField ${op} "136.36.3.205"`, []);
+        testErrorsAndWarnings(`from a_index | eval "136.36.3.205" ${op} ipField`, []);
       }
+
+      // casting for IN for version, date, boolean, ip
+      testErrorsAndWarnings(
+        'from a_index | eval versionField in ("1.2.3", "4.5.6", to_version("2.3.2"))',
+        []
+      );
+      testErrorsAndWarnings(
+        'from a_index | eval dateField in ("2023-12-12", "2024-12-12", date_parse("yyyy-MM-dd", "2025-12-12"))',
+        []
+      );
+      testErrorsAndWarnings('from a_index | eval booleanField in ("true", "false", false)', []);
+      testErrorsAndWarnings(
+        'from a_index | eval ipField in ("136.36.3.205", "136.36.3.206", to_ip("136.36.3.207"))',
+        []
+      );
+
       for (const op of ['+', '-', '*', '/', '%']) {
         testErrorsAndWarnings(`from a_index | eval numberField ${op} 1`, []);
         testErrorsAndWarnings(`from a_index | eval (numberField ${op} 1)`, []);
@@ -1755,6 +1776,15 @@ describe('validation logic', () => {
                 `Argument of [${op}] must be [number], found value [now()] type [date]`,
               ]
         );
+
+        testErrorsAndWarnings(`from a_index | eval 1 ${op} "1"`, [
+          `Argument of [${op}] must be [number], found value [\"1\"] type [string]`,
+        ]);
+        testErrorsAndWarnings(`from a_index | eval "1" ${op} 1`, [
+          `Argument of [${op}] must be [number], found value [\"1\"] type [string]`,
+        ]);
+        // TODO: enable when https://github.com/elastic/elasticsearch/issues/108432 is complete
+        // testErrorsAndWarnings(`from a_index | eval "2022" ${op} 1 day`, []);
       }
       for (const divideByZeroExpr of ['1/0', 'var = 1/0', '1 + 1/0']) {
         testErrorsAndWarnings(
@@ -1802,16 +1832,16 @@ describe('validation logic', () => {
         []
       );
       testErrorsAndWarnings('from a_index | eval 1 in ("a", "b", "c")', [
-        'Argument of [in] must be [number[]], found value [("a", "b", "c")] type [(string, string, string)]',
+        // 'Argument of [in] must be [number[]], found value [("a", "b", "c")] type [(string, string, string)]',
       ]);
       testErrorsAndWarnings('from a_index | eval numberField in ("a", "b", "c")', [
-        'Argument of [in] must be [number[]], found value [("a", "b", "c")] type [(string, string, string)]',
+        // 'Argument of [in] must be [number[]], found value [("a", "b", "c")] type [(string, string, string)]',
       ]);
       testErrorsAndWarnings('from a_index | eval numberField not in ("a", "b", "c")', [
-        'Argument of [not_in] must be [number[]], found value [("a", "b", "c")] type [(string, string, string)]',
+        // 'Argument of [not_in] must be [number[]], found value [("a", "b", "c")] type [(string, string, string)]',
       ]);
       testErrorsAndWarnings('from a_index | eval numberField not in (1, 2, 3, stringField)', [
-        'Argument of [not_in] must be [number[]], found value [(1, 2, 3, stringField)] type [(number, number, number, string)]',
+        // 'Argument of [not_in] must be [number[]], found value [(1, 2, 3, stringField)] type [(number, number, number, string)]',
       ]);
 
       testErrorsAndWarnings('from a_index | eval avg(numberField)', [
@@ -2251,7 +2281,7 @@ describe('validation logic', () => {
           // the right error message
           if (
             params.every(({ type }) => type !== 'any') &&
-            !['to_version', 'mv_sort', 'date_diff'].includes(name)
+            !['to_version', 'mv_sort'].includes(name)
           ) {
             // now test nested functions
             const fieldMappingWithNestedAggsFunctions = getFieldMapping(params, {
diff --git a/packages/kbn-field-utils/index.ts b/packages/kbn-field-utils/index.ts
index 643e22ce6450a9..d631c51c757a4c 100644
--- a/packages/kbn-field-utils/index.ts
+++ b/packages/kbn-field-utils/index.ts
@@ -21,6 +21,7 @@ export { getFieldTypeDescription } from './src/utils/get_field_type_description'
 export { getFieldTypeName, UNKNOWN_FIELD_TYPE_MESSAGE } from './src/utils/get_field_type_name';
 export {
   fieldNameWildcardMatcher,
+  comboBoxFieldOptionMatcher,
   getFieldSearchMatchingHighlight,
 } from './src/utils/field_name_wildcard_matcher';
 
diff --git a/packages/kbn-field-utils/src/utils/field_name_wildcard_matcher.ts b/packages/kbn-field-utils/src/utils/field_name_wildcard_matcher.ts
index 063ca3a16e01ad..ba06e36e95c9f6 100644
--- a/packages/kbn-field-utils/src/utils/field_name_wildcard_matcher.ts
+++ b/packages/kbn-field-utils/src/utils/field_name_wildcard_matcher.ts
@@ -42,6 +42,19 @@ export const fieldNameWildcardMatcher = (
   return (!!field.displayName && regExp.test(field.displayName)) || regExp.test(field.name);
 };
 
+/**
+ * Adapts fieldNameWildcardMatcher to combobox props.
+ * @param field
+ * @param fieldSearchHighlight
+ */
+export const comboBoxFieldOptionMatcher = ({
+  option: { name, label },
+  searchValue,
+}: {
+  option: { name?: string; label: string };
+  searchValue: string;
+}) => fieldNameWildcardMatcher({ name: name || label, displayName: label }, searchValue);
+
 /**
  * Get `highlight` string to be used together with `EuiHighlight`
  * @param displayName
diff --git a/packages/kbn-journeys/services/synthtrace.ts b/packages/kbn-journeys/services/synthtrace.ts
index ffb4f06f200079..d96e186c1b1e63 100644
--- a/packages/kbn-journeys/services/synthtrace.ts
+++ b/packages/kbn-journeys/services/synthtrace.ts
@@ -117,7 +117,7 @@ async function initApmSynthtraceClient(options: SynthtraceClientOptions) {
     version: packageVersion,
   });
 
-  synthEsClient.pipeline(synthEsClient.getDefaultPipeline(false));
+  synthEsClient.pipeline(synthEsClient.getDefaultPipeline({ includeSerialization: false }));
 
   return synthEsClient;
 }
diff --git a/packages/kbn-management/settings/setting_ids/index.ts b/packages/kbn-management/settings/setting_ids/index.ts
index f4a30dac6cb121..93646978aa1a65 100644
--- a/packages/kbn-management/settings/setting_ids/index.ts
+++ b/packages/kbn-management/settings/setting_ids/index.ts
@@ -139,6 +139,7 @@ export const OBSERVABILITY_APM_ENABLE_SERVICE_INVENTORY_TABLE_SEARCH_BAR =
   'observability:apmEnableServiceInventoryTableSearchBar';
 export const OBSERVABILITY_LOGS_EXPLORER_ALLOWED_DATA_VIEWS_ID =
   'observability:logsExplorer:allowedDataViews';
+export const OBSERVABILITY_APM_ENABLE_MULTI_SIGNAL = 'observability:apmEnableMultiSignal';
 
 // Reporting settings
 export const XPACK_REPORTING_CUSTOM_PDF_LOGO_ID = 'xpackReporting:customPdfLogo';
diff --git a/packages/kbn-openapi-bundler/README.md b/packages/kbn-openapi-bundler/README.md
index 4a82cb9c203391..0a096b3f281522 100644
--- a/packages/kbn-openapi-bundler/README.md
+++ b/packages/kbn-openapi-bundler/README.md
@@ -1,15 +1,15 @@
 # OpenAPI Specs Bundler for Kibana
 
-`@kbn/openapi-bundler` is a tool for transforming multiple OpenAPI specification files (source specs) into a single bundled specification file (target spec).
-This can be used for API docs generation purposes. This approach allows you to:
+`@kbn/openapi-bundler` is a tool for transforming multiple OpenAPI specification files (source specs) into a bundled specification file(s) (target spec). The number of resulting bundles depends on a number of versions
+used in the OpenAPI specification files. The package can be used for API documentation generation purposes. This approach allows you to:
 
-- Abstract away the knowledge of where you keep your OpenAPI specs, how many specs there are, and how to find them. The Docs team should only know where a single file is located - the bundle.
+- Abstract away the knowledge of where you keep your OpenAPI specs, how many specs are there, and how to find them. Consumer should only know where result files are located - the bundles.
 - Omit internal API endpoints from the bundle.
 - Omit API endpoints that are hidden behind a feature flag and haven't been released yet.
 - Omit parts of schemas that are hidden behind a feature flag (e.g. a new property added to an existing response schema).
 - Omit custom OpenAPI attributes from the bundle, such as `x-codegen-enabled`, `x-internal`, and `x-modify` (see below).
 - Transform the target schema according to the custom OpenAPI attributes, such as `x-modify`.
-- Resolve references and inline some of them for better readability. The bundled file contains only local references and paths.
+- Resolve references, inline some of them and merge allOf object schemas for better readability. The bundled file contains only local references and paths.
 
 ## Getting started
 
@@ -22,16 +22,22 @@ Currently package supports only programmatic API. As the next step you need to c
 ```ts
 require('../../../../../src/setup_node_env');
 const { bundle } = require('@kbn/openapi-bundler');
-const { resolve } = require('path');
+const { join, resolve } = require('path');
 
 // define ROOT as `my-plugin` instead of `my-plugin/scripts/openapi`
 // pay attention to this constant when your script's location is different
 const ROOT = resolve(__dirname, '../..');
 
 bundle({
-  rootDir: ROOT, // Root path e.g. plugin root directory
-  sourceGlob: './**/*.schema.yaml', // Glob pattern to find OpenAPI specification files
-  outputFilePath: './target/openapi/my-plugin.bundled.schema.yaml', //
+  // Root path e.g. plugin root directory
+  rootDir: ROOT,
+  // Glob pattern to find OpenAPI specification files, relative to `rootDir`
+  sourceGlob: './**/*.schema.yaml',
+  // Output file path. Absolute or related to the node.js working directory.
+  // It may contain `{version}` placeholder which is optional. `{version}` placeholder
+  // will be replaced with the bundled specs version or filename will be prepended with
+  // version when placeholder is omitted, e.g. `2023-10-31-my-plugin.bundled.schema.yaml`.
+  outputFilePath: join(ROOT, 'target/openapi/my-plugin-{version}.bundled.schema.yaml'),
 });
 ```
 
diff --git a/packages/kbn-openapi-bundler/src/__test__/bundle_refs.test.ts b/packages/kbn-openapi-bundler/src/__test__/bundle_refs.test.ts
new file mode 100644
index 00000000000000..a75dca8f275582
--- /dev/null
+++ b/packages/kbn-openapi-bundler/src/__test__/bundle_refs.test.ts
@@ -0,0 +1,407 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { OpenAPIV3 } from 'openapi-types';
+import { bundleSpecs } from './bundle_specs';
+import { createOASDocument } from './create_oas_document';
+
+describe('OpenAPI Bundler - bundle references', () => {
+  it('bundles files with external references', async () => {
+    const spec1 = createOASDocument({
+      paths: {
+        '/api/some_api': {
+          get: {
+            responses: {
+              '200': {
+                description: 'Successful response',
+                content: {
+                  'application/json': {
+                    schema: {
+                      $ref: './common.schema.yaml#/components/schemas/TestSchema',
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+    });
+    const spec2 = createOASDocument({
+      paths: {
+        '/api/some_api': {
+          post: {
+            responses: {
+              '200': {
+                description: 'Successful response',
+                content: {
+                  'application/json': {
+                    schema: {
+                      $ref: './common.schema.yaml#/components/schemas/TestSchema',
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+    });
+    const commonSpec = createOASDocument({
+      info: {
+        version: 'not set',
+      },
+      components: {
+        schemas: {
+          TestSchema: {
+            type: 'string',
+            enum: ['value1', 'value2'],
+          },
+        },
+      },
+    });
+
+    const [bundledSpec] = Object.values(
+      await bundleSpecs({
+        1: spec1,
+        2: spec2,
+        common: commonSpec,
+      })
+    );
+
+    expect(bundledSpec.paths['/api/some_api']!.get!.responses['200']).toMatchObject({
+      content: {
+        'application/json': {
+          schema: {
+            $ref: '#/components/schemas/TestSchema',
+          },
+        },
+      },
+    });
+    expect(bundledSpec.paths['/api/some_api']!.post!.responses['200']).toMatchObject({
+      content: {
+        'application/json': {
+          schema: {
+            $ref: '#/components/schemas/TestSchema',
+          },
+        },
+      },
+    });
+    expect(bundledSpec.components!.schemas).toMatchObject({
+      TestSchema: commonSpec.components!.schemas!.TestSchema,
+    });
+  });
+
+  it('bundles one file with a local reference', async () => {
+    const spec = createOASDocument({
+      paths: {
+        '/api/some_api': {
+          get: {
+            responses: {
+              '200': {
+                description: 'Successful response',
+                content: {
+                  'application/json': {
+                    schema: {
+                      $ref: '#/components/schemas/TestSchema',
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+      components: {
+        schemas: {
+          TestSchema: {
+            type: 'string',
+            enum: ['value1', 'value2'],
+          },
+        },
+      },
+    });
+
+    const [bundledSpec] = Object.values(
+      await bundleSpecs({
+        1: spec,
+      })
+    );
+
+    expect(bundledSpec.paths['/api/some_api']).toEqual({
+      get: expect.objectContaining({
+        responses: expect.objectContaining({
+          '200': expect.objectContaining({
+            content: {
+              'application/json': {
+                schema: {
+                  $ref: '#/components/schemas/TestSchema',
+                },
+              },
+            },
+          }),
+        }),
+      }),
+    });
+    expect(bundledSpec.components!.schemas!.TestSchema).toEqual(
+      spec.components!.schemas!.TestSchema
+    );
+  });
+
+  it('bundles one file with an external reference', async () => {
+    const spec = createOASDocument({
+      paths: {
+        '/api/some_api': {
+          get: {
+            responses: {
+              '200': {
+                description: 'Successful response',
+                content: {
+                  'application/json': {
+                    schema: {
+                      $ref: './common.schema.yaml#/components/schemas/TestSchema',
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+    });
+    const commonSpec = createOASDocument({
+      info: {
+        version: 'not set',
+      },
+      components: {
+        schemas: {
+          TestSchema: {
+            type: 'string',
+            enum: ['value1', 'value2'],
+          },
+        },
+      },
+    });
+
+    const [bundledSpec] = Object.values(
+      await bundleSpecs({
+        1: spec,
+        common: commonSpec,
+      })
+    );
+
+    expect(bundledSpec.paths['/api/some_api']).toEqual({
+      get: expect.objectContaining({
+        responses: expect.objectContaining({
+          '200': expect.objectContaining({
+            content: {
+              'application/json': {
+                schema: {
+                  $ref: '#/components/schemas/TestSchema',
+                },
+              },
+            },
+          }),
+        }),
+      }),
+    });
+    expect(bundledSpec.components!.schemas!.TestSchema).toMatchObject(
+      commonSpec.components!.schemas!.TestSchema
+    );
+  });
+
+  it('bundles conflicting but equal references', async () => {
+    const ConflictTestSchema: OpenAPIV3.SchemaObject = {
+      type: 'integer',
+      minimum: 1,
+    };
+    const spec1 = createOASDocument({
+      paths: {
+        '/api/some_api': {
+          get: {
+            responses: {
+              '200': {
+                description: 'Successful response',
+                content: {
+                  'application/json': {
+                    schema: {
+                      $ref: '#/components/schemas/ConflictTestSchema',
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+      components: {
+        schemas: { ConflictTestSchema },
+      },
+    });
+    const spec2 = createOASDocument({
+      paths: {
+        '/api/some_api': {
+          put: {
+            responses: {
+              '200': {
+                description: 'Successful response',
+                content: {
+                  'application/json': {
+                    schema: {
+                      $ref: '#/components/schemas/ConflictTestSchema',
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+      components: {
+        schemas: { ConflictTestSchema },
+      },
+    });
+
+    const [bundledSpec] = Object.values(await bundleSpecs({ '1': spec1, '2': spec2 }));
+
+    expect(bundledSpec.paths['/api/some_api']).toEqual({
+      get: spec1.paths['/api/some_api']!.get,
+      put: spec2.paths['/api/some_api']!.put,
+    });
+    expect(bundledSpec.components).toMatchObject({ schemas: { ConflictTestSchema } });
+  });
+
+  it('DOES NOT bundle external conflicting references encountered in on spec file', async () => {
+    const spec = createOASDocument({
+      paths: {
+        '/api/some_api': {
+          get: {
+            responses: {
+              '200': {
+                description: 'Successful response',
+                content: {
+                  'application/json': {
+                    schema: {
+                      type: 'object',
+                      properties: {
+                        fieldA: {
+                          $ref: './common_a.schema.yaml#/components/schemas/ConflictTestSchema',
+                        },
+                        fieldB: {
+                          $ref: './common_b.schema.yaml#/components/schemas/ConflictTestSchema',
+                        },
+                      },
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+    });
+    const commonSpecA = createOASDocument({
+      components: {
+        schemas: {
+          ConflictTestSchema: {
+            type: 'string',
+            enum: ['value1', 'value2'],
+          },
+        },
+      },
+    });
+    const commonSpecB = createOASDocument({
+      components: {
+        schemas: {
+          ConflictTestSchema: {
+            type: 'object',
+            properties: {
+              someField: {
+                type: 'string',
+              },
+            },
+          },
+        },
+      },
+    });
+
+    await expect(
+      bundleSpecs({
+        1: spec,
+        common_a: commonSpecA,
+        common_b: commonSpecB,
+      })
+    ).rejects.toThrowError(/\/components\/schemas\/ConflictTestSchema/);
+  });
+
+  it('DOES NOT bundle conflicting references encountered in separate specs', async () => {
+    const spec1 = createOASDocument({
+      paths: {
+        '/api/some_api': {
+          get: {
+            responses: {
+              '200': {
+                description: 'Successful response',
+                content: {
+                  'application/json': {
+                    schema: {
+                      $ref: '#/components/schemas/ConflictTestSchema',
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+      components: {
+        schemas: {
+          ConflictTestSchema: {
+            type: 'string',
+            enum: ['value1', 'value2'],
+          },
+        },
+      },
+    });
+    const spec2 = createOASDocument({
+      paths: {
+        '/api/some_api': {
+          put: {
+            responses: {
+              '200': {
+                description: 'Successful response',
+                content: {
+                  'application/json': {
+                    schema: {
+                      $ref: '#/components/schemas/ConflictTestSchema',
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+      components: {
+        schemas: {
+          ConflictTestSchema: {
+            type: 'integer',
+            minimum: 1,
+          },
+        },
+      },
+    });
+
+    await expect(
+      bundleSpecs({
+        1: spec1,
+        2: spec2,
+      })
+    ).rejects.toThrowError(/\/components\/schemas\/ConflictTestSchema/);
+  });
+});
diff --git a/packages/kbn-openapi-bundler/src/__test__/bundle_simple_specs.test.ts b/packages/kbn-openapi-bundler/src/__test__/bundle_simple_specs.test.ts
new file mode 100644
index 00000000000000..15ef0e82159083
--- /dev/null
+++ b/packages/kbn-openapi-bundler/src/__test__/bundle_simple_specs.test.ts
@@ -0,0 +1,77 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { bundleSpecs } from './bundle_specs';
+import { createOASDocument } from './create_oas_document';
+
+describe('OpenAPI Bundler - simple specs', () => {
+  it('bundles two simple specs', async () => {
+    const spec1 = createOASDocument({
+      paths: {
+        '/api/some_api': {
+          get: {
+            responses: {
+              '200': {
+                description: 'Successful response',
+                content: {
+                  'application/json': {
+                    schema: {
+                      type: 'object',
+                      properties: {
+                        fieldA: {
+                          type: 'integer',
+                        },
+                      },
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+    });
+    const spec2 = createOASDocument({
+      paths: {
+        '/api/some_api': {
+          post: {
+            responses: {
+              '200': {
+                description: 'Successful response',
+                content: {
+                  'application/json': {
+                    schema: {
+                      type: 'object',
+                      properties: {
+                        fieldB: {
+                          type: 'string',
+                        },
+                      },
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+    });
+
+    const [bundledSpec] = Object.values(
+      await bundleSpecs({
+        1: spec1,
+        2: spec2,
+      })
+    );
+
+    expect(bundledSpec.paths['/api/some_api']).toEqual({
+      get: spec1.paths['/api/some_api']?.get,
+      post: spec2.paths['/api/some_api']?.post,
+    });
+  });
+});
diff --git a/packages/kbn-openapi-bundler/src/__test__/bundle_specs.ts b/packages/kbn-openapi-bundler/src/__test__/bundle_specs.ts
new file mode 100644
index 00000000000000..599f81c0e4c85b
--- /dev/null
+++ b/packages/kbn-openapi-bundler/src/__test__/bundle_specs.ts
@@ -0,0 +1,79 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { join } from 'path';
+import {
+  existsSync,
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  rmdirSync,
+  unlinkSync,
+  writeFileSync,
+} from 'fs';
+import { dump, load } from 'js-yaml';
+import { OpenAPIV3 } from 'openapi-types';
+import { bundle } from '../openapi_bundler';
+
+const ROOT_PATH = join(__dirname, '..', '..');
+
+export async function bundleSpecs(
+  oasSpecs: Record<string, OpenAPIV3.Document>
+): Promise<Record<string, OpenAPIV3.Document>> {
+  const randomStr = (Math.random() + 1).toString(36).substring(7);
+  const folderToBundlePath = join(ROOT_PATH, 'target', 'oas-test', randomStr);
+  const resultFolderPath = join(ROOT_PATH, 'target', 'oas-test-bundled-result', randomStr);
+  const bundledFilePathTemplate = join(resultFolderPath, '{version}.yaml');
+
+  dumpSpecs(folderToBundlePath, oasSpecs);
+
+  await bundleFolder(folderToBundlePath, bundledFilePathTemplate);
+
+  return readBundledSpecs(resultFolderPath);
+}
+
+function removeFolder(folderPath: string): void {
+  if (existsSync(folderPath)) {
+    for (const fileName of readdirSync(folderPath)) {
+      unlinkSync(join(folderPath, fileName));
+    }
+
+    rmdirSync(folderPath);
+  }
+}
+
+function dumpSpecs(folderPath: string, oasSpecs: Record<string, OpenAPIV3.Document>): void {
+  removeFolder(folderPath);
+  mkdirSync(folderPath, { recursive: true });
+
+  for (const [fileName, oasSpec] of Object.entries(oasSpecs)) {
+    writeFileSync(join(folderPath, `${fileName}.schema.yaml`), dump(oasSpec));
+  }
+}
+
+export function readBundledSpecs(folderPath: string): Record<string, OpenAPIV3.Document> {
+  const bundledSpecs: Record<string, OpenAPIV3.Document> = {};
+
+  for (const fileName of readdirSync(folderPath)) {
+    const yaml = readFileSync(join(folderPath, fileName), { encoding: 'utf8' });
+
+    bundledSpecs[fileName] = load(yaml);
+  }
+
+  return bundledSpecs;
+}
+
+export async function bundleFolder(
+  folderToBundlePath: string,
+  bundledFilePathTemplate: string
+): Promise<void> {
+  await bundle({
+    sourceGlob: join(folderToBundlePath, '*.schema.yaml'),
+    outputFilePath: bundledFilePathTemplate,
+  });
+}
diff --git a/packages/kbn-openapi-bundler/src/__test__/bundle_specs_with_multiple_modifications.test.ts b/packages/kbn-openapi-bundler/src/__test__/bundle_specs_with_multiple_modifications.test.ts
new file mode 100644
index 00000000000000..ed57d745f2ee45
--- /dev/null
+++ b/packages/kbn-openapi-bundler/src/__test__/bundle_specs_with_multiple_modifications.test.ts
@@ -0,0 +1,32 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { readFileSync } from 'fs';
+import { load } from 'js-yaml';
+import { join } from 'path';
+import { bundleFolder, readBundledSpecs } from './bundle_specs';
+
+const ROOT_PATH = join(__dirname, '..', '..');
+
+describe('OpenAPI Bundler - specs with multiple modifications', () => {
+  it('bundles specs performing multiple modifications without interference', async () => {
+    const folderToBundlePath = join(__dirname, 'complex_specs');
+    const outputFolderPath = join(ROOT_PATH, 'target', 'complex_specs_test');
+    const bundledFilePathTemplate = join(outputFolderPath, 'oas-test-bundle-{version}.yaml');
+
+    await bundleFolder(folderToBundlePath, bundledFilePathTemplate);
+
+    const [bundledSpec] = Object.values(readBundledSpecs(outputFolderPath));
+
+    const expected = load(
+      readFileSync(join(folderToBundlePath, 'expected.yaml'), { encoding: 'utf8' })
+    );
+
+    expect(bundledSpec).toEqual(expected);
+  });
+});
diff --git a/packages/kbn-openapi-bundler/src/__test__/circular.test.ts b/packages/kbn-openapi-bundler/src/__test__/circular.test.ts
new file mode 100644
index 00000000000000..0d7715ace78278
--- /dev/null
+++ b/packages/kbn-openapi-bundler/src/__test__/circular.test.ts
@@ -0,0 +1,228 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { dump } from 'js-yaml';
+import { OpenAPIV3 } from 'openapi-types';
+import { bundleSpecs } from './bundle_specs';
+import { createOASDocument } from './create_oas_document';
+
+describe('OpenAPI Bundler - circular specs', () => {
+  it('bundles recursive spec', async () => {
+    const recursiveSchema: OpenAPIV3.SchemaObject = {
+      type: 'object',
+      properties: {
+        fieldA: {
+          type: 'integer',
+        },
+      },
+    };
+    recursiveSchema.properties!.fieldB = recursiveSchema;
+
+    const spec = createOASDocument({
+      paths: {
+        '/api/some_api': {
+          get: {
+            responses: {
+              '200': {
+                description: 'Successful response',
+                content: {
+                  'application/json': {
+                    schema: recursiveSchema,
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+    });
+
+    const [bundledSpec] = Object.values(
+      await bundleSpecs({
+        1: spec,
+      })
+    );
+
+    expect(dump(bundledSpec.paths['/api/some_api']!.get!.responses['200'])).toMatchInlineSnapshot(`
+"content:
+  application/json:
+    schema: &ref_0
+      type: object
+      properties:
+        fieldA:
+          type: integer
+        fieldB: *ref_0
+description: Successful response
+"
+`);
+  });
+
+  it('bundles specs with recursive references', async () => {
+    const spec1 = createOASDocument({
+      paths: {
+        '/api/some_api': {
+          get: {
+            responses: {
+              '200': {
+                description: 'Successful response',
+                content: {
+                  'application/json': {
+                    schema: {
+                      $ref: './common.schema.yaml#/components/schemas/CircularTestSchema',
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+    });
+    const spec2 = createOASDocument({
+      paths: {
+        '/api/some_api': {
+          post: {
+            responses: {
+              '200': {
+                description: 'Successful response',
+                content: {
+                  'application/json': {
+                    schema: {
+                      $ref: './common.schema.yaml#/components/schemas/CircularTestSchema',
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+    });
+    const commonSpec = createOASDocument({
+      info: {
+        version: 'not set',
+      },
+      components: {
+        schemas: {
+          CircularTestSchema: {
+            type: 'object',
+            properties: {
+              field: {
+                $ref: '#/components/schemas/AnotherCircularTestSchema',
+              },
+            },
+          },
+          AnotherCircularTestSchema: {
+            anyOf: [
+              { $ref: '#/components/schemas/CircularTestSchema' },
+              { type: 'string', enum: ['value1', 'value2'] },
+            ],
+          },
+        },
+      },
+    });
+
+    const [bundledSpec] = Object.values(
+      await bundleSpecs({
+        1: spec1,
+        2: spec2,
+        common: commonSpec,
+      })
+    );
+
+    expect(bundledSpec.paths['/api/some_api']).toEqual({
+      get: expect.objectContaining({
+        responses: expect.objectContaining({
+          '200': expect.objectContaining({
+            content: {
+              'application/json': {
+                schema: {
+                  $ref: '#/components/schemas/CircularTestSchema',
+                },
+              },
+            },
+          }),
+        }),
+      }),
+      post: expect.objectContaining({
+        responses: expect.objectContaining({
+          '200': expect.objectContaining({
+            content: {
+              'application/json': {
+                schema: {
+                  $ref: '#/components/schemas/CircularTestSchema',
+                },
+              },
+            },
+          }),
+        }),
+      }),
+    });
+    expect(bundledSpec.components).toMatchObject({ schemas: commonSpec.components!.schemas });
+  });
+
+  it('bundles spec with a self-recursive reference', async () => {
+    const spec = createOASDocument({
+      paths: {
+        '/api/some_api': {
+          get: {
+            responses: {
+              '200': {
+                description: 'Successful response',
+                content: {
+                  'application/json': {
+                    schema: {
+                      $ref: '#/components/schemas/CircularTestSchema',
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+      components: {
+        schemas: {
+          CircularTestSchema: {
+            type: 'object',
+            properties: {
+              field: {
+                $ref: '#/components/schemas/CircularTestSchema',
+              },
+            },
+          },
+        },
+      },
+    });
+
+    const [bundledSpec] = Object.values(
+      await bundleSpecs({
+        1: spec,
+      })
+    );
+
+    expect(bundledSpec.paths['/api/some_api']).toEqual({
+      get: expect.objectContaining({
+        responses: expect.objectContaining({
+          '200': expect.objectContaining({
+            content: {
+              'application/json': {
+                schema: {
+                  $ref: '#/components/schemas/CircularTestSchema',
+                },
+              },
+            },
+          }),
+        }),
+      }),
+    });
+    expect(bundledSpec.components!.schemas!.CircularTestSchema).toEqual(
+      spec.components!.schemas!.CircularTestSchema
+    );
+  });
+});
diff --git a/packages/kbn-openapi-bundler/src/__test__/complex_specs/common.schema.yaml b/packages/kbn-openapi-bundler/src/__test__/complex_specs/common.schema.yaml
new file mode 100644
index 00000000000000..aaa7af54a2fd13
--- /dev/null
+++ b/packages/kbn-openapi-bundler/src/__test__/complex_specs/common.schema.yaml
@@ -0,0 +1,70 @@
+openapi: 3.0.3
+info:
+  title: Test endpoint
+  version: 'no applicable'
+paths: {}
+
+components:
+  schemas:
+    FieldSchemaA:
+      type: object
+      properties:
+        fieldX:
+          type: string
+        fieldY:
+          type: integer
+
+    SchemaA:
+      type: object
+      properties:
+        schemaAField1:
+          type: string
+          enum:
+            - value1
+            - value2
+        schemaAField2:
+          type: integer
+      required:
+        - schemaAField1
+        - schemaAField2
+
+    SchemaB:
+      allOf:
+        - $ref: '#/components/schemas/SharedSchema'
+        - $ref: '#/components/schemas/SchemaA'
+        - type: object
+          properties:
+            schemaBField:
+              type: boolean
+
+    SharedSchema:
+      x-inline: true
+      type: object
+      properties:
+        fieldA:
+          type: string
+        fieldRef:
+          $ref: '#/components/schemas/FieldSchemaA'
+          x-modify: required
+        fieldB:
+          type: boolean
+
+    SharedSchemaWithAllOf:
+      x-inline: true
+      allOf:
+        - type: object
+          properties:
+            sharedSchemaFieldX:
+              type: string
+            sharedSchemaFieldY:
+              type: string
+            commonField:
+              type: string
+          required:
+            - commonField
+        - type: object
+          properties:
+            sharedSchemaField1:
+              type: string
+            sharedSchemaField2:
+              type: string
diff --git a/packages/kbn-openapi-bundler/src/__test__/complex_specs/expected.yaml b/packages/kbn-openapi-bundler/src/__test__/complex_specs/expected.yaml
new file mode 100644
index 00000000000000..9a7660f14070e7
--- /dev/null
+++ b/packages/kbn-openapi-bundler/src/__test__/complex_specs/expected.yaml
@@ -0,0 +1,172 @@
+openapi: 3.0.3
+info:
+  title: Bundled OpenAPI specs
+  version: '2023-10-31'
+servers:
+  - url: 'http://{kibana_host}:{port}'
+    variables:
+      kibana_host:
+        default: localhost
+      port:
+        default: '5601'
+security:
+  - BasicAuth: []
+
+paths:
+  /api/some_api:
+    get:
+      operationId: TestEndpointGet
+      responses:
+        '200':
+          description: Successful response
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  fieldA:
+                    type: string
+                  fieldRef:
+                    type: object
+                    properties:
+                      fieldX:
+                        type: string
+                      fieldY:
+                        type: integer
+                    required:
+                      - fieldX
+                      - fieldY
+                  fieldB:
+                    type: boolean
+    post:
+      operationId: TestEndpointPost
+      responses:
+        '200':
+          description: Successful response
+          content:
+            application/json:
+              schema:
+                anyOf:
+                  - type: object
+                    properties:
+                      localField1:
+                        type: string
+                      localField2:
+                        type: string
+                    required:
+                      - localField1
+                  - type: object
+                    properties:
+                      schemaAField1:
+                        type: string
+                        enum:
+                          - value1
+                          - value2
+                      schemaAField2:
+                        type: integer
+                  - type: object
+                    properties:
+                      fieldA:
+                        type: string
+                      fieldRef:
+                        type: object
+                        properties:
+                          fieldX:
+                            type: string
+                          fieldY:
+                            type: integer
+                        required:
+                          - fieldX
+                          - fieldY
+                      fieldB:
+                        type: boolean
+    put:
+      operationId: TestEndpointPut
+      responses:
+        '200':
+          description: Successful response
+          content:
+            application/json:
+              schema:
+                oneOf:
+                  - $ref: '#/components/schemas/SchemaWithOptionalFields'
+                  - $ref: '#/components/schemas/SchemaB'
+
+components:
+  securitySchemes:
+    BasicAuth:
+      type: http
+      scheme: basic
+  schemas:
+    SchemaWithOptionalFields:
+      type: object
+      properties:
+        fieldA:
+          type: boolean
+        fieldB:
+          type: object
+          properties:
+            fieldA:
+              type: string
+            fieldRef:
+              type: object
+              properties:
+                fieldX:
+                  type: string
+                fieldY:
+                  type: integer
+              required:
+                - fieldX
+                - fieldY
+            fieldB:
+              type: boolean
+        sharedSchemaFieldX:
+          type: string
+        sharedSchemaFieldY:
+          type: string
+        commonField:
+          type: string
+        sharedSchemaField1:
+          type: string
+        sharedSchemaField2:
+          type: string
+        localSchemaFieldA:
+          type: number
+        localSchemaFieldB:
+          type: string
+      required:
+        - commonField
+    SchemaA:
+      type: object
+      properties:
+        schemaAField1:
+          type: string
+          enum:
+            - value1
+            - value2
+        schemaAField2:
+          type: integer
+      required:
+        - schemaAField1
+        - schemaAField2
+    SchemaB:
+      allOf:
+        - type: object
+          properties:
+            fieldA:
+              type: string
+            fieldRef:
+              type: object
+              properties:
+                fieldX:
+                  type: string
+                fieldY:
+                  type: integer
+              required:
+                - fieldX
+                - fieldY
+            fieldB:
+              type: boolean
+            schemaBField:
+              type: boolean
+        - $ref: '#/components/schemas/SchemaA'
diff --git a/packages/kbn-openapi-bundler/src/__test__/spec_with_external_ref/spec.schema.yaml b/packages/kbn-openapi-bundler/src/__test__/complex_specs/spec1.schema.yaml
similarity index 87%
rename from packages/kbn-openapi-bundler/src/__test__/spec_with_external_ref/spec.schema.yaml
rename to packages/kbn-openapi-bundler/src/__test__/complex_specs/spec1.schema.yaml
index b1d910fa5e963b..0d6656fde5b680 100644
--- a/packages/kbn-openapi-bundler/src/__test__/spec_with_external_ref/spec.schema.yaml
+++ b/packages/kbn-openapi-bundler/src/__test__/complex_specs/spec1.schema.yaml
@@ -12,4 +12,5 @@ paths:
           content:
             application/json:
               schema:
-                $ref: './common.schema.yaml#/components/schemas/TestSchema'
+                $ref: './common.schema.yaml#/components/schemas/SharedSchema'
+                x-modify: partial
diff --git a/packages/kbn-openapi-bundler/src/__test__/complex_specs/spec2.schema.yaml b/packages/kbn-openapi-bundler/src/__test__/complex_specs/spec2.schema.yaml
new file mode 100644
index 00000000000000..a79a78f94950d6
--- /dev/null
+++ b/packages/kbn-openapi-bundler/src/__test__/complex_specs/spec2.schema.yaml
@@ -0,0 +1,26 @@
+openapi: 3.0.3
+info:
+  title: Test endpoint
+  version: '2023-10-31'
+paths:
+  /api/some_api:
+    post:
+      operationId: TestEndpointPost
+      responses:
+        '200':
+          description: Successful response
+          content:
+            application/json:
+              schema:
+                anyOf:
+                  - type: object
+                    properties:
+                      localField1:
+                        type: string
+                      localField2:
+                        type: string
+                    required:
+                      - localField1
+                  - $ref: './common.schema.yaml#/components/schemas/SchemaA'
+                    x-modify: partial
+                  - $ref: './common.schema.yaml#/components/schemas/SharedSchema'
diff --git a/packages/kbn-openapi-bundler/src/__test__/complex_specs/spec3.schema.yaml b/packages/kbn-openapi-bundler/src/__test__/complex_specs/spec3.schema.yaml
new file mode 100644
index 00000000000000..d249210fff2d24
--- /dev/null
+++ b/packages/kbn-openapi-bundler/src/__test__/complex_specs/spec3.schema.yaml
@@ -0,0 +1,45 @@
+openapi: 3.0.3
+info:
+  title: Test endpoint
+  version: '2023-10-31'
+paths:
+  /api/some_api:
+    put:
+      x-codegen-enabled: true
+      operationId: TestEndpointPut
+      responses:
+        '200':
+          description: Successful response
+          content:
+            application/json:
+              schema:
+                oneOf:
+                  - $ref: '#/components/schemas/SchemaWithOptionalFields'
+                  - $ref: './common.schema.yaml#/components/schemas/SchemaB'
+
+components:
+  schemas:
+    SchemaWithOptionalFields:
+      allOf:
+        - type: object
+          properties:
+            fieldA:
+              type: boolean
+            fieldB:
+              $ref: './common.schema.yaml#/components/schemas/SharedSchema'
+        - $ref: './common.schema.yaml#/components/schemas/SharedSchemaWithAllOf'
+        - $ref: '#/components/schemas/LocalSchemaWithAllOf'
+          x-inline: true
+
+    LocalSchemaWithAllOf:
+      allOf:
+        - type: object
+          properties:
+            localSchemaFieldA:
+              type: number
+            localSchemaFieldB:
+              type: string
+            commonField:
+              type: string
+          required:
+            - commonField
diff --git a/packages/kbn-openapi-bundler/src/__test__/conflicting_but_equal_refs_in_different_specs/expected.yaml b/packages/kbn-openapi-bundler/src/__test__/conflicting_but_equal_refs_in_different_specs/expected.yaml
deleted file mode 100644
index d8eb6a8b66c681..00000000000000
--- a/packages/kbn-openapi-bundler/src/__test__/conflicting_but_equal_refs_in_different_specs/expected.yaml
+++ /dev/null
@@ -1,40 +0,0 @@
-spec1.schema.yaml:
-  openapi: 3.0.3
-  info:
-    title: Test endpoint
-    version: '2023-10-31'
-  paths:
-    /api/some_api:
-      get:
-        operationId: TestEndpointGet
-        responses:
-          '200':
-            description: Successful response
-            content:
-              application/json:
-                schema:
-                  $ref: './shared_components.schema.yaml#/components/schemas/ConflictTestSchema'
-
-spec2.schema.yaml:
-  openapi: 3.0.3
-  info:
-    title: Another test endpoint
-    version: '2023-10-31'
-  paths:
-    /api/another_api:
-      put:
-        operationId: AnotherTestEndpointPut
-        responses:
-          '200':
-            description: Successful response
-            content:
-              application/json:
-                schema:
-                  $ref: './shared_components.schema.yaml#/components/schemas/ConflictTestSchema'
-
-shared_components.schema.yaml:
-  components:
-    schemas:
-      ConflictTestSchema:
-        type: integer
-        minimum: 1
diff --git a/packages/kbn-openapi-bundler/src/__test__/conflicting_but_equal_refs_in_different_specs/spec1.schema.yaml b/packages/kbn-openapi-bundler/src/__test__/conflicting_but_equal_refs_in_different_specs/spec1.schema.yaml
deleted file mode 100644
index a44cd371ba3267..00000000000000
--- a/packages/kbn-openapi-bundler/src/__test__/conflicting_but_equal_refs_in_different_specs/spec1.schema.yaml
+++ /dev/null
@@ -1,21 +0,0 @@
-openapi: 3.0.3
-info:
-  title: Test endpoint
-  version: '2023-10-31'
-paths:
-  /api/some_api:
-    get:
-      operationId: TestEndpointGet
-      responses:
-        '200':
-          description: Successful response
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ConflictTestSchema'
-
-components:
-  schemas:
-    ConflictTestSchema:
-      type: integer
-      minimum: 1
diff --git a/packages/kbn-openapi-bundler/src/__test__/conflicting_but_equal_refs_in_different_specs/spec2.schema.yaml b/packages/kbn-openapi-bundler/src/__test__/conflicting_but_equal_refs_in_different_specs/spec2.schema.yaml
deleted file mode 100644
index 4a5670f8ae5f59..00000000000000
--- a/packages/kbn-openapi-bundler/src/__test__/conflicting_but_equal_refs_in_different_specs/spec2.schema.yaml
+++ /dev/null
@@ -1,21 +0,0 @@
-openapi: 3.0.3
-info:
-  title: Another test endpoint
-  version: '2023-10-31'
-paths:
-  /api/another_api:
-    put:
-      operationId: AnotherTestEndpointPut
-      responses:
-        '200':
-          description: Successful response
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ConflictTestSchema'
-
-components:
-  schemas:
-    ConflictTestSchema:
-      type: integer
-      minimum: 1
diff --git a/packages/kbn-openapi-bundler/src/__test__/conflicting_refs_in_different_specs/spec1.schema.yaml b/packages/kbn-openapi-bundler/src/__test__/conflicting_refs_in_different_specs/spec1.schema.yaml
deleted file mode 100644
index 765811b78a6197..00000000000000
--- a/packages/kbn-openapi-bundler/src/__test__/conflicting_refs_in_different_specs/spec1.schema.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
-openapi: 3.0.3
-info:
-  title: Test endpoint
-  version: '2023-10-31'
-paths:
-  /api/some_api:
-    get:
-      operationId: TestEndpointGet
-      responses:
-        '200':
-          description: Successful response
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ConflictTestSchema'
-
-components:
-  schemas:
-    ConflictTestSchema:
-      type: string
-      enum:
-        - value1
-        - value2
diff --git a/packages/kbn-openapi-bundler/src/__test__/conflicting_refs_in_different_specs/spec2.schema.yaml b/packages/kbn-openapi-bundler/src/__test__/conflicting_refs_in_different_specs/spec2.schema.yaml
deleted file mode 100644
index 4a5670f8ae5f59..00000000000000
--- a/packages/kbn-openapi-bundler/src/__test__/conflicting_refs_in_different_specs/spec2.schema.yaml
+++ /dev/null
@@ -1,21 +0,0 @@
-openapi: 3.0.3
-info:
-  title: Another test endpoint
-  version: '2023-10-31'
-paths:
-  /api/another_api:
-    put:
-      operationId: AnotherTestEndpointPut
-      responses:
-        '200':
-          description: Successful response
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ConflictTestSchema'
-
-components:
-  schemas:
-    ConflictTestSchema:
-      type: integer
-      minimum: 1
diff --git a/packages/kbn-openapi-bundler/src/__test__/create_oas_document.ts b/packages/kbn-openapi-bundler/src/__test__/create_oas_document.ts
new file mode 100644
index 00000000000000..c91e535e0cf12e
--- /dev/null
+++ b/packages/kbn-openapi-bundler/src/__test__/create_oas_document.ts
@@ -0,0 +1,31 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { OpenAPIV3 } from 'openapi-types';
+
+export function createOASDocument(overrides: {
+  openapi?: string;
+  info?: Partial<OpenAPIV3.InfoObject>;
+  paths?: OpenAPIV3.PathsObject;
+  components?: OpenAPIV3.ComponentsObject;
+}): OpenAPIV3.Document {
+  return {
+    openapi: overrides.openapi ?? '3.0.3',
+    info: {
+      title: 'Test endpoint',
+      version: '2023-10-31',
+      ...overrides.info,
+    },
+    paths: {
+      ...overrides.paths,
+    },
+    components: {
+      ...overrides.components,
+    },
+  };
+}
diff --git a/packages/kbn-openapi-bundler/src/__test__/different_endpoint_versions.test.ts b/packages/kbn-openapi-bundler/src/__test__/different_endpoint_versions.test.ts
new file mode 100644
index 00000000000000..956bd59f25adbb
--- /dev/null
+++ b/packages/kbn-openapi-bundler/src/__test__/different_endpoint_versions.test.ts
@@ -0,0 +1,88 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { bundleSpecs } from './bundle_specs';
+import { createOASDocument } from './create_oas_document';
+
+describe('OpenAPI Bundler - different API versions', () => {
+  it('bundles one endpoint with different versions', async () => {
+    const spec1 = createOASDocument({
+      info: {
+        version: '2023-10-31',
+      },
+      paths: {
+        '/api/some_api': {
+          get: {
+            responses: {
+              '200': {
+                description: 'Successful response',
+                content: {
+                  'application/json': {
+                    schema: {
+                      type: 'object',
+                      properties: {
+                        field1: {
+                          type: 'integer',
+                        },
+                      },
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+    });
+    const spec2 = createOASDocument({
+      info: {
+        version: '2023-11-11',
+      },
+      paths: {
+        '/api/some_api': {
+          put: {
+            responses: {
+              '200': {
+                description: 'Successful response',
+                content: {
+                  'application/json': {
+                    schema: {
+                      type: 'object',
+                      properties: {
+                        field1: {
+                          type: 'integer',
+                        },
+                        field2: {
+                          type: 'string',
+                        },
+                      },
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+    });
+
+    const bundledSpecs = await bundleSpecs({
+      1: spec1,
+      2: spec2,
+    });
+
+    expect(bundledSpecs).toEqual({
+      '2023_10_31.yaml': expect.objectContaining({
+        paths: spec1.paths,
+      }),
+      '2023_11_11.yaml': expect.objectContaining({
+        paths: spec2.paths,
+      }),
+    });
+  });
+});
diff --git a/packages/kbn-openapi-bundler/src/__test__/different_endpoint_versions/expected.yaml b/packages/kbn-openapi-bundler/src/__test__/different_endpoint_versions/expected.yaml
deleted file mode 100644
index 0b916b7b17ac2f..00000000000000
--- a/packages/kbn-openapi-bundler/src/__test__/different_endpoint_versions/expected.yaml
+++ /dev/null
@@ -1,44 +0,0 @@
-version1.schema.yaml:
-  openapi: 3.0.3
-  info:
-    title: Test endpoint GET
-    version: '2023-10-31'
-  paths:
-    /api/some_api:
-      get:
-        operationId: TestEndpointGet
-        responses:
-          '200':
-            description: Successful response
-            content:
-              application/json:
-                schema:
-                  type: object
-                  properties:
-                    field1:
-                      type: integer
-
-version2.schema.yaml:
-  openapi: 3.0.3
-  info:
-    title: Test endpoint GET
-    version: '2023-11-11'
-  paths:
-    /api/some_api:
-      get:
-        operationId: TestEndpointGet
-        responses:
-          '200':
-            description: Successful response
-            content:
-              application/json:
-                schema:
-                  type: object
-                  properties:
-                    field1:
-                      type: integer
-                    field2:
-                      type: string
-
-shared_components.schema.yaml:
-  components: {}
diff --git a/packages/kbn-openapi-bundler/src/__test__/different_endpoint_versions/version1.schema.yaml b/packages/kbn-openapi-bundler/src/__test__/different_endpoint_versions/version1.schema.yaml
deleted file mode 100644
index 5b7f6a8718fcfc..00000000000000
--- a/packages/kbn-openapi-bundler/src/__test__/different_endpoint_versions/version1.schema.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-openapi: 3.0.3
-info:
-  title: Test endpoint GET
-  version: '2023-10-31'
-paths:
-  /api/some_api:
-    get:
-      operationId: TestEndpointGet
-      responses:
-        '200':
-          description: Successful response
-          content:
-            application/json:
-              schema:
-                type: object
-                properties:
-                  field1:
-                    type: integer
diff --git a/packages/kbn-openapi-bundler/src/__test__/different_endpoint_versions/version2.schema.yaml b/packages/kbn-openapi-bundler/src/__test__/different_endpoint_versions/version2.schema.yaml
deleted file mode 100644
index 4492f449ba2fe6..00000000000000
--- a/packages/kbn-openapi-bundler/src/__test__/different_endpoint_versions/version2.schema.yaml
+++ /dev/null
@@ -1,20 +0,0 @@
-openapi: 3.0.3
-info:
-  title: Test endpoint GET
-  version: '2023-11-11'
-paths:
-  /api/some_api:
-    get:
-      operationId: TestEndpointGet
-      responses:
-        '200':
-          description: Successful response
-          content:
-            application/json:
-              schema:
-                type: object
-                properties:
-                  field1:
-                    type: integer
-                  field2:
-                    type: string
diff --git a/packages/kbn-openapi-bundler/src/__test__/different_oas_versions.test.ts b/packages/kbn-openapi-bundler/src/__test__/different_oas_versions.test.ts
new file mode 100644
index 00000000000000..949f4f882ff4eb
--- /dev/null
+++ b/packages/kbn-openapi-bundler/src/__test__/different_oas_versions.test.ts
@@ -0,0 +1,64 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { bundleSpecs } from './bundle_specs';
+import { createOASDocument } from './create_oas_document';
+
+describe('OpenAPI Bundler - different OAS versions', () => {
+  it('DOES NOT bundle specs with different OpenAPI versions', async () => {
+    const spec1 = createOASDocument({
+      openapi: '3.0.3',
+      paths: {
+        '/api/some_api': {
+          get: {
+            responses: {
+              '200': {
+                description: 'Successful response',
+                content: {
+                  'application/json': {
+                    schema: {
+                      type: 'string',
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+    });
+    const spec2 = createOASDocument({
+      openapi: '3.1.0',
+      paths: {
+        '/api/some_api': {
+          put: {
+            responses: {
+              '200': {
+                description: 'Successful response',
+                content: {
+                  'application/json': {
+                    schema: {
+                      type: 'boolean',
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+    });
+
+    await expect(
+      bundleSpecs({
+        1: spec1,
+        2: spec2,
+      })
+    ).rejects.toThrowError(new RegExp('^OpenAPI specs must use the same OpenAPI version'));
+  });
+});
diff --git a/packages/kbn-openapi-bundler/src/__test__/different_openapi_versions/expected.yaml b/packages/kbn-openapi-bundler/src/__test__/different_openapi_versions/expected.yaml
deleted file mode 100644
index 3aa6c7051ebcf6..00000000000000
--- a/packages/kbn-openapi-bundler/src/__test__/different_openapi_versions/expected.yaml
+++ /dev/null
@@ -1,42 +0,0 @@
-spec1.schema.yaml:
-  openapi: 3.0.3
-  info:
-    title: Test endpoint GET
-    version: '2023-10-31'
-  paths:
-    /api/some_api:
-      get:
-        operationId: TestEndpointGet
-        responses:
-          '200':
-            description: Successful response
-            content:
-              application/json:
-                schema:
-                  type: object
-                  properties:
-                    field1:
-                      type: integer
-
-spec2.schema.yaml:
-  openapi: 3.1.0
-  info:
-    title: Test endpoint POST
-    version: '2023-10-31'
-  paths:
-    /api/some_api:
-      post:
-        operationId: TestEndpointPost
-        responses:
-          '200':
-            description: Successful response
-            content:
-              application/json:
-                schema:
-                  type: object
-                  properties:
-                    field2:
-                      type: string
-
-shared_components.schema.yaml:
-  components: {}
diff --git a/packages/kbn-openapi-bundler/src/__test__/different_openapi_versions/spec1.schema.yaml b/packages/kbn-openapi-bundler/src/__test__/different_openapi_versions/spec1.schema.yaml
deleted file mode 100644
index 5b7f6a8718fcfc..00000000000000
--- a/packages/kbn-openapi-bundler/src/__test__/different_openapi_versions/spec1.schema.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-openapi: 3.0.3
-info:
-  title: Test endpoint GET
-  version: '2023-10-31'
-paths:
-  /api/some_api:
-    get:
-      operationId: TestEndpointGet
-      responses:
-        '200':
-          description: Successful response
-          content:
-            application/json:
-              schema:
-                type: object
-                properties:
-                  field1:
-                    type: integer
diff --git a/packages/kbn-openapi-bundler/src/__test__/different_openapi_versions/spec2.schema.yaml b/packages/kbn-openapi-bundler/src/__test__/different_openapi_versions/spec2.schema.yaml
deleted file mode 100644
index e437e40e6698ee..00000000000000
--- a/packages/kbn-openapi-bundler/src/__test__/different_openapi_versions/spec2.schema.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-openapi: 3.1.0
-info:
-  title: Test endpoint POST
-  version: '2023-10-31'
-paths:
-  /api/some_api:
-    post:
-      operationId: TestEndpointPost
-      responses:
-        '200':
-          description: Successful response
-          content:
-            application/json:
-              schema:
-                type: object
-                properties:
-                  field2:
-                    type: string
diff --git a/packages/kbn-openapi-bundler/src/__test__/inline_ref.test.ts b/packages/kbn-openapi-bundler/src/__test__/inline_ref.test.ts
new file mode 100644
index 00000000000000..913afd934de095
--- /dev/null
+++ b/packages/kbn-openapi-bundler/src/__test__/inline_ref.test.ts
@@ -0,0 +1,227 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { bundleSpecs } from './bundle_specs';
+import { createOASDocument } from './create_oas_document';
+
+describe('OpenAPI Bundler - inline references', () => {
+  it('inlines local references', async () => {
+    const spec = createOASDocument({
+      paths: {
+        '/api/some_api': {
+          get: {
+            responses: {
+              '200': {
+                description: 'Successful response',
+                content: {
+                  'application/json': {
+                    schema: {
+                      anyOf: [
+                        { $ref: '#/components/schemas/SchemaToInline' },
+                        { $ref: '#/components/schemas/SchemaNotToInline1' },
+                        { $ref: '#/components/schemas/SchemaNotToInline2' },
+                      ],
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+      components: {
+        schemas: {
+          SchemaToInline: {
+            // @ts-expect-error OpenAPIV3.Document doesn't allow to add custom props to components.schemas
+            'x-inline': true,
+            type: 'object',
+            properties: {
+              field1: {
+                type: 'string',
+                enum: ['value1'],
+              },
+              field2: {
+                type: 'integer',
+                minimum: 1,
+              },
+            },
+          },
+          SchemaNotToInline1: {
+            // @ts-expect-error OpenAPIV3.Document doesn't allow to add custom props to components.schemas
+            'x-inline': false,
+            type: 'object',
+            properties: {
+              field1: {
+                type: 'string',
+                enum: ['value1'],
+              },
+              field2: {
+                type: 'integer',
+                minimum: 1,
+              },
+            },
+          },
+          SchemaNotToInline2: {
+            type: 'object',
+            properties: {
+              field1: {
+                type: 'string',
+                enum: ['value1'],
+              },
+              field2: {
+                type: 'integer',
+                minimum: 1,
+              },
+            },
+          },
+        },
+      },
+    });
+
+    const [bundledSpec] = Object.values(
+      await bundleSpecs({
+        1: spec,
+      })
+    );
+
+    expect(bundledSpec.paths['/api/some_api']!.get!.responses['200']).toMatchObject({
+      content: {
+        'application/json': {
+          schema: {
+            anyOf: expect.arrayContaining([
+              {
+                type: 'object',
+                properties: {
+                  field1: {
+                    type: 'string',
+                    enum: ['value1'],
+                  },
+                  field2: {
+                    type: 'integer',
+                    minimum: 1,
+                  },
+                },
+              },
+            ]),
+          },
+        },
+      },
+    });
+    expect(Object.keys(bundledSpec.components!.schemas!)).toEqual([
+      'SchemaNotToInline1',
+      'SchemaNotToInline2',
+    ]);
+  });
+
+  it('inlines external references', async () => {
+    const spec = createOASDocument({
+      paths: {
+        '/api/some_api': {
+          get: {
+            responses: {
+              '200': {
+                description: 'Successful response',
+                content: {
+                  'application/json': {
+                    schema: {
+                      anyOf: [
+                        { $ref: './common.schema.yaml#/components/schemas/SchemaToInline' },
+                        { $ref: './common.schema.yaml#/components/schemas/SchemaNotToInline1' },
+                        { $ref: './common.schema.yaml#/components/schemas/SchemaNotToInline2' },
+                      ],
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+    });
+    const commonSpec = createOASDocument({
+      components: {
+        schemas: {
+          SchemaToInline: {
+            // @ts-expect-error OpenAPIV3.Document doesn't allow to add custom props to components.schemas
+            'x-inline': true,
+            type: 'object',
+            properties: {
+              field1: {
+                type: 'string',
+                enum: ['value1'],
+              },
+              field2: {
+                type: 'integer',
+                minimum: 1,
+              },
+            },
+          },
+          SchemaNotToInline1: {
+            // @ts-expect-error OpenAPIV3.Document doesn't allow to add custom props to components.schemas
+            'x-inline': false,
+            type: 'object',
+            properties: {
+              field1: {
+                type: 'string',
+                enum: ['value1'],
+              },
+              field2: {
+                type: 'integer',
+                minimum: 1,
+              },
+            },
+          },
+          SchemaNotToInline2: {
+            type: 'object',
+            properties: {
+              field1: {
+                type: 'string',
+                enum: ['value1'],
+              },
+              field2: {
+                type: 'integer',
+                minimum: 1,
+              },
+            },
+          },
+        },
+      },
+    });
+
+    const [bundledSpec] = Object.values(
+      await bundleSpecs({
+        1: spec,
+        common: commonSpec,
+      })
+    );
+
+    expect(bundledSpec.paths['/api/some_api']!.get!.responses['200']).toMatchObject({
+      content: {
+        'application/json': {
+          schema: {
+            anyOf: expect.arrayContaining([
+              {
+                type: 'object',
+                properties: {
+                  field1: {
+                    type: 'string',
+                    enum: ['value1'],
+                  },
+                  field2: {
+                    type: 'integer',
+                    minimum: 1,
+                  },
+                },
+              },
+            ]),
+          },
+        },
+      },
+    });
+  });
+});
diff --git a/packages/kbn-openapi-bundler/src/__test__/inline_ref/expected.yaml b/packages/kbn-openapi-bundler/src/__test__/inline_ref/expected.yaml
deleted file mode 100644
index 270886caa051ed..00000000000000
--- a/packages/kbn-openapi-bundler/src/__test__/inline_ref/expected.yaml
+++ /dev/null
@@ -1,50 +0,0 @@
-spec.schema.yaml:
-  openapi: 3.0.3
-  info:
-    title: Test endpoint GET
-    version: '2023-10-31'
-  paths:
-    /api/some_api:
-      get:
-        operationId: TestEndpointGet
-        responses:
-          '200':
-            description: Successful response
-            content:
-              application/json:
-                schema:
-                  anyOf:
-                    - type: object
-                      properties:
-                        field1:
-                          type: string
-                          enum: [value1]
-                        field2:
-                          type: integer
-                          minimum: 1
-                    - $ref: './shared_components.schema.yaml#/components/schemas/TestSchema2'
-                    - $ref: './shared_components.schema.yaml#/components/schemas/TestSchema3'
-
-shared_components.schema.yaml:
-  components:
-    schemas:
-      TestSchema2:
-        x-inline: false
-        type: object
-        properties:
-          field1:
-            type: string
-            enum: [value1]
-          field2:
-            type: integer
-            minimum: 1
-
-      TestSchema3:
-        type: object
-        properties:
-          field1:
-            type: string
-            enum: [value1]
-          field2:
-            type: integer
-            minimum: 1
diff --git a/packages/kbn-openapi-bundler/src/__test__/inline_ref/spec.schema.yaml b/packages/kbn-openapi-bundler/src/__test__/inline_ref/spec.schema.yaml
deleted file mode 100644
index f5cdb2694a5c80..00000000000000
--- a/packages/kbn-openapi-bundler/src/__test__/inline_ref/spec.schema.yaml
+++ /dev/null
@@ -1,52 +0,0 @@
-openapi: 3.0.3
-info:
-  title: Test endpoint GET
-  version: '2023-10-31'
-paths:
-  /api/some_api:
-    get:
-      operationId: TestEndpointGet
-      responses:
-        '200':
-          description: Successful response
-          content:
-            application/json:
-              schema:
-                anyOf:
-                  - $ref: '#/components/schemas/TestSchema1'
-                  - $ref: '#/components/schemas/TestSchema2'
-                  - $ref: '#/components/schemas/TestSchema3'
-
-components:
-  schemas:
-    TestSchema1:
-      x-inline: true
-      type: object
-      properties:
-        field1:
-          type: string
-          enum: [value1]
-        field2:
-          type: integer
-          minimum: 1
-
-    TestSchema2:
-      x-inline: false
-      type: object
-      properties:
-        field1:
-          type: string
-          enum: [value1]
-        field2:
-          type: integer
-          minimum: 1
-
-    TestSchema3:
-      type: object
-      properties:
-        field1:
-          type: string
-          enum: [value1]
-        field2:
-          type: integer
-          minimum: 1
diff --git a/packages/kbn-openapi-bundler/src/__test__/modify_partial_node/expected.yaml b/packages/kbn-openapi-bundler/src/__test__/modify_partial_node/expected.yaml
deleted file mode 100644
index fa679d0c3f8c0b..00000000000000
--- a/packages/kbn-openapi-bundler/src/__test__/modify_partial_node/expected.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-spec.schema.yaml:
-  openapi: 3.0.3
-  info:
-    title: Test endpoint GET
-    version: '2023-10-31'
-  paths:
-    /api/some_api:
-      get:
-        operationId: TestEndpointGet
-        responses:
-          '200':
-            description: Successful response
-            content:
-              application/json:
-                schema:
-                  type: object
-                  properties:
-                    field1:
-                      type: string
-                      enum: [value1]
-                    field2:
-                      type: integer
-                      minimum: 1
-
-shared_components.schema.yaml:
-  components: {}
diff --git a/packages/kbn-openapi-bundler/src/__test__/modify_partial_node/spec.schema.yaml b/packages/kbn-openapi-bundler/src/__test__/modify_partial_node/spec.schema.yaml
deleted file mode 100644
index 9646051aab9079..00000000000000
--- a/packages/kbn-openapi-bundler/src/__test__/modify_partial_node/spec.schema.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-openapi: 3.0.3
-info:
-  title: Test endpoint GET
-  version: '2023-10-31'
-paths:
-  /api/some_api:
-    get:
-      operationId: TestEndpointGet
-      responses:
-        '200':
-          description: Successful response
-          content:
-            application/json:
-              schema:
-                x-modify: partial
-                type: object
-                properties:
-                  field1:
-                    type: string
-                    enum: [value1]
-                  field2:
-                    type: integer
-                    minimum: 1
-                required:
-                  - field1
-                  - field2
diff --git a/packages/kbn-openapi-bundler/src/__test__/modify_partial_ref/expected.yaml b/packages/kbn-openapi-bundler/src/__test__/modify_partial_ref/expected.yaml
deleted file mode 100644
index fa679d0c3f8c0b..00000000000000
--- a/packages/kbn-openapi-bundler/src/__test__/modify_partial_ref/expected.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-spec.schema.yaml:
-  openapi: 3.0.3
-  info:
-    title: Test endpoint GET
-    version: '2023-10-31'
-  paths:
-    /api/some_api:
-      get:
-        operationId: TestEndpointGet
-        responses:
-          '200':
-            description: Successful response
-            content:
-              application/json:
-                schema:
-                  type: object
-                  properties:
-                    field1:
-                      type: string
-                      enum: [value1]
-                    field2:
-                      type: integer
-                      minimum: 1
-
-shared_components.schema.yaml:
-  components: {}
diff --git a/packages/kbn-openapi-bundler/src/__test__/modify_partial_ref/spec.schema.yaml b/packages/kbn-openapi-bundler/src/__test__/modify_partial_ref/spec.schema.yaml
deleted file mode 100644
index 547bb4cd913beb..00000000000000
--- a/packages/kbn-openapi-bundler/src/__test__/modify_partial_ref/spec.schema.yaml
+++ /dev/null
@@ -1,31 +0,0 @@
-openapi: 3.0.3
-info:
-  title: Test endpoint GET
-  version: '2023-10-31'
-paths:
-  /api/some_api:
-    get:
-      operationId: TestEndpointGet
-      responses:
-        '200':
-          description: Successful response
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/TestSchema'
-                x-modify: partial
-
-components:
-  schemas:
-    TestSchema:
-      type: object
-      properties:
-        field1:
-          type: string
-          enum: [value1]
-        field2:
-          type: integer
-          minimum: 1
-      required:
-        - field1
-        - field2
diff --git a/packages/kbn-openapi-bundler/src/__test__/modify_required_node/expected.yaml b/packages/kbn-openapi-bundler/src/__test__/modify_required_node/expected.yaml
deleted file mode 100644
index 3b075e3cf803bb..00000000000000
--- a/packages/kbn-openapi-bundler/src/__test__/modify_required_node/expected.yaml
+++ /dev/null
@@ -1,29 +0,0 @@
-spec.schema.yaml:
-  openapi: 3.0.3
-  info:
-    title: Test endpoint GET
-    version: '2023-10-31'
-  paths:
-    /api/some_api:
-      get:
-        operationId: TestEndpointGet
-        responses:
-          '200':
-            description: Successful response
-            content:
-              application/json:
-                schema:
-                  type: object
-                  properties:
-                    field1:
-                      type: string
-                      enum: [value1]
-                    field2:
-                      type: integer
-                      minimum: 1
-                  required:
-                    - field1
-                    - field2
-
-shared_components.schema.yaml:
-  components: {}
diff --git a/packages/kbn-openapi-bundler/src/__test__/modify_required_node/spec.schema.yaml b/packages/kbn-openapi-bundler/src/__test__/modify_required_node/spec.schema.yaml
deleted file mode 100644
index 68d478ea8caaa0..00000000000000
--- a/packages/kbn-openapi-bundler/src/__test__/modify_required_node/spec.schema.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
-openapi: 3.0.3
-info:
-  title: Test endpoint GET
-  version: '2023-10-31'
-paths:
-  /api/some_api:
-    get:
-      operationId: TestEndpointGet
-      responses:
-        '200':
-          description: Successful response
-          content:
-            application/json:
-              schema:
-                x-modify: required
-                type: object
-                properties:
-                  field1:
-                    type: string
-                    enum: [value1]
-                  field2:
-                    type: integer
-                    minimum: 1
diff --git a/packages/kbn-openapi-bundler/src/__test__/modify_required_ref/expected.yaml b/packages/kbn-openapi-bundler/src/__test__/modify_required_ref/expected.yaml
deleted file mode 100644
index 3b075e3cf803bb..00000000000000
--- a/packages/kbn-openapi-bundler/src/__test__/modify_required_ref/expected.yaml
+++ /dev/null
@@ -1,29 +0,0 @@
-spec.schema.yaml:
-  openapi: 3.0.3
-  info:
-    title: Test endpoint GET
-    version: '2023-10-31'
-  paths:
-    /api/some_api:
-      get:
-        operationId: TestEndpointGet
-        responses:
-          '200':
-            description: Successful response
-            content:
-              application/json:
-                schema:
-                  type: object
-                  properties:
-                    field1:
-                      type: string
-                      enum: [value1]
-                    field2:
-                      type: integer
-                      minimum: 1
-                  required:
-                    - field1
-                    - field2
-
-shared_components.schema.yaml:
-  components: {}
diff --git a/packages/kbn-openapi-bundler/src/__test__/modify_required_ref/spec.schema.yaml b/packages/kbn-openapi-bundler/src/__test__/modify_required_ref/spec.schema.yaml
deleted file mode 100644
index 0f02e3e905e230..00000000000000
--- a/packages/kbn-openapi-bundler/src/__test__/modify_required_ref/spec.schema.yaml
+++ /dev/null
@@ -1,28 +0,0 @@
-openapi: 3.0.3
-info:
-  title: Test endpoint GET
-  version: '2023-10-31'
-paths:
-  /api/some_api:
-    get:
-      operationId: TestEndpointGet
-      responses:
-        '200':
-          description: Successful response
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/TestSchema'
-                x-modify: required
-
-components:
-  schemas:
-    TestSchema:
-      type: object
-      properties:
-        field1:
-          type: string
-          enum: [value1]
-        field2:
-          type: integer
-          minimum: 1
diff --git a/packages/kbn-openapi-bundler/src/__test__/omit_unused_schemas.test.ts b/packages/kbn-openapi-bundler/src/__test__/omit_unused_schemas.test.ts
new file mode 100644
index 00000000000000..b714ba5ddf8347
--- /dev/null
+++ b/packages/kbn-openapi-bundler/src/__test__/omit_unused_schemas.test.ts
@@ -0,0 +1,144 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { bundleSpecs } from './bundle_specs';
+import { createOASDocument } from './create_oas_document';
+
+describe('OpenAPI Bundler - omit unused schemas', () => {
+  it('omits unused local schema', async () => {
+    const spec = createOASDocument({
+      paths: {
+        '/api/some_api': {
+          get: {
+            responses: {
+              '200': {
+                description: 'Successful response',
+                content: {
+                  'application/json': {
+                    schema: {
+                      type: 'string',
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+      components: {
+        schemas: {
+          TestSchema: {
+            type: 'string',
+            enum: ['value1', 'value2'],
+          },
+        },
+      },
+    });
+
+    const [bundledSpec] = Object.values(
+      await bundleSpecs({
+        1: spec,
+      })
+    );
+
+    expect(bundledSpec.components).not.toMatchObject({ schemas: expect.anything() });
+  });
+
+  it('omits unused external schema', async () => {
+    const spec = createOASDocument({
+      paths: {
+        '/api/some_api': {
+          get: {
+            responses: {
+              '200': {
+                description: 'Successful response',
+                content: {
+                  'application/json': {
+                    schema: {
+                      $ref: './common.schema.yaml#/components/schemas/SchemaA',
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+      components: {
+        schemas: {
+          TestSchema: {
+            type: 'string',
+            enum: ['value1', 'value2'],
+          },
+        },
+      },
+    });
+    const commonSpec = createOASDocument({
+      components: {
+        schemas: {
+          SchemaA: {
+            type: 'number',
+          },
+          SchemaB: {
+            type: 'string',
+          },
+        },
+      },
+    });
+
+    const [bundledSpec] = Object.values(
+      await bundleSpecs({
+        1: spec,
+        common: commonSpec,
+      })
+    );
+
+    expect(bundledSpec.components!.schemas).toEqual({ SchemaA: expect.anything() });
+  });
+
+  it('omits inlined schemas', async () => {
+    const spec = createOASDocument({
+      paths: {
+        '/api/some_api': {
+          get: {
+            responses: {
+              '200': {
+                description: 'Successful response',
+                content: {
+                  'application/json': {
+                    schema: { $ref: './common.schema.yaml#/components/schemas/SchemaToInline' },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+    });
+    const commonSpec = createOASDocument({
+      components: {
+        schemas: {
+          SchemaToInline: {
+            // @ts-expect-error custom prop
+            'x-inline': true,
+            type: 'string',
+          },
+        },
+      },
+    });
+
+    const [bundledSpec] = Object.values(
+      await bundleSpecs({
+        1: spec,
+        common: commonSpec,
+      })
+    );
+
+    expect(bundledSpec.components).not.toMatchObject({ schemas: expect.anything() });
+  });
+});
diff --git a/packages/kbn-openapi-bundler/src/__test__/produce_stable_bundle.test.ts b/packages/kbn-openapi-bundler/src/__test__/produce_stable_bundle.test.ts
new file mode 100644
index 00000000000000..04f85272121f2c
--- /dev/null
+++ b/packages/kbn-openapi-bundler/src/__test__/produce_stable_bundle.test.ts
@@ -0,0 +1,102 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { OpenAPIV3 } from 'openapi-types';
+import { bundleSpecs } from './bundle_specs';
+import { createOASDocument } from './create_oas_document';
+
+describe('OpenAPI Bundler - produce stable bundle', () => {
+  it('produces stable bundle (keys are sorted)', async () => {
+    const response: OpenAPIV3.ResponseObject = {
+      description: 'Successful response',
+      content: {
+        'application/json': {
+          schema: {
+            type: 'object',
+            properties: {
+              fieldA: {
+                $ref: './common.schema.yaml#/components/schemas/SchemaB',
+              },
+              fieldB: {
+                $ref: './common.schema.yaml#/components/schemas/SchemaA',
+              },
+            },
+          },
+        },
+      },
+    };
+
+    const spec1 = createOASDocument({
+      paths: {
+        '/api/some_api': {
+          post: {
+            responses: {
+              '200': response,
+            },
+          },
+          get: {
+            responses: {
+              '200': response,
+            },
+          },
+          put: {
+            responses: {
+              '200': response,
+            },
+          },
+        },
+      },
+    });
+    const spec2 = createOASDocument({
+      paths: {
+        '/api/another_api': {
+          get: {
+            responses: {
+              '200': response,
+            },
+          },
+          put: {
+            responses: {
+              '200': response,
+            },
+          },
+          patch: {
+            responses: {
+              '200': response,
+            },
+          },
+        },
+      },
+    });
+    const commonSpec = createOASDocument({
+      components: {
+        schemas: {
+          SchemaB: {
+            type: 'string',
+          },
+          SchemaA: {
+            type: 'number',
+          },
+        },
+      },
+    });
+
+    const [bundledSpec] = Object.values(
+      await bundleSpecs({
+        1: spec1,
+        2: spec2,
+        common: commonSpec,
+      })
+    );
+
+    expect(Object.keys(bundledSpec.paths)).toEqual(['/api/another_api', '/api/some_api']);
+    expect(Object.keys(bundledSpec.paths['/api/another_api']!)).toEqual(['get', 'patch', 'put']);
+    expect(Object.keys(bundledSpec.paths['/api/some_api']!)).toEqual(['get', 'post', 'put']);
+    expect(Object.keys(bundledSpec.components!.schemas!)).toEqual(['SchemaA', 'SchemaB']);
+  });
+});
diff --git a/packages/kbn-openapi-bundler/src/__test__/recursive_ref_specs/common.schema.yaml b/packages/kbn-openapi-bundler/src/__test__/recursive_ref_specs/common.schema.yaml
deleted file mode 100644
index 6e0ec47b773c51..00000000000000
--- a/packages/kbn-openapi-bundler/src/__test__/recursive_ref_specs/common.schema.yaml
+++ /dev/null
@@ -1,21 +0,0 @@
-openapi: 3.0.3
-info:
-  title: Test endpoint
-  version: '2023-10-31'
-paths: {}
-
-components:
-  schemas:
-    CircularTestSchema:
-      type: string
-      data:
-        items:
-          $ref: '#/components/schemas/AnotherCircularTestSchema'
-
-    AnotherCircularTestSchema:
-      anyof:
-        - $ref: '#/components/schemas/CircularTestSchema'
-        - type: string
-          enum:
-            - value1
-            - value2
diff --git a/packages/kbn-openapi-bundler/src/__test__/recursive_ref_specs/expected.yaml b/packages/kbn-openapi-bundler/src/__test__/recursive_ref_specs/expected.yaml
deleted file mode 100644
index cce50159ca39f7..00000000000000
--- a/packages/kbn-openapi-bundler/src/__test__/recursive_ref_specs/expected.yaml
+++ /dev/null
@@ -1,50 +0,0 @@
-spec1.schema.yaml:
-  openapi: 3.0.3
-  info:
-    title: Test endpoint GET
-    version: '2023-10-31'
-  paths:
-    /api/some_api:
-      get:
-        operationId: TestEndpointGet
-        responses:
-          '200':
-            description: Successful response
-            content:
-              application/json:
-                schema:
-                  $ref: './shared_components.schema.yaml#/components/schemas/CircularTestSchema'
-
-spec2.schema.yaml:
-  openapi: 3.0.3
-  info:
-    title: Test endpoint POST
-    version: '2023-10-31'
-  paths:
-    /api/some_api:
-      post:
-        operationId: TestEndpointPost
-        responses:
-          '200':
-            description: Successful response
-            content:
-              application/json:
-                schema:
-                  $ref: './shared_components.schema.yaml#/components/schemas/CircularTestSchema'
-
-shared_components.schema.yaml:
-  components:
-    schemas:
-      CircularTestSchema:
-        type: string
-        data:
-          items:
-            $ref: '#/components/schemas/AnotherCircularTestSchema'
-
-      AnotherCircularTestSchema:
-        anyof:
-          - $ref: '#/components/schemas/CircularTestSchema'
-          - type: string
-            enum:
-              - value1
-              - value2
diff --git a/packages/kbn-openapi-bundler/src/__test__/recursive_ref_specs/spec1.schema.yaml b/packages/kbn-openapi-bundler/src/__test__/recursive_ref_specs/spec1.schema.yaml
deleted file mode 100644
index 2e64f53087f84f..00000000000000
--- a/packages/kbn-openapi-bundler/src/__test__/recursive_ref_specs/spec1.schema.yaml
+++ /dev/null
@@ -1,15 +0,0 @@
-openapi: 3.0.3
-info:
-  title: Test endpoint GET
-  version: '2023-10-31'
-paths:
-  /api/some_api:
-    get:
-      operationId: TestEndpointGet
-      responses:
-        '200':
-          description: Successful response
-          content:
-            application/json:
-              schema:
-                $ref: './common.schema.yaml#/components/schemas/CircularTestSchema'
diff --git a/packages/kbn-openapi-bundler/src/__test__/recursive_ref_specs/spec2.schema.yaml b/packages/kbn-openapi-bundler/src/__test__/recursive_ref_specs/spec2.schema.yaml
deleted file mode 100644
index 92ebc5f4468e50..00000000000000
--- a/packages/kbn-openapi-bundler/src/__test__/recursive_ref_specs/spec2.schema.yaml
+++ /dev/null
@@ -1,15 +0,0 @@
-openapi: 3.0.3
-info:
-  title: Test endpoint POST
-  version: '2023-10-31'
-paths:
-  /api/some_api:
-    post:
-      operationId: TestEndpointPost
-      responses:
-        '200':
-          description: Successful response
-          content:
-            application/json:
-              schema:
-                $ref: './common.schema.yaml#/components/schemas/CircularTestSchema'
diff --git a/packages/kbn-openapi-bundler/src/__test__/recursive_spec/expected.yaml b/packages/kbn-openapi-bundler/src/__test__/recursive_spec/expected.yaml
deleted file mode 100644
index b5bb0cffb6390b..00000000000000
--- a/packages/kbn-openapi-bundler/src/__test__/recursive_spec/expected.yaml
+++ /dev/null
@@ -1,27 +0,0 @@
-spec.schema.yaml:
-  openapi: 3.0.3
-  info:
-    title: Test endpoint
-    version: '2023-10-31'
-  paths:
-    /api/some_api:
-      get:
-        operationId: TestEndpointGet
-        responses:
-          '200':
-            description: Successful response
-            content:
-              application/json:
-                schema: &ref0
-                  type: object
-                  properties:
-                    - name: field1
-                      required: false
-                      schema: *ref0
-                    - field2:
-                      required: false
-                      schema:
-                        type: string
-
-shared_components.schema.yaml:
-  components: {}
diff --git a/packages/kbn-openapi-bundler/src/__test__/recursive_spec/spec.schema.yaml b/packages/kbn-openapi-bundler/src/__test__/recursive_spec/spec.schema.yaml
deleted file mode 100644
index f9e3d8b2c590e1..00000000000000
--- a/packages/kbn-openapi-bundler/src/__test__/recursive_spec/spec.schema.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
-openapi: 3.0.3
-info:
-  title: Test endpoint
-  version: '2023-10-31'
-paths:
-  /api/some_api:
-    get:
-      operationId: TestEndpointGet
-      responses:
-        '200':
-          description: Successful response
-          content:
-            application/json:
-              schema: &ref0
-                type: object
-                properties:
-                  - name: field1
-                    required: false
-                    schema: *ref0
-                  - field2:
-                    required: false
-                    schema:
-                      type: string
diff --git a/packages/kbn-openapi-bundler/src/__test__/reduce_all_of.test.ts b/packages/kbn-openapi-bundler/src/__test__/reduce_all_of.test.ts
new file mode 100644
index 00000000000000..8d79f8d77ea095
--- /dev/null
+++ b/packages/kbn-openapi-bundler/src/__test__/reduce_all_of.test.ts
@@ -0,0 +1,640 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { bundleSpecs } from './bundle_specs';
+import { createOASDocument } from './create_oas_document';
+
+describe('OpenAPI Bundler - reduce allOf item', () => {
+  it('flatten folded allOfs', async () => {
+    const spec = createOASDocument({
+      paths: {
+        '/api/some_api': {
+          get: {
+            responses: {
+              '200': {
+                description: 'Successful response',
+                content: {
+                  'application/json': {
+                    schema: {
+                      allOf: [
+                        {
+                          allOf: [
+                            {
+                              allOf: [
+                                { $ref: '#/components/schemas/SchemaA' },
+                                {
+                                  type: 'object',
+                                  properties: {
+                                    fieldA: { type: 'string' },
+                                  },
+                                  required: ['fieldA'],
+                                },
+                              ],
+                            },
+                          ],
+                        },
+                        { $ref: '#/components/schemas/SchemaB' },
+                      ],
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+      components: {
+        schemas: {
+          SchemaA: {
+            type: 'object',
+            properties: {
+              fieldX: { type: 'string' },
+            },
+          },
+          SchemaB: {
+            type: 'object',
+            properties: {
+              fieldX: { type: 'string' },
+            },
+          },
+        },
+      },
+    });
+
+    const [bundledSpec] = Object.values(
+      await bundleSpecs({
+        1: spec,
+      })
+    );
+
+    expect(bundledSpec.paths['/api/some_api']!.get?.responses['200']).toMatchObject({
+      content: {
+        'application/json': {
+          schema: {
+            allOf: [
+              { $ref: '#/components/schemas/SchemaA' },
+              {
+                type: 'object',
+                properties: {
+                  fieldA: { type: 'string' },
+                },
+                required: ['fieldA'],
+              },
+              { $ref: '#/components/schemas/SchemaB' },
+            ],
+          },
+        },
+      },
+    });
+  });
+
+  it('unfolds single allOf item', async () => {
+    const spec = createOASDocument({
+      paths: {
+        '/api/some_api': {
+          get: {
+            responses: {
+              '200': {
+                description: 'Successful response',
+                content: {
+                  'application/json': {
+                    schema: {
+                      allOf: [
+                        {
+                          type: 'string',
+                        },
+                      ],
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+    });
+
+    const [bundledSpec] = Object.values(
+      await bundleSpecs({
+        1: spec,
+      })
+    );
+
+    expect(bundledSpec.paths['/api/some_api']!.get?.responses['200']).toMatchObject({
+      content: {
+        'application/json': {
+          schema: { type: 'string' },
+        },
+      },
+    });
+  });
+
+  it('merges non conflicting allOf object schema items', async () => {
+    const spec = createOASDocument({
+      paths: {
+        '/api/some_api': {
+          get: {
+            responses: {
+              '200': {
+                description: 'Successful response',
+                content: {
+                  'application/json': {
+                    schema: {
+                      allOf: [
+                        { $ref: '#/components/schemas/SchemaA' },
+                        {
+                          type: 'object',
+                          properties: {
+                            fieldA: {
+                              type: 'string',
+                            },
+                          },
+                        },
+                        { $ref: '#/components/schemas/SchemaB' },
+                        {
+                          type: 'object',
+                          properties: {
+                            fieldB: {
+                              type: 'string',
+                            },
+                          },
+                          required: ['fieldB'],
+                        },
+                        { $ref: '#/components/schemas/SchemaC' },
+                        {
+                          type: 'object',
+                          properties: {
+                            fieldC: {
+                              type: 'string',
+                            },
+                          },
+                          required: ['fieldC'],
+                        },
+                      ],
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+      components: {
+        schemas: {
+          SchemaA: {
+            type: 'object',
+            properties: {
+              fieldX: { type: 'string' },
+            },
+          },
+          SchemaB: {
+            type: 'object',
+            properties: {
+              fieldY: { type: 'string' },
+            },
+          },
+          SchemaC: {
+            type: 'object',
+            properties: {
+              fieldZ: { type: 'string' },
+            },
+          },
+        },
+      },
+    });
+
+    const [bundledSpec] = Object.values(
+      await bundleSpecs({
+        1: spec,
+      })
+    );
+
+    expect(bundledSpec.paths['/api/some_api']!.get?.responses['200']).toMatchObject({
+      content: {
+        'application/json': {
+          schema: {
+            allOf: [
+              {
+                type: 'object',
+                properties: {
+                  fieldA: {
+                    type: 'string',
+                  },
+                  fieldB: {
+                    type: 'string',
+                  },
+                  fieldC: {
+                    type: 'string',
+                  },
+                },
+                required: ['fieldB', 'fieldC'],
+              },
+              { $ref: '#/components/schemas/SchemaA' },
+              { $ref: '#/components/schemas/SchemaB' },
+              { $ref: '#/components/schemas/SchemaC' },
+            ],
+          },
+        },
+      },
+    });
+  });
+
+  it('DOES NOT merge conflicting incompatible allOf object schema items', async () => {
+    const spec = createOASDocument({
+      paths: {
+        '/api/some_api': {
+          get: {
+            responses: {
+              '200': {
+                description: 'Successful response',
+                content: {
+                  'application/json': {
+                    schema: {
+                      allOf: [
+                        {
+                          type: 'object',
+                          properties: {
+                            fieldA: {
+                              type: 'string',
+                            },
+                          },
+                        },
+                        {
+                          type: 'object',
+                          properties: {
+                            fieldB: {
+                              type: 'string',
+                            },
+                          },
+                          required: ['fieldB'],
+                        },
+                        {
+                          type: 'object',
+                          properties: {
+                            fieldA: {
+                              type: 'boolean',
+                            },
+                          },
+                        },
+                      ],
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+    });
+
+    const [bundledSpec] = Object.values(
+      await bundleSpecs({
+        1: spec,
+      })
+    );
+
+    expect(bundledSpec.paths['/api/some_api']!.get?.responses['200']).toMatchObject({
+      content: {
+        'application/json': {
+          schema: {
+            allOf: [
+              {
+                type: 'object',
+                properties: {
+                  fieldA: {
+                    type: 'string',
+                  },
+                },
+              },
+              {
+                type: 'object',
+                properties: {
+                  fieldB: {
+                    type: 'string',
+                  },
+                },
+                required: ['fieldB'],
+              },
+              {
+                type: 'object',
+                properties: {
+                  fieldA: {
+                    type: 'boolean',
+                  },
+                },
+              },
+            ],
+          },
+        },
+      },
+    });
+  });
+
+  it('merges allOf object schema items with inlined references', async () => {
+    const spec = createOASDocument({
+      paths: {
+        '/api/some_api': {
+          get: {
+            responses: {
+              '200': {
+                description: 'Successful response',
+                content: {
+                  'application/json': {
+                    schema: {
+                      allOf: [
+                        {
+                          type: 'string',
+                          enum: ['value1'],
+                        },
+                        {
+                          type: 'object',
+                          properties: {
+                            fieldA: {
+                              type: 'string',
+                            },
+                          },
+                        },
+                        {
+                          $ref: '#/components/schemas/SchemaA',
+                        },
+                        {
+                          type: 'object',
+                          properties: {
+                            fieldB: {
+                              type: 'string',
+                            },
+                          },
+                          required: ['fieldB'],
+                        },
+                        {
+                          $ref: '#/components/schemas/SchemaAToInline',
+                        },
+                        {
+                          $ref: '#/components/schemas/SchemaB',
+                        },
+                        {
+                          type: 'object',
+                          properties: {
+                            stringField: {
+                              type: 'string',
+                            },
+                          },
+                          required: ['stringField'],
+                        },
+                      ],
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+      components: {
+        schemas: {
+          SchemaAToInline: {
+            // @ts-expect-error OpenAPIV3.Document doesn't allow to add custom props to components.schemas
+            'x-inline': true,
+            allOf: [
+              {
+                type: 'string',
+                enum: ['SchemaAToInline-value1'],
+              },
+              {
+                type: 'object',
+                properties: {
+                  enumField: {
+                    type: 'string',
+                    enum: ['SchemaAToInline-value2'],
+                  },
+                  integerField: {
+                    type: 'integer',
+                    minimum: 1,
+                  },
+                },
+              },
+              {
+                $ref: './common.schema.yaml#/components/schemas/SchemaBToInline',
+              },
+            ],
+          },
+          SchemaA: {
+            type: 'object',
+            properties: {
+              fieldX: { type: 'string' },
+            },
+          },
+          SchemaB: {
+            type: 'object',
+            properties: {
+              fieldY: { type: 'string' },
+            },
+          },
+        },
+      },
+    });
+    const commonSpec = createOASDocument({
+      components: {
+        schemas: {
+          SchemaBToInline: {
+            // @ts-expect-error OpenAPIV3.Document doesn't allow to add custom props to components.schemas
+            'x-inline': true,
+            allOf: [
+              {
+                type: 'string',
+                enum: ['SchemaBToInline-value1', 'SchemaBToInline-value2'],
+              },
+              {
+                type: 'object',
+                properties: {
+                  fieldD: {
+                    type: 'string',
+                  },
+                  fieldE: {
+                    type: 'string',
+                  },
+                },
+                required: ['fieldE'],
+              },
+            ],
+          },
+        },
+      },
+    });
+
+    const [bundledSpec] = Object.values(
+      await bundleSpecs({
+        1: spec,
+        common: commonSpec,
+      })
+    );
+
+    expect(bundledSpec.paths['/api/some_api']!.get?.responses['200']).toMatchObject({
+      content: {
+        'application/json': {
+          schema: {
+            allOf: [
+              {
+                type: 'object',
+                properties: {
+                  fieldA: {
+                    type: 'string',
+                  },
+                  fieldB: {
+                    type: 'string',
+                  },
+                  enumField: {
+                    type: 'string',
+                    enum: ['SchemaAToInline-value2'],
+                  },
+                  integerField: {
+                    type: 'integer',
+                    minimum: 1,
+                  },
+                  fieldD: {
+                    type: 'string',
+                  },
+                  fieldE: {
+                    type: 'string',
+                  },
+                  stringField: {
+                    type: 'string',
+                  },
+                },
+                required: ['fieldB', 'fieldE', 'stringField'],
+              },
+              {
+                type: 'string',
+                enum: ['value1'],
+              },
+              {
+                $ref: '#/components/schemas/SchemaA',
+              },
+              {
+                type: 'string',
+                enum: ['SchemaAToInline-value1'],
+              },
+              {
+                type: 'string',
+                enum: ['SchemaBToInline-value1', 'SchemaBToInline-value2'],
+              },
+              {
+                $ref: '#/components/schemas/SchemaB',
+              },
+            ],
+          },
+        },
+      },
+    });
+  });
+
+  it('merges allOf object schema items inlined in different document branches with extra field', async () => {
+    const spec = createOASDocument({
+      paths: {
+        '/api/some_api': {
+          get: {
+            responses: {
+              '200': {
+                description: 'Successful response',
+                content: {
+                  'application/json': {
+                    schema: {
+                      type: 'object',
+                      properties: {
+                        responseSchemaFieldA: {
+                          $ref: '#/components/schemas/SchemaToInline',
+                        },
+                        responseSchemaFieldB: {
+                          $ref: '#/components/schemas/MySchema',
+                        },
+                      },
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+      components: {
+        schemas: {
+          MySchema: {
+            allOf: [
+              {
+                $ref: '#/components/schemas/SchemaToInline',
+              },
+              {
+                type: 'object',
+                properties: {
+                  mySchemaSubfield: {
+                    type: 'boolean',
+                  },
+                },
+              },
+            ],
+          },
+          SchemaToInline: {
+            // @ts-expect-error OpenAPIV3.Document doesn't allow to add custom props to components.schemas
+            'x-inline': true,
+            allOf: [
+              {
+                type: 'object',
+                properties: {
+                  SchemaToInlineField1: {
+                    type: 'string',
+                  },
+                },
+              },
+              {
+                type: 'object',
+                properties: {
+                  SchemaToInlineField2: {
+                    type: 'number',
+                  },
+                },
+                required: ['field2'],
+              },
+            ],
+          },
+        },
+      },
+    });
+    const [bundledSpec] = Object.values(
+      await bundleSpecs({
+        1: spec,
+      })
+    );
+
+    expect(bundledSpec.paths['/api/some_api']!.get?.responses['200']).toMatchObject({
+      content: {
+        'application/json': {
+          schema: {
+            type: 'object',
+            properties: {
+              responseSchemaFieldA: {
+                type: 'object',
+                properties: {
+                  SchemaToInlineField1: {
+                    type: 'string',
+                  },
+                  SchemaToInlineField2: {
+                    type: 'number',
+                  },
+                },
+                required: ['field2'],
+              },
+              responseSchemaFieldB: {
+                $ref: '#/components/schemas/MySchema',
+              },
+            },
+          },
+        },
+      },
+    });
+  });
+});
diff --git a/packages/kbn-openapi-bundler/src/__test__/remove_props.test.ts b/packages/kbn-openapi-bundler/src/__test__/remove_props.test.ts
new file mode 100644
index 00000000000000..d9ab67386f3c22
--- /dev/null
+++ b/packages/kbn-openapi-bundler/src/__test__/remove_props.test.ts
@@ -0,0 +1,210 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { OpenAPIV3 } from 'openapi-types';
+import { bundleSpecs } from './bundle_specs';
+import { createOASDocument } from './create_oas_document';
+
+describe('OpenAPI Bundler - remove custom x- props', () => {
+  it('removes "x-codegen-enabled" property', async () => {
+    const spec1 = createOASDocument({
+      paths: {
+        '/api/some_api': {
+          get: {
+            // @ts-expect-error custom prop
+            'x-codegen-enabled': true,
+            responses: {
+              '200': {
+                description: 'Successful response',
+                content: {
+                  'application/json': {
+                    schema: {
+                      type: 'object',
+                      properties: {
+                        field1: {
+                          type: 'integer',
+                        },
+                      },
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+    });
+    const spec2 = createOASDocument({
+      paths: {
+        '/api/some_api': {
+          post: {
+            // @ts-expect-error custom prop
+            'x-codegen-enabled': false,
+            responses: {
+              '200': {
+                description: 'Successful response',
+                content: {
+                  'application/json': {
+                    schema: {
+                      type: 'object',
+                      properties: {
+                        field2: {
+                          type: 'string',
+                        },
+                      },
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+    });
+    const spec3 = createOASDocument({
+      paths: {
+        '/api/some_api': {
+          put: {
+            // @ts-expect-error custom prop
+            'x-codegen-enabled': undefined,
+            responses: {
+              '200': {
+                description: 'Successful response',
+                content: {
+                  'application/json': {
+                    schema: {
+                      type: 'object',
+                      properties: {
+                        field2: {
+                          type: 'string',
+                        },
+                      },
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+    });
+
+    const [bundledSpec] = Object.values(
+      await bundleSpecs({
+        1: spec1,
+        2: spec2,
+        3: spec3,
+      })
+    );
+
+    expect(bundledSpec.paths['/api/some_api']!.get).not.toMatchObject({
+      'x-codegen-enabled': expect.anything(),
+    });
+    expect(bundledSpec.paths['/api/some_api']!.post).not.toMatchObject({
+      'x-codegen-enabled': expect.anything(),
+    });
+    expect(bundledSpec.paths['/api/some_api']!.put).not.toMatchObject({
+      'x-codegen-enabled': expect.anything(),
+    });
+  });
+
+  it('removes "x-inline" property', async () => {
+    const spec = createOASDocument({
+      paths: {
+        '/api/some_api': {
+          get: {
+            operationId: 'TestEndpointGet',
+            responses: {
+              '200': {
+                description: 'Successful response',
+                content: {
+                  'application/json': {
+                    schema: {
+                      $ref: '#/components/schemas/SchemaToInline',
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+      components: {
+        schemas: {
+          SchemaToInline: {
+            // @ts-expect-error OpenAPIV3.Document doesn't allow to add custom props to components.schemas
+            'x-inline': true,
+            type: 'string',
+          },
+        },
+      },
+    });
+
+    const [bundledSpec] = Object.values(
+      await bundleSpecs({
+        1: spec,
+      })
+    );
+
+    const bundledSchema = (
+      bundledSpec.paths['/api/some_api']!.get?.responses['200'] as OpenAPIV3.ResponseObject
+    ).content!['application/json'].schema;
+
+    expect(bundledSchema).not.toMatchObject({
+      'x-inline': expect.anything(),
+    });
+  });
+
+  it('removes "x-modify" property', async () => {
+    const spec = createOASDocument({
+      paths: {
+        '/api/some_api': {
+          get: {
+            operationId: 'TestEndpointGet',
+            responses: {
+              '200': {
+                description: 'Successful response',
+                content: {
+                  'application/json': {
+                    schema: {
+                      // @ts-expect-error custom prop
+                      'x-modify': 'required',
+                      type: 'object',
+                      properties: {
+                        field1: {
+                          type: 'string',
+                        },
+                        field2: {
+                          type: 'integer',
+                        },
+                      },
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+    });
+
+    const [bundledSpec] = Object.values(
+      await bundleSpecs({
+        1: spec,
+      })
+    );
+
+    const bundledSchema = (
+      bundledSpec.paths['/api/some_api']!.get?.responses['200'] as OpenAPIV3.ResponseObject
+    ).content!['application/json'].schema;
+
+    expect(bundledSchema).not.toMatchObject({
+      'x-modify': expect.anything(),
+    });
+  });
+});
diff --git a/packages/kbn-openapi-bundler/src/__test__/self_recursive_ref/expected.yaml b/packages/kbn-openapi-bundler/src/__test__/self_recursive_ref/expected.yaml
deleted file mode 100644
index 2b75720a069b17..00000000000000
--- a/packages/kbn-openapi-bundler/src/__test__/self_recursive_ref/expected.yaml
+++ /dev/null
@@ -1,24 +0,0 @@
-spec.schema.yaml:
-  openapi: 3.0.3
-  info:
-    title: Test endpoint
-    version: '2023-10-31'
-  paths:
-    /api/some_api:
-      get:
-        operationId: TestEndpointGet
-        responses:
-          '200':
-            description: Successful response
-            content:
-              application/json:
-                schema:
-                  $ref: './shared_components.schema.yaml#/components/schemas/CircularTestSchema'
-
-shared_components.schema.yaml:
-  components:
-    schemas:
-      CircularTestSchema:
-        type: string
-        data:
-          $ref: '#/components/schemas/CircularTestSchema'
diff --git a/packages/kbn-openapi-bundler/src/__test__/self_recursive_ref/spec.schema.yaml b/packages/kbn-openapi-bundler/src/__test__/self_recursive_ref/spec.schema.yaml
deleted file mode 100644
index d90a1178184553..00000000000000
--- a/packages/kbn-openapi-bundler/src/__test__/self_recursive_ref/spec.schema.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-openapi: 3.0.3
-info:
-  title: Test endpoint
-  version: '2023-10-31'
-paths:
-  /api/some_api:
-    get:
-      operationId: TestEndpointGet
-      responses:
-        '200':
-          description: Successful response
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/CircularTestSchema'
-
-components:
-  schemas:
-    CircularTestSchema:
-      type: string
-      data:
-        $ref: '#/components/schemas/CircularTestSchema'
diff --git a/packages/kbn-openapi-bundler/src/__test__/skip_internal/expected.yaml b/packages/kbn-openapi-bundler/src/__test__/skip_internal/expected.yaml
deleted file mode 100644
index d8f6d6cb474bf4..00000000000000
--- a/packages/kbn-openapi-bundler/src/__test__/skip_internal/expected.yaml
+++ /dev/null
@@ -1,31 +0,0 @@
-spec.schema.yaml:
-  openapi: 3.0.3
-  info:
-    title: Test endpoint GET
-    version: '2023-10-31'
-  paths:
-    /api/some_api:
-      get:
-        operationId: TestEndpointGet
-        responses:
-          '200':
-            description: Successful response
-            content:
-              application/json:
-                schema:
-                  anyOf:
-                    - $ref: './shared_components.schema.yaml#/components/schemas/TestSchema1'
-                    - type: object
-
-shared_components.schema.yaml:
-  components:
-    schemas:
-      TestSchema1:
-        type: object
-        properties:
-          field1:
-            type: string
-            enum: [value1]
-          field2:
-            type: integer
-            minimum: 1
diff --git a/packages/kbn-openapi-bundler/src/__test__/skip_internal/spec.schema.yaml b/packages/kbn-openapi-bundler/src/__test__/skip_internal/spec.schema.yaml
deleted file mode 100644
index 1d172978a42402..00000000000000
--- a/packages/kbn-openapi-bundler/src/__test__/skip_internal/spec.schema.yaml
+++ /dev/null
@@ -1,57 +0,0 @@
-openapi: 3.0.3
-info:
-  title: Test endpoint GET
-  version: '2023-10-31'
-paths:
-  /api/some_api:
-    get:
-      operationId: TestEndpointGet
-      responses:
-        '200':
-          description: Successful response
-          content:
-            application/json:
-              schema:
-                anyOf:
-                  - $ref: '#/components/schemas/TestSchema1'
-                  - $ref: '#/components/schemas/TestSchema2'
-                    x-internal: true
-                  - type: object
-                    properties:
-                      x-internal: true
-                      field1:
-                        $ref: '#/components/schemas/TestSchema3'
-
-components:
-  schemas:
-    TestSchema1:
-      # x-internal is not supported here
-      # x-internal: true
-      type: object
-      properties:
-        field1:
-          type: string
-          enum: [value1]
-        field2:
-          type: integer
-          minimum: 1
-
-    TestSchema2:
-      type: object
-      properties:
-        field1:
-          type: string
-          enum: [value1]
-        field2:
-          type: integer
-          minimum: 1
-
-    TestSchema3:
-      type: object
-      properties:
-        field1:
-          type: string
-          enum: [value1]
-        field2:
-          type: integer
-          minimum: 1
diff --git a/packages/kbn-openapi-bundler/src/__test__/skip_internal_endpoint/expected.yaml b/packages/kbn-openapi-bundler/src/__test__/skip_internal_endpoint/expected.yaml
deleted file mode 100644
index 3015eb607287a3..00000000000000
--- a/packages/kbn-openapi-bundler/src/__test__/skip_internal_endpoint/expected.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-spec1.schema.yaml:
-  openapi: 3.0.3
-  info:
-    title: Test endpoint GET
-    version: '2023-10-31'
-  paths:
-    /api/some_api:
-      get:
-        operationId: TestEndpointGet
-        responses:
-          '200':
-            description: Successful response
-            content:
-              application/json:
-                schema:
-                  type: object
-                  properties:
-                    field1:
-                      type: integer
-
-shared_components.schema.yaml:
-  components: {}
diff --git a/packages/kbn-openapi-bundler/src/__test__/skip_internal_endpoint/spec1.schema.yaml b/packages/kbn-openapi-bundler/src/__test__/skip_internal_endpoint/spec1.schema.yaml
deleted file mode 100644
index 5b7f6a8718fcfc..00000000000000
--- a/packages/kbn-openapi-bundler/src/__test__/skip_internal_endpoint/spec1.schema.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-openapi: 3.0.3
-info:
-  title: Test endpoint GET
-  version: '2023-10-31'
-paths:
-  /api/some_api:
-    get:
-      operationId: TestEndpointGet
-      responses:
-        '200':
-          description: Successful response
-          content:
-            application/json:
-              schema:
-                type: object
-                properties:
-                  field1:
-                    type: integer
diff --git a/packages/kbn-openapi-bundler/src/__test__/skip_internal_endpoint/spec2.schema.yaml b/packages/kbn-openapi-bundler/src/__test__/skip_internal_endpoint/spec2.schema.yaml
deleted file mode 100644
index 5a53977b69100a..00000000000000
--- a/packages/kbn-openapi-bundler/src/__test__/skip_internal_endpoint/spec2.schema.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-openapi: 3.0.3
-info:
-  title: Test endpoint POST
-  version: '2023-10-31'
-paths:
-  /internal/some_api:
-    post:
-      operationId: TestEndpointPost
-      responses:
-        '200':
-          description: Successful response
-          content:
-            application/json:
-              schema:
-                type: object
-                properties:
-                  field2:
-                    type: string
diff --git a/packages/kbn-openapi-bundler/src/__test__/skip_nodes.test.ts b/packages/kbn-openapi-bundler/src/__test__/skip_nodes.test.ts
new file mode 100644
index 00000000000000..35b1de2b3a0bc6
--- /dev/null
+++ b/packages/kbn-openapi-bundler/src/__test__/skip_nodes.test.ts
@@ -0,0 +1,168 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { bundleSpecs } from './bundle_specs';
+import { createOASDocument } from './create_oas_document';
+
+describe('OpenAPI Bundler - skip nodes like internal endpoints', () => {
+  it('skips nodes with x-internal property', async () => {
+    const spec = createOASDocument({
+      paths: {
+        '/api/some_api': {
+          get: {
+            responses: {
+              '200': {
+                description: 'Successful response',
+                content: {
+                  'application/json': {
+                    schema: {
+                      anyOf: [
+                        {
+                          $ref: '#/components/schemas/TestSchema1',
+                        },
+                        {
+                          $ref: '#/components/schemas/TestSchema2',
+                          // @ts-expect-error custom prop
+                          'x-internal': true,
+                        },
+                        {
+                          type: 'object',
+                          properties: {
+                            field1: {
+                              type: 'string',
+                            },
+                            internalField: {
+                              'x-internal': true,
+                              type: 'string',
+                            },
+                          },
+                        },
+                      ],
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+      components: {
+        schemas: {
+          TestSchema1: {
+            type: 'object',
+            properties: {
+              field1: {
+                type: 'string',
+                enum: ['value1'],
+              },
+              field2: {
+                type: 'integer',
+                minimum: 1,
+              },
+            },
+          },
+          TestSchema2: {
+            type: 'string',
+          },
+        },
+      },
+    });
+
+    const [bundledSpec] = Object.values(
+      await bundleSpecs({
+        1: spec,
+      })
+    );
+
+    expect(bundledSpec.paths['/api/some_api']!.get!.responses['200']).toMatchObject({
+      content: {
+        'application/json': {
+          schema: {
+            anyOf: [
+              {
+                $ref: '#/components/schemas/TestSchema1',
+              },
+              {
+                type: 'object',
+                properties: {
+                  field1: {
+                    type: 'string',
+                  },
+                },
+              },
+            ],
+          },
+        },
+      },
+    });
+  });
+
+  it('skips endpoints starting with /internal', async () => {
+    const spec1 = createOASDocument({
+      paths: {
+        '/api/some_api': {
+          get: {
+            operationId: 'TestEndpointGet',
+            responses: {
+              '200': {
+                description: 'Successful response',
+                content: {
+                  'application/json': {
+                    schema: {
+                      type: 'object',
+                      properties: {
+                        field1: {
+                          type: 'integer',
+                        },
+                      },
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+    });
+    const spec2 = createOASDocument({
+      paths: {
+        '/internal/some_api': {
+          post: {
+            operationId: 'TestEndpointPost',
+            responses: {
+              '200': {
+                description: 'Successful response',
+                content: {
+                  'application/json': {
+                    schema: {
+                      type: 'object',
+                      properties: {
+                        field2: {
+                          type: 'string',
+                        },
+                      },
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+    });
+
+    const [bundledSpec] = Object.values(
+      await bundleSpecs({
+        1: spec1,
+        2: spec2,
+      })
+    );
+
+    expect(Object.keys(bundledSpec.paths)).not.toContain('/internal/some_api');
+  });
+});
diff --git a/packages/kbn-openapi-bundler/src/__test__/spec_with_external_ref/common.schema.yaml b/packages/kbn-openapi-bundler/src/__test__/spec_with_external_ref/common.schema.yaml
deleted file mode 100644
index b710c4e8b114b8..00000000000000
--- a/packages/kbn-openapi-bundler/src/__test__/spec_with_external_ref/common.schema.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-openapi: 3.0.3
-info:
-  title: Test endpoint
-  version: '2023-10-31'
-paths: {}
-
-components:
-  schemas:
-    TestSchema:
-      type: string
-      enum:
-        - value1
-        - value2
diff --git a/packages/kbn-openapi-bundler/src/__test__/spec_with_external_ref/expected.yaml b/packages/kbn-openapi-bundler/src/__test__/spec_with_external_ref/expected.yaml
deleted file mode 100644
index 48c9045d62ce5f..00000000000000
--- a/packages/kbn-openapi-bundler/src/__test__/spec_with_external_ref/expected.yaml
+++ /dev/null
@@ -1,25 +0,0 @@
-spec.schema.yaml:
-  openapi: 3.0.3
-  info:
-    title: Test endpoint
-    version: '2023-10-31'
-  paths:
-    /api/some_api:
-      get:
-        operationId: TestEndpointGet
-        responses:
-          '200':
-            description: Successful response
-            content:
-              application/json:
-                schema:
-                  $ref: './shared_components.schema.yaml#/components/schemas/TestSchema'
-
-shared_components.schema.yaml:
-  components:
-    schemas:
-      TestSchema:
-        type: string
-        enum:
-          - value1
-          - value2
diff --git a/packages/kbn-openapi-bundler/src/__test__/spec_with_local_ref/expected.yaml b/packages/kbn-openapi-bundler/src/__test__/spec_with_local_ref/expected.yaml
deleted file mode 100644
index 48c9045d62ce5f..00000000000000
--- a/packages/kbn-openapi-bundler/src/__test__/spec_with_local_ref/expected.yaml
+++ /dev/null
@@ -1,25 +0,0 @@
-spec.schema.yaml:
-  openapi: 3.0.3
-  info:
-    title: Test endpoint
-    version: '2023-10-31'
-  paths:
-    /api/some_api:
-      get:
-        operationId: TestEndpointGet
-        responses:
-          '200':
-            description: Successful response
-            content:
-              application/json:
-                schema:
-                  $ref: './shared_components.schema.yaml#/components/schemas/TestSchema'
-
-shared_components.schema.yaml:
-  components:
-    schemas:
-      TestSchema:
-        type: string
-        enum:
-          - value1
-          - value2
diff --git a/packages/kbn-openapi-bundler/src/__test__/spec_with_local_ref/spec.schema.yaml b/packages/kbn-openapi-bundler/src/__test__/spec_with_local_ref/spec.schema.yaml
deleted file mode 100644
index 2339d5eb7aa59f..00000000000000
--- a/packages/kbn-openapi-bundler/src/__test__/spec_with_local_ref/spec.schema.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
-openapi: 3.0.3
-info:
-  title: Test endpoint
-  version: '2023-10-31'
-paths:
-  /api/some_api:
-    get:
-      operationId: TestEndpointGet
-      responses:
-        '200':
-          description: Successful response
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/TestSchema'
-
-components:
-  schemas:
-    TestSchema:
-      type: string
-      enum:
-        - value1
-        - value2
diff --git a/packages/kbn-openapi-bundler/src/__test__/two_simple_specs/expected.yaml b/packages/kbn-openapi-bundler/src/__test__/two_simple_specs/expected.yaml
deleted file mode 100644
index dbe9fdb445e86d..00000000000000
--- a/packages/kbn-openapi-bundler/src/__test__/two_simple_specs/expected.yaml
+++ /dev/null
@@ -1,42 +0,0 @@
-spec1.schema.yaml:
-  openapi: 3.0.3
-  info:
-    title: Test endpoint GET
-    version: '2023-10-31'
-  paths:
-    /api/some_api:
-      get:
-        operationId: TestEndpointGet
-        responses:
-          '200':
-            description: Successful response
-            content:
-              application/json:
-                schema:
-                  type: object
-                  properties:
-                    field1:
-                      type: integer
-
-spec2.schema.yaml:
-  openapi: 3.0.3
-  info:
-    title: Test endpoint POST
-    version: '2023-10-31'
-  paths:
-    /api/some_api:
-      post:
-        operationId: TestEndpointPost
-        responses:
-          '200':
-            description: Successful response
-            content:
-              application/json:
-                schema:
-                  type: object
-                  properties:
-                    field2:
-                      type: string
-
-shared_components.schema.yaml:
-  components: {}
diff --git a/packages/kbn-openapi-bundler/src/__test__/two_simple_specs/spec1.schema.yaml b/packages/kbn-openapi-bundler/src/__test__/two_simple_specs/spec1.schema.yaml
deleted file mode 100644
index 5b7f6a8718fcfc..00000000000000
--- a/packages/kbn-openapi-bundler/src/__test__/two_simple_specs/spec1.schema.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-openapi: 3.0.3
-info:
-  title: Test endpoint GET
-  version: '2023-10-31'
-paths:
-  /api/some_api:
-    get:
-      operationId: TestEndpointGet
-      responses:
-        '200':
-          description: Successful response
-          content:
-            application/json:
-              schema:
-                type: object
-                properties:
-                  field1:
-                    type: integer
diff --git a/packages/kbn-openapi-bundler/src/__test__/two_simple_specs/spec2.schema.yaml b/packages/kbn-openapi-bundler/src/__test__/two_simple_specs/spec2.schema.yaml
deleted file mode 100644
index c3ba67e0b46eaf..00000000000000
--- a/packages/kbn-openapi-bundler/src/__test__/two_simple_specs/spec2.schema.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-openapi: 3.0.3
-info:
-  title: Test endpoint POST
-  version: '2023-10-31'
-paths:
-  /api/some_api:
-    post:
-      operationId: TestEndpointPost
-      responses:
-        '200':
-          description: Successful response
-          content:
-            application/json:
-              schema:
-                type: object
-                properties:
-                  field2:
-                    type: string
diff --git a/packages/kbn-openapi-bundler/src/__test__/two_specs_with_external_ref/common.schema.yaml b/packages/kbn-openapi-bundler/src/__test__/two_specs_with_external_ref/common.schema.yaml
deleted file mode 100644
index b710c4e8b114b8..00000000000000
--- a/packages/kbn-openapi-bundler/src/__test__/two_specs_with_external_ref/common.schema.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-openapi: 3.0.3
-info:
-  title: Test endpoint
-  version: '2023-10-31'
-paths: {}
-
-components:
-  schemas:
-    TestSchema:
-      type: string
-      enum:
-        - value1
-        - value2
diff --git a/packages/kbn-openapi-bundler/src/__test__/two_specs_with_external_ref/expected.yaml b/packages/kbn-openapi-bundler/src/__test__/two_specs_with_external_ref/expected.yaml
deleted file mode 100644
index d3040ae511b2cc..00000000000000
--- a/packages/kbn-openapi-bundler/src/__test__/two_specs_with_external_ref/expected.yaml
+++ /dev/null
@@ -1,42 +0,0 @@
-spec1.schema.yaml:
-  openapi: 3.0.3
-  info:
-    title: Test endpoint GET
-    version: '2023-10-31'
-  paths:
-    /api/some_api:
-      get:
-        operationId: TestEndpointGet
-        responses:
-          '200':
-            description: Successful response
-            content:
-              application/json:
-                schema:
-                  $ref: './shared_components.schema.yaml#/components/schemas/TestSchema'
-
-spec2.schema.yaml:
-  openapi: 3.0.3
-  info:
-    title: Test endpoint POST
-    version: '2023-10-31'
-  paths:
-    /api/some_api:
-      post:
-        operationId: TestEndpointPost
-        responses:
-          '200':
-            description: Successful response
-            content:
-              application/json:
-                schema:
-                  $ref: './shared_components.schema.yaml#/components/schemas/TestSchema'
-
-shared_components.schema.yaml:
-  components:
-    schemas:
-      TestSchema:
-        type: string
-        enum:
-          - value1
-          - value2
diff --git a/packages/kbn-openapi-bundler/src/__test__/two_specs_with_external_ref/spec1.schema.yaml b/packages/kbn-openapi-bundler/src/__test__/two_specs_with_external_ref/spec1.schema.yaml
deleted file mode 100644
index c08570d69311cf..00000000000000
--- a/packages/kbn-openapi-bundler/src/__test__/two_specs_with_external_ref/spec1.schema.yaml
+++ /dev/null
@@ -1,15 +0,0 @@
-openapi: 3.0.3
-info:
-  title: Test endpoint GET
-  version: '2023-10-31'
-paths:
-  /api/some_api:
-    get:
-      operationId: TestEndpointGet
-      responses:
-        '200':
-          description: Successful response
-          content:
-            application/json:
-              schema:
-                $ref: './common.schema.yaml#/components/schemas/TestSchema'
diff --git a/packages/kbn-openapi-bundler/src/__test__/two_specs_with_external_ref/spec2.schema.yaml b/packages/kbn-openapi-bundler/src/__test__/two_specs_with_external_ref/spec2.schema.yaml
deleted file mode 100644
index 9dec5566875bb8..00000000000000
--- a/packages/kbn-openapi-bundler/src/__test__/two_specs_with_external_ref/spec2.schema.yaml
+++ /dev/null
@@ -1,15 +0,0 @@
-openapi: 3.0.3
-info:
-  title: Test endpoint POST
-  version: '2023-10-31'
-paths:
-  /api/some_api:
-    post:
-      operationId: TestEndpointPost
-      responses:
-        '200':
-          description: Successful response
-          content:
-            application/json:
-              schema:
-                $ref: './common.schema.yaml#/components/schemas/TestSchema'
diff --git a/packages/kbn-openapi-bundler/src/__test__/x_modify.test.ts b/packages/kbn-openapi-bundler/src/__test__/x_modify.test.ts
new file mode 100644
index 00000000000000..cdc53e83693457
--- /dev/null
+++ b/packages/kbn-openapi-bundler/src/__test__/x_modify.test.ts
@@ -0,0 +1,340 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { bundleSpecs } from './bundle_specs';
+import { createOASDocument } from './create_oas_document';
+
+describe('OpenAPI Bundler - x-modify', () => {
+  it('inlines references with x-modify property', async () => {
+    const spec = createOASDocument({
+      paths: {
+        '/api/some_api': {
+          get: {
+            responses: {
+              '200': {
+                description: 'Successful response',
+                content: {
+                  'application/json': {
+                    schema: {
+                      anyOf: [
+                        {
+                          $ref: '#/components/schemas/SchemaWithRequiredFields',
+                          // @ts-expect-error custom prop
+                          'x-modify': 'partial',
+                        },
+                        {
+                          $ref: '#/components/schemas/SchemaWithOptionalFields',
+                          'x-modify': 'required',
+                        },
+                      ],
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+      components: {
+        schemas: {
+          SchemaWithRequiredFields: {
+            type: 'object',
+            properties: {
+              fieldA: {
+                type: 'string',
+                enum: ['value1'],
+              },
+              fieldB: {
+                type: 'integer',
+                minimum: 1,
+              },
+            },
+            required: ['fieldA', 'fieldB'],
+          },
+          SchemaWithOptionalFields: {
+            type: 'object',
+            properties: {
+              fieldC: {
+                type: 'string',
+                enum: ['value1'],
+              },
+              fieldD: {
+                type: 'integer',
+                minimum: 1,
+              },
+            },
+          },
+        },
+      },
+    });
+
+    const [bundledSpec] = Object.values(
+      await bundleSpecs({
+        1: spec,
+      })
+    );
+
+    expect(bundledSpec.paths['/api/some_api']!.get!.responses['200']).toMatchObject({
+      content: {
+        'application/json': {
+          schema: {
+            anyOf: [
+              {
+                type: 'object',
+                properties: {
+                  fieldA: {
+                    type: 'string',
+                    enum: ['value1'],
+                  },
+                  fieldB: {
+                    type: 'integer',
+                    minimum: 1,
+                  },
+                },
+              },
+              {
+                type: 'object',
+                properties: {
+                  fieldC: {
+                    type: 'string',
+                    enum: ['value1'],
+                  },
+                  fieldD: {
+                    type: 'integer',
+                    minimum: 1,
+                  },
+                },
+                required: ['fieldC', 'fieldD'],
+              },
+            ],
+          },
+        },
+      },
+    });
+  });
+
+  it('makes properties in an object schema node partial', async () => {
+    const spec = createOASDocument({
+      paths: {
+        '/api/some_api': {
+          get: {
+            responses: {
+              '200': {
+                description: 'Successful response',
+                content: {
+                  'application/json': {
+                    schema: {
+                      // @ts-expect-error custom prop
+                      'x-modify': 'partial',
+                      type: 'object',
+                      properties: {
+                        fieldA: {
+                          type: 'string',
+                          enum: ['value1'],
+                        },
+                        fieldB: {
+                          type: 'integer',
+                          minimum: 1,
+                        },
+                      },
+                      required: ['fieldA', 'fieldB'],
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+    });
+
+    const [bundledSpec] = Object.values(
+      await bundleSpecs({
+        1: spec,
+      })
+    );
+
+    expect(bundledSpec.paths['/api/some_api']!.get!.responses['200']).toMatchObject({
+      content: {
+        'application/json': {
+          schema: expect.not.objectContaining({
+            required: expect.anything(),
+          }),
+        },
+      },
+    });
+  });
+
+  it('makes properties in a referenced object schema node partial', async () => {
+    const spec = createOASDocument({
+      paths: {
+        '/api/some_api': {
+          get: {
+            responses: {
+              '200': {
+                description: 'Successful response',
+                content: {
+                  'application/json': {
+                    schema: {
+                      $ref: '#/components/schemas/TestSchema',
+                      // @ts-expect-error custom prop
+                      'x-modify': 'partial',
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+      components: {
+        schemas: {
+          TestSchema: {
+            type: 'object',
+            properties: {
+              fieldA: {
+                type: 'string',
+                enum: ['value1'],
+              },
+              fieldB: {
+                type: 'integer',
+                minimum: 1,
+              },
+            },
+            required: ['fieldA', 'fieldB'],
+          },
+        },
+      },
+    });
+
+    const [bundledSpec] = Object.values(
+      await bundleSpecs({
+        1: spec,
+      })
+    );
+
+    expect(bundledSpec.paths['/api/some_api']!.get!.responses['200']).toMatchObject({
+      content: {
+        'application/json': {
+          schema: expect.not.objectContaining({
+            required: expect.anything(),
+          }),
+        },
+      },
+    });
+  });
+
+  it('makes properties in an object schema node required', async () => {
+    const spec = createOASDocument({
+      paths: {
+        '/api/some_api': {
+          get: {
+            responses: {
+              '200': {
+                description: 'Successful response',
+                content: {
+                  'application/json': {
+                    schema: {
+                      // @ts-expect-error custom prop
+                      'x-modify': 'required',
+                      type: 'object',
+                      properties: {
+                        fieldA: {
+                          type: 'string',
+                          enum: ['value1'],
+                        },
+                        fieldB: {
+                          type: 'integer',
+                          minimum: 1,
+                        },
+                      },
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+    });
+
+    const [bundledSpec] = Object.values(
+      await bundleSpecs({
+        1: spec,
+      })
+    );
+
+    expect(bundledSpec.paths['/api/some_api']!.get!.responses['200']).toMatchObject({
+      content: {
+        'application/json': {
+          schema: expect.objectContaining({
+            required: ['fieldA', 'fieldB'],
+          }),
+        },
+      },
+    });
+  });
+
+  it('makes properties in a referenced object schema node required', async () => {
+    const spec = createOASDocument({
+      paths: {
+        '/api/some_api': {
+          get: {
+            responses: {
+              '200': {
+                description: 'Successful response',
+                content: {
+                  'application/json': {
+                    schema: {
+                      $ref: '#/components/schemas/TestSchema',
+                      // @ts-expect-error custom prop
+                      'x-modify': 'required',
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+      components: {
+        schemas: {
+          TestSchema: {
+            type: 'object',
+            properties: {
+              fieldA: {
+                type: 'string',
+                enum: ['value1'],
+              },
+              fieldB: {
+                type: 'integer',
+                minimum: 1,
+              },
+            },
+          },
+        },
+      },
+    });
+
+    const [bundledSpec] = Object.values(
+      await bundleSpecs({
+        1: spec,
+      })
+    );
+
+    expect(bundledSpec.paths['/api/some_api']!.get!.responses['200']).toMatchObject({
+      content: {
+        'application/json': {
+          schema: expect.objectContaining({
+            required: ['fieldA', 'fieldB'],
+          }),
+        },
+      },
+    });
+  });
+});
diff --git a/packages/kbn-openapi-bundler/src/bundler/bundle_document.ts b/packages/kbn-openapi-bundler/src/bundler/bundle_document.ts
index 1f6884a87f6774..502ede318ca6d0 100644
--- a/packages/kbn-openapi-bundler/src/bundler/bundle_document.ts
+++ b/packages/kbn-openapi-bundler/src/bundler/bundle_document.ts
@@ -19,6 +19,11 @@ import { createModifyRequiredProcessor } from './document_processors/modify_requ
 import { X_CODEGEN_ENABLED, X_INLINE, X_INTERNAL, X_MODIFY } from './known_custom_props';
 import { RemoveUnusedComponentsProcessor } from './document_processors/remove_unused_components';
 import { isPlainObjectType } from '../utils/is_plain_object_type';
+import {
+  createFlattenFoldedAllOfItemsProcessor,
+  createMergeNonConflictingAllOfItemsProcessor,
+  createUnfoldSingleAllOfItemProcessor,
+} from './document_processors/reduce_all_of_items';
 
 export class SkipException extends Error {
   constructor(public documentPath: string, message: string) {
@@ -72,7 +77,10 @@ export async function bundleDocument(absoluteDocumentPath: string): Promise<Bund
     createSkipInternalPathProcessor('/internal'),
     createModifyPartialProcessor(),
     createModifyRequiredProcessor(),
-    createRemovePropsProcessor([X_MODIFY, X_CODEGEN_ENABLED]),
+    createRemovePropsProcessor([X_INLINE, X_MODIFY, X_CODEGEN_ENABLED]),
+    createFlattenFoldedAllOfItemsProcessor(),
+    createMergeNonConflictingAllOfItemsProcessor(),
+    createUnfoldSingleAllOfItemProcessor(),
     bundleRefsProcessor,
     removeUnusedComponentsProcessor,
   ]);
@@ -81,7 +89,7 @@ export async function bundleDocument(absoluteDocumentPath: string): Promise<Bund
     removeUnusedComponentsProcessor.removeUnusedComponents(resolvedDocument.document.components);
   }
 
-  // If document.paths were removed by processors skip the document
+  // If document.paths was removed by processors skip the document
   if (!hasPaths(resolvedDocument.document as MaybeObjectWithPaths)) {
     throw new SkipException(
       resolvedDocument.absolutePath,
@@ -89,7 +97,7 @@ export async function bundleDocument(absoluteDocumentPath: string): Promise<Bund
     );
   }
 
-  return { ...resolvedDocument, bundledRefs: bundleRefsProcessor.getBundledRefs() };
+  return { ...resolvedDocument, bundledRefs: Array.from(bundleRefsProcessor.getBundledRefs()) };
 }
 
 interface MaybeObjectWithPaths {
diff --git a/packages/kbn-openapi-bundler/src/bundler/document_processors/bundle_refs.ts b/packages/kbn-openapi-bundler/src/bundler/document_processors/bundle_refs.ts
index 4064e92a7b806b..976914bcbd3432 100644
--- a/packages/kbn-openapi-bundler/src/bundler/document_processors/bundle_refs.ts
+++ b/packages/kbn-openapi-bundler/src/bundler/document_processors/bundle_refs.ts
@@ -6,39 +6,56 @@
  * Side Public License, v 1.
  */
 
-import { Document, ResolvedRef, TraverseDocumentContext, RefNode } from '../types';
+import deepEqual from 'fast-deep-equal';
+import chalk from 'chalk';
+import {
+  Document,
+  ResolvedRef,
+  TraverseDocumentContext,
+  RefNode,
+  DocumentNode,
+  TraverseRootDocumentContext,
+  DocumentNodeProcessor,
+} from '../types';
 import { hasProp } from '../../utils/has_prop';
 import { isChildContext } from '../is_child_context';
-import { inlineRef } from './utils/inline_ref';
 import { insertRefByPointer } from '../../utils/insert_by_json_pointer';
+import { inlineRef } from './utils/inline_ref';
 
 /**
  * Node processor to bundle and conditionally dereference document references.
  *
  * Bundling means all external references like `../../some_file.schema.yaml#/components/schemas/SomeSchema` saved
  * to the result document under corresponding path `components` -> `schemas` -> `SomeSchema` and `$ref` property's
- * values is updated to `#/components/schemas/SomeSchema`.
+ * values are updated to be local e.g. `#/components/schemas/SomeSchema`.
  *
- * Conditional dereference means inlining references when `inliningPredicate()` returns `true`. If `inliningPredicate`
- * is not passed only bundling happens.
+ * Some references get inlined based on a condition (conditional dereference). It's controlled by inlining
+ * property whose value should be `true`. `inliningPropName` specifies inlining property name e.g. `x-inline`.
+ * Nodes having `x-inline: true` will be inlined.
  */
-export class BundleRefProcessor {
-  private refs: ResolvedRef[] = [];
+export class BundleRefProcessor implements DocumentNodeProcessor {
+  private refs = new Map<string, ResolvedRef>();
+  private nodesToInline = new Set<Readonly<DocumentNode>>();
 
   constructor(private inliningPropName: string) {}
 
-  ref(node: RefNode, resolvedRef: ResolvedRef, context: TraverseDocumentContext): void {
-    if (!resolvedRef.pointer.startsWith('/components/schemas')) {
-      throw new Error(`$ref pointer must start with "/components/schemas"`);
+  onNodeEnter(node: Readonly<DocumentNode>): void {
+    if (hasProp(node, this.inliningPropName, true)) {
+      this.nodesToInline.add(node);
     }
+  }
 
-    if (
-      hasProp(node, this.inliningPropName, true) ||
-      hasProp(resolvedRef.refNode, this.inliningPropName, true)
-    ) {
-      inlineRef(node, resolvedRef);
+  onRefNodeLeave(node: RefNode, resolvedRef: ResolvedRef, context: TraverseDocumentContext): void {
+    if (!resolvedRef.pointer.startsWith('/components')) {
+      throw new Error(
+        `$ref pointer ${chalk.yellow(
+          resolvedRef.pointer
+        )} must start with "/components" at ${chalk.bold(resolvedRef.absolutePath)}`
+      );
+    }
 
-      delete node[this.inliningPropName];
+    if (this.nodesToInline.has(node) || this.nodesToInline.has(resolvedRef.refNode)) {
+      inlineRef(node, resolvedRef);
     } else {
       const rootDocument = this.extractRootDocument(context);
 
@@ -46,16 +63,34 @@ export class BundleRefProcessor {
         rootDocument.components = {};
       }
 
+      const ref = this.refs.get(resolvedRef.pointer);
+
+      if (ref && !deepEqual(ref.refNode, resolvedRef.refNode)) {
+        const documentAbsolutePath =
+          this.extractParentContext(context).resolvedDocument.absolutePath;
+
+        throw new Error(
+          `❌  Unable to bundle ${chalk.bold(
+            documentAbsolutePath
+          )} due to conflicts in references. Schema ${chalk.yellow(
+            ref.pointer
+          )} is defined in ${chalk.blue(ref.absolutePath)} and in ${chalk.magenta(
+            resolvedRef.absolutePath
+          )} but has not matching definitions.`
+        );
+      }
+
       node.$ref = this.saveComponent(
         resolvedRef,
         rootDocument.components as Record<string, unknown>
       );
-      this.refs.push(resolvedRef);
+
+      this.refs.set(resolvedRef.pointer, resolvedRef);
     }
   }
 
-  getBundledRefs(): ResolvedRef[] {
-    return this.refs;
+  getBundledRefs(): IterableIterator<ResolvedRef> {
+    return this.refs.values();
   }
 
   private saveComponent(ref: ResolvedRef, components: Record<string, unknown>): string {
@@ -64,11 +99,15 @@ export class BundleRefProcessor {
     return `#${ref.pointer}`;
   }
 
-  private extractRootDocument(context: TraverseDocumentContext): Document {
+  private extractParentContext(context: TraverseDocumentContext): TraverseRootDocumentContext {
     while (isChildContext(context)) {
       context = context.parentContext;
     }
 
-    return context.resolvedDocument.document;
+    return context;
+  }
+
+  private extractRootDocument(context: TraverseDocumentContext): Document {
+    return this.extractParentContext(context).resolvedDocument.document;
   }
 }
diff --git a/packages/kbn-openapi-bundler/src/bundler/document_processors/modify_partial.ts b/packages/kbn-openapi-bundler/src/bundler/document_processors/modify_partial.ts
index 13c876b7579ca6..5d667eff1bc805 100644
--- a/packages/kbn-openapi-bundler/src/bundler/document_processors/modify_partial.ts
+++ b/packages/kbn-openapi-bundler/src/bundler/document_processors/modify_partial.ts
@@ -17,7 +17,7 @@ import { X_MODIFY } from '../known_custom_props';
  */
 export function createModifyPartialProcessor(): DocumentNodeProcessor {
   return {
-    ref(node, resolvedRef) {
+    onRefNodeLeave(node, resolvedRef) {
       if (!hasProp(node, X_MODIFY, 'partial')) {
         return;
       }
@@ -27,7 +27,7 @@ export function createModifyPartialProcessor(): DocumentNodeProcessor {
 
       delete node.required;
     },
-    leave(node) {
+    onNodeLeave(node) {
       if (!hasProp(node, X_MODIFY, 'partial')) {
         return;
       }
diff --git a/packages/kbn-openapi-bundler/src/bundler/document_processors/modify_required.ts b/packages/kbn-openapi-bundler/src/bundler/document_processors/modify_required.ts
index 14a9ac2ea25c68..769672d64a39db 100644
--- a/packages/kbn-openapi-bundler/src/bundler/document_processors/modify_required.ts
+++ b/packages/kbn-openapi-bundler/src/bundler/document_processors/modify_required.ts
@@ -20,7 +20,7 @@ import { inlineRef } from './utils/inline_ref';
  */
 export function createModifyRequiredProcessor(): DocumentNodeProcessor {
   return {
-    ref(node, resolvedRef) {
+    onRefNodeLeave(node, resolvedRef) {
       if (!hasProp(node, X_MODIFY, 'required')) {
         return;
       }
@@ -48,7 +48,7 @@ export function createModifyRequiredProcessor(): DocumentNodeProcessor {
 
       node.required = Object.keys(resolvedRef.refNode.properties);
     },
-    leave(node) {
+    onNodeLeave(node) {
       if (!hasProp(node, X_MODIFY, 'required')) {
         return;
       }
diff --git a/packages/kbn-openapi-bundler/src/bundler/document_processors/reduce_all_of_items/flatten_folded_all_of_items.ts b/packages/kbn-openapi-bundler/src/bundler/document_processors/reduce_all_of_items/flatten_folded_all_of_items.ts
new file mode 100644
index 00000000000000..dcf4b82a42af5d
--- /dev/null
+++ b/packages/kbn-openapi-bundler/src/bundler/document_processors/reduce_all_of_items/flatten_folded_all_of_items.ts
@@ -0,0 +1,61 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { DocumentNodeProcessor } from '../../types';
+
+/**
+ * Creates a node processor to flatten folded `allOf` items. Folded means `allOf` has items
+ * which are another `allOf`s instead of being e.g. object schemas.
+ *
+ * Folded `allOf` schemas is usually a result of inlining references.
+ *
+ * Example:
+ *
+ * The following folded `allOf`s
+ *
+ * ```yaml
+ * allOf:
+ *   - allOf:
+ *     - type: object
+ *       properties:
+ *         fieldA:
+ *           $ref: '#/components/schemas/FieldA'
+ *     - type: object
+ *       properties:
+ *         fieldB:
+ *           type: string
+ * ```
+ *
+ * will be transformed to
+ *
+ * ```yaml
+ * allOf:
+ *   - type: object
+ *     properties:
+ *       fieldA:
+ *         $ref: '#/components/schemas/FieldA'
+ *   - type: object
+ *     properties:
+ *       fieldB:
+ *         type: string
+ * ```
+ *
+ */
+export function createFlattenFoldedAllOfItemsProcessor(): DocumentNodeProcessor {
+  return {
+    onNodeLeave(node) {
+      if (!('allOf' in node) || !Array.isArray(node.allOf)) {
+        return;
+      }
+
+      node.allOf = node.allOf.flatMap((childNode) =>
+        'allOf' in childNode ? childNode.allOf : childNode
+      );
+    },
+  };
+}
diff --git a/packages/kbn-openapi-bundler/src/bundler/document_processors/reduce_all_of_items/index.ts b/packages/kbn-openapi-bundler/src/bundler/document_processors/reduce_all_of_items/index.ts
new file mode 100644
index 00000000000000..acfe16cc95c5e3
--- /dev/null
+++ b/packages/kbn-openapi-bundler/src/bundler/document_processors/reduce_all_of_items/index.ts
@@ -0,0 +1,11 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export * from './flatten_folded_all_of_items';
+export * from './merge_non_conflicting_all_of_items';
+export * from './unfold_single_all_of_item';
diff --git a/packages/kbn-openapi-bundler/src/bundler/document_processors/reduce_all_of_items/merge_non_conflicting_all_of_items.ts b/packages/kbn-openapi-bundler/src/bundler/document_processors/reduce_all_of_items/merge_non_conflicting_all_of_items.ts
new file mode 100644
index 00000000000000..87895be952b960
--- /dev/null
+++ b/packages/kbn-openapi-bundler/src/bundler/document_processors/reduce_all_of_items/merge_non_conflicting_all_of_items.ts
@@ -0,0 +1,149 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { omit } from 'lodash';
+import deepEqual from 'fast-deep-equal';
+import { OpenAPIV3 } from 'openapi-types';
+import { isPlainObjectType } from '../../../utils/is_plain_object_type';
+import { DocumentNodeProcessor } from '../../types';
+
+type MergedObjectSchema = Required<Pick<OpenAPIV3.SchemaObject, 'type' | 'properties'>> &
+  Pick<OpenAPIV3.SchemaObject, 'required'>;
+
+/**
+ * Creates a node processor to merge object schema definitions when there are no conflicts
+ * between them.
+ *
+ * After inlining references or any other transformations a schema may have `allOf`
+ * with multiple object schema items. Object schema has `properties` field describing object
+ * properties and optional `required` field to say which object properties are not optional.
+ *
+ * Conflicts between object schemas do now allow merge them. The following conflicts may appear
+ *
+ * - Two or more object schemas define the same named object field but definition is different
+ * - Some of object schemas have optional properties like `readOnly`
+ * - Two or more object schemas have conflicting optional properties values
+ *
+ * Example:
+ *
+ * The following `allOf` containing multiple object schemas
+ *
+ * ```yaml
+ * allOf:
+ *   - type: object
+ *     properties:
+ *       fieldA:
+ *         $ref: '#/components/schemas/FieldA'
+ *   - type: object
+ *     properties:
+ *       fieldB:
+ *         type: string
+ * ```
+ *
+ * will be transformed to
+ *
+ * ```yaml
+ * allOf:
+ *   - type: object
+ *     properties:
+ *       fieldA:
+ *         $ref: '#/components/schemas/FieldA'
+ *       fieldB:
+ *         type: string
+ * ```
+ */
+export function createMergeNonConflictingAllOfItemsProcessor(): DocumentNodeProcessor {
+  return {
+    onNodeLeave(allOfNode) {
+      if (
+        !('allOf' in allOfNode) ||
+        !Array.isArray(allOfNode.allOf) ||
+        !canMergeObjectSchemas(allOfNode.allOf)
+      ) {
+        return;
+      }
+
+      const resultItems: [
+        MergedObjectSchema,
+        ...Array<OpenAPIV3.SchemaObject | OpenAPIV3.ReferenceObject>
+      ] = [
+        {
+          type: 'object',
+          properties: {},
+        },
+      ];
+      const mergedRequired = new Set<string>();
+
+      for (const item of allOfNode.allOf) {
+        if (!isObjectNode(item) || !isPlainObjectType(item.properties)) {
+          resultItems.push(item);
+          continue;
+        }
+
+        Object.assign(resultItems[0].properties, item.properties);
+
+        for (const requiredField of item.required ?? []) {
+          mergedRequired.add(requiredField);
+        }
+      }
+
+      if (mergedRequired.size > 0) {
+        resultItems[0].required = Array.from(mergedRequired);
+      }
+
+      allOfNode.allOf = resultItems;
+    },
+  };
+}
+
+/**
+ * Object schemas can be merged when
+ *
+ * - as minimum there are two object schemas
+ * - object schemas DO NOT contain conflicting fields (same name but different definition)
+ * - object schemas DO NOT contain fields besides `type`, `properties` and `required`
+ *
+ */
+function canMergeObjectSchemas(schemas: OpenAPIV3.SchemaObject[]): boolean {
+  const props = new Map<string, OpenAPIV3.SchemaObject | OpenAPIV3.ReferenceObject>();
+  let objectSchemasCounter = 0;
+
+  for (const node of schemas) {
+    if (!isObjectNode(node) || !isPlainObjectType(node.properties)) {
+      continue;
+    }
+
+    if (getObjectSchemaExtraFieldNames(node).size > 0) {
+      return false;
+    }
+
+    const nodePropNames = Object.keys(node.properties);
+
+    for (const nodePropName of nodePropNames) {
+      const propSchema = props.get(nodePropName);
+
+      if (propSchema && !deepEqual(propSchema, node.properties[nodePropName])) {
+        return false;
+      }
+
+      props.set(nodePropName, node.properties[nodePropName]);
+    }
+
+    objectSchemasCounter++;
+  }
+
+  return objectSchemasCounter > 1;
+}
+
+function getObjectSchemaExtraFieldNames(schema: OpenAPIV3.SchemaObject): Set<string> {
+  return new Set(Object.keys(omit(schema, ['type', 'properties', 'required'])));
+}
+
+function isObjectNode(node: unknown): boolean {
+  return isPlainObjectType(node) && node.type === 'object';
+}
diff --git a/packages/kbn-openapi-bundler/src/bundler/document_processors/reduce_all_of_items/unfold_single_all_of_item.ts b/packages/kbn-openapi-bundler/src/bundler/document_processors/reduce_all_of_items/unfold_single_all_of_item.ts
new file mode 100644
index 00000000000000..67a056091db4c6
--- /dev/null
+++ b/packages/kbn-openapi-bundler/src/bundler/document_processors/reduce_all_of_items/unfold_single_all_of_item.ts
@@ -0,0 +1,51 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { DocumentNodeProcessor } from '../../types';
+
+/**
+ * Created a node processor to remove/unfold `allOf` with only single item.
+ *
+ * While a schema can be defined like that the most often reason why `allOf` has
+ * only one item is flattening folded `allOf` items via `flattenFoldedAllOfItems`
+ * node processor.
+ *
+ * Example:
+ *
+ * The following single item `allOf`
+ *
+ * ```yaml
+ * allOf:
+ *   - type: object
+ *     properties:
+ *       fieldA:
+ *         $ref: '#/components/schemas/FieldA'
+ * ```
+ *
+ * will be transformed to
+ *
+ * ```yaml
+ * type: object
+ * properties:
+ *   fieldA:
+ *     $ref: '#/components/schemas/FieldA'
+ * ```
+ *
+ */
+export function createUnfoldSingleAllOfItemProcessor(): DocumentNodeProcessor {
+  return {
+    onNodeLeave(node) {
+      if (!('allOf' in node) || !Array.isArray(node.allOf) || node.allOf.length > 1) {
+        return;
+      }
+
+      Object.assign(node, node.allOf[0]);
+      delete node.allOf;
+    },
+  };
+}
diff --git a/packages/kbn-openapi-bundler/src/bundler/document_processors/remove_props.ts b/packages/kbn-openapi-bundler/src/bundler/document_processors/remove_props.ts
index 616d9db11f55e5..02fb2036e2a0c1 100644
--- a/packages/kbn-openapi-bundler/src/bundler/document_processors/remove_props.ts
+++ b/packages/kbn-openapi-bundler/src/bundler/document_processors/remove_props.ts
@@ -14,13 +14,13 @@ import { DocumentNodeProcessor } from '../types';
  */
 export function createRemovePropsProcessor(propNames: string[]): DocumentNodeProcessor {
   return {
-    leave(node) {
+    onNodeLeave(node) {
       if (!isPlainObjectType(node)) {
         return;
       }
 
       for (const propName of propNames) {
-        if (!node[propName]) {
+        if (!Object.hasOwn(node, propName)) {
           continue;
         }
 
diff --git a/packages/kbn-openapi-bundler/src/bundler/document_processors/remove_unused_components.ts b/packages/kbn-openapi-bundler/src/bundler/document_processors/remove_unused_components.ts
index 1f5053d4667fe4..393f986ec5a1ae 100644
--- a/packages/kbn-openapi-bundler/src/bundler/document_processors/remove_unused_components.ts
+++ b/packages/kbn-openapi-bundler/src/bundler/document_processors/remove_unused_components.ts
@@ -8,7 +8,7 @@
 
 import { hasProp } from '../../utils/has_prop';
 import { isPlainObjectType } from '../../utils/is_plain_object_type';
-import { PlainObjectNode, ResolvedRef } from '../types';
+import { DocumentNodeProcessor, PlainObjectNode, ResolvedRef } from '../types';
 
 /**
  * Helps to remove unused components.
@@ -17,10 +17,10 @@ import { PlainObjectNode, ResolvedRef } from '../types';
  * and then `removeUnusedComponents()` should be invoked after document processing to perform
  * actual unused components deletion.
  */
-export class RemoveUnusedComponentsProcessor {
+export class RemoveUnusedComponentsProcessor implements DocumentNodeProcessor {
   private refs = new Set();
 
-  ref(node: unknown, resolvedRef: ResolvedRef): void {
+  onRefNodeLeave(node: unknown, resolvedRef: ResolvedRef): void {
     // If the reference has been inlined by one of the previous processors skip it
     if (!hasProp(node, '$ref')) {
       return;
diff --git a/packages/kbn-openapi-bundler/src/bundler/document_processors/skip_internal_path.ts b/packages/kbn-openapi-bundler/src/bundler/document_processors/skip_internal_path.ts
index 42769eab7a68ac..280002ce13890e 100644
--- a/packages/kbn-openapi-bundler/src/bundler/document_processors/skip_internal_path.ts
+++ b/packages/kbn-openapi-bundler/src/bundler/document_processors/skip_internal_path.ts
@@ -13,7 +13,7 @@ import { DocumentNodeProcessor } from '../types';
  */
 export function createSkipInternalPathProcessor(skipPathPrefix: string): DocumentNodeProcessor {
   return {
-    enter(_, context) {
+    shouldRemove(_, context) {
       if (typeof context.parentKey === 'number') {
         return false;
       }
diff --git a/packages/kbn-openapi-bundler/src/bundler/document_processors/skip_node_with_internal_prop.ts b/packages/kbn-openapi-bundler/src/bundler/document_processors/skip_node_with_internal_prop.ts
index 4931036bcd1bc4..b674cfb8c0b9c4 100644
--- a/packages/kbn-openapi-bundler/src/bundler/document_processors/skip_node_with_internal_prop.ts
+++ b/packages/kbn-openapi-bundler/src/bundler/document_processors/skip_node_with_internal_prop.ts
@@ -16,6 +16,6 @@ export function createSkipNodeWithInternalPropProcessor(
   skipProperty: string
 ): DocumentNodeProcessor {
   return {
-    enter: (node) => skipProperty in node,
+    shouldRemove: (node) => skipProperty in node,
   };
 }
diff --git a/packages/kbn-openapi-bundler/src/bundler/document_processors/utils/inline_ref.ts b/packages/kbn-openapi-bundler/src/bundler/document_processors/utils/inline_ref.ts
index 3106bf9cbc95d9..fac6c519980b96 100644
--- a/packages/kbn-openapi-bundler/src/bundler/document_processors/utils/inline_ref.ts
+++ b/packages/kbn-openapi-bundler/src/bundler/document_processors/utils/inline_ref.ts
@@ -6,15 +6,11 @@
  * Side Public License, v 1.
  */
 
-import { cloneDeep } from 'lodash';
 import { DocumentNode, ResolvedRef } from '../../types';
 import { InlinableRefNode } from '../types';
 
 export function inlineRef(node: DocumentNode, resolvedRef: ResolvedRef): void {
-  // Make sure unwanted side effects don't happen when child nodes are processed
-  const deepClone = cloneDeep(resolvedRef.refNode);
-
-  Object.assign(node, deepClone);
+  Object.assign(node, resolvedRef.refNode);
 
   delete (node as InlinableRefNode).$ref;
 }
diff --git a/packages/kbn-openapi-bundler/src/bundler/merge_documents.ts b/packages/kbn-openapi-bundler/src/bundler/merge_documents.ts
deleted file mode 100644
index e27253cefc1c98..00000000000000
--- a/packages/kbn-openapi-bundler/src/bundler/merge_documents.ts
+++ /dev/null
@@ -1,142 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import deepEqual from 'fast-deep-equal';
-import { basename, dirname, join } from 'path';
-import chalk from 'chalk';
-import { parseRef } from '../utils/parse_ref';
-import { insertRefByPointer } from '../utils/insert_by_json_pointer';
-import { DocumentNodeProcessor, PlainObjectNode, ResolvedDocument, ResolvedRef } from './types';
-import { BundledDocument } from './bundle_document';
-import { processDocument } from './process_document';
-
-type MergedDocuments = Record<string, ResolvedDocument>;
-
-type MergedResult = Record<string, PlainObjectNode>;
-
-const SHARED_COMPONENTS_FILE_NAME = 'shared_components.schema.yaml';
-
-export async function mergeDocuments(bundledDocuments: BundledDocument[]): Promise<MergedResult> {
-  const mergedDocuments: MergedDocuments = {};
-  const componentsMap = new Map<string, ResolvedRef>();
-
-  for (const bundledDocument of bundledDocuments) {
-    mergeRefsToMap(bundledDocument.bundledRefs, componentsMap);
-
-    delete bundledDocument.document.components;
-
-    await setRefsFileName(bundledDocument, SHARED_COMPONENTS_FILE_NAME);
-    mergeDocument(bundledDocument, mergedDocuments);
-  }
-
-  const result: MergedResult = {};
-
-  for (const fileName of Object.keys(mergedDocuments)) {
-    result[fileName] = mergedDocuments[fileName].document;
-  }
-
-  result[SHARED_COMPONENTS_FILE_NAME] = {
-    components: componentsMapToComponents(componentsMap),
-  };
-
-  return result;
-}
-
-function mergeDocument(resolvedDocument: ResolvedDocument, mergeResult: MergedDocuments): void {
-  const fileName = basename(resolvedDocument.absolutePath);
-
-  if (!mergeResult[fileName]) {
-    mergeResult[fileName] = resolvedDocument;
-    return;
-  }
-
-  const nonConflictFileName = generateNonConflictingFilePath(
-    resolvedDocument.absolutePath,
-    mergeResult
-  );
-
-  mergeResult[nonConflictFileName] = resolvedDocument;
-}
-
-function generateNonConflictingFilePath(
-  documentAbsolutePath: string,
-  mergeResult: MergedDocuments
-): string {
-  let pathToDocument = dirname(documentAbsolutePath);
-  let suggestedName = basename(documentAbsolutePath);
-
-  while (mergeResult[suggestedName]) {
-    suggestedName = `${basename(pathToDocument)}_${suggestedName}`;
-    pathToDocument = join(pathToDocument, '..');
-  }
-
-  return suggestedName;
-}
-
-function mergeRefsToMap(bundledRefs: ResolvedRef[], componentsMap: Map<string, ResolvedRef>): void {
-  for (const bundledRef of bundledRefs) {
-    const existingRef = componentsMap.get(bundledRef.pointer);
-
-    if (!existingRef) {
-      componentsMap.set(bundledRef.pointer, bundledRef);
-      continue;
-    }
-
-    if (deepEqual(existingRef.refNode, bundledRef.refNode)) {
-      continue;
-    }
-
-    throw new Error(
-      `❌ Unable to bundle documents due to conflicts in references. Schema ${chalk.yellow(
-        bundledRef.pointer
-      )} is defined in ${chalk.blue(existingRef.absolutePath)} and in ${chalk.magenta(
-        bundledRef.absolutePath
-      )} but has not matching definitions.`
-    );
-  }
-}
-
-function componentsMapToComponents(
-  componentsMap: Map<string, ResolvedRef>
-): Record<string, unknown> {
-  const result: Record<string, unknown> = {};
-
-  for (const resolvedRef of componentsMap.values()) {
-    insertRefByPointer(resolvedRef.pointer, resolvedRef.refNode, result);
-  }
-
-  return result;
-}
-
-async function setRefsFileName(
-  resolvedDocument: ResolvedDocument,
-  fileName: string
-): Promise<void> {
-  // We don't need to follow references
-  const stubRefResolver = {
-    resolveRef: async (refDocumentAbsolutePath: string, pointer: string): Promise<ResolvedRef> => ({
-      absolutePath: refDocumentAbsolutePath,
-      pointer,
-      document: resolvedDocument.document,
-      refNode: {},
-    }),
-    resolveDocument: async (): Promise<ResolvedDocument> => ({
-      absolutePath: '',
-      document: resolvedDocument.document,
-    }),
-  };
-  const setRefFileProcessor: DocumentNodeProcessor = {
-    ref: (node) => {
-      const { pointer } = parseRef(node.$ref);
-
-      node.$ref = `./${fileName}#${pointer}`;
-    },
-  };
-
-  await processDocument(resolvedDocument, stubRefResolver, [setRefFileProcessor]);
-}
diff --git a/packages/kbn-openapi-bundler/src/bundler/merge_documents/create_blank_oas_document.ts b/packages/kbn-openapi-bundler/src/bundler/merge_documents/create_blank_oas_document.ts
new file mode 100644
index 00000000000000..925471719b3456
--- /dev/null
+++ b/packages/kbn-openapi-bundler/src/bundler/merge_documents/create_blank_oas_document.ts
@@ -0,0 +1,46 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { OpenAPIV3 } from 'openapi-types';
+
+export function createBlankOpenApiDocument(
+  oasVersion: string,
+  info: OpenAPIV3.InfoObject
+): OpenAPIV3.Document {
+  return {
+    openapi: oasVersion,
+    info,
+    servers: [
+      {
+        url: 'http://{kibana_host}:{port}',
+        variables: {
+          kibana_host: {
+            default: 'localhost',
+          },
+          port: {
+            default: '5601',
+          },
+        },
+      },
+    ],
+    security: [
+      {
+        BasicAuth: [],
+      },
+    ],
+    paths: {},
+    components: {
+      securitySchemes: {
+        BasicAuth: {
+          type: 'http',
+          scheme: 'basic',
+        },
+      },
+    },
+  };
+}
diff --git a/packages/kbn-openapi-bundler/src/bundler/merge_documents/index.ts b/packages/kbn-openapi-bundler/src/bundler/merge_documents/index.ts
new file mode 100644
index 00000000000000..554cf7cd2c2c5e
--- /dev/null
+++ b/packages/kbn-openapi-bundler/src/bundler/merge_documents/index.ts
@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export * from './merge_documents';
diff --git a/packages/kbn-openapi-bundler/src/bundler/merge_documents/merge_documents.ts b/packages/kbn-openapi-bundler/src/bundler/merge_documents/merge_documents.ts
new file mode 100644
index 00000000000000..03275dbf3f3de7
--- /dev/null
+++ b/packages/kbn-openapi-bundler/src/bundler/merge_documents/merge_documents.ts
@@ -0,0 +1,101 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import chalk from 'chalk';
+import { OpenAPIV3 } from 'openapi-types';
+import { logger } from '../../logger';
+import { BundledDocument } from '../bundle_document';
+import { mergePaths } from './merge_paths';
+import { mergeSharedComponents } from './merge_shared_components';
+
+export async function mergeDocuments(
+  bundledDocuments: BundledDocument[],
+  blankOasFactory: (oasVersion: string, apiVersion: string) => OpenAPIV3.Document
+): Promise<Map<string, OpenAPIV3.Document>> {
+  const bundledDocumentsByVersion = splitByVersion(bundledDocuments);
+  const mergedByVersion = new Map<string, OpenAPIV3.Document>();
+
+  for (const [apiVersion, singleVersionBundledDocuments] of bundledDocumentsByVersion.entries()) {
+    const oasVersion = extractOasVersion(singleVersionBundledDocuments);
+    const mergedDocument = blankOasFactory(oasVersion, apiVersion);
+
+    mergedDocument.paths = mergePaths(singleVersionBundledDocuments);
+    mergedDocument.components = {
+      // Copy components defined in the blank OpenAPI document
+      ...mergedDocument.components,
+      ...mergeSharedComponents(singleVersionBundledDocuments),
+    };
+
+    mergedByVersion.set(mergedDocument.info.version, mergedDocument);
+  }
+
+  return mergedByVersion;
+}
+
+function splitByVersion(bundledDocuments: BundledDocument[]): Map<string, BundledDocument[]> {
+  const splitBundledDocuments = new Map<string, BundledDocument[]>();
+
+  for (const bundledDocument of bundledDocuments) {
+    const documentInfo = bundledDocument.document.info as OpenAPIV3.InfoObject;
+
+    if (!documentInfo.version) {
+      logger.warning(`OpenAPI version is missing in ${chalk.bold(bundledDocument.absolutePath)}`);
+
+      continue;
+    }
+
+    const versionBundledDocuments = splitBundledDocuments.get(documentInfo.version);
+
+    if (!versionBundledDocuments) {
+      splitBundledDocuments.set(documentInfo.version, [bundledDocument]);
+    } else {
+      versionBundledDocuments.push(bundledDocument);
+    }
+  }
+
+  return splitBundledDocuments;
+}
+
+function extractOasVersion(bundledDocuments: BundledDocument[]): string {
+  if (bundledDocuments.length === 0) {
+    throw new Error('Empty bundled document list');
+  }
+
+  const firstBundledDocument = bundledDocuments[0];
+
+  for (let i = 1; i < bundledDocuments.length; ++i) {
+    if (
+      !areOasVersionsEqual(
+        bundledDocuments[i].document.openapi as string,
+        firstBundledDocument.document.openapi as string
+      )
+    ) {
+      throw new Error(
+        `OpenAPI specs must use the same OpenAPI version, encountered ${chalk.blue(
+          bundledDocuments[i].document.openapi
+        )} at ${chalk.bold(bundledDocuments[i].absolutePath)} does not match ${chalk.blue(
+          firstBundledDocument.document.openapi
+        )} at ${chalk.bold(firstBundledDocument.absolutePath)}`
+      );
+    }
+  }
+
+  const version = firstBundledDocument.document.openapi as string;
+
+  // Automatically promote to the recent OAS 3.0 version which is 3.0.3
+  // 3.0.3 is the version used in the specification https://swagger.io/specification/v3/
+  return version < '3.0.3' ? '3.0.3' : version;
+}
+
+/**
+ * Tells if versions are equal by comparing only major and minor OAS version parts
+ */
+function areOasVersionsEqual(versionA: string, versionB: string): boolean {
+  // versionA.substring(0, 3) results in `3.0` or `3.1`
+  return versionA.substring(0, 3) === versionB.substring(0, 3);
+}
diff --git a/packages/kbn-openapi-bundler/src/bundler/merge_documents/merge_paths.ts b/packages/kbn-openapi-bundler/src/bundler/merge_documents/merge_paths.ts
new file mode 100644
index 00000000000000..1d541b5bb513e4
--- /dev/null
+++ b/packages/kbn-openapi-bundler/src/bundler/merge_documents/merge_paths.ts
@@ -0,0 +1,159 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import chalk from 'chalk';
+import { OpenAPIV3 } from 'openapi-types';
+import { BundledDocument } from '../bundle_document';
+
+export function mergePaths(bundledDocuments: BundledDocument[]): OpenAPIV3.PathsObject {
+  const mergedPaths: Record<string, OpenAPIV3.PathItemObject> = {};
+
+  for (const { absolutePath, document } of bundledDocuments) {
+    if (!document.paths) {
+      continue;
+    }
+
+    const pathsObject = document.paths as Record<string, OpenAPIV3.PathItemObject>;
+
+    for (const path of Object.keys(pathsObject)) {
+      if (!mergedPaths[path]) {
+        mergedPaths[path] = {};
+      }
+
+      const sourcePathItem = pathsObject[path];
+      const mergedPathItem = mergedPaths[path];
+
+      try {
+        mergeOptionalPrimitiveValue('summary', sourcePathItem, mergedPathItem);
+      } catch {
+        throw new Error(
+          `❌  Unable to bundle ${chalk.bold(absolutePath)} since ${chalk.bold(
+            `paths.${path}.summary`
+          )}'s value ${chalk.blue(
+            sourcePathItem.summary
+          )} doesn't match to already encountered ${chalk.magenta(mergedPathItem.summary)}.`
+        );
+      }
+
+      try {
+        mergeOptionalPrimitiveValue('description', sourcePathItem, mergedPathItem);
+      } catch {
+        throw new Error(
+          `❌  Unable to bundle ${chalk.bold(absolutePath)} since ${chalk.bold(
+            `paths.${path}.description`
+          )}'s value ${chalk.blue(
+            sourcePathItem.description
+          )} doesn't match to already encountered ${chalk.magenta(mergedPathItem.description)}.`
+        );
+      }
+
+      try {
+        mergeOperations(sourcePathItem, mergedPathItem);
+      } catch (e) {
+        throw new Error(
+          `❌  Unable to bundle ${chalk.bold(absolutePath)} since ${chalk.bold(
+            `paths.${path}.${e.message}`
+          )}'s definition is duplicated and differs from previously encountered.`
+        );
+      }
+
+      try {
+        mergeParameters(sourcePathItem, mergedPathItem);
+      } catch (e) {
+        throw new Error(
+          `❌  Unable to bundle ${chalk.bold(absolutePath)} since ${chalk.bold(
+            `paths.${path}.parameters.[${e.message}]`
+          )}'s definition is duplicated and differs from previously encountered.`
+        );
+      }
+    }
+  }
+
+  return mergedPaths;
+}
+
+const KNOWN_HTTP_METHODS = [
+  OpenAPIV3.HttpMethods.HEAD,
+  OpenAPIV3.HttpMethods.GET,
+  OpenAPIV3.HttpMethods.POST,
+  OpenAPIV3.HttpMethods.PATCH,
+  OpenAPIV3.HttpMethods.PUT,
+  OpenAPIV3.HttpMethods.OPTIONS,
+  OpenAPIV3.HttpMethods.DELETE,
+  OpenAPIV3.HttpMethods.TRACE,
+];
+
+function mergeOperations(
+  sourcePathItem: OpenAPIV3.PathItemObject,
+  mergedPathItem: OpenAPIV3.PathItemObject
+) {
+  for (const httpMethod of KNOWN_HTTP_METHODS) {
+    if (!sourcePathItem[httpMethod]) {
+      continue;
+    }
+
+    if (mergedPathItem[httpMethod]) {
+      throw new Error(httpMethod);
+    }
+
+    mergedPathItem[httpMethod] = sourcePathItem[httpMethod];
+  }
+}
+
+function mergeOptionalPrimitiveValue<FieldName extends string>(
+  fieldName: FieldName,
+  source: { [field in FieldName]?: unknown },
+  merged: { [field in FieldName]?: unknown }
+): void {
+  if (!source[fieldName]) {
+    return;
+  }
+
+  if (source[fieldName] && !merged[fieldName]) {
+    merged[fieldName] = source[fieldName];
+  }
+
+  if (source[fieldName] !== merged[fieldName]) {
+    throw new Error(`${fieldName} merge conflict`);
+  }
+}
+
+function mergeParameters(
+  sourcePathItem: OpenAPIV3.PathItemObject,
+  mergedPathItem: OpenAPIV3.PathItemObject
+): void {
+  if (!sourcePathItem.parameters) {
+    return;
+  }
+
+  if (!mergedPathItem.parameters) {
+    mergedPathItem.parameters = [];
+  }
+
+  for (const sourceParameter of sourcePathItem.parameters) {
+    if ('$ref' in sourceParameter) {
+      const existing = mergedPathItem.parameters.find(
+        (x) => '$ref' in x && x.$ref === sourceParameter.$ref
+      );
+
+      if (existing) {
+        continue;
+      }
+    } else {
+      const existing = mergedPathItem.parameters.find(
+        (x) => !('$ref' in x) && x.name === sourceParameter.name && x.in === sourceParameter.in
+      );
+
+      if (existing) {
+        throw new Error(`{ "name": "${sourceParameter.name}", "in": "${sourceParameter.in}" }`);
+      }
+    }
+
+    mergedPathItem.parameters.push(sourceParameter);
+  }
+}
diff --git a/packages/kbn-openapi-bundler/src/bundler/merge_documents/merge_shared_components.ts b/packages/kbn-openapi-bundler/src/bundler/merge_documents/merge_shared_components.ts
new file mode 100644
index 00000000000000..72f55645fa717b
--- /dev/null
+++ b/packages/kbn-openapi-bundler/src/bundler/merge_documents/merge_shared_components.ts
@@ -0,0 +1,54 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { OpenAPIV3 } from 'openapi-types';
+import deepEqual from 'fast-deep-equal';
+import chalk from 'chalk';
+import { insertRefByPointer } from '../../utils/insert_by_json_pointer';
+import { ResolvedRef } from '../types';
+import { BundledDocument } from '../bundle_document';
+
+export function mergeSharedComponents(
+  bundledDocuments: BundledDocument[]
+): OpenAPIV3.ComponentsObject {
+  const componentsMap = new Map<string, ResolvedRef>();
+  const mergedComponents: Record<string, unknown> = {};
+
+  for (const bundledDocument of bundledDocuments) {
+    mergeRefsToMap(bundledDocument.bundledRefs, componentsMap);
+  }
+
+  for (const resolvedRef of componentsMap.values()) {
+    insertRefByPointer(resolvedRef.pointer, resolvedRef.refNode, mergedComponents);
+  }
+
+  return mergedComponents;
+}
+
+function mergeRefsToMap(bundledRefs: ResolvedRef[], componentsMap: Map<string, ResolvedRef>): void {
+  for (const bundledRef of bundledRefs) {
+    const existingRef = componentsMap.get(bundledRef.pointer);
+
+    if (!existingRef) {
+      componentsMap.set(bundledRef.pointer, bundledRef);
+      continue;
+    }
+
+    if (deepEqual(existingRef.refNode, bundledRef.refNode)) {
+      continue;
+    }
+
+    throw new Error(
+      `❌  Unable to bundle documents due to conflicts in references. Schema ${chalk.yellow(
+        bundledRef.pointer
+      )} is defined in ${chalk.blue(existingRef.absolutePath)} and in ${chalk.magenta(
+        bundledRef.absolutePath
+      )} but has not matching definitions.`
+    );
+  }
+}
diff --git a/packages/kbn-openapi-bundler/src/bundler/process_document.test.ts b/packages/kbn-openapi-bundler/src/bundler/process_document.test.ts
index d78a4ce515b650..fd6e73d4272c6a 100644
--- a/packages/kbn-openapi-bundler/src/bundler/process_document.test.ts
+++ b/packages/kbn-openapi-bundler/src/bundler/process_document.test.ts
@@ -19,13 +19,13 @@ describe('processDocument', () => {
       document: {} as Document,
     };
     const calls: string[] = [];
-    const processor1 = {
-      leave() {
+    const processor1: DocumentNodeProcessor = {
+      onNodeLeave() {
         calls.push('processor1');
       },
     };
-    const processor2 = {
-      leave() {
+    const processor2: DocumentNodeProcessor = {
+      onNodeLeave() {
         calls.push('processor2');
       },
     };
@@ -46,14 +46,17 @@ describe('processDocument', () => {
     const calls: string[] = [];
     const refResolver = new RefResolver();
     const processor: DocumentNodeProcessor = {
-      enter(node) {
+      onNodeEnter(node) {
         calls.push(`enter - ${(node as NodeWithId).id}`);
+      },
+      shouldRemove(node) {
+        calls.push(`shouldRemove - ${(node as NodeWithId).id}`);
         return false;
       },
-      ref(node) {
+      onRefNodeLeave(node) {
         calls.push(`ref - ${(node as NodeWithId).id}`);
       },
-      leave(node) {
+      onNodeLeave(node) {
         calls.push(`leave - ${(node as NodeWithId).id}`);
       },
     };
@@ -82,8 +85,11 @@ describe('processDocument', () => {
     );
 
     expect(calls).toEqual([
+      'shouldRemove - root',
       'enter - root',
+      'shouldRemove - t1',
       'enter - t1',
+      'shouldRemove - TestRef',
       'enter - TestRef',
       'leave - TestRef',
       'ref - t1',
@@ -92,7 +98,7 @@ describe('processDocument', () => {
     ]);
   });
 
-  it('removes a node after "enter" callback returned true', async () => {
+  it('removes a node after "shouldRemove" callback returned true', async () => {
     const nodeToRemove = {
       id: 't2',
       foo: 'bar',
@@ -104,7 +110,7 @@ describe('processDocument', () => {
       t2: nodeToRemove,
     };
     const removeNodeProcessor: DocumentNodeProcessor = {
-      enter(node) {
+      shouldRemove(node) {
         return node === nodeToRemove;
       },
     };
diff --git a/packages/kbn-openapi-bundler/src/bundler/process_document.ts b/packages/kbn-openapi-bundler/src/bundler/process_document.ts
index 1efe64b87b4edb..29344fa4aa7c50 100644
--- a/packages/kbn-openapi-bundler/src/bundler/process_document.ts
+++ b/packages/kbn-openapi-bundler/src/bundler/process_document.ts
@@ -67,11 +67,13 @@ export async function processDocument(
 
     traverseItem.visitedDocumentNodes.add(traverseItem.node);
 
-    if (shouldSkipNode(traverseItem, processors)) {
+    if (shouldRemoveSubTree(traverseItem, processors)) {
       removeNode(traverseItem);
       continue;
     }
 
+    applyEnterProcessors(traverseItem, processors);
+
     postOrderTraversalStack.push(traverseItem);
 
     if (isRefNode(traverseItem.node)) {
@@ -144,14 +146,14 @@ export async function processDocument(
       // If ref has been inlined by one of the processors it's not a ref node anymore
       // so we can skip the following processors
       if (isRefNode(traverseItem.node) && traverseItem.resolvedRef) {
-        processor.ref?.(
+        processor.onRefNodeLeave?.(
           traverseItem.node as RefNode,
           traverseItem.resolvedRef,
           traverseItem.context
         );
       }
 
-      processor.leave?.(traverseItem.node, traverseItem.context);
+      processor.onNodeLeave?.(traverseItem.node, traverseItem.context);
     }
   }
 }
@@ -165,9 +167,28 @@ export function isRefNode(node: DocumentNode): node is { $ref: string } {
   return isPlainObject(node) && '$ref' in node;
 }
 
-function shouldSkipNode(traverseItem: TraverseItem, processors: DocumentNodeProcessor[]): boolean {
-  return processors?.some((p) =>
-    p.enter?.(traverseItem.node, {
+function applyEnterProcessors(
+  traverseItem: TraverseItem,
+  processors: DocumentNodeProcessor[]
+): void {
+  for (const processor of processors) {
+    processor.onNodeEnter?.(traverseItem.node, {
+      ...traverseItem.context,
+      parentNode: traverseItem.parentNode,
+      parentKey: traverseItem.parentKey,
+    });
+  }
+}
+
+/**
+ * Removes a node with its subtree
+ */
+function shouldRemoveSubTree(
+  traverseItem: TraverseItem,
+  processors: DocumentNodeProcessor[]
+): boolean {
+  return processors.some((p) =>
+    p.shouldRemove?.(traverseItem.node, {
       ...traverseItem.context,
       parentNode: traverseItem.parentNode,
       parentKey: traverseItem.parentKey,
diff --git a/packages/kbn-openapi-bundler/src/bundler/types.ts b/packages/kbn-openapi-bundler/src/bundler/types.ts
index 06aa533c9122a7..fa8a7f3c831208 100644
--- a/packages/kbn-openapi-bundler/src/bundler/types.ts
+++ b/packages/kbn-openapi-bundler/src/bundler/types.ts
@@ -94,41 +94,70 @@ export type TraverseDocumentEntryContext = TraverseDocumentContext & {
 };
 
 /**
- * Entry processor controls when a node should be omitted from the result document.
+ * Should remove processor controls whether a node and all its descendants
+ * should be omitted from the further processing and result document.
+ *
+ * When result is
+ *
+ * - `true` - omit the node
+ * - `false` - keep the node
  *
- * When result is `true` - omit the node.
  */
-export type EntryProcessorFn = (
+export type ShouldRemoveNodeProcessorFn = (
   node: Readonly<DocumentNode>,
   context: TraverseDocumentEntryContext
 ) => boolean;
 
-export type LeaveProcessorFn = (node: DocumentNode, context: TraverseDocumentContext) => void;
+export type OnNodeEntryProcessorFn = (
+  node: Readonly<DocumentNode>,
+  context: TraverseDocumentEntryContext
+) => void;
+
+export type OnNodeLeaveProcessorFn = (node: DocumentNode, context: TraverseDocumentContext) => void;
 
-export type RefProcessorFn = (
+export type OnRefNodeLeaveProcessorFn = (
   node: RefNode,
   resolvedRef: ResolvedRef,
   context: TraverseDocumentContext
 ) => void;
 
 /**
+ * OpenAPI tree is traversed in two phases
+ *
+ * 1. Diving from root to leaves.
+ *    Allows to analyze unprocessed nodes and calculate any metrics if necessary.
+ *
+ * 2. Post order traversal from leaves to root.
+ *    Mostly to transform the OpenAPI document.
+ *
  * Document or document node processor gives flexibility in modifying OpenAPI specs and/or collect some metrics.
- * For convenience it defined handlers invoked upon action or specific node type.
+ * For convenience there are following node processors supported
+ *
+ * 1st phase
+ *
+ * - `onNodeEnter` - Callback function is invoked at the first phase (diving from root to leaves) while
+ *             traversing the document. It can be considered in a similar way events dive in DOM during
+ *             capture phase. In the other words it means entering a subtree. It allows to analyze
+ *             unprocessed nodes.
  *
- * Currently the following node types supported
+ * - `shouldRemove` - Callback function is invoked at the first phase (diving from root to leaves) while
+ *             traversing the document. It controls whether the node will be excluded from further processing
+ *             and the result document eventually. Returning `true` excluded the node while returning `false`
+ *             passes the node untouched.
  *
- * - ref - Callback function is invoked upon leaving ref node (a node having `$ref` key)
+ * 2nd phase
  *
- * and the following actions
+ * - `onNodeLeave` - Callback function is invoked upon leaving any type of node. It give an opportunity to
+ *             modify the document like inline references or remove unwanted properties. It can be considered
+ *             in a similar way event bubble in DOM during bubble phase. In the other words it means leaving
+ *             a subtree.
  *
- * - enter - Callback function is invoked upon entering any type of node element including ref nodes. It doesn't allow
- *           to modify node's content but provides an ability to remove the element by returning `true`.
+ * - `onRefNodeLeave` - Callback function is invoked upon leaving a reference node (a node having `$ref` key)
  *
- * - leave - Callback function is invoked upon leaving any type of node.  It give an opportunity to modify the document like
- *           dereference refs or remove unwanted properties.
  */
 export interface DocumentNodeProcessor {
-  enter?: EntryProcessorFn;
-  leave?: LeaveProcessorFn;
-  ref?: RefProcessorFn;
+  shouldRemove?: ShouldRemoveNodeProcessorFn;
+  onNodeEnter?: OnNodeEntryProcessorFn;
+  onNodeLeave?: OnNodeLeaveProcessorFn;
+  onRefNodeLeave?: OnRefNodeLeaveProcessorFn;
 }
diff --git a/packages/kbn-openapi-bundler/src/openapi_bundler.test.ts b/packages/kbn-openapi-bundler/src/openapi_bundler.test.ts
deleted file mode 100644
index eaed80727dee8b..00000000000000
--- a/packages/kbn-openapi-bundler/src/openapi_bundler.test.ts
+++ /dev/null
@@ -1,162 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import { existsSync, rmSync } from 'fs';
-import { basename, join } from 'path';
-import { bundle } from './openapi_bundler';
-import { readYamlDocument } from './utils/read_yaml_document';
-
-const rootPath = join(__dirname, '__test__');
-const targetAbsoluteFilePath = join(rootPath, 'bundled.yaml');
-
-describe('OpenAPI Bundler', () => {
-  afterEach(() => {
-    removeTargetFile();
-  });
-
-  it('bundles two simple specs', async () => {
-    await bundleFolder('two_simple_specs');
-    await expectBundleToMatchFile('two_simple_specs', 'expected.yaml');
-  });
-
-  it('bundles one file with a local reference', async () => {
-    await bundleFolder('spec_with_local_ref');
-    await expectBundleToMatchFile('spec_with_local_ref', 'expected.yaml');
-  });
-
-  it('bundles one file with an external reference', async () => {
-    await bundleFolder('spec_with_external_ref');
-    await expectBundleToMatchFile('spec_with_external_ref', 'expected.yaml');
-  });
-
-  it('bundles files with external references', async () => {
-    await bundleFolder('two_specs_with_external_ref');
-    await expectBundleToMatchFile('two_specs_with_external_ref', 'expected.yaml');
-  });
-
-  // Fails because `writeYamlDocument()` has `noRefs: true` setting
-  // it('bundles recursive spec', async () => {
-  //   await bundleFolder('recursive_spec');
-  //   await expectBundleToMatchFile('recursive_spec', 'expected.yaml');
-  // });
-
-  it('bundles specs with recursive references', async () => {
-    await bundleFolder('recursive_ref_specs');
-    await expectBundleToMatchFile('recursive_ref_specs', 'expected.yaml');
-  });
-
-  it('bundles spec with a self-recursive reference', async () => {
-    await bundleFolder('self_recursive_ref');
-    await expectBundleToMatchFile('self_recursive_ref', 'expected.yaml');
-  });
-
-  it('bundles one endpoint with different versions', async () => {
-    await bundleFolder('different_endpoint_versions');
-    await expectBundleToMatchFile('different_endpoint_versions', 'expected.yaml');
-  });
-
-  it('bundles spec with different OpenAPI versions', async () => {
-    await bundleFolder('different_openapi_versions');
-    await expectBundleToMatchFile('different_openapi_versions', 'expected.yaml');
-  });
-
-  it('bundles conflicting but equal references', async () => {
-    await bundleFolder('conflicting_but_equal_refs_in_different_specs');
-    await expectBundleToMatchFile('conflicting_but_equal_refs_in_different_specs', 'expected.yaml');
-  });
-
-  it('fails to bundle conflicting references encountered in separate specs', async () => {
-    await expectBundlingError(
-      'conflicting_refs_in_different_specs',
-      /\/components\/schemas\/ConflictTestSchema/
-    );
-  });
-
-  describe('x-modify', () => {
-    it('makes properties in an object node partial', async () => {
-      await bundleFolder('modify_partial_node');
-      await expectBundleToMatchFile('modify_partial_node', 'expected.yaml');
-    });
-
-    it('makes properties in a referenced object node partial', async () => {
-      await bundleFolder('modify_partial_ref');
-      await expectBundleToMatchFile('modify_partial_ref', 'expected.yaml');
-    });
-
-    it('makes properties in an object node required', async () => {
-      await bundleFolder('modify_required_node');
-      await expectBundleToMatchFile('modify_required_node', 'expected.yaml');
-    });
-
-    it('makes properties in a referenced object node required', async () => {
-      await bundleFolder('modify_required_ref');
-      await expectBundleToMatchFile('modify_required_ref', 'expected.yaml');
-    });
-  });
-
-  describe('x-inline', () => {
-    it('inlines a reference', async () => {
-      await bundleFolder('inline_ref');
-      await expectBundleToMatchFile('inline_ref', 'expected.yaml');
-    });
-  });
-
-  describe('skip internal', () => {
-    it('skips nodes with x-internal property', async () => {
-      await bundleFolder('skip_internal');
-      await expectBundleToMatchFile('skip_internal', 'expected.yaml');
-    });
-
-    it('skips endpoints starting with /internal', async () => {
-      await bundleFolder('skip_internal_endpoint');
-      await expectBundleToMatchFile('skip_internal_endpoint', 'expected.yaml');
-    });
-  });
-});
-
-async function bundleFolder(folderName: string): Promise<void> {
-  await expect(
-    bundle({
-      rootDir: join(rootPath, folderName),
-      sourceGlob: '*.schema.yaml',
-      outputFilePath: join('..', basename(targetAbsoluteFilePath)),
-    })
-  ).resolves.toBeUndefined();
-}
-
-async function expectBundlingError(
-  folderName: string,
-  error: string | RegExp | jest.Constructable | Error | undefined
-): Promise<void> {
-  return await expect(
-    bundle({
-      rootDir: join(rootPath, folderName),
-      sourceGlob: '*.schema.yaml',
-      outputFilePath: join('..', basename(targetAbsoluteFilePath)),
-    })
-  ).rejects.toThrowError(error);
-}
-
-async function expectBundleToMatchFile(
-  folderName: string,
-  expectedFileName: string
-): Promise<void> {
-  expect(existsSync(targetAbsoluteFilePath)).toBeTruthy();
-
-  const bundledSpec = await readYamlDocument(targetAbsoluteFilePath);
-  const expectedAbsoluteFilePath = join(rootPath, folderName, expectedFileName);
-  const expectedSpec = await readYamlDocument(expectedAbsoluteFilePath);
-
-  expect(bundledSpec).toEqual(expectedSpec);
-}
-
-function removeTargetFile(): void {
-  if (existsSync(targetAbsoluteFilePath)) {
-    rmSync(targetAbsoluteFilePath, { force: true });
-  }
-}
diff --git a/packages/kbn-openapi-bundler/src/openapi_bundler.ts b/packages/kbn-openapi-bundler/src/openapi_bundler.ts
index 451b0ff700bae5..aa542a28b0a325 100644
--- a/packages/kbn-openapi-bundler/src/openapi_bundler.ts
+++ b/packages/kbn-openapi-bundler/src/openapi_bundler.ts
@@ -7,43 +7,75 @@
  */
 
 import chalk from 'chalk';
+import { isUndefined, omitBy } from 'lodash';
+import { OpenAPIV3 } from 'openapi-types';
 import globby from 'globby';
-import { basename, dirname, join, resolve } from 'path';
+import { basename, dirname, resolve } from 'path';
 import { BundledDocument, bundleDocument, SkipException } from './bundler/bundle_document';
 import { mergeDocuments } from './bundler/merge_documents';
 import { removeFilesByGlob } from './utils/remove_files_by_glob';
 import { logger } from './logger';
 import { writeYamlDocument } from './utils/write_yaml_document';
+import { createBlankOpenApiDocument } from './bundler/merge_documents/create_blank_oas_document';
 
 export interface BundlerConfig {
-  rootDir: string;
   sourceGlob: string;
   outputFilePath: string;
+  specInfo?: Omit<Partial<OpenAPIV3.InfoObject>, 'version'>;
 }
 
-export const bundle = async (config: BundlerConfig) => {
-  const {
-    rootDir,
-    sourceGlob,
-    outputFilePath: relativeOutputFilePath = 'target/openapi/bundled.schema.yaml',
-  } = config;
-
+export const bundle = async ({
+  sourceGlob,
+  outputFilePath = 'bundled-{version}.schema.yaml',
+  specInfo,
+}: BundlerConfig) => {
   logger.debug(chalk.bold(`Bundling API route schemas`));
-  logger.debug(chalk.bold(`Working directory: ${chalk.underline(rootDir)}`));
-  logger.debug(`👀  Searching for source files`);
+  logger.debug(`👀  Searching for source files in ${chalk.underline(sourceGlob)}`);
 
-  const outputFilePath = join(rootDir, relativeOutputFilePath);
-  const sourceFilesGlob = resolve(rootDir, sourceGlob);
+  const sourceFilesGlob = resolve(sourceGlob);
   const schemaFilePaths = await globby([sourceFilesGlob]);
 
   logger.info(`🕵️‍♀️  Found ${schemaFilePaths.length} schemas`);
   logSchemas(schemaFilePaths);
 
   logger.info(`🧹  Cleaning up any previously generated artifacts`);
-  await removeFilesByGlob(dirname(outputFilePath), basename(outputFilePath));
+  await removeFilesByGlob(
+    dirname(outputFilePath),
+    basename(outputFilePath.replace('{version}', '*'))
+  );
 
   logger.debug(`Processing schemas...`);
 
+  const resolvedDocuments = await resolveDocuments(schemaFilePaths);
+
+  logger.success(`Processed ${resolvedDocuments.length} schemas`);
+
+  const blankOasFactory = (oasVersion: string, apiVersion: string) =>
+    createBlankOpenApiDocument(oasVersion, {
+      version: apiVersion,
+      title: specInfo?.title ?? 'Bundled OpenAPI specs',
+      ...omitBy(
+        {
+          description: specInfo?.description,
+          termsOfService: specInfo?.termsOfService,
+          contact: specInfo?.contact,
+          license: specInfo?.license,
+        },
+        isUndefined
+      ),
+    });
+  const resultDocumentsMap = await mergeDocuments(resolvedDocuments, blankOasFactory);
+
+  await writeDocuments(resultDocumentsMap, outputFilePath);
+};
+
+function logSchemas(schemaFilePaths: string[]): void {
+  for (const filePath of schemaFilePaths) {
+    logger.debug(`Found OpenAPI spec ${chalk.bold(filePath)}`);
+  }
+}
+
+async function resolveDocuments(schemaFilePaths: string[]): Promise<BundledDocument[]> {
   const resolvedDocuments = await Promise.all(
     schemaFilePaths.map(async (schemaFilePath) => {
       try {
@@ -62,26 +94,9 @@ export const bundle = async (config: BundlerConfig) => {
       }
     })
   );
-
   const processedDocuments = filterOutSkippedDocuments(resolvedDocuments);
 
-  logger.success(`Processed ${processedDocuments.length} schemas`);
-
-  const resultDocument = await mergeDocuments(processedDocuments);
-
-  try {
-    await writeYamlDocument(outputFilePath, resultDocument);
-
-    logger.success(`📖  Wrote all bundled OpenAPI specs to ${chalk.bold(outputFilePath)}`);
-  } catch (e) {
-    logger.error(`Unable to save bundled document to ${chalk.bold(outputFilePath)}: ${e.message}`);
-  }
-};
-
-function logSchemas(schemaFilePaths: string[]): void {
-  for (const filePath of schemaFilePaths) {
-    logger.debug(`Found OpenAPI spec ${chalk.bold(filePath)}`);
-  }
+  return processedDocuments;
 }
 
 function filterOutSkippedDocuments(
@@ -99,3 +114,35 @@ function filterOutSkippedDocuments(
 
   return processedDocuments;
 }
+
+async function writeDocuments(
+  resultDocumentsMap: Map<string, OpenAPIV3.Document>,
+  outputFilePath: string
+): Promise<void> {
+  for (const [version, document] of resultDocumentsMap.entries()) {
+    const versionedOutputFilePath = getVersionedOutputFilePath(outputFilePath, version);
+
+    try {
+      await writeYamlDocument(versionedOutputFilePath, document);
+
+      logger.success(`📖  Wrote bundled OpenAPI specs to ${chalk.bold(versionedOutputFilePath)}`);
+    } catch (e) {
+      logger.error(
+        `Unable to save bundled document to ${chalk.bold(versionedOutputFilePath)}: ${e.message}`
+      );
+    }
+  }
+}
+
+function getVersionedOutputFilePath(outputFilePath: string, version: string): string {
+  const hasVersionPlaceholder = outputFilePath.indexOf('{version}') > -1;
+  const snakeCasedVersion = version.replaceAll(/[^\w\d]+/g, '_');
+
+  if (hasVersionPlaceholder) {
+    return outputFilePath.replace('{version}', snakeCasedVersion);
+  }
+
+  const filename = basename(outputFilePath);
+
+  return outputFilePath.replace(filename, `${version}-${filename}`);
+}
diff --git a/packages/kbn-openapi-bundler/src/utils/insert_by_json_pointer.ts b/packages/kbn-openapi-bundler/src/utils/insert_by_json_pointer.ts
index 8538102305edc6..161f548ad2cf95 100644
--- a/packages/kbn-openapi-bundler/src/utils/insert_by_json_pointer.ts
+++ b/packages/kbn-openapi-bundler/src/utils/insert_by_json_pointer.ts
@@ -10,16 +10,23 @@
  * Inserts `data` into the location specified by pointer in the `document`.
  *
  * @param pointer [JSON Pointer](https://datatracker.ietf.org/doc/html/rfc6901)
- * @param data An object to insert
- * @param document A document to insert to
+ * @param component Component data to insert
+ * @param componentsObject Components object to insert to
  */
 export function insertRefByPointer(
   pointer: string,
-  data: unknown,
-  document: Record<string, unknown>
+  component: unknown,
+  componentsObject: Record<string, unknown>
 ): void {
+  if (!pointer.startsWith('/components')) {
+    throw new Error(
+      `insertRefByPointer expected a pointer starting with "/components" but got ${pointer}`
+    );
+  }
+
+  // splitting '/components' by '/' gives ['', 'components'] which should be skipped
   const segments = pointer.split('/').slice(2);
-  let target = document;
+  let target = componentsObject;
 
   while (segments.length > 0) {
     const segment = segments.shift() as string;
@@ -31,5 +38,5 @@ export function insertRefByPointer(
     target = target[segment] as Record<string, unknown>;
   }
 
-  Object.assign(target, data);
+  Object.assign(target, component);
 }
diff --git a/packages/kbn-openapi-bundler/src/utils/write_yaml_document.ts b/packages/kbn-openapi-bundler/src/utils/write_yaml_document.ts
index bdcd783e1a214a..99872292804be6 100644
--- a/packages/kbn-openapi-bundler/src/utils/write_yaml_document.ts
+++ b/packages/kbn-openapi-bundler/src/utils/write_yaml_document.ts
@@ -12,7 +12,7 @@ import { dirname } from 'path';
 
 export async function writeYamlDocument(filePath: string, document: unknown): Promise<void> {
   try {
-    const yaml = dump(document, { noRefs: true });
+    const yaml = stringifyToYaml(document);
 
     await fs.mkdir(dirname(filePath), { recursive: true });
     await fs.writeFile(filePath, yaml);
@@ -20,3 +20,50 @@ export async function writeYamlDocument(filePath: string, document: unknown): Pr
     throw new Error(`Unable to write bundled yaml: ${e.message}`, { cause: e });
   }
 }
+
+function stringifyToYaml(document: unknown): string {
+  try {
+    // Disable YAML Anchors https://yaml.org/spec/1.2.2/#3222-anchors-and-aliases
+    // It makes YAML much more human readable
+    return dump(document, {
+      noRefs: true,
+      sortKeys: sortYamlKeys,
+    });
+  } catch (e) {
+    // RangeError might happened because of stack overflow
+    // due to circular references in the document
+    // since YAML Anchors are disabled
+    if (e instanceof RangeError) {
+      // Try to stringify with YAML Anchors enabled
+      return dump(document, { noRefs: false, sortKeys: sortYamlKeys });
+    }
+
+    throw e;
+  }
+}
+
+function sortYamlKeys(a: string, b: string): number {
+  if (a in FIELDS_ORDER && b in FIELDS_ORDER) {
+    return FIELDS_ORDER[a as CustomOrderedField] - FIELDS_ORDER[b as CustomOrderedField];
+  }
+
+  return a.localeCompare(b);
+}
+
+const FIELDS_ORDER = {
+  // root level fields
+  openapi: 1,
+  info: 2,
+  servers: 3,
+  paths: 4,
+  components: 5,
+  security: 6,
+  tags: 7,
+  externalDocs: 8,
+  // object schema fields
+  type: 9,
+  properties: 10,
+  required: 11,
+} as const;
+
+type CustomOrderedField = keyof typeof FIELDS_ORDER;
diff --git a/packages/kbn-search-connectors/types/native_connectors.ts b/packages/kbn-search-connectors/types/native_connectors.ts
index a044dd717ef4ff..3c235b0c3f4a34 100644
--- a/packages/kbn-search-connectors/types/native_connectors.ts
+++ b/packages/kbn-search-connectors/types/native_connectors.ts
@@ -2605,7 +2605,7 @@ export const NATIVE_CONNECTOR_DEFINITIONS: Record<string, NativeConnector | unde
         type: FieldType.LIST,
         ui_restrictions: [],
         validations: [],
-        value: '',
+        value: '*',
       },
       ssl_enabled: {
         default_value: false,
@@ -2808,84 +2808,89 @@ export const NATIVE_CONNECTOR_DEFINITIONS: Record<string, NativeConnector | unde
   },
   notion: {
     configuration: {
-      tenant_id: {
+      notion_secret_key: {
         default_value: null,
         depends_on: [],
         display: DisplayType.TEXTBOX,
-        label: i18n.translate('searchConnectors.nativeConnectors.notion.tenantIdLabel', {
-          defaultMessage: 'Tenant ID',
+        label: i18n.translate('searchConnectors.nativeConnectors.notion.notionSecretKeyLabel', {
+          defaultMessage: 'Notion Secret Key',
         }),
         options: [],
         order: 1,
         required: true,
-        sensitive: false,
+        sensitive: true,
         tooltip: null,
         type: FieldType.STRING,
         ui_restrictions: [],
         validations: [],
         value: '',
       },
-      client_id: {
-        default_value: null,
+      databases: {
+        default_value: '',
         depends_on: [],
         display: DisplayType.TEXTBOX,
-        label: i18n.translate('searchConnectors.nativeConnectors.notion.clientIdLabel', {
-          defaultMessage: 'Client ID',
+        label: i18n.translate('searchConnectors.nativeConnectors.notion.databasesLabel', {
+          defaultMessage: 'List of Databases',
         }),
         options: [],
         order: 2,
         required: true,
         sensitive: false,
-        tooltip: null,
-        type: FieldType.STRING,
+        tooltip: '',
+        type: FieldType.LIST,
         ui_restrictions: [],
         validations: [],
         value: '',
       },
-      secret_value: {
-        default_value: null,
+      pages: {
+        default_value: '',
         depends_on: [],
         display: DisplayType.TEXTBOX,
-        label: i18n.translate('searchConnectors.nativeConnectors.notion.secretValueLabel', {
-          defaultMessage: 'Secret value',
+        label: i18n.translate('searchConnectors.nativeConnectors.notion.pagesLabel', {
+          defaultMessage: 'List of Pages',
         }),
         options: [],
         order: 3,
         required: true,
-        sensitive: true,
-        tooltip: null,
-        type: FieldType.STRING,
+        sensitive: false,
+        tooltip: '',
+        type: FieldType.LIST,
         ui_restrictions: [],
         validations: [],
         value: '',
       },
-      username: {
+      index_comments: {
         default_value: null,
         depends_on: [],
-        display: DisplayType.TEXTBOX,
-        label: USERNAME_LABEL,
+        display: DisplayType.TOGGLE,
+        label: i18n.translate('searchConnectors.nativeConnectors.notion.indexCommentsLabel', {
+          defaultMessage: 'Enable indexing comments',
+        }),
         options: [],
         order: 4,
         required: true,
         sensitive: false,
-        tooltip: null,
-        type: FieldType.STRING,
+        tooltip: i18n.translate('searchConnectors.nativeConnectors.notion.indexCommentsTooltip', {
+          defaultMessage:
+            'Enabling this will increase the amount of network calls to the source, and may decrease performance',
+        }),
+        type: FieldType.BOOLEAN,
         ui_restrictions: [],
         validations: [],
-        value: '',
+        value: false,
       },
-      password: {
-        default_value: null,
+      concurrent_downloads: {
+        default_value: 30,
         depends_on: [],
-        display: DisplayType.TEXTBOX,
-        label: PASSWORD_LABEL,
+        display: DisplayType.NUMERIC,
+        label: MAX_CONCURRENT_DOWNLOADS_LABEL,
         options: [],
         order: 5,
-        required: true,
-        sensitive: true,
+        required: false,
+        sensitive: false,
         tooltip: null,
-        type: FieldType.STRING,
-        ui_restrictions: [],
+        type: FieldType.INTEGER,
+        ui_restrictions: ['advanced'],
         validations: [],
         value: '',
       },
@@ -3142,7 +3147,7 @@ export const NATIVE_CONNECTOR_DEFINITIONS: Record<string, NativeConnector | unde
         type: FieldType.LIST,
         ui_restrictions: [],
         validations: [],
-        value: '',
+        value: '*',
       },
       fetch_size: {
         default_value: 50,
@@ -4279,7 +4284,7 @@ export const NATIVE_CONNECTOR_DEFINITIONS: Record<string, NativeConnector | unde
         type: FieldType.LIST,
         ui_restrictions: [],
         validations: [],
-        value: '',
+        value: '*',
       },
       use_text_extraction_service: {
         default_value: false,
diff --git a/packages/kbn-securitysolution-exception-list-components/src/exception_item_card/conditions/entry_content/__snapshots__/entry_content.test.tsx.snap b/packages/kbn-securitysolution-exception-list-components/src/exception_item_card/conditions/entry_content/__snapshots__/entry_content.test.tsx.snap
index bd4792360e0c94..9927750e4f84e9 100644
--- a/packages/kbn-securitysolution-exception-list-components/src/exception_item_card/conditions/entry_content/__snapshots__/entry_content.test.tsx.snap
+++ b/packages/kbn-securitysolution-exception-list-components/src/exception_item_card/conditions/entry_content/__snapshots__/entry_content.test.tsx.snap
@@ -12,7 +12,7 @@ Object {
           css="You have tried to stringify object returned from \`css\` function. It isn't supposed to be used directly (e.g. as value of the \`className\` prop), but rather handed to emotion so it can handle it (e.g. as value of \`css\` prop)."
         >
           <div
-            class="euiFlexGroup css-d309m3"
+            class="euiFlexGroup emotion-euiFlexGroup-responsive-m-flexStart-center-row"
             data-test-subj="EntryContentNestedEntry"
           >
             <span
@@ -65,7 +65,7 @@ Object {
         css="You have tried to stringify object returned from \`css\` function. It isn't supposed to be used directly (e.g. as value of the \`className\` prop), but rather handed to emotion so it can handle it (e.g. as value of \`css\` prop)."
       >
         <div
-          class="euiFlexGroup css-d309m3"
+          class="euiFlexGroup emotion-euiFlexGroup-responsive-m-flexStart-center-row"
           data-test-subj="EntryContentNestedEntry"
         >
           <span
diff --git a/packages/kbn-securitysolution-exception-list-components/src/generate_linked_rules_menu_item/__snapshots__/generate_linked_rules_menu_item.test.tsx.snap b/packages/kbn-securitysolution-exception-list-components/src/generate_linked_rules_menu_item/__snapshots__/generate_linked_rules_menu_item.test.tsx.snap
index ce85a678a6952f..a4e5a45683de86 100644
--- a/packages/kbn-securitysolution-exception-list-components/src/generate_linked_rules_menu_item/__snapshots__/generate_linked_rules_menu_item.test.tsx.snap
+++ b/packages/kbn-securitysolution-exception-list-components/src/generate_linked_rules_menu_item/__snapshots__/generate_linked_rules_menu_item.test.tsx.snap
@@ -13,7 +13,7 @@ Object {
           class="euiContextMenuItem__text emotion-euiContextMenuItem__text"
         >
           <div
-            class="euiFlexGroup css-5zp1nn"
+            class="euiFlexGroup emotion-euiFlexGroup-responsive-s-flexStart-stretch-row"
           >
             <div
               class="euiFlexItem emotion-euiFlexItem-growZero"
@@ -24,7 +24,7 @@ Object {
               />
             </div>
             <div
-              class="euiFlexItem emotion-EuiFlexItem"
+              class="euiFlexItem emotion-euiFlexItem-grow-1"
             >
               <div
                 data-test-subj="securityLinkAnchorComponent"
@@ -50,7 +50,7 @@ Object {
         class="euiContextMenuItem__text emotion-euiContextMenuItem__text"
       >
         <div
-          class="euiFlexGroup css-5zp1nn"
+          class="euiFlexGroup emotion-euiFlexGroup-responsive-s-flexStart-stretch-row"
         >
           <div
             class="euiFlexItem emotion-euiFlexItem-growZero"
@@ -61,7 +61,7 @@ Object {
             />
           </div>
           <div
-            class="euiFlexItem emotion-EuiFlexItem"
+            class="euiFlexItem emotion-euiFlexItem-grow-1"
           >
             <div
               data-test-subj="securityLinkAnchorComponent"
@@ -144,10 +144,10 @@ Object {
           class="euiContextMenuItem__text emotion-euiContextMenuItem__text"
         >
           <div
-            class="euiFlexGroup css-5zp1nn"
+            class="euiFlexGroup emotion-euiFlexGroup-responsive-s-flexStart-stretch-row"
           >
             <div
-              class="euiFlexItem emotion-EuiFlexItem"
+              class="euiFlexItem emotion-euiFlexItem-grow-1"
             >
               <div
                 data-test-subj="securityLinkAnchorComponent"
@@ -173,10 +173,10 @@ Object {
         class="euiContextMenuItem__text emotion-euiContextMenuItem__text"
       >
         <div
-          class="euiFlexGroup css-5zp1nn"
+          class="euiFlexGroup emotion-euiFlexGroup-responsive-s-flexStart-stretch-row"
         >
           <div
-            class="euiFlexItem emotion-EuiFlexItem"
+            class="euiFlexItem emotion-euiFlexItem-grow-1"
           >
             <div
               data-test-subj="securityLinkAnchorComponent"
diff --git a/packages/kbn-securitysolution-exception-list-components/src/list_header/__snapshots__/list_header.test.tsx.snap b/packages/kbn-securitysolution-exception-list-components/src/list_header/__snapshots__/list_header.test.tsx.snap
index bdbbc9db0d9a50..7e2a43f7151662 100644
--- a/packages/kbn-securitysolution-exception-list-components/src/list_header/__snapshots__/list_header.test.tsx.snap
+++ b/packages/kbn-securitysolution-exception-list-components/src/list_header/__snapshots__/list_header.test.tsx.snap
@@ -57,7 +57,7 @@ Object {
                   class="euiTitle emotion-euiTitle-l"
                 >
                   <div
-                    class="euiFlexGroup css-nhr7ke"
+                    class="euiFlexGroup emotion-euiFlexGroup-responsive-l-flexStart-stretch-row"
                   >
                     <div
                       class="euiFlexItem emotion-euiFlexItem-grow-10"
@@ -69,7 +69,7 @@ Object {
                       </span>
                     </div>
                     <div
-                      class="euiFlexItem emotion-EuiFlexItem"
+                      class="euiFlexItem emotion-euiFlexItem-growZero"
                     >
                       <button
                         aria-label="Edit Text List Header"
@@ -98,7 +98,7 @@ Object {
                       css="You have tried to stringify object returned from \`css\` function. It isn't supposed to be used directly (e.g. as value of the \`className\` prop), but rather handed to emotion so it can handle it (e.g. as value of \`css\` prop)."
                     >
                       <div
-                        class="euiFlexGroup css-nhr7ke"
+                        class="euiFlexGroup emotion-euiFlexGroup-responsive-l-flexStart-stretch-row"
                       >
                         <div
                           class="euiFlexItem emotion-euiFlexItem-grow-10"
@@ -111,7 +111,7 @@ Object {
                           </span>
                         </div>
                         <div
-                          class="euiFlexItem emotion-EuiFlexItem"
+                          class="euiFlexItem emotion-euiFlexItem-growZero"
                         >
                           <button
                             aria-label="Edit Text List Header"
@@ -162,7 +162,7 @@ Object {
                       data-test-subj="RightSideMenuItemsContainer"
                     >
                       <div
-                        class="euiFlexItem emotion-EuiFlexItem"
+                        class="euiFlexItem emotion-euiFlexItem-grow-1"
                       >
                         <span
                           class="emotion-EuiTextColor"
@@ -442,7 +442,7 @@ Object {
                 class="euiTitle emotion-euiTitle-l"
               >
                 <div
-                  class="euiFlexGroup css-nhr7ke"
+                  class="euiFlexGroup emotion-euiFlexGroup-responsive-l-flexStart-stretch-row"
                 >
                   <div
                     class="euiFlexItem emotion-euiFlexItem-grow-10"
@@ -454,7 +454,7 @@ Object {
                     </span>
                   </div>
                   <div
-                    class="euiFlexItem emotion-EuiFlexItem"
+                    class="euiFlexItem emotion-euiFlexItem-growZero"
                   >
                     <button
                       aria-label="Edit Text List Header"
@@ -483,7 +483,7 @@ Object {
                     css="You have tried to stringify object returned from \`css\` function. It isn't supposed to be used directly (e.g. as value of the \`className\` prop), but rather handed to emotion so it can handle it (e.g. as value of \`css\` prop)."
                   >
                     <div
-                      class="euiFlexGroup css-nhr7ke"
+                      class="euiFlexGroup emotion-euiFlexGroup-responsive-l-flexStart-stretch-row"
                     >
                       <div
                         class="euiFlexItem emotion-euiFlexItem-grow-10"
@@ -496,7 +496,7 @@ Object {
                         </span>
                       </div>
                       <div
-                        class="euiFlexItem emotion-EuiFlexItem"
+                        class="euiFlexItem emotion-euiFlexItem-growZero"
                       >
                         <button
                           aria-label="Edit Text List Header"
@@ -547,7 +547,7 @@ Object {
                     data-test-subj="RightSideMenuItemsContainer"
                   >
                     <div
-                      class="euiFlexItem emotion-EuiFlexItem"
+                      class="euiFlexItem emotion-euiFlexItem-grow-1"
                     >
                       <span
                         class="emotion-EuiTextColor"
@@ -721,7 +721,7 @@ Object {
                   class="euiTitle emotion-euiTitle-l"
                 >
                   <div
-                    class="euiFlexGroup css-nhr7ke"
+                    class="euiFlexGroup emotion-euiFlexGroup-responsive-l-flexStart-stretch-row"
                   >
                     <div
                       class="euiFlexItem emotion-euiFlexItem-grow-10"
@@ -733,7 +733,7 @@ Object {
                       </span>
                     </div>
                     <div
-                      class="euiFlexItem emotion-EuiFlexItem"
+                      class="euiFlexItem emotion-euiFlexItem-growZero"
                     >
                       <button
                         aria-label="Edit Text List Header"
@@ -762,7 +762,7 @@ Object {
                       css="You have tried to stringify object returned from \`css\` function. It isn't supposed to be used directly (e.g. as value of the \`className\` prop), but rather handed to emotion so it can handle it (e.g. as value of \`css\` prop)."
                     >
                       <div
-                        class="euiFlexGroup css-nhr7ke"
+                        class="euiFlexGroup emotion-euiFlexGroup-responsive-l-flexStart-stretch-row"
                       >
                         <div
                           class="euiFlexItem emotion-euiFlexItem-grow-10"
@@ -775,7 +775,7 @@ Object {
                           </span>
                         </div>
                         <div
-                          class="euiFlexItem emotion-EuiFlexItem"
+                          class="euiFlexItem emotion-euiFlexItem-growZero"
                         >
                           <button
                             aria-label="Edit Text List Header"
@@ -826,7 +826,7 @@ Object {
                       data-test-subj="RightSideMenuItemsContainer"
                     >
                       <div
-                        class="euiFlexItem emotion-EuiFlexItem"
+                        class="euiFlexItem emotion-euiFlexItem-grow-1"
                       >
                         <span
                           class="emotion-EuiTextColor"
@@ -943,7 +943,7 @@ Object {
                 class="euiTitle emotion-euiTitle-l"
               >
                 <div
-                  class="euiFlexGroup css-nhr7ke"
+                  class="euiFlexGroup emotion-euiFlexGroup-responsive-l-flexStart-stretch-row"
                 >
                   <div
                     class="euiFlexItem emotion-euiFlexItem-grow-10"
@@ -955,7 +955,7 @@ Object {
                     </span>
                   </div>
                   <div
-                    class="euiFlexItem emotion-EuiFlexItem"
+                    class="euiFlexItem emotion-euiFlexItem-growZero"
                   >
                     <button
                       aria-label="Edit Text List Header"
@@ -984,7 +984,7 @@ Object {
                     css="You have tried to stringify object returned from \`css\` function. It isn't supposed to be used directly (e.g. as value of the \`className\` prop), but rather handed to emotion so it can handle it (e.g. as value of \`css\` prop)."
                   >
                     <div
-                      class="euiFlexGroup css-nhr7ke"
+                      class="euiFlexGroup emotion-euiFlexGroup-responsive-l-flexStart-stretch-row"
                     >
                       <div
                         class="euiFlexItem emotion-euiFlexItem-grow-10"
@@ -997,7 +997,7 @@ Object {
                         </span>
                       </div>
                       <div
-                        class="euiFlexItem emotion-EuiFlexItem"
+                        class="euiFlexItem emotion-euiFlexItem-growZero"
                       >
                         <button
                           aria-label="Edit Text List Header"
@@ -1048,7 +1048,7 @@ Object {
                     data-test-subj="RightSideMenuItemsContainer"
                   >
                     <div
-                      class="euiFlexItem emotion-EuiFlexItem"
+                      class="euiFlexItem emotion-euiFlexItem-grow-1"
                     >
                       <span
                         class="emotion-EuiTextColor"
@@ -1222,7 +1222,7 @@ Object {
                   class="euiTitle emotion-euiTitle-l"
                 >
                   <div
-                    class="euiFlexGroup css-nhr7ke"
+                    class="euiFlexGroup emotion-euiFlexGroup-responsive-l-flexStart-stretch-row"
                   >
                     <div
                       class="euiFlexItem emotion-euiFlexItem-grow-10"
@@ -1234,7 +1234,7 @@ Object {
                       </span>
                     </div>
                     <div
-                      class="euiFlexItem emotion-EuiFlexItem"
+                      class="euiFlexItem emotion-euiFlexItem-growZero"
                     />
                   </div>
                 </h1>
@@ -1249,7 +1249,7 @@ Object {
                       css="You have tried to stringify object returned from \`css\` function. It isn't supposed to be used directly (e.g. as value of the \`className\` prop), but rather handed to emotion so it can handle it (e.g. as value of \`css\` prop)."
                     >
                       <div
-                        class="euiFlexGroup css-nhr7ke"
+                        class="euiFlexGroup emotion-euiFlexGroup-responsive-l-flexStart-stretch-row"
                       >
                         <div
                           class="euiFlexItem emotion-euiFlexItem-grow-10"
@@ -1262,7 +1262,7 @@ Object {
                           </span>
                         </div>
                         <div
-                          class="euiFlexItem emotion-EuiFlexItem"
+                          class="euiFlexItem emotion-euiFlexItem-growZero"
                         />
                       </div>
                       <div
@@ -1299,7 +1299,7 @@ Object {
                       data-test-subj="RightSideMenuItemsContainer"
                     >
                       <div
-                        class="euiFlexItem emotion-EuiFlexItem"
+                        class="euiFlexItem emotion-euiFlexItem-grow-1"
                       >
                         <span
                           class="emotion-EuiTextColor"
@@ -1417,7 +1417,7 @@ Object {
                 class="euiTitle emotion-euiTitle-l"
               >
                 <div
-                  class="euiFlexGroup css-nhr7ke"
+                  class="euiFlexGroup emotion-euiFlexGroup-responsive-l-flexStart-stretch-row"
                 >
                   <div
                     class="euiFlexItem emotion-euiFlexItem-grow-10"
@@ -1429,7 +1429,7 @@ Object {
                     </span>
                   </div>
                   <div
-                    class="euiFlexItem emotion-EuiFlexItem"
+                    class="euiFlexItem emotion-euiFlexItem-growZero"
                   />
                 </div>
               </h1>
@@ -1444,7 +1444,7 @@ Object {
                     css="You have tried to stringify object returned from \`css\` function. It isn't supposed to be used directly (e.g. as value of the \`className\` prop), but rather handed to emotion so it can handle it (e.g. as value of \`css\` prop)."
                   >
                     <div
-                      class="euiFlexGroup css-nhr7ke"
+                      class="euiFlexGroup emotion-euiFlexGroup-responsive-l-flexStart-stretch-row"
                     >
                       <div
                         class="euiFlexItem emotion-euiFlexItem-grow-10"
@@ -1457,7 +1457,7 @@ Object {
                         </span>
                       </div>
                       <div
-                        class="euiFlexItem emotion-EuiFlexItem"
+                        class="euiFlexItem emotion-euiFlexItem-growZero"
                       />
                     </div>
                     <div
@@ -1494,7 +1494,7 @@ Object {
                     data-test-subj="RightSideMenuItemsContainer"
                   >
                     <div
-                      class="euiFlexItem emotion-EuiFlexItem"
+                      class="euiFlexItem emotion-euiFlexItem-grow-1"
                     >
                       <span
                         class="emotion-EuiTextColor"
@@ -1669,7 +1669,7 @@ Object {
                   class="euiTitle emotion-euiTitle-l"
                 >
                   <div
-                    class="euiFlexGroup css-nhr7ke"
+                    class="euiFlexGroup emotion-euiFlexGroup-responsive-l-flexStart-stretch-row"
                   >
                     <div
                       class="euiFlexItem emotion-euiFlexItem-grow-10"
@@ -1681,7 +1681,7 @@ Object {
                       </span>
                     </div>
                     <div
-                      class="euiFlexItem emotion-EuiFlexItem"
+                      class="euiFlexItem emotion-euiFlexItem-growZero"
                     />
                   </div>
                 </h1>
@@ -1696,7 +1696,7 @@ Object {
                       css="You have tried to stringify object returned from \`css\` function. It isn't supposed to be used directly (e.g. as value of the \`className\` prop), but rather handed to emotion so it can handle it (e.g. as value of \`css\` prop)."
                     >
                       <div
-                        class="euiFlexGroup css-nhr7ke"
+                        class="euiFlexGroup emotion-euiFlexGroup-responsive-l-flexStart-stretch-row"
                       >
                         <div
                           class="euiFlexItem emotion-euiFlexItem-grow-10"
@@ -1709,7 +1709,7 @@ Object {
                           </span>
                         </div>
                         <div
-                          class="euiFlexItem emotion-EuiFlexItem"
+                          class="euiFlexItem emotion-euiFlexItem-growZero"
                         />
                       </div>
                       <div
@@ -1746,7 +1746,7 @@ Object {
                       data-test-subj="RightSideMenuItemsContainer"
                     >
                       <div
-                        class="euiFlexItem emotion-EuiFlexItem"
+                        class="euiFlexItem emotion-euiFlexItem-grow-1"
                       >
                         <span
                           class="emotion-EuiTextColor"
@@ -1934,7 +1934,7 @@ Object {
                 class="euiTitle emotion-euiTitle-l"
               >
                 <div
-                  class="euiFlexGroup css-nhr7ke"
+                  class="euiFlexGroup emotion-euiFlexGroup-responsive-l-flexStart-stretch-row"
                 >
                   <div
                     class="euiFlexItem emotion-euiFlexItem-grow-10"
@@ -1946,7 +1946,7 @@ Object {
                     </span>
                   </div>
                   <div
-                    class="euiFlexItem emotion-EuiFlexItem"
+                    class="euiFlexItem emotion-euiFlexItem-growZero"
                   />
                 </div>
               </h1>
@@ -1961,7 +1961,7 @@ Object {
                     css="You have tried to stringify object returned from \`css\` function. It isn't supposed to be used directly (e.g. as value of the \`className\` prop), but rather handed to emotion so it can handle it (e.g. as value of \`css\` prop)."
                   >
                     <div
-                      class="euiFlexGroup css-nhr7ke"
+                      class="euiFlexGroup emotion-euiFlexGroup-responsive-l-flexStart-stretch-row"
                     >
                       <div
                         class="euiFlexItem emotion-euiFlexItem-grow-10"
@@ -1974,7 +1974,7 @@ Object {
                         </span>
                       </div>
                       <div
-                        class="euiFlexItem emotion-EuiFlexItem"
+                        class="euiFlexItem emotion-euiFlexItem-growZero"
                       />
                     </div>
                     <div
@@ -2011,7 +2011,7 @@ Object {
                     data-test-subj="RightSideMenuItemsContainer"
                   >
                     <div
-                      class="euiFlexItem emotion-EuiFlexItem"
+                      class="euiFlexItem emotion-euiFlexItem-grow-1"
                     >
                       <span
                         class="emotion-EuiTextColor"
diff --git a/packages/kbn-securitysolution-exception-list-components/src/list_header/menu_items/__snapshots__/menu_items.test.tsx.snap b/packages/kbn-securitysolution-exception-list-components/src/list_header/menu_items/__snapshots__/menu_items.test.tsx.snap
index a58f4a042bca32..a08e9f336802af 100644
--- a/packages/kbn-securitysolution-exception-list-components/src/list_header/menu_items/__snapshots__/menu_items.test.tsx.snap
+++ b/packages/kbn-securitysolution-exception-list-components/src/list_header/menu_items/__snapshots__/menu_items.test.tsx.snap
@@ -10,7 +10,7 @@ Object {
         data-test-subj="Container"
       >
         <div
-          class="euiFlexItem emotion-EuiFlexItem"
+          class="euiFlexItem emotion-euiFlexItem-grow-1"
         >
           <div
             class="euiFlexGroup emotion-euiFlexGroup-responsive-l-flexStart-stretch-row"
@@ -77,7 +77,7 @@ Object {
       data-test-subj="Container"
     >
       <div
-        class="euiFlexItem emotion-EuiFlexItem"
+        class="euiFlexItem emotion-euiFlexItem-grow-1"
       >
         <div
           class="euiFlexGroup emotion-euiFlexGroup-responsive-l-flexStart-stretch-row"
@@ -201,7 +201,7 @@ Object {
         data-test-subj="Container"
       >
         <div
-          class="euiFlexItem emotion-EuiFlexItem"
+          class="euiFlexItem emotion-euiFlexItem-grow-1"
         >
           <span
             class="emotion-EuiTextColor"
@@ -264,7 +264,7 @@ Object {
       data-test-subj="Container"
     >
       <div
-        class="euiFlexItem emotion-EuiFlexItem"
+        class="euiFlexItem emotion-euiFlexItem-grow-1"
       >
         <span
           class="emotion-EuiTextColor"
@@ -384,7 +384,7 @@ Object {
         data-test-subj="Container"
       >
         <div
-          class="euiFlexItem emotion-EuiFlexItem"
+          class="euiFlexItem emotion-euiFlexItem-grow-1"
         >
           <span
             class="emotion-EuiTextColor"
@@ -535,7 +535,7 @@ Object {
       data-test-subj="Container"
     >
       <div
-        class="euiFlexItem emotion-EuiFlexItem"
+        class="euiFlexItem emotion-euiFlexItem-grow-1"
       >
         <span
           class="emotion-EuiTextColor"
@@ -655,7 +655,7 @@ Object {
         data-test-subj="Container"
       >
         <div
-          class="euiFlexItem emotion-EuiFlexItem"
+          class="euiFlexItem emotion-euiFlexItem-grow-1"
         >
           <div
             class="euiFlexGroup emotion-euiFlexGroup-responsive-l-flexStart-stretch-row"
@@ -812,7 +812,7 @@ Object {
       data-test-subj="Container"
     >
       <div
-        class="euiFlexItem emotion-EuiFlexItem"
+        class="euiFlexItem emotion-euiFlexItem-grow-1"
       >
         <div
           class="euiFlexGroup emotion-euiFlexGroup-responsive-l-flexStart-stretch-row"
@@ -936,7 +936,7 @@ Object {
         data-test-subj="Container"
       >
         <div
-          class="euiFlexItem emotion-EuiFlexItem"
+          class="euiFlexItem emotion-euiFlexItem-grow-1"
         >
           <div
             class="euiFlexGroup emotion-euiFlexGroup-responsive-l-flexStart-stretch-row"
@@ -1022,7 +1022,7 @@ Object {
       data-test-subj="Container"
     >
       <div
-        class="euiFlexItem emotion-EuiFlexItem"
+        class="euiFlexItem emotion-euiFlexItem-grow-1"
       >
         <div
           class="euiFlexGroup emotion-euiFlexGroup-responsive-l-flexStart-stretch-row"
diff --git a/packages/kbn-securitysolution-exception-list-components/src/text_with_edit/__snapshots__/text_with_edit.test.tsx.snap b/packages/kbn-securitysolution-exception-list-components/src/text_with_edit/__snapshots__/text_with_edit.test.tsx.snap
index bbd89a2a31d167..2f06c1efcee6d3 100644
--- a/packages/kbn-securitysolution-exception-list-components/src/text_with_edit/__snapshots__/text_with_edit.test.tsx.snap
+++ b/packages/kbn-securitysolution-exception-list-components/src/text_with_edit/__snapshots__/text_with_edit.test.tsx.snap
@@ -6,7 +6,7 @@ Object {
   "baseElement": <body>
     <div>
       <div
-        class="euiFlexGroup css-nhr7ke"
+        class="euiFlexGroup emotion-euiFlexGroup-responsive-l-flexStart-stretch-row"
       >
         <div
           class="euiFlexItem emotion-euiFlexItem-grow-10"
@@ -18,14 +18,14 @@ Object {
           </span>
         </div>
         <div
-          class="euiFlexItem emotion-EuiFlexItem"
+          class="euiFlexItem emotion-euiFlexItem-growZero"
         />
       </div>
     </div>
   </body>,
   "container": <div>
     <div
-      class="euiFlexGroup css-nhr7ke"
+      class="euiFlexGroup emotion-euiFlexGroup-responsive-l-flexStart-stretch-row"
     >
       <div
         class="euiFlexItem emotion-euiFlexItem-grow-10"
@@ -37,7 +37,7 @@ Object {
         </span>
       </div>
       <div
-        class="euiFlexItem emotion-EuiFlexItem"
+        class="euiFlexItem emotion-euiFlexItem-growZero"
       />
     </div>
   </div>,
@@ -101,7 +101,7 @@ Object {
   "baseElement": <body>
     <div>
       <div
-        class="euiFlexGroup css-nhr7ke"
+        class="euiFlexGroup emotion-euiFlexGroup-responsive-l-flexStart-stretch-row"
       >
         <div
           class="euiFlexItem emotion-euiFlexItem-grow-10"
@@ -113,7 +113,7 @@ Object {
           </span>
         </div>
         <div
-          class="euiFlexItem emotion-EuiFlexItem"
+          class="euiFlexItem emotion-euiFlexItem-growZero"
         >
           <button
             aria-label="Edit Text List Header"
@@ -134,7 +134,7 @@ Object {
   </body>,
   "container": <div>
     <div
-      class="euiFlexGroup css-nhr7ke"
+      class="euiFlexGroup emotion-euiFlexGroup-responsive-l-flexStart-stretch-row"
     >
       <div
         class="euiFlexItem emotion-euiFlexItem-grow-10"
@@ -146,7 +146,7 @@ Object {
         </span>
       </div>
       <div
-        class="euiFlexItem emotion-EuiFlexItem"
+        class="euiFlexItem emotion-euiFlexItem-growZero"
       >
         <button
           aria-label="Edit Text List Header"
diff --git a/packages/kbn-telemetry-tools/src/cli/run_telemetry_check.ts b/packages/kbn-telemetry-tools/src/cli/run_telemetry_check.ts
index ed5a7ff8b81356..3f11b61d1e4be4 100644
--- a/packages/kbn-telemetry-tools/src/cli/run_telemetry_check.ts
+++ b/packages/kbn-telemetry-tools/src/cli/run_telemetry_check.ts
@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 
-import Listr from 'listr';
+import { Listr } from 'listr2';
 import chalk from 'chalk';
 import { createFailError } from '@kbn/dev-cli-errors';
 import { run } from '@kbn/dev-cli-runner';
@@ -48,22 +48,22 @@ export function runTelemetryCheck() {
         );
       }
 
-      const list = new Listr(
+      const list = new Listr<TaskContext>(
         [
           {
             title: 'Checking .telemetryrc.json files',
-            task: () => new Listr(parseConfigsTask(), { exitOnError: true }),
+            task: (context, task) => task.newListr(parseConfigsTask(), { exitOnError: true }),
           },
           {
             title: 'Extracting Collectors',
-            task: (context) =>
-              new Listr(extractCollectorsTask(context, path), { exitOnError: true }),
+            task: (context, task) =>
+              task.newListr(extractCollectorsTask(context, path), { exitOnError: true }),
           },
           {
             enabled: () => typeof path !== 'undefined',
             title: 'Checking collectors in --path are not excluded',
-            task: ({ roots }: TaskContext) => {
-              const totalCollections = roots.reduce((acc, root) => {
+            task: (context) => {
+              const totalCollections = context.roots.reduce((acc, root) => {
                 return acc + (root.parsedCollections?.length || 0);
               }, 0);
               const collectorsInPath = Array.isArray(path) ? path.length : 1;
@@ -77,39 +77,41 @@ export function runTelemetryCheck() {
           },
           {
             title: 'Checking Compatible collector.schema with collector.fetch type',
-            task: (context) => new Listr(checkCompatibleTypesTask(context), { exitOnError: true }),
+            task: (context, task) =>
+              task.newListr(checkCompatibleTypesTask(context), { exitOnError: true }),
           },
           {
             enabled: (_) => fix || !ignoreStoredJson,
             title: 'Checking Matching collector.schema against stored json files',
-            task: (context) =>
-              new Listr(checkMatchingSchemasTask(context, !fix), { exitOnError: true }),
+            task: (context, task) =>
+              task.newListr(checkMatchingSchemasTask(context, !fix), { exitOnError: true }),
           },
           {
             enabled: (_) => fix,
-            skip: ({ roots }: TaskContext) => {
-              const noDiffs = roots.every(
+            skip: (context) => {
+              const noDiffs = context.roots.every(
                 ({ esMappingDiffs }) => !esMappingDiffs || !esMappingDiffs.length
               );
               return noDiffs && 'No changes needed.';
             },
             title: 'Generating new telemetry mappings',
-            task: (context) => new Listr(generateSchemasTask(context), { exitOnError: true }),
+            task: (context, task) =>
+              task.newListr(generateSchemasTask(context), { exitOnError: true }),
           },
           {
             enabled: (_) => fix,
-            skip: ({ roots }: TaskContext) => {
-              const noDiffs = roots.every(
+            skip: (context) => {
+              const noDiffs = context.roots.every(
                 ({ esMappingDiffs }) => !esMappingDiffs || !esMappingDiffs.length
               );
               return noDiffs && 'No changes needed.';
             },
             title: 'Updating telemetry mapping files',
-            task: (context) => new Listr(writeToFileTask(context), { exitOnError: true }),
+            task: (context, task) => task.newListr(writeToFileTask(context), { exitOnError: true }),
           },
         ],
         {
-          renderer: process.env.CI ? 'verbose' : 'default',
+          renderer: process.env.CI ? 'verbose' : ('default' as any),
         }
       );
 
diff --git a/packages/kbn-telemetry-tools/src/cli/run_telemetry_extract.ts b/packages/kbn-telemetry-tools/src/cli/run_telemetry_extract.ts
index 22790ab6a05783..b55833f86c290e 100644
--- a/packages/kbn-telemetry-tools/src/cli/run_telemetry_extract.ts
+++ b/packages/kbn-telemetry-tools/src/cli/run_telemetry_extract.ts
@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 
-import Listr from 'listr';
+import { Listr } from 'listr2';
 import { run } from '@kbn/dev-cli-runner';
 
 import {
@@ -25,19 +25,21 @@ export function runTelemetryExtract() {
         [
           {
             title: 'Parsing .telemetryrc.json files',
-            task: () => new Listr(parseConfigsTask(), { exitOnError: true }),
+            task: (context, task) => task.newListr(parseConfigsTask(), { exitOnError: true }),
           },
           {
             title: 'Extracting Telemetry Collectors',
-            task: (context) => new Listr(extractCollectorsTask(context), { exitOnError: true }),
+            task: (context, task) =>
+              task.newListr(extractCollectorsTask(context), { exitOnError: true }),
           },
           {
             title: 'Generating Schema files',
-            task: (context) => new Listr(generateSchemasTask(context), { exitOnError: true }),
+            task: (context, task) =>
+              task.newListr(generateSchemasTask(context), { exitOnError: true }),
           },
           {
             title: 'Writing to file',
-            task: (context) => new Listr(writeToFileTask(context), { exitOnError: true }),
+            task: (context, task) => task.newListr(writeToFileTask(context), { exitOnError: true }),
           },
         ],
         {
diff --git a/packages/kbn-unified-data-table/src/utils/get_render_cell_value.test.tsx b/packages/kbn-unified-data-table/src/utils/get_render_cell_value.test.tsx
index 8d18c7d454db7b..04d160bef5c2ef 100644
--- a/packages/kbn-unified-data-table/src/utils/get_render_cell_value.test.tsx
+++ b/packages/kbn-unified-data-table/src/utils/get_render_cell_value.test.tsx
@@ -156,7 +156,7 @@ describe('Unified data table cell rendering', function () {
       />
     );
     expect(component.html()).toMatchInlineSnapshot(
-      `"<div class=\\"euiFlexGroup css-1h68cm-euiFlexGroup-none-flexStart-stretch-row\\" data-test-subj=\\"dataTableExpandCellActionPopover\\"><div class=\\"euiFlexItem css-9sbomz-euiFlexItem-grow-1\\"><span class=\\"unifiedDataTable__cellPopoverValue eui-textBreakWord\\"><span>100</span></span></div><div class=\\"euiFlexItem css-kpsrin-euiFlexItem-growZero\\"><button class=\\"euiButtonIcon css-1gd56qr-euiButtonIcon-xs-empty-primary\\" type=\\"button\\" aria-label=\\"Close popover\\" data-test-subj=\\"docTableClosePopover\\"><span data-euiicon-type=\\"cross\\" class=\\"euiButtonIcon__icon\\" aria-hidden=\\"true\\" color=\\"inherit\\"></span></button></div></div>"`
+      `"<div data-test-subj=\\"dataTableExpandCellActionPopover\\" class=\\"euiFlexGroup css-1h68cm-euiFlexGroup-none-flexStart-stretch-row\\"><div class=\\"euiFlexItem css-9sbomz-euiFlexItem-grow-1\\"><span class=\\"unifiedDataTable__cellPopoverValue eui-textBreakWord\\"><span>100</span></span></div><div class=\\"euiFlexItem css-kpsrin-euiFlexItem-growZero\\"><button class=\\"euiButtonIcon css-1gd56qr-euiButtonIcon-xs-empty-primary\\" type=\\"button\\" aria-label=\\"Close popover\\" data-test-subj=\\"docTableClosePopover\\"><span data-euiicon-type=\\"cross\\" class=\\"euiButtonIcon__icon\\" aria-hidden=\\"true\\" color=\\"inherit\\"></span></button></div></div>"`
     );
   });
 
@@ -183,7 +183,7 @@ describe('Unified data table cell rendering', function () {
       />
     );
     expect(component.html()).toMatchInlineSnapshot(
-      `"<div class=\\"euiFlexGroup css-1h68cm-euiFlexGroup-none-flexStart-stretch-row\\" data-test-subj=\\"dataTableExpandCellActionPopover\\"><div class=\\"euiFlexItem css-9sbomz-euiFlexItem-grow-1\\"><span class=\\"unifiedDataTable__cellPopoverValue eui-textBreakWord\\"><span>100</span></span></div><div class=\\"euiFlexItem css-kpsrin-euiFlexItem-growZero\\"><button class=\\"euiButtonIcon css-1gd56qr-euiButtonIcon-xs-empty-primary\\" type=\\"button\\" aria-label=\\"Close popover\\" data-test-subj=\\"docTableClosePopover\\"><span data-euiicon-type=\\"cross\\" class=\\"euiButtonIcon__icon\\" aria-hidden=\\"true\\" color=\\"inherit\\"></span></button></div></div>"`
+      `"<div data-test-subj=\\"dataTableExpandCellActionPopover\\" class=\\"euiFlexGroup css-1h68cm-euiFlexGroup-none-flexStart-stretch-row\\"><div class=\\"euiFlexItem css-9sbomz-euiFlexItem-grow-1\\"><span class=\\"unifiedDataTable__cellPopoverValue eui-textBreakWord\\"><span>100</span></span></div><div class=\\"euiFlexItem css-kpsrin-euiFlexItem-growZero\\"><button class=\\"euiButtonIcon css-1gd56qr-euiButtonIcon-xs-empty-primary\\" type=\\"button\\" aria-label=\\"Close popover\\" data-test-subj=\\"docTableClosePopover\\"><span data-euiicon-type=\\"cross\\" class=\\"euiButtonIcon__icon\\" aria-hidden=\\"true\\" color=\\"inherit\\"></span></button></div></div>"`
     );
     findTestSubject(component, 'docTableClosePopover').simulate('click');
     expect(closePopoverMockFn).toHaveBeenCalledTimes(1);
diff --git a/packages/kbn-visualization-ui-components/components/field_picker/field_picker.tsx b/packages/kbn-visualization-ui-components/components/field_picker/field_picker.tsx
index 94b3977c8b031d..414b17ccd908de 100644
--- a/packages/kbn-visualization-ui-components/components/field_picker/field_picker.tsx
+++ b/packages/kbn-visualization-ui-components/components/field_picker/field_picker.tsx
@@ -10,6 +10,7 @@ import './field_picker.scss';
 import React from 'react';
 import { i18n } from '@kbn/i18n';
 import classNames from 'classnames';
+import { comboBoxFieldOptionMatcher } from '@kbn/field-utils';
 import { EuiComboBox, EuiComboBoxOptionOption, EuiComboBoxProps } from '@elastic/eui';
 import { FieldIcon } from '@kbn/field-utils/src/components/field_icon';
 import { calculateWidthFromCharCount } from '@kbn/calculate-width-from-char-count';
@@ -91,6 +92,7 @@ export function FieldPicker<T extends FieldOptionValue = FieldOptionValue>(
       placeholder={i18n.translate('visualizationUiComponents.fieldPicker.fieldPlaceholder', {
         defaultMessage: 'Select a field',
       })}
+      optionMatcher={comboBoxFieldOptionMatcher}
       options={styledOptions}
       isInvalid={fieldIsInvalid}
       selectedOptions={selectedOption ? [selectedOption] : []}
diff --git a/packages/kbn-visualization-utils/src/get_lens_attributes.test.ts b/packages/kbn-visualization-utils/src/get_lens_attributes.test.ts
index 8b0a22c63d005b..bd0a24dd554f34 100644
--- a/packages/kbn-visualization-utils/src/get_lens_attributes.test.ts
+++ b/packages/kbn-visualization-utils/src/get_lens_attributes.test.ts
@@ -37,13 +37,7 @@ describe('getLensAttributesFromSuggestion', () => {
           'index-pattern-with-timefield-id': {},
         },
       }),
-      references: [
-        {
-          id: 'index-pattern-with-timefield-id',
-          name: 'textBasedLanguages-datasource-layer-suggestion',
-          type: 'index-pattern',
-        },
-      ],
+      references: [],
       title: currentSuggestionMock.title,
       visualizationType: 'lnsHeatmap',
     });
diff --git a/packages/kbn-visualization-utils/src/get_lens_attributes.ts b/packages/kbn-visualization-utils/src/get_lens_attributes.ts
index 3a62c7bee736f2..2a1fe66dc680d5 100644
--- a/packages/kbn-visualization-utils/src/get_lens_attributes.ts
+++ b/packages/kbn-visualization-utils/src/get_lens_attributes.ts
@@ -50,13 +50,7 @@ export const getLensAttributesFromSuggestion = ({
       i18n.translate('visualizationUtils.config.suggestion.title', {
         defaultMessage: 'New suggestion',
       }),
-    references: [
-      {
-        id: dataView?.id ?? '',
-        name: `textBasedLanguages-datasource-layer-suggestion`,
-        type: 'index-pattern',
-      },
-    ],
+    references: [],
     state: {
       datasourceStates,
       filters,
diff --git a/packages/serverless/settings/observability_project/index.ts b/packages/serverless/settings/observability_project/index.ts
index b6cd0a21fb0f34..e9b5ceeee5eedb 100644
--- a/packages/serverless/settings/observability_project/index.ts
+++ b/packages/serverless/settings/observability_project/index.ts
@@ -32,4 +32,5 @@ export const OBSERVABILITY_PROJECT_SETTINGS = [
   settings.OBSERVABILITY_LOGS_EXPLORER_ALLOWED_DATA_VIEWS_ID,
   settings.OBSERVABILITY_APM_ENABLE_TABLE_SEARCH_BAR,
   settings.OBSERVABILITY_APM_ENABLE_SERVICE_INVENTORY_TABLE_SEARCH_BAR,
+  settings.OBSERVABILITY_APM_ENABLE_MULTI_SIGNAL,
 ];
diff --git a/packages/shared-ux/avatar/solution/package.json b/packages/shared-ux/avatar/solution/package.json
index 84cd3fb6e597d1..7ebb65ba7cd32f 100644
--- a/packages/shared-ux/avatar/solution/package.json
+++ b/packages/shared-ux/avatar/solution/package.json
@@ -3,5 +3,5 @@
   "private": true,
   "version": "1.0.0",
   "license": "SSPL-1.0 OR Elastic License 2.0",
-  "sideEffects": false
+  "sideEffects": ["*.scss"]
 }
\ No newline at end of file
diff --git a/packages/shared-ux/button/exit_full_screen/package.json b/packages/shared-ux/button/exit_full_screen/package.json
index 0cbd7067a2465a..338264b5ecbf50 100644
--- a/packages/shared-ux/button/exit_full_screen/package.json
+++ b/packages/shared-ux/button/exit_full_screen/package.json
@@ -3,5 +3,5 @@
   "private": true,
   "version": "1.0.0",
   "license": "SSPL-1.0 OR Elastic License 2.0",
-  "sideEffects": false
+  "sideEffects": ["*.scss"]
 }
\ No newline at end of file
diff --git a/packages/shared-ux/chrome/navigation/package.json b/packages/shared-ux/chrome/navigation/package.json
index 3409c5e815049a..74a4a5b42a923e 100644
--- a/packages/shared-ux/chrome/navigation/package.json
+++ b/packages/shared-ux/chrome/navigation/package.json
@@ -3,5 +3,5 @@
   "private": true,
   "version": "1.0.0",
   "license": "SSPL-1.0 OR Elastic License 2.0",
-  "sideEffects": false
+  "sideEffects": ["*.scss"]
 }
\ No newline at end of file
diff --git a/packages/shared-ux/file/file_picker/impl/package.json b/packages/shared-ux/file/file_picker/impl/package.json
index b2e7d0fb874032..1f6ae6648a0815 100644
--- a/packages/shared-ux/file/file_picker/impl/package.json
+++ b/packages/shared-ux/file/file_picker/impl/package.json
@@ -3,5 +3,5 @@
   "private": true,
   "version": "1.0.0",
   "license": "SSPL-1.0 OR Elastic License 2.0",
-  "sideEffects": false
+  "sideEffects": ["*.scss"]
 }
diff --git a/packages/shared-ux/page/solution_nav/package.json b/packages/shared-ux/page/solution_nav/package.json
index f133dbd40daab1..53a5979da78b1e 100644
--- a/packages/shared-ux/page/solution_nav/package.json
+++ b/packages/shared-ux/page/solution_nav/package.json
@@ -3,5 +3,5 @@
   "private": true,
   "version": "1.0.0",
   "license": "SSPL-1.0 OR Elastic License 2.0",
-  "sideEffects": false
+  "sideEffects": ["*.scss"]
 }
\ No newline at end of file
diff --git a/renovate.json b/renovate.json
index 87cf0e30347736..9393a7b005225f 100644
--- a/renovate.json
+++ b/renovate.json
@@ -157,6 +157,24 @@
       ],
       "enabled": true
     },
+    {
+      "groupName": "OpenAPI Spec",
+      "matchPackageNames": [
+        "@redocly/cli"
+      ],
+      "reviewers": [
+        "team:kibana-core"
+      ],
+      "matchBaseBranches": [
+        "main"
+      ],
+      "labels": [
+        "release_note:skip",
+        "Team:Core",
+        "backport:all-open"
+      ],
+      "enabled": true
+    },
     {
       "groupName": "babel",
       "matchPackageNames": [
@@ -234,6 +252,24 @@
       ],
       "enabled": true
     },
+    {
+      "groupName": "CLI tooling",
+      "matchPackageNames": [
+        "listr2"
+      ],
+      "reviewers": [
+        "team:kibana-operations"
+      ],
+      "matchBaseBranches": [
+        "main"
+      ],
+      "labels": [
+        "Team:Operations",
+        "backport:all-open",
+        "release_note:skip"
+      ],
+      "enabled": true
+    },
     {
       "groupName": "vega related modules",
       "matchPackageNames": [
diff --git a/src/core/server/docs/kib_core_logging.mdx b/src/core/server/docs/kib_core_logging.mdx
index f117f0d54f7184..f097192865a96b 100644
--- a/src/core/server/docs/kib_core_logging.mdx
+++ b/src/core/server/docs/kib_core_logging.mdx
@@ -18,7 +18,8 @@ tags: ['kibana','dev', 'contributor', 'api docs']
 - [Appenders](#appenders)
   - [Rolling File Appender](#rolling-file-appender)
     - [Triggering Policies](#triggering-policies)
-    - [Rolling strategies](#rolling-strategies)
+    - [Rolling Strategies](#rolling-strategies)
+    - [Retention Policies](#retention-policies)
 - [Configuration](#configuration)
 - [Usage](#usage)
 - [Logging config migration](#logging-config-migration)
@@ -270,15 +271,13 @@ The default value is `true`.
 
 #### Rolling strategies
 
-The rolling strategy determines how the rollover should occur: both the naming of the rolled files,
-and their retention policy.
+The rolling strategy determines how the naming of the rolled file should be performed.
 
 There is currently one strategy supported: `numeric`.
 
 ##### NumericRollingStrategy
 
-This strategy will suffix the file with a given pattern when rolling,
-and will retains a fixed amount of rolled files.
+This strategy will suffix the file with a given pattern when rolling.
 
 ```yaml
 logging:
@@ -291,7 +290,8 @@ logging:
       strategy:
         type: numeric
         pattern: '-%i'
-        max: 2
+      retention:
+        maxFiles: 2
       layout:
         type: pattern
 ```
@@ -323,6 +323,86 @@ The maximum number of files to keep. Once this number is reached, oldest files w
 
 The default value is `7`
 
+**deprecated**: Please use a retention policy instead.
+
+#### Retention Policies
+
+The retention policy defines when the rolled files must be deleted.
+
+##### maxFiles
+
+Retention policy that will keep, at max, the defined number of files (ordered from the most recent to the oldest one)
+and delete the others. 
+
+This is the same behavior as what was previously achieved via the deprecated `strategy.max` field.
+
+**Example**: Appender configured to keep `5` rolled files:
+```yaml
+logging:
+  appenders:
+    rolling-file:
+      type: rolling-file
+      fileName: /var/logs/kibana.log
+      layout:
+        type: pattern
+      policy:
+        // ...
+      strategy:
+        // ...
+      retention:
+        maxFiles: 5
+```
+
+##### maxAccumulatedFileSize
+
+Retention policy based on the size on disk used by the rolled files. Size count will be
+performed from the most recent file to the oldest one, and will delete all files
+(including the one breaching the threshold) over the limit. Only the size from the rolled files is taken into 
+account (the active file is ignored).
+
+*Note:* The field supports the following optional suffixes: `b`, `kb`, `mb`, `gb` and `tb` (case-insensitive). The default suffix is `b`
+
+**Example**: Appender configured to keep 5GB of rolled logs at maximum:
+```yaml
+logging:
+  appenders:
+    rolling-file:
+      type: rolling-file
+      fileName: /var/logs/kibana.log
+      layout:
+        type: pattern
+      policy:
+        // ...
+      strategy:
+        // ...
+      retention:
+        maxAccumulatedFileSize: "5GB"
+```
+
+##### removeOlderThan
+
+Retention policy based on the time (modification date - `mtime`) the files were rolled, and that will delete all files
+that are older than the specified duration.
+
+*Note:* The field supports the following optional suffixes: `ms`, `s`, `m`, `h`, `d`, `w`, `M` and `Y`. The default suffix is `ms`.
+
+**Example**: Appender configured to delete rolled files after 30 days:
+```yaml
+logging:
+  appenders:
+    rolling-file:
+      type: rolling-file
+      fileName: /var/logs/kibana.log
+      layout:
+        type: pattern
+      policy:
+        // ...
+      strategy:
+        // ...
+      retention:
+        removeOlderThan: "30d"
+```
+
 ### Rewrite Appender
 
 *This appender is currently considered experimental and is not intended
diff --git a/src/core/server/integration_tests/ci_checks/saved_objects/check_registered_types.test.ts b/src/core/server/integration_tests/ci_checks/saved_objects/check_registered_types.test.ts
index 46893ca263afc9..2fa22873190e50 100644
--- a/src/core/server/integration_tests/ci_checks/saved_objects/check_registered_types.test.ts
+++ b/src/core/server/integration_tests/ci_checks/saved_objects/check_registered_types.test.ts
@@ -108,7 +108,7 @@ describe('checking migration metadata changes on all registered SO types', () =>
         "infra-custom-dashboards": "1a5994f2e05bb8a1609825ddbf5012f77c5c67f3",
         "infrastructure-monitoring-log-view": "5f86709d3c27aed7a8379153b08ee5d3d90d77f5",
         "infrastructure-ui-source": "113182d6895764378dfe7fa9fa027244f3a457c4",
-        "ingest-agent-policies": "d2ee0bf36a512c2ac744b0def1c822b7880f1f83",
+        "ingest-agent-policies": "803dc27e106440c41e8f3c3d8ee8bbb0821bcde2",
         "ingest-download-sources": "279a68147e62e4d8858c09ad1cf03bd5551ce58d",
         "ingest-outputs": "daafff49255ab700e07491376fe89f04fc998b91",
         "ingest-package-policies": "d63e091b2b3cf2eecaa46ae2533bdd5214a983fc",
diff --git a/src/core/server/integration_tests/logging/rolling_file_appender.test.ts b/src/core/server/integration_tests/logging/rolling_file_appender.test.ts
index 65fe152bdc9b07..c5a0760a09b741 100644
--- a/src/core/server/integration_tests/logging/rolling_file_appender.test.ts
+++ b/src/core/server/integration_tests/logging/rolling_file_appender.test.ts
@@ -60,7 +60,7 @@ describe('RollingFileAppender', () => {
   const expectedFileContent = (indices: number[]) => indices.map(message).join('\n') + '\n';
 
   describe('`size-limit` policy with `numeric` strategy', () => {
-    it('rolls the log file in the correct order', async () => {
+    it('supports the deprecated `strategy.max` field', async () => {
       root = createRoot({
         type: 'rolling-file',
         fileName: logFile,
@@ -106,7 +106,7 @@ describe('RollingFileAppender', () => {
       expect(await getFileContent('kibana.2.log')).toEqual(expectedFileContent([1, 2, 3]));
     });
 
-    it('only keep the correct number of files', async () => {
+    it('maxFile retention: only keep the correct number of files', async () => {
       root = createRoot({
         type: 'rolling-file',
         fileName: logFile,
@@ -120,9 +120,11 @@ describe('RollingFileAppender', () => {
         },
         strategy: {
           type: 'numeric',
-          max: 2,
           pattern: '-%i',
         },
+        retention: {
+          maxFiles: 2,
+        },
       });
       await root.preboot();
       await root.setup();
@@ -153,6 +155,107 @@ describe('RollingFileAppender', () => {
       expect(await getFileContent('kibana-1.log')).toEqual(expectedFileContent([5, 6]));
       expect(await getFileContent('kibana-2.log')).toEqual(expectedFileContent([3, 4]));
     });
+
+    it('maxAccumulatedFileSize retention: only keep the correct number of files', async () => {
+      root = createRoot({
+        type: 'rolling-file',
+        fileName: logFile,
+        layout: {
+          type: 'pattern',
+          pattern: '%message',
+        },
+        policy: {
+          type: 'size-limit',
+          size: '60b',
+        },
+        strategy: {
+          type: 'numeric',
+          pattern: '-%i',
+        },
+        retention: {
+          maxAccumulatedFileSize: '100b',
+        },
+      });
+      await root.preboot();
+      await root.setup();
+
+      const logger = root.logger.get('test.rolling.file');
+
+      // size = 60b, message.length ~= 40b, should roll every 2 message
+
+      // last file - 'kibana-3.log' (which will be removed during rolling)
+      logger.info(message(1));
+      logger.info(message(2));
+      // roll - 'kibana-2.log' (which will be removed during rolling)
+      logger.info(message(3));
+      logger.info(message(4));
+      // roll - 'kibana-1.log'
+      logger.info(message(5));
+      logger.info(message(6));
+      // roll - 'kibana.log'
+      logger.info(message(7));
+      logger.info(message(8));
+
+      await flush();
+
+      const files = await readdir(testDir);
+
+      expect(files.sort()).toEqual(['kibana-1.log', 'kibana.log']);
+      expect(await getFileContent('kibana.log')).toEqual(expectedFileContent([7, 8]));
+      expect(await getFileContent('kibana-1.log')).toEqual(expectedFileContent([5, 6]));
+    });
+
+    it('removeOlderThan retention: only keep the correct files', async () => {
+      root = createRoot({
+        type: 'rolling-file',
+        fileName: logFile,
+        layout: {
+          type: 'pattern',
+          pattern: '%message',
+        },
+        policy: {
+          type: 'size-limit',
+          size: '60b',
+        },
+        strategy: {
+          type: 'numeric',
+          pattern: '-%i',
+        },
+        retention: {
+          removeOlderThan: '2s',
+        },
+      });
+      await root.preboot();
+      await root.setup();
+
+      const logger = root.logger.get('test.rolling.file');
+
+      // size = 60b, message.length ~= 40b, should roll every 2 message
+
+      // last file - 'kibana-3.log' (which will be removed during rolling)
+      logger.info(message(1));
+      logger.info(message(2));
+      // roll - 'kibana-2.log' (which will be removed during rolling)
+      logger.info(message(3));
+      logger.info(message(4));
+
+      await delay(2500);
+
+      // roll - 'kibana-1.log'
+      logger.info(message(5));
+      logger.info(message(6));
+      // roll - 'kibana.log'
+      logger.info(message(7));
+      logger.info(message(8));
+
+      await flush();
+
+      const files = await readdir(testDir);
+
+      expect(files.sort()).toEqual(['kibana-1.log', 'kibana.log']);
+      expect(await getFileContent('kibana.log')).toEqual(expectedFileContent([7, 8]));
+      expect(await getFileContent('kibana-1.log')).toEqual(expectedFileContent([5, 6]));
+    });
   });
 
   describe('`time-interval` policy with `numeric` strategy', () => {
diff --git a/src/dev/build/tasks/os_packages/docker_generator/templates/base/Dockerfile b/src/dev/build/tasks/os_packages/docker_generator/templates/base/Dockerfile
index 2284e504229a81..e42d2a7ec1dcd1 100644
--- a/src/dev/build/tasks/os_packages/docker_generator/templates/base/Dockerfile
+++ b/src/dev/build/tasks/os_packages/docker_generator/templates/base/Dockerfile
@@ -25,21 +25,27 @@ RUN cd /tmp && \
      https://{{publicArtifactSubdomain}}.elastic.co/downloads/kibana/{{artifactPrefix}}-$(arch).tar.gz && \
   cd -
 {{/usePublicArtifact}}
-
 {{^usePublicArtifact}}
 COPY {{artifactTarball}} /tmp/kibana.tar.gz
 {{/usePublicArtifact}}
 
 RUN mkdir /usr/share/kibana
 WORKDIR /usr/share/kibana
-RUN tar --strip-components=1 -zxf /tmp/kibana.tar.gz
+RUN tar \
+# Exclude serverless.yml disabled assets
+{{#serverless}}
+  --exclude=screenshotting-plugin/chromium \
+  --exclude=screenshotting-plugin/server/assets \
+{{/serverless}}
+  --strip-components=1 \
+  -zxf /tmp/kibana.tar.gz
 # Ensure that group permissions are the same as user permissions.
 # This will help when relying on GID-0 to run Kibana, rather than UID-1000.
 # OpenShift does this, for example.
 # REF: https://docs.openshift.org/latest/creating_images/guidelines.html
 RUN chmod -R g=u /usr/share/kibana
-
 {{#cloud}}
+
 COPY {{filebeatTarball}} /tmp/filebeat.tar.gz
 COPY {{metricbeatTarball}} /tmp/metricbeat.tar.gz
 
diff --git a/src/dev/i18n/tasks/check_compatibility.ts b/src/dev/i18n/tasks/check_compatibility.ts
index b6b94a5aba6661..10970dc92f551e 100644
--- a/src/dev/i18n/tasks/check_compatibility.ts
+++ b/src/dev/i18n/tasks/check_compatibility.ts
@@ -8,6 +8,7 @@
 
 import { ToolingLog } from '@kbn/tooling-log';
 import { integrateLocaleFiles, I18nConfig } from '..';
+import { I18nCheckTaskContext } from '../types';
 
 export interface I18nFlags {
   fix: boolean;
@@ -20,7 +21,7 @@ export interface I18nFlags {
 export function checkCompatibility(config: I18nConfig, flags: I18nFlags, log: ToolingLog) {
   const { fix, ignoreIncompatible, ignoreUnused, ignoreMalformed, ignoreMissing } = flags;
   return config.translations.map((translationsPath) => ({
-    task: async ({ messages }: { messages: Map<string, { message: string }> }) => {
+    task: async ({ messages }: I18nCheckTaskContext) => {
       // If `fix` is set we should try apply all possible fixes and override translations file.
       await integrateLocaleFiles(messages, {
         dryRun: !fix,
diff --git a/src/dev/i18n/tasks/check_configs.ts b/src/dev/i18n/tasks/check_configs.ts
index 091f1fa806a148..66d5e8fd445003 100644
--- a/src/dev/i18n/tasks/check_configs.ts
+++ b/src/dev/i18n/tasks/check_configs.ts
@@ -8,7 +8,8 @@
 
 import { resolve, join } from 'path';
 import { I18N_RC } from '../constants';
-import { ErrorReporter, checkConfigNamespacePrefix, arrayify } from '..';
+import { checkConfigNamespacePrefix, arrayify } from '..';
+import { I18nCheckTaskContext } from '../types';
 
 export function checkConfigs(additionalConfigPaths: string | string[] = []) {
   const root = join(__dirname, '../../../../');
@@ -18,7 +19,7 @@ export function checkConfigs(additionalConfigPaths: string | string[] = []) {
   const configPaths = [kibanaRC, xpackRC, ...arrayify(additionalConfigPaths)];
 
   return configPaths.map((configPath) => ({
-    task: async (context: { reporter: ErrorReporter }) => {
+    task: async (context: I18nCheckTaskContext) => {
       try {
         await checkConfigNamespacePrefix(configPath);
       } catch (err) {
diff --git a/src/dev/i18n/tasks/extract_default_translations.ts b/src/dev/i18n/tasks/extract_default_translations.ts
index 57de2148d5ff44..512c3bc91dbfb0 100644
--- a/src/dev/i18n/tasks/extract_default_translations.ts
+++ b/src/dev/i18n/tasks/extract_default_translations.ts
@@ -8,7 +8,8 @@
 
 import chalk from 'chalk';
 import { createFailError } from '@kbn/dev-cli-errors';
-import { ErrorReporter, extractMessagesFromPathToMap, filterConfigPaths, I18nConfig } from '..';
+import { extractMessagesFromPathToMap, filterConfigPaths, I18nConfig } from '..';
+import { I18nCheckTaskContext } from '../types';
 
 export function extractDefaultMessages(config: I18nConfig, inputPaths: string[]) {
   const filteredPaths = filterConfigPaths(inputPaths, config) as string[];
@@ -20,10 +21,7 @@ export function extractDefaultMessages(config: I18nConfig, inputPaths: string[])
     );
   }
   return filteredPaths.map((filteredPath) => ({
-    task: async (context: {
-      messages: Map<string, { message: string }>;
-      reporter: ErrorReporter;
-    }) => {
+    task: async (context: I18nCheckTaskContext) => {
       const { messages, reporter } = context;
       const initialErrorsNumber = reporter.errors.length;
 
diff --git a/src/dev/i18n/tasks/extract_untracked_translations.ts b/src/dev/i18n/tasks/extract_untracked_translations.ts
index e2ea89661d5194..9bc4c27f4a4a07 100644
--- a/src/dev/i18n/tasks/extract_untracked_translations.ts
+++ b/src/dev/i18n/tasks/extract_untracked_translations.ts
@@ -10,6 +10,7 @@ import { createFailError } from '@kbn/dev-cli-errors';
 import { matchEntriesWithExctractors } from '../extract_default_translations';
 import { I18nConfig } from '../config';
 import { normalizePath, readFileAsync, ErrorReporter } from '../utils';
+import { I18nCheckTaskContext } from '../types';
 
 function filterEntries(entries: string[], exclude: string[]) {
   return entries.filter((entry: string) =>
@@ -24,7 +25,7 @@ export async function extractUntrackedMessagesTask({
 }: {
   path?: string | string[];
   config: I18nConfig;
-  reporter: any;
+  reporter: ErrorReporter;
 }) {
   const inputPaths = Array.isArray(path) ? path : [path || './'];
   const availablePaths = Object.values(config.paths).flat();
@@ -76,10 +77,14 @@ export async function extractUntrackedMessagesTask({
 export function extractUntrackedMessages(inputPaths: string[]) {
   return inputPaths.map((inputPath) => ({
     title: `Checking untracked messages in ${inputPath}`,
-    task: async (context: { reporter: ErrorReporter; config: I18nConfig }) => {
+    task: async (context: I18nCheckTaskContext) => {
       const { reporter, config } = context;
       const initialErrorsNumber = reporter.errors.length;
-      const result = await extractUntrackedMessagesTask({ path: inputPath, config, reporter });
+      const result = await extractUntrackedMessagesTask({
+        path: inputPath,
+        config: config as I18nConfig,
+        reporter,
+      });
       if (reporter.errors.length === initialErrorsNumber) {
         return result;
       }
diff --git a/src/dev/i18n/tasks/merge_configs.ts b/src/dev/i18n/tasks/merge_configs.ts
index 89ce47dcbecf20..916980dc2cb4c3 100644
--- a/src/dev/i18n/tasks/merge_configs.ts
+++ b/src/dev/i18n/tasks/merge_configs.ts
@@ -7,7 +7,8 @@
  */
 
 import { resolve, join } from 'path';
-import { ErrorReporter, I18nConfig, assignConfigFromPath, arrayify } from '..';
+import { assignConfigFromPath, arrayify } from '..';
+import { I18nCheckTaskContext } from '../types';
 
 export function mergeConfigs(additionalConfigPaths: string | string[] = []) {
   const root = join(__dirname, '../../../../');
@@ -17,7 +18,7 @@ export function mergeConfigs(additionalConfigPaths: string | string[] = []) {
   const configPaths = [kibanaRC, xpackRC, ...arrayify(additionalConfigPaths)];
 
   return configPaths.map((configPath) => ({
-    task: async (context: { reporter: ErrorReporter; config?: I18nConfig }) => {
+    task: async (context: I18nCheckTaskContext) => {
       try {
         context.config = await assignConfigFromPath(context.config, configPath);
       } catch (err) {
diff --git a/src/dev/i18n/types.ts b/src/dev/i18n/types.ts
new file mode 100644
index 00000000000000..4b790051b294cb
--- /dev/null
+++ b/src/dev/i18n/types.ts
@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { I18nConfig } from './config';
+import { ErrorReporter } from './utils';
+
+export interface I18nCheckTaskContext {
+  config?: I18nConfig;
+  reporter: ErrorReporter;
+  messages: Map<string, { message: string }>;
+}
diff --git a/src/dev/license_checker/config.ts b/src/dev/license_checker/config.ts
index a985d328eb9c8a..f73d44b46a9827 100644
--- a/src/dev/license_checker/config.ts
+++ b/src/dev/license_checker/config.ts
@@ -86,7 +86,7 @@ export const LICENSE_OVERRIDES = {
   'jsts@1.6.2': ['Eclipse Distribution License - v 1.0'], // cf. https://github.com/bjornharrtell/jsts
   '@mapbox/jsonlint-lines-primitives@2.0.2': ['MIT'], // license in readme https://github.com/tmcw/jsonlint
   '@elastic/ems-client@8.5.1': ['Elastic License 2.0'],
-  '@elastic/eui@94.2.1-backport.0': ['SSPL-1.0 OR Elastic License 2.0'],
+  '@elastic/eui@94.3.0': ['SSPL-1.0 OR Elastic License 2.0'],
   'language-subtag-registry@0.3.21': ['CC-BY-4.0'], // retired ODC‑By license https://github.com/mattcg/language-subtag-registry
   'buffers@0.1.1': ['MIT'], // license in importing module https://www.npmjs.com/package/binary
   '@bufbuild/protobuf@1.2.1': ['Apache-2.0'], // license (Apache-2.0 AND BSD-3-Clause)
diff --git a/src/dev/run_i18n_check.ts b/src/dev/run_i18n_check.ts
index 2d04e7c9ca3a5b..eed82a1f08783c 100644
--- a/src/dev/run_i18n_check.ts
+++ b/src/dev/run_i18n_check.ts
@@ -7,13 +7,13 @@
  */
 
 import chalk from 'chalk';
-import Listr from 'listr';
+import { Listr } from 'listr2';
 
 import { createFailError } from '@kbn/dev-cli-errors';
 import { run } from '@kbn/dev-cli-runner';
 import { ToolingLog } from '@kbn/tooling-log';
 import { getTimeReporter } from '@kbn/ci-stats-reporter';
-import { ErrorReporter, I18nConfig } from './i18n';
+import { ErrorReporter } from './i18n';
 import {
   extractDefaultMessages,
   extractUntrackedMessages,
@@ -21,6 +21,7 @@ import {
   checkConfigs,
   mergeConfigs,
 } from './i18n/tasks';
+import { I18nCheckTaskContext } from './i18n/types';
 
 const toolingLog = new ToolingLog({
   level: 'info',
@@ -30,8 +31,8 @@ const toolingLog = new ToolingLog({
 const runStartTime = Date.now();
 const reportTime = getTimeReporter(toolingLog, 'scripts/i18n_check');
 
-const skipOnNoTranslations = ({ config }: { config: I18nConfig }) =>
-  !config.translations.length && 'No translations found.';
+const skipOnNoTranslations = ({ config }: I18nCheckTaskContext) =>
+  !config?.translations.length && 'No translations found.';
 
 run(
   async ({
@@ -74,36 +75,38 @@ run(
 
     const srcPaths = Array().concat(path || ['./src', './packages', './x-pack']);
 
-    const list = new Listr(
+    const list = new Listr<I18nCheckTaskContext>(
       [
         {
           title: 'Checking .i18nrc.json files',
-          task: () => new Listr(checkConfigs(includeConfig), { exitOnError: true }),
+          task: (context, task) =>
+            task.newListr(checkConfigs(includeConfig), { exitOnError: true }),
         },
         {
           title: 'Merging .i18nrc.json files',
-          task: () => new Listr(mergeConfigs(includeConfig), { exitOnError: true }),
+          task: (context, task) =>
+            task.newListr(mergeConfigs(includeConfig), { exitOnError: true }),
         },
         {
           title: 'Checking For Untracked Messages based on .i18nrc.json',
           enabled: (_) => !ignoreUntracked,
           skip: skipOnNoTranslations,
-          task: ({ config }) =>
-            new Listr(extractUntrackedMessages(srcPaths), { exitOnError: true }),
+          task: (context, task) =>
+            task.newListr(extractUntrackedMessages(srcPaths), { exitOnError: true }),
         },
         {
           title: 'Validating Default Messages',
           skip: skipOnNoTranslations,
-          task: ({ config }) =>
-            new Listr(extractDefaultMessages(config, srcPaths), { exitOnError: true }),
+          task: (context, task) =>
+            task.newListr(extractDefaultMessages(context.config!, srcPaths), { exitOnError: true }),
         },
         {
           title: 'Compatibility Checks',
           skip: skipOnNoTranslations,
-          task: ({ config }) =>
-            new Listr(
+          task: (context, task) =>
+            task.newListr(
               checkCompatibility(
-                config,
+                context.config!,
                 {
                   ignoreMalformed: !!ignoreMalformed,
                   ignoreIncompatible: !!ignoreIncompatible,
@@ -120,7 +123,7 @@ run(
       {
         concurrent: false,
         exitOnError: true,
-        renderer: process.env.CI ? 'verbose' : 'default',
+        renderer: process.env.CI ? 'verbose' : ('default' as any),
       }
     );
 
diff --git a/src/dev/run_i18n_extract.ts b/src/dev/run_i18n_extract.ts
index 2c1f39e929a364..cc356a0cdb5d77 100644
--- a/src/dev/run_i18n_extract.ts
+++ b/src/dev/run_i18n_extract.ts
@@ -7,13 +7,14 @@
  */
 
 import chalk from 'chalk';
-import Listr from 'listr';
+import { Listr } from 'listr2';
 import { resolve } from 'path';
 
 import { createFailError } from '@kbn/dev-cli-errors';
 import { run } from '@kbn/dev-cli-runner';
 import { ErrorReporter, serializeToJson, serializeToJson5, writeFileAsync } from './i18n';
 import { extractDefaultMessages, mergeConfigs } from './i18n/tasks';
+import { I18nCheckTaskContext } from './i18n/types';
 
 run(
   async ({
@@ -38,22 +39,23 @@ run(
     }
     const srcPaths = Array().concat(path || ['./src', './packages', './x-pack']);
 
-    const list = new Listr(
+    const list = new Listr<I18nCheckTaskContext>(
       [
         {
           title: 'Merging .i18nrc.json files',
-          task: () => new Listr(mergeConfigs(includeConfig), { exitOnError: true }),
+          task: (context, task) =>
+            task.newListr(mergeConfigs(includeConfig), { exitOnError: true }),
         },
         {
           title: 'Extracting Default Messages',
-          task: ({ config }) =>
-            new Listr(extractDefaultMessages(config, srcPaths), { exitOnError: true }),
+          task: (context, task) =>
+            task.newListr(extractDefaultMessages(context.config!, srcPaths), { exitOnError: true }),
         },
         {
           title: 'Writing to file',
-          enabled: (ctx) => outputDir && ctx.messages.size,
-          task: async (ctx) => {
-            const sortedMessages = [...ctx.messages].sort(([key1], [key2]) =>
+          enabled: (ctx) => Boolean(outputDir && ctx.messages.size > 0),
+          task: async (context) => {
+            const sortedMessages = [...context.messages].sort(([key1], [key2]) =>
               key1.localeCompare(key2)
             );
             await writeFileAsync(
@@ -66,7 +68,7 @@ run(
         },
       ],
       {
-        renderer: process.env.CI ? 'verbose' : 'default',
+        renderer: process.env.CI ? 'verbose' : ('default' as any),
       }
     );
 
diff --git a/src/dev/run_i18n_integrate.ts b/src/dev/run_i18n_integrate.ts
index 80e2f8cb1f33b7..4788036320ca45 100644
--- a/src/dev/run_i18n_integrate.ts
+++ b/src/dev/run_i18n_integrate.ts
@@ -7,12 +7,13 @@
  */
 
 import chalk from 'chalk';
-import Listr from 'listr';
+import { Listr } from 'listr2';
 
 import { createFailError } from '@kbn/dev-cli-errors';
 import { run } from '@kbn/dev-cli-runner';
 import { ErrorReporter, integrateLocaleFiles } from './i18n';
 import { extractDefaultMessages, mergeConfigs } from './i18n/tasks';
+import { I18nCheckTaskContext } from './i18n/types';
 
 run(
   async ({
@@ -69,7 +70,7 @@ run(
 
     const srcPaths = Array().concat(path || ['./src', './packages', './x-pack']);
 
-    const list = new Listr(
+    const list = new Listr<I18nCheckTaskContext>(
       [
         {
           title: 'Merging .i18nrc.json files',
@@ -77,13 +78,13 @@ run(
         },
         {
           title: 'Extracting Default Messages',
-          task: ({ config }) =>
-            new Listr(extractDefaultMessages(config, srcPaths), { exitOnError: true }),
+          task: (context) =>
+            new Listr(extractDefaultMessages(context.config!, srcPaths), { exitOnError: true }),
         },
         {
           title: 'Integrating Locale File',
-          task: async ({ messages, config }) => {
-            await integrateLocaleFiles(messages, {
+          task: async (context) => {
+            await integrateLocaleFiles(context.messages, {
               sourceFileName: source,
               targetFileName: target,
               dryRun,
@@ -91,14 +92,14 @@ run(
               ignoreUnused,
               ignoreMissing,
               ignoreMalformed,
-              config,
+              config: context.config!,
               log,
             });
           },
         },
       ],
       {
-        renderer: process.env.CI ? 'verbose' : 'default',
+        renderer: process.env.CI ? 'verbose' : ('default' as any),
       }
     );
 
diff --git a/src/plugins/console/kibana.jsonc b/src/plugins/console/kibana.jsonc
index 2dc047ebb661d7..ae0cac514b67dc 100644
--- a/src/plugins/console/kibana.jsonc
+++ b/src/plugins/console/kibana.jsonc
@@ -20,7 +20,6 @@
     ],
     "requiredBundles": [
       "esUiShared",
-      "kibanaReact",
       "kibanaUtils"
     ]
   }
diff --git a/src/plugins/console/public/application/containers/editor/legacy/console_editor/editor.tsx b/src/plugins/console/public/application/containers/editor/legacy/console_editor/editor.tsx
index 8de241aee705b8..c53e1ff5dc2a56 100644
--- a/src/plugins/console/public/application/containers/editor/legacy/console_editor/editor.tsx
+++ b/src/plugins/console/public/application/containers/editor/legacy/console_editor/editor.tsx
@@ -222,7 +222,12 @@ function EditorUI({ initialTextValue, setEditorInstance }: EditorProps) {
     autocompleteInfo.retrieve(settingsService, settingsService.getAutocomplete());
 
     const unsubscribeResizer = subscribeResizeChecker(editorRef.current!, editor);
-    setupAutosave();
+    if (!initialQueryParams.load_from) {
+      // Don't setup autosaving editor content when we pre-load content
+      // This prevents losing the user's current console content when
+      // `loadFrom` query param is used for a console session
+      setupAutosave();
+    }
 
     return () => {
       unsubscribeResizer();
diff --git a/src/plugins/console/public/application/containers/editor/monaco/use_set_initial_value.ts b/src/plugins/console/public/application/containers/editor/monaco/use_set_initial_value.ts
index 9a752fa3a31d9d..9d963bb2cf00f5 100644
--- a/src/plugins/console/public/application/containers/editor/monaco/use_set_initial_value.ts
+++ b/src/plugins/console/public/application/containers/editor/monaco/use_set_initial_value.ts
@@ -30,7 +30,7 @@ interface SetInitialValueParams {
 /**
  * Util function for reading the load_from parameter from the current url.
  */
-const readLoadFromParam = () => {
+export const readLoadFromParam = () => {
   const [, queryString] = (window.location.hash || window.location.search || '').split('?');
 
   const queryParams = parse(queryString || '', { sort: false }) as Required<QueryParams>;
diff --git a/src/plugins/console/public/application/containers/editor/monaco/use_setup_autosave.ts b/src/plugins/console/public/application/containers/editor/monaco/use_setup_autosave.ts
index 21058fc60aafae..323279045fa6ba 100644
--- a/src/plugins/console/public/application/containers/editor/monaco/use_setup_autosave.ts
+++ b/src/plugins/console/public/application/containers/editor/monaco/use_setup_autosave.ts
@@ -8,6 +8,7 @@
 
 import { useEffect, useRef } from 'react';
 import { useSaveCurrentTextObject } from '../../../hooks';
+import { readLoadFromParam } from './use_set_initial_value';
 
 interface SetupAutosaveParams {
   /** The current input value in the Console editor. */
@@ -38,6 +39,12 @@ export const useSetupAutosave = (params: SetupAutosaveParams) => {
     if (timerRef.current) {
       clearTimeout(timerRef.current);
     }
+
+    const loadFromParam = readLoadFromParam();
+    if (loadFromParam) {
+      // If we pre-loaded content we want to skip saving the state of the editor
+      return;
+    }
     timerRef.current = window.setTimeout(saveCurrentState, saveDelay);
 
     return () => {
diff --git a/src/plugins/console/public/application/containers/embeddable/console_wrapper.tsx b/src/plugins/console/public/application/containers/embeddable/console_wrapper.tsx
index 53c75706b9da0b..db3624db41f68b 100644
--- a/src/plugins/console/public/application/containers/embeddable/console_wrapper.tsx
+++ b/src/plugins/console/public/application/containers/embeddable/console_wrapper.tsx
@@ -112,6 +112,8 @@ interface ConsoleWrapperProps
 export const ConsoleWrapper = (props: ConsoleWrapperProps) => {
   const [dependencies, setDependencies] = useState<ConsoleDependencies | null>(null);
   const { core, usageCollection, onKeyDown, isMonacoEnabled } = props;
+  const { analytics, i18n, theme } = core;
+  const startServices = { analytics, i18n, theme };
 
   useEffect(() => {
     if (dependencies === null) {
@@ -142,7 +144,6 @@ export const ConsoleWrapper = (props: ConsoleWrapperProps) => {
     objectStorageClient,
     settings,
     storage,
-    theme$,
     trackUiMetric,
   } = dependencies;
   return (
@@ -162,10 +163,10 @@ export const ConsoleWrapper = (props: ConsoleWrapperProps) => {
             http,
             autocompleteInfo,
           },
-          theme$,
           config: {
             isMonacoEnabled,
           },
+          startServices,
         }}
       >
         <RequestContextProvider>
diff --git a/src/plugins/console/public/application/contexts/services_context.mock.ts b/src/plugins/console/public/application/contexts/services_context.mock.ts
index f02a6df5ff9961..fc22676b9f72da 100644
--- a/src/plugins/console/public/application/contexts/services_context.mock.ts
+++ b/src/plugins/console/public/application/contexts/services_context.mock.ts
@@ -7,9 +7,9 @@
  */
 
 import {
+  coreMock,
   notificationServiceMock,
   httpServiceMock,
-  themeServiceMock,
   docLinksServiceMock,
 } from '@kbn/core/public/mocks';
 
@@ -22,6 +22,8 @@ import { createApi, createEsHostService } from '../lib';
 
 import { ContextValue } from './services_context';
 
+const coreStart = coreMock.createStart();
+
 export const serviceContextMock = {
   create: (): ContextValue => {
     const storage = new StorageMock({} as unknown as Storage, 'test');
@@ -42,11 +44,11 @@ export const serviceContextMock = {
         autocompleteInfo: new AutocompleteInfoMock(),
       },
       docLinkVersion: 'NA',
-      theme$: themeServiceMock.create().start().theme$,
       docLinks: docLinksServiceMock.createStartContract().links,
       config: {
         isMonacoEnabled: false,
       },
+      startServices: coreStart,
     };
   },
 };
diff --git a/src/plugins/console/public/application/contexts/services_context.tsx b/src/plugins/console/public/application/contexts/services_context.tsx
index d2c91e7c736048..49bc4d4afec9b2 100644
--- a/src/plugins/console/public/application/contexts/services_context.tsx
+++ b/src/plugins/console/public/application/contexts/services_context.tsx
@@ -7,12 +7,11 @@
  */
 
 import React, { createContext, useContext, useEffect } from 'react';
-import { Observable } from 'rxjs';
-import type { NotificationsSetup, CoreTheme, DocLinksStart, HttpSetup } from '@kbn/core/public';
+import type { NotificationsSetup, DocLinksStart, HttpSetup } from '@kbn/core/public';
 
 import type { AutocompleteInfo, History, Settings, Storage } from '../../services';
 import { ObjectStorageClient } from '../../../common/types';
-import { MetricsTracker } from '../../types';
+import { ConsoleStartServices, MetricsTracker } from '../../types';
 import { EsHostService } from '../lib';
 
 interface ContextServices {
@@ -30,11 +29,11 @@ interface ContextServices {
 export interface ContextValue {
   services: ContextServices;
   docLinkVersion: string;
-  theme$: Observable<CoreTheme>;
   docLinks: DocLinksStart['links'];
   config?: {
     isMonacoEnabled: boolean;
   };
+  startServices: ConsoleStartServices;
 }
 
 interface ContextProps {
diff --git a/src/plugins/console/public/application/hooks/use_send_current_request/use_send_current_request.ts b/src/plugins/console/public/application/hooks/use_send_current_request/use_send_current_request.ts
index 28d875c246ca30..69f9042edd76d4 100644
--- a/src/plugins/console/public/application/hooks/use_send_current_request/use_send_current_request.ts
+++ b/src/plugins/console/public/application/hooks/use_send_current_request/use_send_current_request.ts
@@ -23,7 +23,7 @@ import { DEFAULT_VARIABLES } from '../../../../common/constants';
 export const useSendCurrentRequest = () => {
   const {
     services: { history, settings, notifications, trackUiMetric, http, autocompleteInfo, storage },
-    theme$,
+    startServices,
   } = useServicesContext();
 
   const dispatch = useRequestActionContext();
@@ -88,7 +88,7 @@ export const useSendCurrentRequest = () => {
                   notifications.toasts.remove(toast);
                 },
               }),
-              { theme$ }
+              startServices
             ),
           });
         } else {
@@ -140,7 +140,7 @@ export const useSendCurrentRequest = () => {
     notifications.toasts,
     trackUiMetric,
     history,
-    theme$,
     autocompleteInfo,
+    startServices,
   ]);
 };
diff --git a/src/plugins/console/public/application/index.tsx b/src/plugins/console/public/application/index.tsx
index e211e1557476a8..a2d8cfb0cab18d 100644
--- a/src/plugins/console/public/application/index.tsx
+++ b/src/plugins/console/public/application/index.tsx
@@ -8,17 +8,10 @@
 
 import React from 'react';
 import { render, unmountComponentAtNode } from 'react-dom';
-import { Observable } from 'rxjs';
-import {
-  HttpSetup,
-  NotificationsSetup,
-  I18nStart,
-  CoreTheme,
-  DocLinksStart,
-} from '@kbn/core/public';
-import { KibanaThemeProvider } from '@kbn/react-kibana-context-theme';
+import { HttpSetup, NotificationsSetup, DocLinksStart } from '@kbn/core/public';
 
 import { UsageCollectionSetup } from '@kbn/usage-collection-plugin/public';
+import { KibanaRenderContextProvider } from '@kbn/react-kibana-context-render';
 import {
   createStorage,
   createHistory,
@@ -32,31 +25,30 @@ import * as localStorageObjectClient from '../lib/local_storage_object_client';
 import { Main } from './containers';
 import { ServicesContextProvider, EditorContextProvider, RequestContextProvider } from './contexts';
 import { createApi, createEsHostService } from './lib';
+import { ConsoleStartServices } from '../types';
 
 export interface BootDependencies {
   http: HttpSetup;
   docLinkVersion: string;
-  I18nContext: I18nStart['Context'];
   notifications: NotificationsSetup;
   usageCollection?: UsageCollectionSetup;
   element: HTMLElement;
-  theme$: Observable<CoreTheme>;
   docLinks: DocLinksStart['links'];
   autocompleteInfo: AutocompleteInfo;
   isMonacoEnabled: boolean;
+  startServices: ConsoleStartServices;
 }
 
 export async function renderApp({
-  I18nContext,
   notifications,
   docLinkVersion,
   usageCollection,
   element,
   http,
-  theme$,
   docLinks,
   autocompleteInfo,
   isMonacoEnabled,
+  startServices,
 }: BootDependencies) {
   const trackUiMetric = createUsageTracker(usageCollection);
   trackUiMetric.load('opened_app');
@@ -76,37 +68,35 @@ export async function renderApp({
   autocompleteInfo.mapping.setup(http, settings);
 
   render(
-    <I18nContext>
-      <KibanaThemeProvider theme={{ theme$ }}>
-        <ServicesContextProvider
-          value={{
-            docLinkVersion,
-            docLinks,
-            services: {
-              esHostService,
-              storage,
-              history,
-              settings,
-              notifications,
-              trackUiMetric,
-              objectStorageClient,
-              http,
-              autocompleteInfo,
-            },
-            theme$,
-            config: {
-              isMonacoEnabled,
-            },
-          }}
-        >
-          <RequestContextProvider>
-            <EditorContextProvider settings={settings.toJSON()}>
-              <Main />
-            </EditorContextProvider>
-          </RequestContextProvider>
-        </ServicesContextProvider>
-      </KibanaThemeProvider>
-    </I18nContext>,
+    <KibanaRenderContextProvider {...startServices}>
+      <ServicesContextProvider
+        value={{
+          docLinkVersion,
+          docLinks,
+          services: {
+            esHostService,
+            storage,
+            history,
+            settings,
+            notifications,
+            trackUiMetric,
+            objectStorageClient,
+            http,
+            autocompleteInfo,
+          },
+          config: {
+            isMonacoEnabled,
+          },
+          startServices,
+        }}
+      >
+        <RequestContextProvider>
+          <EditorContextProvider settings={settings.toJSON()}>
+            <Main />
+          </EditorContextProvider>
+        </RequestContextProvider>
+      </ServicesContextProvider>
+    </KibanaRenderContextProvider>,
     element
   );
 
diff --git a/src/plugins/console/public/plugin.ts b/src/plugins/console/public/plugin.ts
index 54d8d1db97bc7b..f1cae7206ea4dc 100644
--- a/src/plugins/console/public/plugin.ts
+++ b/src/plugins/console/public/plugin.ts
@@ -79,12 +79,12 @@ export class ConsoleUIPlugin
           defaultMessage: 'Console',
         }),
         enableRouting: false,
-        mount: async ({ element, theme$ }) => {
+        mount: async ({ element }) => {
           const [core] = await getStartServices();
 
           const {
-            i18n: { Context: I18nContext },
             docLinks: { DOC_LINK_VERSION, links },
+            ...startServices
           } = core;
 
           const { renderApp } = await import('./application');
@@ -93,13 +93,12 @@ export class ConsoleUIPlugin
             http,
             docLinkVersion: DOC_LINK_VERSION,
             docLinks: links,
-            I18nContext,
             notifications,
             usageCollection,
             element,
-            theme$,
             autocompleteInfo: this.autocompleteInfo,
             isMonacoEnabled,
+            startServices,
           });
         },
       });
diff --git a/src/plugins/console/public/shared_imports.ts b/src/plugins/console/public/shared_imports.ts
index 95b96b565e27fb..779a2b9ee1c0af 100644
--- a/src/plugins/console/public/shared_imports.ts
+++ b/src/plugins/console/public/shared_imports.ts
@@ -12,4 +12,6 @@ const { collapseLiteralStrings, expandLiteralStrings } = XJson;
 
 export { sendRequest, collapseLiteralStrings, expandLiteralStrings };
 
-export { KibanaThemeProvider, toMountPoint } from '@kbn/kibana-react-plugin/public';
+export { KibanaThemeProvider } from '@kbn/react-kibana-context-theme';
+
+export { toMountPoint } from '@kbn/react-kibana-mount';
diff --git a/src/plugins/console/public/types/plugin_dependencies.ts b/src/plugins/console/public/types/plugin_dependencies.ts
index 63446135e7f3c9..39b82939619ec8 100644
--- a/src/plugins/console/public/types/plugin_dependencies.ts
+++ b/src/plugins/console/public/types/plugin_dependencies.ts
@@ -7,6 +7,7 @@
  */
 
 import type { FC } from 'react';
+import type { AnalyticsServiceStart, I18nStart, ThemeServiceStart } from '@kbn/core/public';
 import { HomePublicPluginSetup, HomePublicPluginStart } from '@kbn/home-plugin/public';
 import { DevToolsSetup } from '@kbn/dev-tools-plugin/public';
 import { UsageCollectionSetup, UsageCollectionStart } from '@kbn/usage-collection-plugin/public';
@@ -15,6 +16,12 @@ import { SharePluginSetup, SharePluginStart, LocatorPublic } from '@kbn/share-pl
 import { ConsoleUILocatorParams } from './locator';
 import { EmbeddedConsoleView } from './embeddable_console';
 
+export interface ConsoleStartServices {
+  analytics: Pick<AnalyticsServiceStart, 'reportEvent'>;
+  i18n: I18nStart;
+  theme: Pick<ThemeServiceStart, 'theme$'>;
+}
+
 export interface AppSetupUIPluginDependencies {
   home?: HomePublicPluginSetup;
   devTools: DevToolsSetup;
diff --git a/src/plugins/console/tsconfig.json b/src/plugins/console/tsconfig.json
index 06adc91f994db9..88b6216cbde665 100644
--- a/src/plugins/console/tsconfig.json
+++ b/src/plugins/console/tsconfig.json
@@ -9,7 +9,6 @@
     "@kbn/dev-tools-plugin",
     "@kbn/es-ui-shared-plugin",
     "@kbn/home-plugin",
-    "@kbn/kibana-react-plugin",
     "@kbn/kibana-utils-plugin",
     "@kbn/share-plugin",
     "@kbn/usage-collection-plugin",
@@ -31,7 +30,8 @@
     "@kbn/monaco",
     "@kbn/cloud-plugin",
     "@kbn/core-notifications-browser",
-    "@kbn/react-kibana-context-render"
+    "@kbn/react-kibana-context-render",
+    "@kbn/react-kibana-mount"
   ],
   "exclude": [
     "target/**/*",
diff --git a/src/plugins/controls/public/control_group/component/control_group_component.tsx b/src/plugins/controls/public/control_group/component/control_group_component.tsx
index ebbcf20b66366e..56a50e596870cb 100644
--- a/src/plugins/controls/public/control_group/component/control_group_component.tsx
+++ b/src/plugins/controls/public/control_group/component/control_group_component.tsx
@@ -17,8 +17,8 @@ import {
   DragEndEvent,
   DragOverlay,
   KeyboardSensor,
-  LayoutMeasuringStrategy,
   PointerSensor,
+  MeasuringStrategy,
   useSensor,
   useSensors,
 } from '@dnd-kit/core';
@@ -217,7 +217,7 @@ export const ControlGroup = () => {
 
   const onDragEnd = ({ over }: DragEndEvent) => {
     if (over) {
-      const overIndex = idsInOrder.indexOf(over.id);
+      const overIndex = idsInOrder.indexOf(`${over.id}`);
       if (draggingIndex !== overIndex) {
         const newIndex = overIndex;
         controlGroup.dispatch.setControlOrders({
@@ -264,14 +264,16 @@ export const ControlGroup = () => {
             {tourStep}
             <EuiFlexItem>
               <DndContext
-                onDragStart={({ active }) => setDraggingId(active.id)}
+                onDragStart={({ active }) => setDraggingId(`${active.id}`)}
                 onDragEnd={onDragEnd}
                 onDragCancel={() => setDraggingId(null)}
                 sensors={sensors}
-                collisionDetection={closestCenter}
-                layoutMeasuring={{
-                  strategy: LayoutMeasuringStrategy.Always,
+                measuring={{
+                  droppable: {
+                    strategy: MeasuringStrategy.Always,
+                  },
                 }}
+                collisionDetection={closestCenter}
               >
                 <SortableContext items={idsInOrder} strategy={rectSortingStrategy}>
                   <EuiFlexGroup
diff --git a/src/plugins/dashboard/public/dashboard_actions/copy_to_dashboard_action.tsx b/src/plugins/dashboard/public/dashboard_actions/copy_to_dashboard_action.tsx
index a041370185f666..be9545c31e21b6 100644
--- a/src/plugins/dashboard/public/dashboard_actions/copy_to_dashboard_action.tsx
+++ b/src/plugins/dashboard/public/dashboard_actions/copy_to_dashboard_action.tsx
@@ -22,7 +22,6 @@ import {
 } from '@kbn/presentation-publishing';
 import { toMountPoint } from '@kbn/react-kibana-mount';
 import { Action, IncompatibleActionError } from '@kbn/ui-actions-plugin/public';
-import { apiCanExpandPanels } from '@kbn/presentation-containers/interfaces/panel_management';
 
 import { DASHBOARD_CONTAINER_TYPE } from '../dashboard_container';
 import { DashboardPluginInternalFunctions } from '../dashboard_container/external_api/dashboard_api';
@@ -49,8 +48,7 @@ const apiIsCompatible = (api: unknown): api is CopyToDashboardAPI => {
     apiHasUniqueId(api) &&
     apiHasParentApi(api) &&
     apiIsOfType(api.parentApi, DASHBOARD_CONTAINER_TYPE) &&
-    apiPublishesSavedObjectId(api.parentApi) &&
-    !(apiCanExpandPanels(api.parentApi) && api.parentApi.expandedPanelId.getValue())
+    apiPublishesSavedObjectId(api.parentApi)
   );
 };
 
diff --git a/src/plugins/dashboard/public/dashboard_container/component/grid/dashboard_grid_item.tsx b/src/plugins/dashboard/public/dashboard_container/component/grid/dashboard_grid_item.tsx
index 49a24e8bfacb6c..7ec73f6dbe97ca 100644
--- a/src/plugins/dashboard/public/dashboard_container/component/grid/dashboard_grid_item.tsx
+++ b/src/plugins/dashboard/public/dashboard_container/component/grid/dashboard_grid_item.tsx
@@ -8,12 +8,7 @@
 
 import { EuiLoadingChart } from '@elastic/eui';
 import { css } from '@emotion/react';
-import {
-  EmbeddablePanel,
-  reactEmbeddableRegistryHasKey,
-  ReactEmbeddableRenderer,
-  ViewMode,
-} from '@kbn/embeddable-plugin/public';
+import { EmbeddablePanel, ReactEmbeddableRenderer, ViewMode } from '@kbn/embeddable-plugin/public';
 import { PhaseEvent } from '@kbn/presentation-publishing';
 import classNames from 'classnames';
 import React, { useEffect, useLayoutEffect, useMemo, useRef, useState } from 'react';
@@ -101,6 +96,9 @@ export const Item = React.forwardRef<HTMLDivElement, Props>(
       : undefined;
 
     const renderedEmbeddable = useMemo(() => {
+      const {
+        embeddable: { reactEmbeddableRegistryHasKey },
+      } = pluginServices.getServices();
       const references = getReferencesForPanelId(id, container.savedObjectReferences);
 
       const panelProps = {
@@ -134,7 +132,7 @@ export const Item = React.forwardRef<HTMLDivElement, Props>(
           {...panelProps}
         />
       );
-    }, [id, container, type, index, useMargins, onPanelStatusChange, panel.explicitInput]);
+    }, [id, container, useMargins, type, index, onPanelStatusChange, panel.explicitInput]);
 
     return (
       <div
diff --git a/src/plugins/dashboard/public/dashboard_container/embeddable/api/duplicate_dashboard_panel.ts b/src/plugins/dashboard/public/dashboard_container/embeddable/api/duplicate_dashboard_panel.ts
index 012c0e720cb058..7dd3feabb89c76 100644
--- a/src/plugins/dashboard/public/dashboard_container/embeddable/api/duplicate_dashboard_panel.ts
+++ b/src/plugins/dashboard/public/dashboard_container/embeddable/api/duplicate_dashboard_panel.ts
@@ -10,7 +10,6 @@ import {
   isReferenceOrValueEmbeddable,
   PanelIncompatibleError,
   PanelNotFoundError,
-  reactEmbeddableRegistryHasKey,
 } from '@kbn/embeddable-plugin/public';
 import { apiHasSerializableState } from '@kbn/presentation-containers';
 import { apiPublishesPanelTitle, getPanelTitle } from '@kbn/presentation-publishing';
@@ -77,13 +76,17 @@ const duplicateReactEmbeddableInput = async (
 };
 
 export async function duplicateDashboardPanel(this: DashboardContainer, idToDuplicate: string) {
+  const {
+    notifications: { toasts },
+    embeddable: { reactEmbeddableRegistryHasKey },
+  } = pluginServices.getServices();
   const panelToClone = this.getInput().panels[idToDuplicate] as DashboardPanelState;
 
   const duplicatedPanelState = reactEmbeddableRegistryHasKey(panelToClone.type)
     ? await duplicateReactEmbeddableInput(this, panelToClone, idToDuplicate)
     : await duplicateLegacyInput(this, panelToClone, idToDuplicate);
 
-  pluginServices.getServices().notifications.toasts.addSuccess({
+  toasts.addSuccess({
     title: dashboardClonePanelActionStrings.getSuccessMessage(),
     'data-test-subj': 'addObjectToContainerSuccess',
   });
diff --git a/src/plugins/dashboard/public/dashboard_container/embeddable/api/run_save_functions.tsx b/src/plugins/dashboard/public/dashboard_container/embeddable/api/run_save_functions.tsx
index 60f772a61e3890..3f89845f94c2bb 100644
--- a/src/plugins/dashboard/public/dashboard_container/embeddable/api/run_save_functions.tsx
+++ b/src/plugins/dashboard/public/dashboard_container/embeddable/api/run_save_functions.tsx
@@ -9,11 +9,7 @@
 import { Reference } from '@kbn/content-management-utils';
 import type { PersistableControlGroupInput } from '@kbn/controls-plugin/common';
 import { reportPerformanceMetricEvent } from '@kbn/ebt-tools';
-import {
-  EmbeddableInput,
-  isReferenceOrValueEmbeddable,
-  reactEmbeddableRegistryHasKey,
-} from '@kbn/embeddable-plugin/public';
+import { EmbeddableInput, isReferenceOrValueEmbeddable } from '@kbn/embeddable-plugin/public';
 import { apiHasSerializableState } from '@kbn/presentation-containers';
 import { showSaveModal } from '@kbn/saved-objects-plugin/public';
 import { cloneDeep } from 'lodash';
@@ -35,6 +31,9 @@ import { DashboardSaveModal } from './overlays/save_modal';
 const serializeAllPanelState = async (
   dashboard: DashboardContainer
 ): Promise<{ panels: DashboardContainerInput['panels']; references: Reference[] }> => {
+  const {
+    embeddable: { reactEmbeddableRegistryHasKey },
+  } = pluginServices.getServices();
   const references: Reference[] = [];
   const panels = cloneDeep(dashboard.getInput().panels);
   for (const [uuid, panel] of Object.entries(panels)) {
diff --git a/src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx b/src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx
index d3ba52c97edf29..9a33543b7c3b1a 100644
--- a/src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx
+++ b/src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx
@@ -26,7 +26,6 @@ import {
   embeddableInputToSubject,
   isExplicitInputWithAttributes,
   PanelNotFoundError,
-  reactEmbeddableRegistryHasKey,
   ViewMode,
   type EmbeddableFactory,
   type EmbeddableInput,
@@ -482,7 +481,7 @@ export class DashboardContainer
   ) {
     const {
       notifications: { toasts },
-      embeddable: { getEmbeddableFactory },
+      embeddable: { getEmbeddableFactory, reactEmbeddableRegistryHasKey },
     } = pluginServices.getServices();
 
     const onSuccess = (id?: string, title?: string) => {
@@ -569,6 +568,9 @@ export class DashboardContainer
   }
 
   public getDashboardPanelFromId = async (panelId: string) => {
+    const {
+      embeddable: { reactEmbeddableRegistryHasKey },
+    } = pluginServices.getServices();
     const panel = this.getInput().panels[panelId];
     if (reactEmbeddableRegistryHasKey(panel.type)) {
       const child = this.children$.value[panelId];
@@ -680,6 +682,7 @@ export class DashboardContainer
       }
       this.dispatch.setAnimatePanelTransforms(false); // prevents panels from animating on navigate.
       this.dispatch.setLastSavedId(newSavedObjectId);
+      this.setExpandedPanelId(undefined);
     });
     this.updateInput(newInput);
     dashboardContainerReady$.next(this);
@@ -731,6 +734,9 @@ export class DashboardContainer
   };
 
   public async getPanelTitles(): Promise<string[]> {
+    const {
+      embeddable: { reactEmbeddableRegistryHasKey },
+    } = pluginServices.getServices();
     const titles: string[] = [];
     for (const [id, panel] of Object.entries(this.getInput().panels)) {
       const title = await (async () => {
@@ -814,6 +820,9 @@ export class DashboardContainer
   };
 
   public removePanel(id: string) {
+    const {
+      embeddable: { reactEmbeddableRegistryHasKey },
+    } = pluginServices.getServices();
     const type = this.getInput().panels[id]?.type;
     this.removeEmbeddable(id);
     if (reactEmbeddableRegistryHasKey(type)) {
diff --git a/src/plugins/dashboard/public/dashboard_container/state/diffing/dashboard_diffing_functions.ts b/src/plugins/dashboard/public/dashboard_container/state/diffing/dashboard_diffing_functions.ts
index 75d88fb5e720cf..172a389a3f4d4b 100644
--- a/src/plugins/dashboard/public/dashboard_container/state/diffing/dashboard_diffing_functions.ts
+++ b/src/plugins/dashboard/public/dashboard_container/state/diffing/dashboard_diffing_functions.ts
@@ -6,10 +6,10 @@
  * Side Public License, v 1.
  */
 
-import { reactEmbeddableRegistryHasKey } from '@kbn/embeddable-plugin/public';
 import { compareFilters, COMPARE_ALL_OPTIONS, isFilterPinned } from '@kbn/es-query';
 import fastIsEqual from 'fast-deep-equal';
 import { DashboardContainerInput } from '../../../../common';
+import { pluginServices } from '../../../services/plugin_services';
 import { DashboardContainer } from '../../embeddable/dashboard_container';
 import { DashboardContainerInputWithoutId } from '../../types';
 import { areTimesEqual, getPanelLayoutsAreEqual } from './dashboard_diffing_utils';
@@ -74,6 +74,9 @@ export const unsavedChangesDiffingFunctions: DashboardDiffFunctions = {
     const explicitInputComparePromises = Object.values(currentValue ?? {}).map(
       (panel) =>
         new Promise<boolean>((resolve, reject) => {
+          const {
+            embeddable: { reactEmbeddableRegistryHasKey },
+          } = pluginServices.getServices();
           const embeddableId = panel.explicitInput.id;
           if (!embeddableId || reactEmbeddableRegistryHasKey(panel.type)) {
             // if this is a new style embeddable, it will handle its own diffing.
diff --git a/src/plugins/dashboard/public/services/dashboard_content_management/lib/migrate_dashboard_input.ts b/src/plugins/dashboard/public/services/dashboard_content_management/lib/migrate_dashboard_input.ts
index adc4de15d38aff..46e57588a2c952 100644
--- a/src/plugins/dashboard/public/services/dashboard_content_management/lib/migrate_dashboard_input.ts
+++ b/src/plugins/dashboard/public/services/dashboard_content_management/lib/migrate_dashboard_input.ts
@@ -9,11 +9,11 @@
 import { ControlGroupInput } from '@kbn/controls-plugin/common';
 import {
   EmbeddableFactoryNotFoundError,
-  reactEmbeddableRegistryHasKey,
   runEmbeddableFactoryMigrations,
 } from '@kbn/embeddable-plugin/public';
 import { DashboardContainerInput, DashboardPanelState } from '../../../../common';
 import { type DashboardEmbeddableService } from '../../embeddable/types';
+import { pluginServices } from '../../plugin_services';
 import { SavedDashboardInput } from '../types';
 
 /**
@@ -26,6 +26,9 @@ export const migrateDashboardInput = (
   dashboardInput: SavedDashboardInput,
   embeddable: DashboardEmbeddableService
 ) => {
+  const {
+    embeddable: { reactEmbeddableRegistryHasKey },
+  } = pluginServices.getServices();
   let anyMigrationRun = false;
   if (!dashboardInput) return dashboardInput;
   if (dashboardInput.controlGroupInput) {
diff --git a/src/plugins/dashboard/public/services/embeddable/embeddable.stub.ts b/src/plugins/dashboard/public/services/embeddable/embeddable.stub.ts
index 655dda0891a64b..d76d95822bc9bb 100644
--- a/src/plugins/dashboard/public/services/embeddable/embeddable.stub.ts
+++ b/src/plugins/dashboard/public/services/embeddable/embeddable.stub.ts
@@ -16,6 +16,7 @@ export const embeddableServiceFactory: EmbeddableServiceFactory = () => {
   const pluginMock = embeddablePluginMock.createStartContract();
 
   return {
+    reactEmbeddableRegistryHasKey: pluginMock.reactEmbeddableRegistryHasKey,
     getEmbeddableFactories: pluginMock.getEmbeddableFactories,
     getEmbeddableFactory: pluginMock.getEmbeddableFactory,
     getStateTransfer: pluginMock.getStateTransfer,
diff --git a/src/plugins/dashboard/public/services/embeddable/embeddable_service.ts b/src/plugins/dashboard/public/services/embeddable/embeddable_service.ts
index 4c86feccc92539..1222fa6778f668 100644
--- a/src/plugins/dashboard/public/services/embeddable/embeddable_service.ts
+++ b/src/plugins/dashboard/public/services/embeddable/embeddable_service.ts
@@ -21,6 +21,7 @@ export const embeddableServiceFactory: EmbeddableServiceFactory = ({ startPlugin
   const { embeddable } = startPlugins;
 
   return pick(embeddable, [
+    'reactEmbeddableRegistryHasKey',
     'getEmbeddableFactory',
     'getEmbeddableFactories',
     'getStateTransfer',
diff --git a/src/plugins/dashboard/public/services/embeddable/types.ts b/src/plugins/dashboard/public/services/embeddable/types.ts
index 182c855a146b00..fb3f91f1ba9354 100644
--- a/src/plugins/dashboard/public/services/embeddable/types.ts
+++ b/src/plugins/dashboard/public/services/embeddable/types.ts
@@ -10,6 +10,7 @@ import type { EmbeddableStart } from '@kbn/embeddable-plugin/public';
 
 export type DashboardEmbeddableService = Pick<
   EmbeddableStart,
+  | 'reactEmbeddableRegistryHasKey'
   | 'getEmbeddableFactories'
   | 'getEmbeddableFactory'
   | 'getAllMigrations'
diff --git a/src/plugins/data/common/search/search_source/mocks.ts b/src/plugins/data/common/search/search_source/mocks.ts
index 6bcd2a76d9aca3..a3ffa23c2819f6 100644
--- a/src/plugins/data/common/search/search_source/mocks.ts
+++ b/src/plugins/data/common/search/search_source/mocks.ts
@@ -15,7 +15,6 @@ import { ISearchStartSearchSource, ISearchSource, SearchSourceFields } from './t
 
 export const searchSourceInstanceMock: MockedKeys<ISearchSource> = {
   setOverwriteDataViewType: jest.fn(),
-  setFields: jest.fn().mockReturnThis(),
   setField: jest.fn().mockReturnThis(),
   removeField: jest.fn().mockReturnThis(),
   getId: jest.fn(),
diff --git a/src/plugins/data/common/search/search_source/search_source.ts b/src/plugins/data/common/search/search_source/search_source.ts
index 3f2e7da84cd020..afd956b7ac3da6 100644
--- a/src/plugins/data/common/search/search_source/search_source.ts
+++ b/src/plugins/data/common/search/search_source/search_source.ts
@@ -210,7 +210,7 @@ export class SearchSource {
    * @private
    * @param newFields New field array.
    */
-  setFields(newFields: SearchSourceFields) {
+  private setFields(newFields: SearchSourceFields) {
     this.fields = newFields;
     return this;
   }
diff --git a/src/plugins/data/common/search/tabify/buckets.ts b/src/plugins/data/common/search/tabify/buckets.ts
index 7835d373c656d8..065a4ac9553054 100644
--- a/src/plugins/data/common/search/tabify/buckets.ts
+++ b/src/plugins/data/common/search/tabify/buckets.ts
@@ -57,13 +57,15 @@ export class TabifyBuckets {
     const buckets = this.buckets;
 
     if (this.objectMode) {
-      this._keys.forEach((key) => {
+      for (let i = 0; i < this._keys.length; i++) {
+        const key = this._keys[i];
         fn(buckets[key], key);
-      });
+      }
     } else {
-      buckets.forEach((bucket: AggResponseBucket) => {
+      for (let i = 0; i < buckets.length; i++) {
+        const bucket = buckets[i];
         fn(bucket, bucket.key);
-      });
+      }
     }
   }
 
diff --git a/src/plugins/data/common/search/tabify/response_writer.ts b/src/plugins/data/common/search/tabify/response_writer.ts
index ed29d2a0aa5411..bbaab641e82f4f 100644
--- a/src/plugins/data/common/search/tabify/response_writer.ts
+++ b/src/plugins/data/common/search/tabify/response_writer.ts
@@ -50,15 +50,25 @@ export class TabbedAggResponseWriter {
   row() {
     const rowBuffer: TabbedAggRow = {};
 
-    this.bucketBuffer.forEach((bucket) => {
+    for (let i = 0; i < this.bucketBuffer.length; i++) {
+      const bucket = this.bucketBuffer[i];
       rowBuffer[bucket.id] = bucket.value;
-    });
+    }
 
-    this.metricBuffer.forEach((metric) => {
+    for (let i = 0; i < this.metricBuffer.length; i++) {
+      const metric = this.metricBuffer[i];
       rowBuffer[metric.id] = metric.value;
-    });
+    }
+
+    let isPartialRow = false;
+    for (let i = 0; i < this.columns.length; i++) {
+      const column = this.columns[i];
+      if (!rowBuffer.hasOwnProperty(column.id)) {
+        isPartialRow = true;
+        break;
+      }
+    }
 
-    const isPartialRow = !this.columns.every((column) => rowBuffer.hasOwnProperty(column.id));
     const removePartial = isPartialRow && !this.partialRows;
     if (!isEmpty(rowBuffer) && !removePartial) {
       this.rows.push(rowBuffer);
diff --git a/src/plugins/data/common/search/tabify/tabify.ts b/src/plugins/data/common/search/tabify/tabify.ts
index 67278e44ec438f..894dc85c23cea3 100644
--- a/src/plugins/data/common/search/tabify/tabify.ts
+++ b/src/plugins/data/common/search/tabify/tabify.ts
@@ -15,141 +15,153 @@ import { AggResponseBucket } from './types';
 import { AggGroupNames, IAggConfigs } from '../aggs';
 
 /**
- * Sets up the ResponseWriter and kicks off bucket collection.
+ * read an aggregation from a bucket, which *might* be found at key (if
+ * the response came in object form), and will recurse down the aggregation
+ * tree and will pass the read values to the ResponseWriter.
  */
-export function tabifyAggResponse(
-  aggConfigs: IAggConfigs,
-  esResponse: Record<string, any>,
+function collectBucket(
+  aggs: IAggConfigs,
+  write: TabbedAggResponseWriter,
+  bucket: AggResponseBucket,
+  key: string,
+  aggScale: number,
   respOpts?: Partial<TabbedResponseWriterOptions>
-): Datatable {
-  /**
-   * read an aggregation from a bucket, which *might* be found at key (if
-   * the response came in object form), and will recurse down the aggregation
-   * tree and will pass the read values to the ResponseWriter.
-   */
-  function collectBucket(
-    aggs: IAggConfigs,
-    write: TabbedAggResponseWriter,
-    bucket: AggResponseBucket,
-    key: string,
-    aggScale: number
-  ) {
-    const column = write.columns.shift();
-
-    if (column) {
-      const agg = column.aggConfig;
-      if (agg.getParam('scaleMetricValues')) {
-        const aggInfo = agg.write(aggs);
-        aggScale *= aggInfo.metricScale || 1;
-      }
-
-      switch (agg.type.type) {
-        case AggGroupNames.Buckets:
-          const aggBucket = get(bucket, agg.id) as Record<string, unknown>;
-          const tabifyBuckets = new TabifyBuckets(aggBucket, agg, respOpts?.timeRange);
-          const precisionError = agg.type.hasPrecisionError?.(aggBucket);
-
-          if (precisionError) {
-            // "сolumn" mutation, we have to do this here as this value is filled in based on aggBucket value
-            column.hasPrecisionError = true;
-          }
-
-          if (tabifyBuckets.length) {
-            tabifyBuckets.forEach((subBucket, tabifyBucketKey) => {
-              // if the bucket doesn't have value don't add it to the row
-              // we don't want rows like: { column1: undefined, column2: 10 }
-              const bucketValue = agg.getKey(subBucket, tabifyBucketKey);
-              const hasBucketValue = typeof bucketValue !== 'undefined';
-
-              if (hasBucketValue) {
-                write.bucketBuffer.push({ id: column.id, value: bucketValue });
-              }
-
-              collectBucket(
-                aggs,
-                write,
-                subBucket,
-                agg.getKey(subBucket, tabifyBucketKey),
-                aggScale
-              );
-
-              if (hasBucketValue) {
-                write.bucketBuffer.pop();
-              }
-            });
-          } else if (respOpts?.partialRows) {
-            // we don't have any buckets, but we do have metrics at this
-            // level, then pass all the empty buckets and jump back in for
-            // the metrics.
-            write.columns.unshift(column);
-            passEmptyBuckets(aggs, write, bucket, key, aggScale);
-            write.columns.shift();
-          } else {
-            // we don't have any buckets, and we don't have isHierarchical
-            // data, so no metrics, just try to write the row
-            write.row();
-          }
-          break;
-        case AggGroupNames.Metrics:
-          let value = agg.getValue(bucket);
-          // since the aggregation could be a non integer (such as a max date)
-          // only do the scaling calculation if it is needed.
-          if (aggScale !== 1) {
-            value *= aggScale;
-          }
-          write.metricBuffer.push({ id: column.id, value });
-
-          if (!write.columns.length) {
-            // row complete
-            write.row();
-          } else {
-            // process the next agg at this same level
-            collectBucket(aggs, write, bucket, key, aggScale);
-          }
-
-          write.metricBuffer.pop();
-
-          break;
-      }
-
-      write.columns.unshift(column);
+) {
+  const column = write.columns.shift();
+
+  if (column) {
+    const agg = column.aggConfig;
+    if (agg.getParam('scaleMetricValues')) {
+      const aggInfo = agg.write(aggs);
+      aggScale *= aggInfo.metricScale || 1;
     }
-  }
 
-  // write empty values for each bucket agg, then write
-  // the metrics from the initial bucket using collectBucket()
-  function passEmptyBuckets(
-    aggs: IAggConfigs,
-    write: TabbedAggResponseWriter,
-    bucket: AggResponseBucket,
-    key: string,
-    aggScale: number
-  ) {
-    const column = write.columns.shift();
-
-    if (column) {
-      const agg = column.aggConfig;
-
-      switch (agg.type.type) {
-        case AggGroupNames.Metrics:
-          // pass control back to collectBucket()
+    switch (agg.type.type) {
+      case AggGroupNames.Buckets:
+        const aggBucket = get(bucket, agg.id) as Record<string, unknown>;
+        const tabifyBuckets = new TabifyBuckets(aggBucket, agg, respOpts?.timeRange);
+        const precisionError = agg.type.hasPrecisionError?.(aggBucket);
+
+        if (precisionError) {
+          // "сolumn" mutation, we have to do this here as this value is filled in based on aggBucket value
+          column.hasPrecisionError = true;
+        }
+
+        if (tabifyBuckets.length) {
+          tabifyBuckets.forEach((subBucket, tabifyBucketKey) => {
+            // if the bucket doesn't have value don't add it to the row
+            // we don't want rows like: { column1: undefined, column2: 10 }
+            const bucketValue = agg.getKey(subBucket, tabifyBucketKey);
+            const hasBucketValue = typeof bucketValue !== 'undefined';
+
+            if (hasBucketValue) {
+              write.bucketBuffer.push({ id: column.id, value: bucketValue });
+            }
+
+            collectBucket(
+              aggs,
+              write,
+              subBucket,
+              agg.getKey(subBucket, tabifyBucketKey),
+              aggScale,
+              respOpts
+            );
+
+            if (hasBucketValue) {
+              write.bucketBuffer.pop();
+            }
+          });
+        } else if (respOpts?.partialRows) {
+          // we don't have any buckets, but we do have metrics at this
+          // level, then pass all the empty buckets and jump back in for
+          // the metrics.
           write.columns.unshift(column);
-          collectBucket(aggs, write, bucket, key, aggScale);
-          return;
-
-        case AggGroupNames.Buckets:
           passEmptyBuckets(aggs, write, bucket, key, aggScale);
-      }
+          write.columns.shift();
+        } else {
+          // we don't have any buckets, and we don't have isHierarchical
+          // data, so no metrics, just try to write the row
+          write.row();
+        }
+        break;
+      case AggGroupNames.Metrics:
+        let value = agg.getValue(bucket);
+        // since the aggregation could be a non integer (such as a max date)
+        // only do the scaling calculation if it is needed.
+        if (aggScale !== 1) {
+          value *= aggScale;
+        }
+        write.metricBuffer.push({ id: column.id, value });
+
+        if (!write.columns.length) {
+          // row complete
+          write.row();
+        } else {
+          // process the next agg at this same level
+          collectBucket(aggs, write, bucket, key, aggScale, respOpts);
+        }
+
+        write.metricBuffer.pop();
+
+        break;
+    }
+
+    write.columns.unshift(column);
+  }
+}
 
-      write.columns.unshift(column);
+// write empty values for each bucket agg, then write
+// the metrics from the initial bucket using collectBucket()
+function passEmptyBuckets(
+  aggs: IAggConfigs,
+  write: TabbedAggResponseWriter,
+  bucket: AggResponseBucket,
+  key: string,
+  aggScale: number
+) {
+  const column = write.columns.shift();
+
+  if (column) {
+    const agg = column.aggConfig;
+
+    switch (agg.type.type) {
+      case AggGroupNames.Metrics:
+        // pass control back to collectBucket()
+        write.columns.unshift(column);
+        collectBucket(aggs, write, bucket, key, aggScale);
+        return;
+
+      case AggGroupNames.Buckets:
+        passEmptyBuckets(aggs, write, bucket, key, aggScale);
     }
+
+    write.columns.unshift(column);
   }
+}
+
+function hasDocCount(key: string) {
+  return /doc_count_/.test(key);
+}
 
+/**
+ * Sets up the ResponseWriter and kicks off bucket collection.
+ */
+export function tabifyAggResponse(
+  aggConfigs: IAggConfigs,
+  esResponse: Record<string, any>,
+  respOpts?: Partial<TabbedResponseWriterOptions>
+): Datatable {
   const write = new TabbedAggResponseWriter(aggConfigs, respOpts || {});
-  // Check whether there's a time shift for a count operation at root level
-  const hasMultipleDocCountAtRootWithFilters = Object.keys(esResponse.aggregations ?? {}).some(
-    (key) => /doc_count_/.test(key)
-  );
+
+  let hasMultipleDocCountAtRootWithFilters = false;
+  if (esResponse.aggregations) {
+    for (const key in esResponse.aggregations) {
+      if (hasDocCount(key)) {
+        hasMultipleDocCountAtRootWithFilters = true;
+        break;
+      }
+    }
+  }
 
   const topLevelBucket: AggResponseBucket = {
     ...(aggConfigs.isSamplingEnabled()
@@ -167,7 +179,7 @@ export function tabifyAggResponse(
     }
   }
 
-  collectBucket(aggConfigs, write, topLevelBucket, '', 1);
+  collectBucket(aggConfigs, write, topLevelBucket, '', 1, respOpts);
 
   return {
     ...write.response(),
diff --git a/src/plugins/data_view_management/public/components/index_pattern_table/index_pattern_table.tsx b/src/plugins/data_view_management/public/components/index_pattern_table/index_pattern_table.tsx
index e2298d40fe1453..7b8075f6eca463 100644
--- a/src/plugins/data_view_management/public/components/index_pattern_table/index_pattern_table.tsx
+++ b/src/plugins/data_view_management/public/components/index_pattern_table/index_pattern_table.tsx
@@ -293,7 +293,7 @@ export const IndexPatternTable = ({
       fill={true}
       iconType="plusInCircle"
       onClick={() => setShowCreateDialog(true)}
-      data-test-subj="createIndexPatternButton"
+      data-test-subj="createDataViewButton"
     >
       <FormattedMessage
         id="indexPatternManagement.dataViewTable.createBtn"
diff --git a/src/plugins/dev_tools/kibana.jsonc b/src/plugins/dev_tools/kibana.jsonc
index 9665ca223ca1dd..c269b749186191 100644
--- a/src/plugins/dev_tools/kibana.jsonc
+++ b/src/plugins/dev_tools/kibana.jsonc
@@ -9,8 +9,6 @@
     "requiredPlugins": [
       "urlForwarding"
     ],
-    "requiredBundles": [
-      "kibanaReact"
-    ]
+    "requiredBundles": []
   }
 }
diff --git a/src/plugins/dev_tools/public/application.tsx b/src/plugins/dev_tools/public/application.tsx
index 3beb133ab3f5d6..840a99c06cf19f 100644
--- a/src/plugins/dev_tools/public/application.tsx
+++ b/src/plugins/dev_tools/public/application.tsx
@@ -7,12 +7,10 @@
  */
 
 import React, { useEffect, useRef } from 'react';
-import { Observable } from 'rxjs';
 import ReactDOM from 'react-dom';
 import { Redirect, RouteComponentProps } from 'react-router-dom';
 import { HashRouter as Router, Routes, Route } from '@kbn/shared-ux-router';
 import { EuiTab, EuiTabs, EuiToolTip, EuiBetaBadge } from '@elastic/eui';
-import { I18nProvider } from '@kbn/i18n-react';
 import { i18n } from '@kbn/i18n';
 import { euiThemeVars } from '@kbn/ui-theme';
 
@@ -20,13 +18,13 @@ import type {
   ApplicationStart,
   ChromeStart,
   ScopedHistory,
-  CoreTheme,
   ExecutionContextStart,
 } from '@kbn/core/public';
-import { KibanaThemeProvider } from '@kbn/kibana-react-plugin/public';
+import { KibanaRenderContextProvider } from '@kbn/react-kibana-context-render';
 import type { DocTitleService, BreadcrumbService } from './services';
 
 import { DevToolApp } from './dev_tool';
+import { DevToolsStartServices } from './types';
 
 export interface AppServices {
   docTitleService: DocTitleService;
@@ -38,9 +36,9 @@ interface DevToolsWrapperProps {
   devTools: readonly DevToolApp[];
   activeDevTool: DevToolApp;
   updateRoute: (newRoute: string) => void;
-  theme$: Observable<CoreTheme>;
   appServices: AppServices;
   location: RouteComponentProps['location'];
+  startServices: DevToolsStartServices;
 }
 
 interface MountedDevToolDescriptor {
@@ -53,9 +51,9 @@ function DevToolsWrapper({
   devTools,
   activeDevTool,
   updateRoute,
-  theme$,
   appServices,
   location,
+  startServices,
 }: DevToolsWrapperProps) {
   const { docTitleService, breadcrumbService } = appServices;
   const mountedTool = useRef<MountedDevToolDescriptor | null>(null);
@@ -123,7 +121,7 @@ function DevToolsWrapper({
             const params = {
               element,
               location,
-              theme$,
+              ...startServices,
             };
 
             const unmountHandler = await activeDevTool.mount(params);
@@ -169,9 +167,9 @@ export function renderApp(
   application: ApplicationStart,
   chrome: ChromeStart,
   history: ScopedHistory,
-  theme$: Observable<CoreTheme>,
   devTools: readonly DevToolApp[],
-  appServices: AppServices
+  appServices: AppServices,
+  startServices: DevToolsStartServices
 ) {
   if (redirectOnMissingCapabilities(application)) {
     return () => {};
@@ -180,37 +178,35 @@ export function renderApp(
   setBadge(application, chrome);
 
   ReactDOM.render(
-    <I18nProvider>
-      <KibanaThemeProvider theme$={theme$}>
-        <Router>
-          <Routes>
-            {devTools
-              // Only create routes for devtools that are not disabled
-              .filter((devTool) => !devTool.isDisabled())
-              .map((devTool) => (
-                <Route
-                  key={devTool.id}
-                  path={`/${devTool.id}`}
-                  exact={!devTool.enableRouting}
-                  render={(props) => (
-                    <DevToolsWrapper
-                      updateRoute={props.history.push}
-                      location={props.location}
-                      activeDevTool={devTool}
-                      devTools={devTools}
-                      theme$={theme$}
-                      appServices={appServices}
-                    />
-                  )}
-                />
-              ))}
-            <Route path="/">
-              <Redirect to={`/${devTools[0].id}`} />
-            </Route>
-          </Routes>
-        </Router>
-      </KibanaThemeProvider>
-    </I18nProvider>,
+    <KibanaRenderContextProvider {...startServices}>
+      <Router>
+        <Routes>
+          {devTools
+            // Only create routes for devtools that are not disabled
+            .filter((devTool) => !devTool.isDisabled())
+            .map((devTool) => (
+              <Route
+                key={devTool.id}
+                path={`/${devTool.id}`}
+                exact={!devTool.enableRouting}
+                render={(props) => (
+                  <DevToolsWrapper
+                    updateRoute={props.history.push}
+                    location={props.location}
+                    activeDevTool={devTool}
+                    devTools={devTools}
+                    appServices={appServices}
+                    startServices={startServices}
+                  />
+                )}
+              />
+            ))}
+          <Route path="/">
+            <Redirect to={`/${devTools[0].id}`} />
+          </Route>
+        </Routes>
+      </Router>
+    </KibanaRenderContextProvider>,
     element
   );
 
diff --git a/src/plugins/dev_tools/public/dev_tool.ts b/src/plugins/dev_tools/public/dev_tool.ts
index 53f79ad686c434..4a33092f433340 100644
--- a/src/plugins/dev_tools/public/dev_tool.ts
+++ b/src/plugins/dev_tools/public/dev_tool.ts
@@ -6,10 +6,10 @@
  * Side Public License, v 1.
  */
 
-import { Observable } from 'rxjs';
 import { RouteComponentProps } from 'react-router-dom';
 
-import { AppUnmount, CoreTheme } from '@kbn/core/public';
+import { AppUnmount } from '@kbn/core/public';
+import { DevToolsStartServices } from './types';
 
 /**
  * Descriptor for a dev tool. A dev tool works similar to an application
@@ -19,10 +19,9 @@ export type CreateDevToolArgs = Omit<DevToolApp, 'enable' | 'disable' | 'isDisab
   disabled?: boolean;
 };
 
-interface DevToolMountParams {
+interface DevToolMountParams extends DevToolsStartServices {
   element: HTMLDivElement;
   location: RouteComponentProps['location'];
-  theme$: Observable<CoreTheme>;
 }
 
 export class DevToolApp {
diff --git a/src/plugins/dev_tools/public/plugin.ts b/src/plugins/dev_tools/public/plugin.ts
index 8b50538af2d4f1..de007e570be6ab 100644
--- a/src/plugins/dev_tools/public/plugin.ts
+++ b/src/plugins/dev_tools/public/plugin.ts
@@ -60,11 +60,13 @@ export class DevToolsPlugin implements Plugin<DevToolsSetup, void> {
       order: 9010,
       category: DEFAULT_APP_CATEGORIES.management,
       mount: async (params: AppMountParameters) => {
-        const { element, history, theme$ } = params;
+        const { element, history } = params;
         element.classList.add('devAppWrapper');
 
         const [core] = await getStartServices();
         const { application, chrome, executionContext } = core;
+        const { analytics, i18n: i18nStart, theme } = core;
+        const startServices = { analytics, i18n: i18nStart, theme };
 
         this.docTitleService.setup(chrome.docTitle.change);
         this.breadcrumbService.setup(chrome.setBreadcrumbs);
@@ -81,9 +83,9 @@ export class DevToolsPlugin implements Plugin<DevToolsSetup, void> {
           application,
           chrome,
           history,
-          theme$,
           this.getSortedDevTools(),
-          appServices
+          appServices,
+          startServices
         );
       },
     });
diff --git a/src/plugins/dev_tools/public/types.ts b/src/plugins/dev_tools/public/types.ts
index 972afe57632053..7432b8fb5dc497 100644
--- a/src/plugins/dev_tools/public/types.ts
+++ b/src/plugins/dev_tools/public/types.ts
@@ -6,8 +6,16 @@
  * Side Public License, v 1.
  */
 
+import { AnalyticsServiceStart, I18nStart, ThemeServiceStart } from '@kbn/core/public';
+
 export interface ConfigSchema {
   deeplinks: {
     navLinkStatus: 'default' | 'visible';
   };
 }
+
+export interface DevToolsStartServices {
+  analytics: Pick<AnalyticsServiceStart, 'reportEvent'>;
+  i18n: I18nStart;
+  theme: Pick<ThemeServiceStart, 'theme$'>;
+}
diff --git a/src/plugins/dev_tools/tsconfig.json b/src/plugins/dev_tools/tsconfig.json
index 13e30f92c8d6e1..102e44488a7ebe 100644
--- a/src/plugins/dev_tools/tsconfig.json
+++ b/src/plugins/dev_tools/tsconfig.json
@@ -8,14 +8,13 @@
     "@kbn/core",
     "@kbn/url-forwarding-plugin",
     "@kbn/management-plugin",
-    "@kbn/i18n-react",
     "@kbn/i18n",
     "@kbn/ui-theme",
-    "@kbn/kibana-react-plugin",
     "@kbn/shared-ux-router",
     "@kbn/deeplinks-devtools",
     "@kbn/config-schema",
     "@kbn/core-plugins-server",
+    "@kbn/react-kibana-context-render",
   ],
   "exclude": [
     "target/**/*",
diff --git a/src/plugins/discover/kibana.jsonc b/src/plugins/discover/kibana.jsonc
index 9b892ee79fe16b..c9714054ee694a 100644
--- a/src/plugins/discover/kibana.jsonc
+++ b/src/plugins/discover/kibana.jsonc
@@ -29,6 +29,7 @@
       "contentManagement"
     ],
     "optionalPlugins": [
+      "dataVisualizer",
       "home",
       "share",
       "usageCollection",
diff --git a/src/plugins/discover/public/__mocks__/services.ts b/src/plugins/discover/public/__mocks__/services.ts
index 5ba0d3730d3432..2a0ffa9f7cb97a 100644
--- a/src/plugins/discover/public/__mocks__/services.ts
+++ b/src/plugins/discover/public/__mocks__/services.ts
@@ -40,6 +40,7 @@ import { createDiscoverDataViewsMock } from './data_views';
 import { SearchSourceDependencies } from '@kbn/data-plugin/common';
 import { SearchResponse } from '@elastic/elasticsearch/lib/api/types';
 import { urlTrackerMock } from './url_tracker.mock';
+import { createElement } from 'react';
 
 export function createDiscoverServicesMock(): DiscoverServices {
   const dataPlugin = dataPluginMock.createStartContract();
@@ -152,6 +153,9 @@ export function createDiscoverServicesMock(): DiscoverServices {
     },
     getScopedHistory: () => scopedHistoryMock.create(),
     data: dataPlugin,
+    dataVisualizer: {
+      FieldStatisticsTable: jest.fn(() => createElement('div')),
+    },
     docLinks: docLinksServiceMock.createStartContract(),
     capabilities: {
       visualize: {
diff --git a/src/plugins/discover/public/application/main/components/field_stats_table/field_stats_tab.tsx b/src/plugins/discover/public/application/main/components/field_stats_table/field_stats_tab.tsx
index c020e380b1555e..aa9b0408b71ef5 100644
--- a/src/plugins/discover/public/application/main/components/field_stats_table/field_stats_tab.tsx
+++ b/src/plugins/discover/public/application/main/components/field_stats_table/field_stats_tab.tsx
@@ -8,7 +8,6 @@
 
 import React from 'react';
 import { useQuerySubscriber } from '@kbn/unified-field-list/src/hooks/use_query_subscriber';
-import { useSavedSearch } from '../../state_management/discover_state_provider';
 import { FieldStatisticsTable, type FieldStatisticsTableProps } from './field_stats_table';
 import { useDiscoverServices } from '../../../../hooks/use_discover_services';
 
@@ -18,12 +17,12 @@ export const FieldStatisticsTab: React.FC<Omit<FieldStatisticsTableProps, 'query
     const querySubscriberResult = useQuerySubscriber({
       data: services.data,
     });
-    const savedSearch = useSavedSearch();
+
+    if (!services.dataVisualizer) return null;
 
     return (
       <FieldStatisticsTable
         {...props}
-        savedSearch={savedSearch}
         query={querySubscriberResult.query}
         filters={querySubscriberResult.filters}
       />
diff --git a/src/plugins/discover/public/application/main/components/field_stats_table/field_stats_table.tsx b/src/plugins/discover/public/application/main/components/field_stats_table/field_stats_table.tsx
index 20b38005aa9e73..f8bd11dd6a690e 100644
--- a/src/plugins/discover/public/application/main/components/field_stats_table/field_stats_table.tsx
+++ b/src/plugins/discover/public/application/main/components/field_stats_table/field_stats_table.tsx
@@ -6,109 +6,28 @@
  * Side Public License, v 1.
  */
 
-import React, { useEffect, useMemo, useRef, useState } from 'react';
-import type { Filter, Query, AggregateQuery } from '@kbn/es-query';
-import { METRIC_TYPE, UiCounterMetricType } from '@kbn/analytics';
-import type { DataViewField, DataView } from '@kbn/data-views-plugin/public';
-import {
-  EmbeddableInput,
-  EmbeddableOutput,
-  ErrorEmbeddable,
-  IEmbeddable,
-  isErrorEmbeddable,
-} from '@kbn/embeddable-plugin/public';
-import type { SavedSearch } from '@kbn/saved-search-plugin/public';
+import React, { useEffect, useMemo, useCallback } from 'react';
+import { METRIC_TYPE } from '@kbn/analytics';
 import { EuiFlexItem } from '@elastic/eui';
 import { css } from '@emotion/react';
 import useObservable from 'react-use/lib/useObservable';
-import { of } from 'rxjs';
+import { of, map } from 'rxjs';
+import { BehaviorSubject } from 'rxjs';
 import { useDiscoverServices } from '../../../../hooks/use_discover_services';
 import { FIELD_STATISTICS_LOADED } from './constants';
-import type { DiscoverStateContainer } from '../../state_management/discover_state';
-export interface RandomSamplingOption {
-  mode: 'random_sampling';
-  seed: string;
-  probability: number;
-}
+import type { NormalSamplingOption, FieldStatisticsTableProps } from './types';
+export type { FieldStatisticsTableProps };
 
-export interface NormalSamplingOption {
-  mode: 'normal_sampling';
-  seed: string;
-  shardSize: number;
-}
+const statsTableCss = css({
+  width: '100%',
+  height: '100%',
+  overflowY: 'auto',
+  '.kbnDocTableWrapper': {
+    overflowX: 'hidden',
+  },
+});
 
-export interface NoSamplingOption {
-  mode: 'no_sampling';
-  seed: string;
-}
-
-export type SamplingOption = RandomSamplingOption | NormalSamplingOption | NoSamplingOption;
-
-export interface DataVisualizerGridEmbeddableInput extends EmbeddableInput {
-  dataView: DataView;
-  savedSearch?: SavedSearch;
-  query?: Query | AggregateQuery;
-  visibleFieldNames?: string[];
-  filters?: Filter[];
-  showPreviewByDefault?: boolean;
-  /**
-   * Callback to add a filter to filter bar
-   */
-  onAddFilter?: (field: DataViewField | string, value: string, type: '+' | '-') => void;
-  sessionId?: string;
-  fieldsToFetch?: string[];
-  totalDocuments?: number;
-  samplingOption?: SamplingOption;
-}
-export interface DataVisualizerGridEmbeddableOutput extends EmbeddableOutput {
-  showDistributions?: boolean;
-}
-
-export interface FieldStatisticsTableProps {
-  /**
-   * Determines which columns are displayed
-   */
-  columns: string[];
-  /**
-   * The used data view
-   */
-  dataView: DataView;
-  /**
-   * Saved search description
-   */
-  searchDescription?: string;
-  /**
-   * Saved search title
-   */
-  searchTitle?: string;
-  /**
-   * Optional saved search
-   */
-  savedSearch?: SavedSearch;
-  /**
-   * Optional query to update the table content
-   */
-  query?: Query | AggregateQuery;
-  /**
-   * Filters query to update the table content
-   */
-  filters?: Filter[];
-  /**
-   * State container with persisted settings
-   */
-  stateContainer?: DiscoverStateContainer;
-  /**
-   * Callback to add a filter to filter bar
-   */
-  onAddFilter?: (field: DataViewField | string, value: string, type: '+' | '-') => void;
-  /**
-   * Metric tracking function
-   * @param metricType
-   * @param eventName
-   */
-  trackUiMetric?: (metricType: UiCounterMetricType, eventName: string | string[]) => void;
-  searchSessionId?: string;
-}
+const fallBacklastReloadRequestTime$ = new BehaviorSubject(0);
 
 export const FieldStatisticsTable = (props: FieldStatisticsTableProps) => {
   const {
@@ -122,154 +41,69 @@ export const FieldStatisticsTable = (props: FieldStatisticsTableProps) => {
     trackUiMetric,
     searchSessionId,
   } = props;
+
   const totalHits = useObservable(stateContainer?.dataState.data$.totalHits$ ?? of(undefined));
   const totalDocuments = useMemo(() => totalHits?.result, [totalHits]);
 
   const services = useDiscoverServices();
-  const [embeddable, setEmbeddable] = useState<
-    | ErrorEmbeddable
-    | IEmbeddable<DataVisualizerGridEmbeddableInput, DataVisualizerGridEmbeddableOutput>
-    | undefined
-  >();
-  const embeddableRoot: React.RefObject<HTMLDivElement> = useRef<HTMLDivElement>(null);
+  const dataVisualizerService = services.dataVisualizer;
 
+  // State from Discover we want the embeddable to reflect
   const showPreviewByDefault = useMemo(
     () => (stateContainer ? !stateContainer.appState.getState().hideAggregatedPreview : true),
     [stateContainer]
   );
 
-  useEffect(() => {
-    const availableFields$ = stateContainer?.dataState.data$.availableFields$;
-    const sub = embeddable?.getOutput$().subscribe((output: DataVisualizerGridEmbeddableOutput) => {
-      if (output.showDistributions !== undefined && stateContainer) {
-        stateContainer.appState.update({ hideAggregatedPreview: !output.showDistributions });
-      }
-    });
-
-    const refetch = stateContainer?.dataState.refetch$.subscribe(() => {
-      if (embeddable && !isErrorEmbeddable(embeddable)) {
-        embeddable.updateInput({ lastReloadRequestTime: Date.now() });
-      }
-    });
+  const lastReloadRequestTime$ = useMemo(() => {
+    return stateContainer?.dataState?.refetch$
+      ? stateContainer?.dataState?.refetch$.pipe(map(() => Date.now()))
+      : fallBacklastReloadRequestTime$;
+  }, [stateContainer]);
 
-    const fields = availableFields$?.subscribe(() => {
-      if (embeddable && !isErrorEmbeddable(embeddable) && !availableFields$?.getValue().error) {
-        embeddable.updateInput({ fieldsToFetch: availableFields$?.getValue().fields });
-      }
-    });
-
-    return () => {
-      sub?.unsubscribe();
-      refetch?.unsubscribe();
-      fields?.unsubscribe();
-    };
-  }, [embeddable, stateContainer]);
-
-  useEffect(() => {
-    if (embeddable && !isErrorEmbeddable(embeddable)) {
-      // Update embeddable whenever one of the important input changes
-      embeddable.updateInput({
-        dataView,
-        savedSearch,
-        query,
-        filters,
-        visibleFieldNames: columns,
-        onAddFilter,
-        sessionId: searchSessionId,
-        fieldsToFetch: stateContainer?.dataState.data$.availableFields$?.getValue().fields,
-        totalDocuments,
-        samplingOption: {
-          mode: 'normal_sampling',
-          shardSize: 5000,
-          seed: searchSessionId,
-        } as NormalSamplingOption,
-      });
-      embeddable.reload();
-    }
-  }, [
-    embeddable,
-    dataView,
-    savedSearch,
-    query,
-    columns,
-    filters,
-    onAddFilter,
-    searchSessionId,
-    totalDocuments,
-    stateContainer,
-  ]);
+  const lastReloadRequestTime = useObservable(lastReloadRequestTime$, 0);
 
   useEffect(() => {
-    if (showPreviewByDefault && embeddable && !isErrorEmbeddable(embeddable)) {
-      // Update embeddable whenever one of the important input changes
-      embeddable.updateInput({
-        showPreviewByDefault,
-      });
-
-      embeddable.reload();
-    }
-  }, [showPreviewByDefault, embeddable]);
+    // Track should only be called once when component is loaded
+    trackUiMetric?.(METRIC_TYPE.LOADED, FIELD_STATISTICS_LOADED);
+  }, [trackUiMetric]);
+
+  const samplingOption: NormalSamplingOption = useMemo(
+    () =>
+      ({
+        mode: 'normal_sampling',
+        shardSize: 5000,
+        seed: searchSessionId,
+      } as NormalSamplingOption),
+    [searchSessionId]
+  );
 
-  useEffect(() => {
-    let unmounted = false;
-    const loadEmbeddable = async () => {
-      if (services.embeddable) {
-        const factory = services.embeddable.getEmbeddableFactory<
-          DataVisualizerGridEmbeddableInput,
-          DataVisualizerGridEmbeddableOutput
-        >('data_visualizer_grid');
-        if (factory) {
-          // Initialize embeddable with information available at mount
-          const initializedEmbeddable = await factory.create({
-            id: 'discover_data_visualizer_grid',
-            dataView,
-            savedSearch,
-            query,
-            showPreviewByDefault,
-            onAddFilter,
-          });
-          if (!unmounted) {
-            setEmbeddable(initializedEmbeddable);
-          }
-        }
+  const updateState = useCallback(
+    (changes) => {
+      if (changes.showDistributions !== undefined && stateContainer) {
+        stateContainer.appState.update({ hideAggregatedPreview: !changes.showDistributions });
       }
-    };
-    loadEmbeddable();
-    return () => {
-      unmounted = true;
-    };
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [services.embeddable, showPreviewByDefault]);
-
-  // We can only render after embeddable has already initialized
-  useEffect(() => {
-    if (embeddableRoot.current && embeddable) {
-      embeddable.render(embeddableRoot.current);
-
-      trackUiMetric?.(METRIC_TYPE.LOADED, FIELD_STATISTICS_LOADED);
-    }
-
-    return () => {
-      // Clean up embeddable upon unmounting
-      embeddable?.destroy();
-    };
-  }, [embeddable, embeddableRoot, trackUiMetric]);
-
-  const statsTableCss = css`
-    overflow-y: auto;
+    },
+    [stateContainer]
+  );
 
-    .kbnDocTableWrapper {
-      overflow-x: hidden;
-    }
-  `;
+  if (!dataVisualizerService) return null;
 
   return (
-    <EuiFlexItem css={statsTableCss}>
-      <div
-        data-test-subj="dscFieldStatsEmbeddedContent"
-        ref={embeddableRoot}
-        // Match the scroll bar of the Discover doc table
-        className="kbnDocTableWrapper"
+    <EuiFlexItem css={statsTableCss} data-test-subj="dscFieldStatsEmbeddedContent">
+      <dataVisualizerService.FieldStatisticsTable
+        shouldGetSubfields={true}
+        dataView={dataView}
+        savedSearch={savedSearch}
+        filters={filters}
+        query={query}
+        visibleFieldNames={columns}
+        sessionId={searchSessionId}
+        totalDocuments={totalDocuments}
+        samplingOption={samplingOption}
+        lastReloadRequestTime={lastReloadRequestTime}
+        onAddFilter={onAddFilter}
+        showPreviewByDefault={showPreviewByDefault}
+        onTableUpdate={updateState}
       />
     </EuiFlexItem>
   );
diff --git a/src/plugins/discover/public/application/main/components/field_stats_table/types.ts b/src/plugins/discover/public/application/main/components/field_stats_table/types.ts
new file mode 100644
index 00000000000000..116a2cbbe37758
--- /dev/null
+++ b/src/plugins/discover/public/application/main/components/field_stats_table/types.ts
@@ -0,0 +1,167 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import type { DataViewField, DataView } from '@kbn/data-views-plugin/public';
+import { type UiCounterMetricType } from '@kbn/analytics';
+import type { Filter, Query, AggregateQuery } from '@kbn/es-query';
+import type { SerializedTitles } from '@kbn/presentation-publishing';
+import type { SavedSearch } from '@kbn/saved-search-plugin/public';
+import { type BehaviorSubject } from 'rxjs';
+import { DefaultEmbeddableApi } from '@kbn/embeddable-plugin/public';
+import type { DiscoverStateContainer } from '../../state_management/discover_state';
+
+export interface RandomSamplingOption {
+  mode: 'random_sampling';
+  seed: string;
+  probability: number;
+}
+
+export interface NormalSamplingOption {
+  mode: 'normal_sampling';
+  seed: string;
+  shardSize: number;
+}
+
+export interface NoSamplingOption {
+  mode: 'no_sampling';
+  seed: string;
+}
+
+export type SamplingOption = RandomSamplingOption | NormalSamplingOption | NoSamplingOption;
+
+export interface FieldStatisticsTableEmbeddableState extends SerializedTitles {
+  /**
+   * Data view is required for esql:false or non-ESQL mode
+   */
+  dataView?: DataView;
+  /**
+   * Kibana saved search object
+   */
+  savedSearch?: SavedSearch;
+  /**
+   * Kibana query
+   */
+  query?: Query | AggregateQuery;
+  /**
+   * List of fields to visibile show in the table
+   * set shouldGetSubfields: true if table needs to show the sub multi-field like .keyword
+   */
+  visibleFieldNames?: string[];
+  /**
+   * List of filters
+   */
+  filters?: Filter[];
+  /**
+   * Whether to show the preview/mini distribution chart on the tables upon first table mounting
+   */
+  showPreviewByDefault?: boolean;
+  /**
+   * If true, will show a button action to edit the data view field in every row
+   */
+  allowEditDataView?: boolean;
+  /**
+   * Optional id to identify the embeddable
+   */
+  id?: string;
+  /**
+   * Callback to add a filter to filter bar
+   */
+  onAddFilter?: (field: DataViewField | string, value: string, type: '+' | '-') => void;
+  /**
+   * Optional search sessionId to save and restore long running search
+   * If not provided, will generate its own sessionId
+   */
+  sessionId?: string;
+  /**
+   * Optional list of fields provided to table to fetch a subset of fields only
+   * so it doesn't need to fetch all fields
+   */
+  fieldsToFetch?: string[];
+  /**
+   * Total documents optionally provided to help table have context of the fetch size
+   * so it can reduce redundant API requests
+   */
+  totalDocuments?: number;
+  /**
+   * For non-ESQL mode, the sampling option is used to determine the sampling strategy
+   */
+  samplingOption?: SamplingOption;
+  /**
+   * If esql:true, switch table to ES|QL mode
+   */
+  esql?: boolean;
+  /**
+   * If esql:true, the index pattern is used to validate time field
+   */
+  indexPattern?: string;
+  /**
+   * If true, the table will try to retrieve subfield information as well based on visibleFields
+   * For example: visibleFields: ['field1', 'field2'] => will show ['field1', 'field1.keyword', 'field2', 'field2.keyword']
+   */
+  shouldGetSubfields?: boolean;
+  /**
+   * Force refresh the table
+   */
+  lastReloadRequestTime?: number;
+}
+interface FieldStatisticsTableEmbeddableComponentApi {
+  showDistributions$?: BehaviorSubject<boolean>;
+}
+
+export type FieldStatisticsTableEmbeddableApi =
+  DefaultEmbeddableApi<FieldStatisticsTableEmbeddableState> &
+    FieldStatisticsTableEmbeddableComponentApi;
+
+export interface FieldStatisticsTableProps {
+  /**
+   * Determines which columns are displayed
+   */
+  columns: string[];
+  /**
+   * The used data view
+   */
+  dataView: DataView;
+  /**
+   * Saved search description
+   */
+  searchDescription?: string;
+  /**
+   * Saved search title
+   */
+  searchTitle?: string;
+  /**
+   * Optional saved search
+   */
+  savedSearch?: SavedSearch;
+  /**
+   * Optional query to update the table content
+   */
+  query?: Query | AggregateQuery;
+  /**
+   * Filters query to update the table content
+   */
+  filters?: Filter[];
+  /**
+   * State container with persisted settings
+   */
+  stateContainer?: DiscoverStateContainer;
+  /**
+   * Callback to add a filter to filter bar
+   */
+  onAddFilter?: (field: DataViewField | string, value: string, type: '+' | '-') => void;
+  /**
+   * Metric tracking function
+   * @param metricType
+   * @param eventName
+   */
+  trackUiMetric?: (metricType: UiCounterMetricType, eventName: string | string[]) => void;
+  /**
+   * Search session id to save to or restore from
+   */
+  searchSessionId?: string;
+}
diff --git a/src/plugins/discover/public/application/main/components/layout/discover_main_content.tsx b/src/plugins/discover/public/application/main/components/layout/discover_main_content.tsx
index 3df041b227e852..701bbdddb6e931 100644
--- a/src/plugins/discover/public/application/main/components/layout/discover_main_content.tsx
+++ b/src/plugins/discover/public/application/main/components/layout/discover_main_content.tsx
@@ -61,7 +61,9 @@ export const DiscoverMainContent = ({
   panelsToggle,
   isChartAvailable,
 }: DiscoverMainContentProps) => {
-  const { trackUiMetric } = useDiscoverServices();
+  const { trackUiMetric, dataVisualizer: dataVisualizerService } = useDiscoverServices();
+
+  const shouldShowViewModeToggle = dataVisualizerService !== undefined;
 
   const setDiscoverViewMode = useCallback(
     (mode: VIEW_MODE) => {
@@ -81,7 +83,7 @@ export const DiscoverMainContent = ({
   const isDropAllowed = Boolean(onDropFieldToTable);
 
   const viewModeToggle = useMemo(() => {
-    return (
+    return shouldShowViewModeToggle ? (
       <DocumentViewModeToggle
         viewMode={viewMode}
         isTextBasedQuery={isPlainRecord}
@@ -93,6 +95,8 @@ export const DiscoverMainContent = ({
             : undefined
         }
       />
+    ) : (
+      <React.Fragment />
     );
   }, [
     viewMode,
@@ -101,6 +105,7 @@ export const DiscoverMainContent = ({
     stateContainer,
     panelsToggle,
     isChartAvailable,
+    shouldShowViewModeToggle,
   ]);
 
   const showChart = useAppStateSelector((state) => !state.hideChart);
diff --git a/src/plugins/discover/public/application/main/components/no_results/no_results.test.tsx b/src/plugins/discover/public/application/main/components/no_results/no_results.test.tsx
index 3a3c3e45300f0e..d88eda61d7db09 100644
--- a/src/plugins/discover/public/application/main/components/no_results/no_results.test.tsx
+++ b/src/plugins/discover/public/application/main/components/no_results/no_results.test.tsx
@@ -37,6 +37,23 @@ jest.spyOn(RxApi, 'lastValueFrom').mockImplementation(async () => ({
 
 const services = createDiscoverServicesMock();
 
+function findSubjects(component: ReactWrapper) {
+  return {
+    mainMsg: findTestSubject(component!, 'discoverNoResults').exists(),
+    errorMsg: findTestSubject(component!, 'discoverNoResultsError').exists(),
+    adjustTimeRange: findTestSubject(component!, 'discoverNoResultsTimefilter').exists(),
+    adjustSearch: findTestSubject(component!, 'discoverNoResultsAdjustSearch').exists(),
+    adjustFilters: findTestSubject(component!, 'discoverNoResultsAdjustFilters').exists(),
+    checkIndices: findTestSubject(component!, 'discoverNoResultsCheckIndices').exists(),
+    disableFiltersButton: findTestSubject(component!, 'discoverNoResultsDisableFilters').exists(),
+    viewMatchesButton: findTestSubject(component!, 'discoverNoResultsViewAllMatches').exists(),
+    searchAllMatchesGivesNoResults: findTestSubject(
+      component!,
+      'discoverSearchAllMatchesGivesNoResults'
+    ).exists(),
+  };
+}
+
 async function mountAndFindSubjects(
   props: Omit<
     DiscoverNoResultsProps,
@@ -66,14 +83,8 @@ async function mountAndFindSubjects(
   });
 
   return {
-    mainMsg: findTestSubject(component!, 'discoverNoResults').exists(),
-    errorMsg: findTestSubject(component!, 'discoverNoResultsError').exists(),
-    adjustTimeRange: findTestSubject(component!, 'discoverNoResultsTimefilter').exists(),
-    adjustSearch: findTestSubject(component!, 'discoverNoResultsAdjustSearch').exists(),
-    adjustFilters: findTestSubject(component!, 'discoverNoResultsAdjustFilters').exists(),
-    checkIndices: findTestSubject(component!, 'discoverNoResultsCheckIndices').exists(),
-    disableFiltersButton: findTestSubject(component!, 'discoverNoResultsDisableFilters').exists(),
-    viewMatchesButton: findTestSubject(component!, 'discoverNoResultsViewAllMatches').exists(),
+    component: component!,
+    subjects: findSubjects(component!),
   };
 }
 
@@ -90,7 +101,7 @@ describe('DiscoverNoResults', () => {
           query: undefined,
           filters: undefined,
         });
-        expect(result).toMatchInlineSnapshot(`
+        expect(result.subjects).toMatchInlineSnapshot(`
           Object {
             "adjustFilters": false,
             "adjustSearch": false,
@@ -99,6 +110,7 @@ describe('DiscoverNoResults', () => {
             "disableFiltersButton": false,
             "errorMsg": false,
             "mainMsg": true,
+            "searchAllMatchesGivesNoResults": false,
             "viewMatchesButton": false,
           }
         `);
@@ -111,7 +123,141 @@ describe('DiscoverNoResults', () => {
           query: { language: 'lucene', query: '' },
           filters: [],
         });
-        expect(result).toMatchInlineSnapshot(`
+        expect(result.subjects).toMatchInlineSnapshot(`
+          Object {
+            "adjustFilters": false,
+            "adjustSearch": false,
+            "adjustTimeRange": true,
+            "checkIndices": false,
+            "disableFiltersButton": false,
+            "errorMsg": false,
+            "mainMsg": true,
+            "searchAllMatchesGivesNoResults": false,
+            "viewMatchesButton": true,
+          }
+        `);
+        expect(RxApi.lastValueFrom).toHaveBeenCalledTimes(0);
+      });
+
+      test('should handle no results after the button is pressed', async () => {
+        (RxApi.lastValueFrom as jest.Mock).mockImplementation(async () => ({
+          rawResponse: {},
+        }));
+        const result = await mountAndFindSubjects({
+          dataView: stubDataView,
+          query: { language: 'lucene', query: '' },
+          filters: [],
+        });
+        expect(result.subjects).toMatchInlineSnapshot(`
+          Object {
+            "adjustFilters": false,
+            "adjustSearch": false,
+            "adjustTimeRange": true,
+            "checkIndices": false,
+            "disableFiltersButton": false,
+            "errorMsg": false,
+            "mainMsg": true,
+            "searchAllMatchesGivesNoResults": false,
+            "viewMatchesButton": true,
+          }
+        `);
+        expect(RxApi.lastValueFrom).toHaveBeenCalledTimes(0);
+
+        await act(async () => {
+          findTestSubject(result.component, 'discoverNoResultsViewAllMatches').simulate('click');
+        });
+
+        const component = result.component.update();
+
+        expect(RxApi.lastValueFrom).toHaveBeenCalledTimes(1);
+
+        expect(findSubjects(component)).toMatchInlineSnapshot(`
+          Object {
+            "adjustFilters": false,
+            "adjustSearch": false,
+            "adjustTimeRange": true,
+            "checkIndices": false,
+            "disableFiltersButton": false,
+            "errorMsg": false,
+            "mainMsg": true,
+            "searchAllMatchesGivesNoResults": true,
+            "viewMatchesButton": false,
+          }
+        `);
+      });
+
+      test('should handle timeout after the button is pressed', async () => {
+        (RxApi.lastValueFrom as jest.Mock).mockImplementation(async () => ({
+          rawResponse: {
+            timed_out: true,
+          },
+        }));
+        const result = await mountAndFindSubjects({
+          dataView: stubDataView,
+          query: { language: 'lucene', query: '' },
+          filters: [],
+        });
+        expect(result.subjects).toMatchInlineSnapshot(`
+          Object {
+            "adjustFilters": false,
+            "adjustSearch": false,
+            "adjustTimeRange": true,
+            "checkIndices": false,
+            "disableFiltersButton": false,
+            "errorMsg": false,
+            "mainMsg": true,
+            "searchAllMatchesGivesNoResults": false,
+            "viewMatchesButton": true,
+          }
+        `);
+        expect(RxApi.lastValueFrom).toHaveBeenCalledTimes(0);
+
+        await act(async () => {
+          findTestSubject(result.component, 'discoverNoResultsViewAllMatches').simulate('click');
+        });
+
+        const component = result.component.update();
+
+        expect(RxApi.lastValueFrom).toHaveBeenCalledTimes(1);
+
+        expect(findSubjects(component)).toMatchInlineSnapshot(`
+          Object {
+            "adjustFilters": false,
+            "adjustSearch": false,
+            "adjustTimeRange": true,
+            "checkIndices": false,
+            "disableFiltersButton": false,
+            "errorMsg": false,
+            "mainMsg": true,
+            "searchAllMatchesGivesNoResults": false,
+            "viewMatchesButton": true,
+          }
+        `);
+      });
+
+      test('should handle failures after the button is pressed', async () => {
+        (RxApi.lastValueFrom as jest.Mock).mockImplementation(async () => ({
+          rawResponse: {
+            _clusters: {
+              total: 2,
+              successful: 1,
+            },
+            aggregations: {
+              earliest_timestamp: {
+                value_as_string: '2020-09-01T08:30:00.000Z',
+              },
+              latest_timestamp: {
+                value_as_string: '2022-09-01T08:30:00.000Z',
+              },
+            },
+          },
+        }));
+        const result = await mountAndFindSubjects({
+          dataView: stubDataView,
+          query: { language: 'lucene', query: '' },
+          filters: [],
+        });
+        expect(result.subjects).toMatchInlineSnapshot(`
           Object {
             "adjustFilters": false,
             "adjustSearch": false,
@@ -120,18 +266,46 @@ describe('DiscoverNoResults', () => {
             "disableFiltersButton": false,
             "errorMsg": false,
             "mainMsg": true,
+            "searchAllMatchesGivesNoResults": false,
             "viewMatchesButton": true,
           }
         `);
+        expect(RxApi.lastValueFrom).toHaveBeenCalledTimes(0);
+
+        await act(async () => {
+          findTestSubject(result.component, 'discoverNoResultsViewAllMatches').simulate('click');
+        });
+
+        const component = result.component.update();
+
         expect(RxApi.lastValueFrom).toHaveBeenCalledTimes(1);
+
+        expect(findSubjects(component)).toMatchInlineSnapshot(`
+          Object {
+            "adjustFilters": false,
+            "adjustSearch": false,
+            "adjustTimeRange": true,
+            "checkIndices": false,
+            "disableFiltersButton": false,
+            "errorMsg": false,
+            "mainMsg": true,
+            "searchAllMatchesGivesNoResults": false,
+            "viewMatchesButton": true,
+          }
+        `);
       });
 
       test('passes strict_date_optional_time format to range query', async () => {
-        await mountAndFindSubjects({
+        const result = await mountAndFindSubjects({
           dataView: stubDataView,
           query: { language: 'lucene', query: '' },
           filters: [],
         });
+
+        await act(async () => {
+          findTestSubject(result.component, 'discoverNoResultsViewAllMatches').simulate('click');
+        });
+
         expect(services.data.search.search).toHaveBeenLastCalledWith(
           expect.objectContaining({
             params: expect.objectContaining({
@@ -163,7 +337,8 @@ describe('DiscoverNoResults', () => {
           query: { language: 'lucene', query: '*' },
           filters: undefined,
         });
-        expect(result).toHaveProperty('adjustSearch', true);
+        expect(result.subjects).toHaveProperty('adjustSearch', true);
+        expect(result.subjects).toHaveProperty('disableFiltersButton', false);
       });
 
       test('shows "adjust filters" message when having filters', async () => {
@@ -172,8 +347,55 @@ describe('DiscoverNoResults', () => {
           query: { language: 'lucene', query: '' },
           filters: [{} as Filter],
         });
-        expect(result).toHaveProperty('adjustFilters', true);
-        expect(result).toHaveProperty('disableFiltersButton', true);
+        expect(result.subjects).toHaveProperty('adjustFilters', true);
+        expect(result.subjects).toHaveProperty('disableFiltersButton', true);
+      });
+
+      test('should handle no results when having filters and after the button is pressed', async () => {
+        (RxApi.lastValueFrom as jest.Mock).mockImplementation(async () => ({
+          rawResponse: {},
+        }));
+        const result = await mountAndFindSubjects({
+          dataView: stubDataView,
+          query: { language: 'lucene', query: 'css*' },
+          filters: [{} as Filter],
+        });
+        expect(result.subjects).toMatchInlineSnapshot(`
+          Object {
+            "adjustFilters": true,
+            "adjustSearch": true,
+            "adjustTimeRange": true,
+            "checkIndices": false,
+            "disableFiltersButton": true,
+            "errorMsg": false,
+            "mainMsg": true,
+            "searchAllMatchesGivesNoResults": false,
+            "viewMatchesButton": true,
+          }
+        `);
+        expect(RxApi.lastValueFrom).toHaveBeenCalledTimes(0);
+
+        await act(async () => {
+          findTestSubject(result.component, 'discoverNoResultsViewAllMatches').simulate('click');
+        });
+
+        const component = result.component.update();
+
+        expect(RxApi.lastValueFrom).toHaveBeenCalledTimes(1);
+
+        expect(findSubjects(component)).toMatchInlineSnapshot(`
+          Object {
+            "adjustFilters": true,
+            "adjustSearch": true,
+            "adjustTimeRange": true,
+            "checkIndices": false,
+            "disableFiltersButton": true,
+            "errorMsg": false,
+            "mainMsg": true,
+            "searchAllMatchesGivesNoResults": true,
+            "viewMatchesButton": false,
+          }
+        `);
       });
     });
   });
diff --git a/src/plugins/discover/public/application/main/components/no_results/no_results_suggestions/no_results_suggestion_when_time_range.tsx b/src/plugins/discover/public/application/main/components/no_results/no_results_suggestions/no_results_suggestion_when_time_range.tsx
index 41f36b446778e4..8e2950185a3cc0 100644
--- a/src/plugins/discover/public/application/main/components/no_results/no_results_suggestions/no_results_suggestion_when_time_range.tsx
+++ b/src/plugins/discover/public/application/main/components/no_results/no_results_suggestions/no_results_suggestion_when_time_range.tsx
@@ -9,14 +9,34 @@
 import React from 'react';
 import { FormattedMessage } from '@kbn/i18n-react';
 import { EuiText } from '@elastic/eui';
+import { TimeRangeExtendingStatus } from './use_fetch_occurances_range';
 
-export const NoResultsSuggestionWhenTimeRange: React.FC = () => {
+export const NoResultsSuggestionWhenTimeRange: React.FC<{
+  timeRangeExtendingStatus?: TimeRangeExtendingStatus;
+}> = ({ timeRangeExtendingStatus }) => {
+  const message = (
+    <FormattedMessage
+      id="discover.noResults.suggestion.expandTimeRangeText"
+      defaultMessage="Expand the time range"
+    />
+  );
   return (
     <EuiText data-test-subj="discoverNoResultsTimefilter">
-      <FormattedMessage
-        id="discover.noResults.suggestion.expandTimeRangeText"
-        defaultMessage="Expand the time range"
-      />
+      {timeRangeExtendingStatus === TimeRangeExtendingStatus.succeedWithoutResults ? (
+        <>
+          <s>{message}</s>
+          <span data-test-subj="discoverSearchAllMatchesGivesNoResults">
+            {' ('}
+            <FormattedMessage
+              id="discover.noResults.suggestion.expandTimeRangeGivesNoResultsText"
+              defaultMessage="No results"
+            />
+            {')'}
+          </span>
+        </>
+      ) : (
+        message
+      )}
     </EuiText>
   );
 };
diff --git a/src/plugins/discover/public/application/main/components/no_results/no_results_suggestions/no_results_suggestions.tsx b/src/plugins/discover/public/application/main/components/no_results/no_results_suggestions/no_results_suggestions.tsx
index 076456fc3cd667..f75376d6ad32cd 100644
--- a/src/plugins/discover/public/application/main/components/no_results/no_results_suggestions/no_results_suggestions.tsx
+++ b/src/plugins/discover/public/application/main/components/no_results/no_results_suggestions/no_results_suggestions.tsx
@@ -6,9 +6,9 @@
  * Side Public License, v 1.
  */
 
-import React, { useState } from 'react';
+import React, { useCallback, useState } from 'react';
 import { css } from '@emotion/react';
-import { EuiEmptyPrompt, EuiButton, EuiLoadingSpinner, EuiSpacer, useEuiTheme } from '@elastic/eui';
+import { EuiEmptyPrompt, EuiButton, EuiSpacer, useEuiTheme } from '@elastic/eui';
 import type { DataView } from '@kbn/data-views-plugin/common';
 import {
   isOfQueryType,
@@ -18,6 +18,7 @@ import {
   type Filter,
 } from '@kbn/es-query';
 import { FormattedMessage } from '@kbn/i18n-react';
+import { i18n } from '@kbn/i18n';
 import { isTextBasedQuery } from '../../../utils/is_text_based_query';
 import { NoResultsSuggestionDefault } from './no_results_suggestion_default';
 import {
@@ -28,7 +29,7 @@ import { NoResultsSuggestionWhenQuery } from './no_results_suggestion_when_query
 import { NoResultsSuggestionWhenTimeRange } from './no_results_suggestion_when_time_range';
 import { hasActiveFilter } from '../../layout/utils';
 import { useDiscoverServices } from '../../../../../hooks/use_discover_services';
-import { useFetchOccurrencesRange } from './use_fetch_occurances_range';
+import { useFetchOccurrencesRange, TimeRangeExtendingStatus } from './use_fetch_occurances_range';
 import { NoResultsIllustration } from './assets/no_results_illustration';
 
 interface NoResultsSuggestionProps {
@@ -48,13 +49,14 @@ export const NoResultsSuggestions: React.FC<NoResultsSuggestionProps> = ({
 }) => {
   const { euiTheme } = useEuiTheme();
   const services = useDiscoverServices();
-  const { data, uiSettings, timefilter } = services;
+  const { data, uiSettings, timefilter, toastNotifications } = services;
   const hasQuery =
     (isOfQueryType(query) && !!query?.query) || (!!query && isOfAggregateQueryType(query));
   const hasFilters = hasActiveFilter(filters);
 
-  const [isExtending, setIsExtending] = useState<boolean>(false);
-  const { range: occurrencesRange, refetch } = useFetchOccurrencesRange({
+  const [timeRangeExtendingStatus, setTimeRangeExtendingStatus] =
+    useState<TimeRangeExtendingStatus>(TimeRangeExtendingStatus.initial);
+  const { fetch } = useFetchOccurrencesRange({
     dataView,
     query,
     filters,
@@ -64,21 +66,35 @@ export const NoResultsSuggestions: React.FC<NoResultsSuggestionProps> = ({
     },
   });
 
-  const extendTimeRange = async () => {
-    setIsExtending(true);
-    const range = await refetch();
-    if (range?.from && range?.to) {
+  const extendTimeRange = useCallback(async () => {
+    setTimeRangeExtendingStatus(TimeRangeExtendingStatus.loading);
+    const { status, range } = await fetch();
+
+    if (status === TimeRangeExtendingStatus.succeedWithResults && range?.from && range?.to) {
       timefilter.setTime({
         from: range.from,
         to: range.to,
       });
-    } else {
-      setIsExtending(false);
+      return;
+    }
+
+    setTimeRangeExtendingStatus(status);
+
+    if (status === TimeRangeExtendingStatus.failed) {
+      toastNotifications.addDanger(
+        i18n.translate('discover.noResults.suggestion.expandTimeRangeFailedNotification', {
+          defaultMessage: 'Request failed when searching the entire time range of documents',
+        })
+      );
+    } else if (status === TimeRangeExtendingStatus.timedOut) {
+      toastNotifications.addDanger(
+        i18n.translate('discover.noResults.suggestion.expandTimeRangeTimedOutNotification', {
+          defaultMessage: 'Request timed out when searching the entire time range of documents',
+        })
+      );
     }
-  };
+  }, [fetch, setTimeRangeExtendingStatus, timefilter, toastNotifications]);
 
-  const canExtendTimeRange =
-    !isTextBasedQuery(query) && Boolean(occurrencesRange?.from && occurrencesRange.to);
   const canAdjustSearchCriteria = isTimeBased || hasFilters || hasQuery;
 
   const body = canAdjustSearchCriteria ? (
@@ -95,7 +111,7 @@ export const NoResultsSuggestions: React.FC<NoResultsSuggestionProps> = ({
       >
         {isTimeBased && (
           <li>
-            <NoResultsSuggestionWhenTimeRange />
+            <NoResultsSuggestionWhenTimeRange timeRangeExtendingStatus={timeRangeExtendingStatus} />
           </li>
         )}
         {hasQuery && (
@@ -132,28 +148,34 @@ export const NoResultsSuggestions: React.FC<NoResultsSuggestionProps> = ({
       }
       body={body}
       actions={
-        <div
-          css={css`
-            min-block-size: ${euiTheme.size.xxl};
-          `}
-        >
-          {typeof occurrencesRange === 'undefined' ? (
-            !isTextBasedQuery(query) && <EuiLoadingSpinner />
-          ) : canExtendTimeRange ? (
-            <EuiButton
-              color="primary"
-              fill
-              onClick={extendTimeRange}
-              isLoading={isExtending}
-              data-test-subj="discoverNoResultsViewAllMatches"
-            >
-              <FormattedMessage
-                id="discover.noResults.suggestion.viewAllMatchesButtonText"
-                defaultMessage="View all matches"
-              />
-            </EuiButton>
-          ) : null}
-        </div>
+        !isTextBasedQuery(query) && isTimeBased ? (
+          <div
+            css={css`
+              min-block-size: ${euiTheme.size.xxl};
+            `}
+          >
+            {[
+              TimeRangeExtendingStatus.initial,
+              TimeRangeExtendingStatus.loading,
+              TimeRangeExtendingStatus.timedOut,
+              TimeRangeExtendingStatus.failed,
+            ].includes(timeRangeExtendingStatus) && (
+              <EuiButton
+                color="primary"
+                fill
+                onClick={extendTimeRange}
+                disabled={timeRangeExtendingStatus === TimeRangeExtendingStatus.loading}
+                isLoading={timeRangeExtendingStatus === TimeRangeExtendingStatus.loading}
+                data-test-subj="discoverNoResultsViewAllMatches"
+              >
+                <FormattedMessage
+                  id="discover.noResults.suggestion.searchAllMatchesButtonText"
+                  defaultMessage="Search entire time range"
+                />
+              </EuiButton>
+            )}
+          </div>
+        ) : undefined
       }
     />
   );
diff --git a/src/plugins/discover/public/application/main/components/no_results/no_results_suggestions/use_fetch_occurances_range.ts b/src/plugins/discover/public/application/main/components/no_results/no_results_suggestions/use_fetch_occurances_range.ts
index 3e878735967efc..4d8904ffb59120 100644
--- a/src/plugins/discover/public/application/main/components/no_results/no_results_suggestions/use_fetch_occurances_range.ts
+++ b/src/plugins/discover/public/application/main/components/no_results/no_results_suggestions/use_fetch_occurances_range.ts
@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 
-import { useCallback, useEffect, useRef, useState } from 'react';
+import { useCallback, useEffect, useRef } from 'react';
 import { lastValueFrom } from 'rxjs';
 import type { DataView } from '@kbn/data-plugin/common';
 import type { AggregateQuery, Filter, Query } from '@kbn/es-query';
@@ -15,7 +15,6 @@ import type { IUiSettingsClient } from '@kbn/core-ui-settings-browser';
 import type { AggregationsSingleMetricAggregateBase } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import { buildEsQuery } from '@kbn/es-query';
 import { getEsQueryConfig } from '@kbn/data-plugin/common';
-import { isTextBasedQuery } from '../../../utils/is_text_based_query';
 
 export interface Params {
   dataView?: DataView;
@@ -27,26 +26,38 @@ export interface Params {
   };
 }
 
+export enum TimeRangeExtendingStatus {
+  initial = 'initial',
+  loading = 'loading',
+  succeedWithResults = 'succeedWithResults',
+  succeedWithoutResults = 'succeedWithoutResults',
+  failed = 'failed',
+  timedOut = 'timedOut',
+}
+
 export interface OccurrencesRange {
   from: string;
   to: string;
 }
 
+interface OccurrencesRangeFetchResult {
+  status: TimeRangeExtendingStatus;
+  range?: OccurrencesRange;
+}
+
 export interface Result {
-  range: OccurrencesRange | null | undefined;
-  refetch: () => Promise<OccurrencesRange | null | undefined>;
+  fetch: () => Promise<OccurrencesRangeFetchResult>;
 }
 
 export const useFetchOccurrencesRange = (params: Params): Result => {
   const data = params.services.data;
   const uiSettings = params.services.uiSettings;
-  const [range, setRange] = useState<OccurrencesRange | null | undefined>(undefined);
   const abortControllerRef = useRef<AbortController | null>(null);
   const mountedRef = useRef<boolean>(true);
 
   const fetchOccurrences = useCallback(
     async (dataView?: DataView, query?: Query | AggregateQuery, filters?: Filter[]) => {
-      let occurrencesRange = null;
+      let occurrencesRangeResult = { status: TimeRangeExtendingStatus.failed };
 
       if (dataView?.isTimeBased() && query && mountedRef.current) {
         abortControllerRef.current?.abort();
@@ -59,7 +70,7 @@ export const useFetchOccurrencesRange = (params: Params): Result => {
             filters ?? [],
             getEsQueryConfig(uiSettings)
           );
-          occurrencesRange = await fetchDocumentsTimeRange({
+          occurrencesRangeResult = await fetchDocumentsTimeRange({
             data,
             dataView,
             dslQuery,
@@ -73,13 +84,9 @@ export const useFetchOccurrencesRange = (params: Params): Result => {
         }
       }
 
-      if (mountedRef.current) {
-        setRange(occurrencesRange);
-      }
-
-      return occurrencesRange;
+      return occurrencesRangeResult;
     },
-    [abortControllerRef, setRange, mountedRef, data, uiSettings]
+    [abortControllerRef, mountedRef, data, uiSettings]
   );
 
   useEffect(() => {
@@ -89,15 +96,8 @@ export const useFetchOccurrencesRange = (params: Params): Result => {
     };
   }, [abortControllerRef, mountedRef]);
 
-  useEffect(() => {
-    if (!isTextBasedQuery(params.query)) {
-      fetchOccurrences(params.dataView, params.query, params.filters);
-    }
-  }, [fetchOccurrences, params.query, params.filters, params.dataView]);
-
   return {
-    range,
-    refetch: () => fetchOccurrences(params.dataView, params.query, params.filters),
+    fetch: () => fetchOccurrences(params.dataView, params.query, params.filters),
   };
 };
 
@@ -111,9 +111,9 @@ async function fetchDocumentsTimeRange({
   dataView: DataView;
   dslQuery?: object;
   abortSignal?: AbortSignal;
-}): Promise<OccurrencesRange | null> {
+}): Promise<OccurrencesRangeFetchResult> {
   if (!dataView?.timeFieldName) {
-    return null;
+    return { status: TimeRangeExtendingStatus.failed };
   }
 
   const result = await lastValueFrom(
@@ -150,14 +150,14 @@ async function fetchDocumentsTimeRange({
   );
 
   if (result.rawResponse?.timed_out) {
-    return null;
+    return { status: TimeRangeExtendingStatus.timedOut };
   }
 
   if (
     result.rawResponse?._clusters?.total !== result.rawResponse?._clusters?.successful ||
     result.rawResponse?._shards?.total !== result.rawResponse?._shards?.successful
   ) {
-    return null;
+    return { status: TimeRangeExtendingStatus.failed };
   }
 
   const earliestTimestamp = (
@@ -168,6 +168,9 @@ async function fetchDocumentsTimeRange({
   )?.value_as_string;
 
   return earliestTimestamp && latestTimestamp
-    ? { from: earliestTimestamp, to: latestTimestamp }
-    : null;
+    ? {
+        status: TimeRangeExtendingStatus.succeedWithResults,
+        range: { from: earliestTimestamp, to: latestTimestamp },
+      }
+    : { status: TimeRangeExtendingStatus.succeedWithoutResults };
 }
diff --git a/src/plugins/discover/public/build_services.ts b/src/plugins/discover/public/build_services.ts
index 7f7bcdee2154ba..91242f3b1cb939 100644
--- a/src/plugins/discover/public/build_services.ts
+++ b/src/plugins/discover/public/build_services.ts
@@ -57,6 +57,7 @@ import type { ContentClient } from '@kbn/content-management-plugin/public';
 import type { ObservabilityAIAssistantPublicStart } from '@kbn/observability-ai-assistant-plugin/public';
 import { memoize, noop } from 'lodash';
 import type { NoDataPagePluginStart } from '@kbn/no-data-page-plugin/public';
+import type { DataVisualizerPluginStart } from '@kbn/data-visualizer-plugin/public';
 import { DiscoverStartPlugins } from './plugin';
 import { DiscoverContextAppLocator } from './application/context/services/locator';
 import { DiscoverSingleDocLocator } from './application/doc/locator';
@@ -107,6 +108,7 @@ export interface DiscoverServices {
   trackUiMetric?: (metricType: UiCounterMetricType, eventName: string | string[]) => void;
   dataViewFieldEditor: IndexPatternFieldEditorStart;
   dataViewEditor: DataViewEditorStart;
+  dataVisualizer?: DataVisualizerPluginStart;
   http: HttpStart;
   storage: Storage;
   spaces?: SpacesApi;
@@ -162,6 +164,7 @@ export const buildServices = memoize(
       chrome: core.chrome,
       core,
       data: plugins.data,
+      dataVisualizer: plugins.dataVisualizer,
       docLinks: core.docLinks,
       embeddable: plugins.embeddable,
       i18n: core.i18n,
diff --git a/src/plugins/discover/public/components/view_mode_toggle/view_mode_toggle.test.tsx b/src/plugins/discover/public/components/view_mode_toggle/view_mode_toggle.test.tsx
index b5d176d0404a71..371ea1f0d06e21 100644
--- a/src/plugins/discover/public/components/view_mode_toggle/view_mode_toggle.test.tsx
+++ b/src/plugins/discover/public/components/view_mode_toggle/view_mode_toggle.test.tsx
@@ -17,6 +17,7 @@ import { BehaviorSubject } from 'rxjs';
 import { getDiscoverStateMock } from '../../__mocks__/discover_state.mock';
 import { DataTotalHits$ } from '../../application/main/state_management/discover_data_state_container';
 import { FetchStatus } from '../../application/types';
+import { discoverServiceMock } from '../../__mocks__/services';
 
 describe('Document view mode toggle component', () => {
   const mountComponent = ({
@@ -25,7 +26,8 @@ describe('Document view mode toggle component', () => {
     isTextBasedQuery = false,
     setDiscoverViewMode = jest.fn(),
   } = {}) => {
-    const serivces = {
+    const services = {
+      ...discoverServiceMock,
       uiSettings: {
         get: () => showFieldStatistics,
       },
@@ -38,7 +40,7 @@ describe('Document view mode toggle component', () => {
     }) as DataTotalHits$;
 
     return mountWithIntl(
-      <KibanaContextProvider services={serivces}>
+      <KibanaContextProvider services={services}>
         <DocumentViewModeToggle
           viewMode={viewMode}
           isTextBasedQuery={isTextBasedQuery}
diff --git a/src/plugins/discover/public/components/view_mode_toggle/view_mode_toggle.tsx b/src/plugins/discover/public/components/view_mode_toggle/view_mode_toggle.tsx
index 36328810747005..d96249827c3002 100644
--- a/src/plugins/discover/public/components/view_mode_toggle/view_mode_toggle.tsx
+++ b/src/plugins/discover/public/components/view_mode_toggle/view_mode_toggle.tsx
@@ -30,7 +30,7 @@ export const DocumentViewModeToggle = ({
   setDiscoverViewMode: (viewMode: VIEW_MODE) => void;
 }) => {
   const { euiTheme } = useEuiTheme();
-  const { uiSettings } = useDiscoverServices();
+  const { uiSettings, dataVisualizer: dataVisualizerService } = useDiscoverServices();
   const isLegacy = useMemo(
     () => isLegacyTableEnabled({ uiSettings, isTextBasedQueryMode: isTextBasedQuery }),
     [uiSettings, isTextBasedQuery]
@@ -48,7 +48,8 @@ export const DocumentViewModeToggle = ({
     }
   `;
 
-  const showViewModeToggle = uiSettings.get(SHOW_FIELD_STATISTICS) ?? false;
+  const showViewModeToggle =
+    (uiSettings.get(SHOW_FIELD_STATISTICS) && dataVisualizerService !== undefined) ?? false;
 
   return (
     <EuiFlexGroup
diff --git a/src/plugins/discover/public/plugin.tsx b/src/plugins/discover/public/plugin.tsx
index 3563697138cc44..a5ab80cbf48574 100644
--- a/src/plugins/discover/public/plugin.tsx
+++ b/src/plugins/discover/public/plugin.tsx
@@ -51,6 +51,7 @@ import type {
   ObservabilityAIAssistantPublicSetup,
   ObservabilityAIAssistantPublicStart,
 } from '@kbn/observability-ai-assistant-plugin/public';
+import type { DataVisualizerPluginStart } from '@kbn/data-visualizer-plugin/public';
 import { PLUGIN_ID } from '../common';
 import { registerFeature } from './register_feature';
 import { buildServices, UrlTracker } from './build_services';
@@ -180,6 +181,7 @@ export interface DiscoverSetupPlugins {
 export interface DiscoverStartPlugins {
   dataViews: DataViewsServicePublic;
   dataViewEditor: DataViewEditorStart;
+  dataVisualizer?: DataVisualizerPluginStart;
   uiActions: UiActionsStart;
   embeddable: EmbeddableStart;
   navigation: NavigationStart;
diff --git a/src/plugins/discover/tsconfig.json b/src/plugins/discover/tsconfig.json
index 4a34f7fb34d423..8ea9e844d10a94 100644
--- a/src/plugins/discover/tsconfig.json
+++ b/src/plugins/discover/tsconfig.json
@@ -85,6 +85,7 @@
     "@kbn/data-view-utils",
     "@kbn/presentation-publishing",
     "@kbn/observability-ai-assistant-plugin",
+    "@kbn/data-visualizer-plugin",
     "@kbn/search-types"
   ],
   "exclude": ["target/**/*"]
diff --git a/src/plugins/embeddable/README.md b/src/plugins/embeddable/README.md
index ab931e559670e5..12cbca12aa939f 100644
--- a/src/plugins/embeddable/README.md
+++ b/src/plugins/embeddable/README.md
@@ -1,757 +1,4 @@
-# Embeddables Plugin
+# Documentation and examples
 
-The Embeddables Plugin provides an opportunity to expose reusable interactive widgets that can be embedded outside the original plugin.
-
-## Capabilities
-
-- Framework-agnostic API.
-- Out-of-the-box React support.
-- Integration with Redux.
-- Integration with the [UI Actions](https://github.com/elastic/kibana/tree/HEAD/src/plugins/ui_actions) plugin.
-- Hierarchical structure to enclose multiple widgets.
-- Error handling.
-
-## Key Concepts
-
-### Embeddable
-
-Embeddable is a re-usable widget that can be rendered on a dashboard as well as in other applications.
-Developers are free to embed them directly in their plugins.
-End users can dynamically select an embeddable to add to a _container_.
-Dashboard container powers the grid of panels on the Dashboard app.
-
-### Container
-
-Container is a special type of embeddable that can hold other embeddable items.
-Embeddables can be added dynamically to the containers, but that should be implemented on the end plugin side.
-Currently, the dashboard plugin provides such functionality.
-
-### Input
-
-Every embeddable has an input which is a serializable set of data.
-This data can be used to update the state of the embeddable widget.
-The input can be updated later so that the embeddable should be capable of reacting to those changes.
-
-### Output
-
-Every embeddable may expose some data to the external interface.
-Usually, it is diverged from the input and not necessarily serializable.
-Output data can also be updated, but that should always be done inside the embeddable.
-
-## Usage
-
-### Getting Started
-
-After listing the `embeddable` plugin in your dependencies, the plugin will be intitalized on the setup stage.
-
-The setup contract exposes a handle to register an embeddable factory.
-At this point, we can provide all the dependencies needed for the widget via the factory.
-
-```typescript
-import { EmbeddableSetup } from '@kbn/embeddable-plugin/public';
-import { HELLO_WORLD } from './hello_world';
-import { HelloWorldFactory } from './hello_world_factory';
-
-interface SetupDeps {
-  embeddable: EmbeddableSetup;
-}
-
-class ExamplePlugin implements Plugin<void, void, SetupDeps> {
-  setup({}: CoreSetup, { embeddable }: SetupDeps) {
-    embeddable.registerEmbeddableFactory(HELLO_WORLD, new HelloWorldFactory());
-  }
-
-  start() {}
-}
-
-export function plugin() {
-  return new ExamplePlugin();
-}
-```
-
-The factory should implement the `EmbeddableFactoryDefinition` interface.
-At this stage, we can inject all the dependencies into the embeddable instance.
-
-```typescript
-import {
-  IContainer,
-  EmbeddableInput,
-  EmbeddableFactoryDefinition,
-} from '@kbn/embeddable-plugin/public';
-import { HelloWorld, HELLO_WORLD } from './hello_world';
-
-export class HelloWorldEmbeddableFactoryDefinition implements EmbeddableFactoryDefinition {
-  readonly type = HELLO_WORLD;
-
-  async isEditable() {
-    return true;
-  }
-
-  async create(input: EmbeddableInput, parent?: IContainer) {
-    return new HelloWorld(input, {}, parent);
-  }
-
-  getDisplayName() {
-    return 'Hello World';
-  }
-}
-```
-
-The embeddable should implement the `IEmbeddable` interface, and usually, that just extends the base class `Embeddable`.
-
-```tsx
-import React from 'react';
-import { Embeddable } from '@kbn/embeddable-plugin/public';
-
-export const HELLO_WORLD = 'HELLO_WORLD';
-
-export class HelloWorld extends Embeddable {
-  readonly type = HELLO_WORLD;
-
-  render() {
-    return <div>{this.getTitle()}</div>;
-  }
-
-  reload() {}
-}
-```
-
-### Life-Cycle Hooks
-
-Every embeddable can implement a specific behavior for the following life-cycle stages.
-
-#### `render`
-
-This is a mandatory method to implement.
-It is used for the initial render of the embeddable.
-
-```tsx
-import React from 'react';
-import { render } from 'react-dom';
-import { Embeddable } from '@kbn/embeddable-plugin/public';
-
-export class HelloWorld extends Embeddable {
-  // ...
-
-  render(node: HTMLElement) {
-    render(<div>{this.getTitle()}</div>, node);
-  }
-}
-```
-
-There is also an option to return a [React node](https://reactjs.org/docs/react-component.html#render) directly.
-In that case, the returned node will be automatically mounted and unmounted.
-
-```tsx
-import React from 'react';
-import { Embeddable } from '@kbn/embeddable-plugin/public';
-
-export class HelloWorld extends Embeddable {
-  // ...
-
-  render() {
-    return <div>{this.getTitle()}</div>;
-  }
-}
-```
-
-#### `reload`
-
-This hook is called after every input update to perform some UI changes.
-
-```typescript
-import { Embeddable } from '@kbn/embeddable-plugin/public';
-
-export class HelloWorld extends Embeddable {
-  // ...
-
-  private node?: HTMLElement;
-
-  render(node: HTMLElement) {
-    this.node = node;
-
-    // ...
-  }
-
-  reload() {
-    if (this.node) {
-      this.render(this.node);
-    }
-  }
-}
-```
-
-In some cases, the `reload` hook can be called to force rerender of the embeddable widget.
-When the imperative rendering approach is used, the example above is good enough to achieve the goal.
-
-In the case of React rendering, it will no longer work as the returned node is mounted on the upper level.
-The recommended way is to use [Redux store](#redux) with a custom reducer.
-
-```tsx
-import React from 'react';
-import { createSlice } from '@reduxjs/toolkit';
-import { connect, Provider } from 'react-redux';
-import { Embeddable, IEmbeddable } from '@kbn/embeddable-plugin/public';
-import { createStore, State } from '@kbn/embeddable-plugin/public/store';
-
-interface ComponentState {
-  reloadedAt?: number;
-}
-
-export interface HelloWorldState extends State<HelloWorld> {
-  component: ComponentState;
-}
-
-const component = createSlice({
-  name: 'hello-world-component',
-  initialState: {} as ComponentState,
-  reducers: {
-    reload(state) {
-      state.reloadedAt = new Date().getTime();
-    },
-  },
-});
-
-export class HelloWorld extends Embeddable {
-  readonly store = createStore<HelloWorld, HelloWorldState>(this, {
-    preloadedState: {
-      component: {},
-    },
-    reducer: { component: component.reducer },
-  });
-
-  render() {
-    return (
-      <Provider store={this.store}>
-        <Component />
-      </Provider>
-    );
-  }
-
-  reload() {
-    this.store.dispatch(component.actions.reload());
-  }
-}
-```
-
-Alternatively, a [state modifier](https://reactjs.org/docs/hooks-faq.html#is-there-something-like-forceupdate) can be exposed via a reference object and later called from the `reload` hook.
-
-#### `catchError`
-
-This is an optional error handler to provide a custom UI for the error state.
-
-The embeddable may change its state in the future so that the error should be able to disappear.
-In that case, the method should return a callback performing cleanup actions for the error UI.
-
-If there is no implementation provided for the `catchError` hook, the embeddable will render a fallback error UI.
-
-In case of an error, the embeddable UI will not be destroyed or unmounted.
-The default behavior is to hide that visually and show the error message on top of that.
-
-```typescript
-import React from 'react';
-import { render, unmountComponentAtNode } from 'react-dom';
-import { Embeddable } from '@kbn/embeddable-plugin/public';
-
-export class HelloWorld extends Embeddable {
-  // ...
-
-  catchError(error: Error, node: HTMLElement) {
-    render(<div>Something went wrong: {error.message}</div>, node);
-
-    return () => unmountComponentAtNode(node);
-  }
-}
-```
-
-There is also an option to return a [React node](https://reactjs.org/docs/react-component.html#render) directly.
-In that case, the returned node will be automatically mounted and unmounted.
-
-```typescript
-import React from 'react';
-import { Embeddable } from '@kbn/embeddable-plugin/public';
-
-export class HelloWorld extends Embeddable {
-  // ...
-
-  catchError(error: Error) {
-    return <div>Something went wrong: {error.message}</div>;
-  }
-}
-```
-
-#### `destroy`
-
-This hook is invoked when the embeddable is destroyed and should perform cleanup actions.
-
-```typescript
-import React from 'react';
-import { render, unmountComponentAtNode } from 'react-dom';
-import { Embeddable } from '@kbn/embeddable-plugin/public';
-
-export class HelloWorld extends Embeddable {
-  // ...
-
-  render(node: HTMLElement) {
-    this.node = node;
-
-    // ...
-  }
-
-  destroy() {
-    if (this.node) {
-      unmountComponentAtNode(this.node);
-    }
-  }
-}
-```
-
-### Input State
-
-The input state can be updated throughout the lifecycle of an embeddable. That can be done via `updateInput` method call.
-
-```typescript
-import { Embeddable } from '@kbn/embeddable-plugin/public';
-
-export class HelloWorld extends Embeddable {
-  setTitle(title: string) {
-    this.updateInput({ title });
-  }
-}
-```
-
-The input should always be updated partially. Otherwise, it may break the inheritance of the container's input as all the values passed in the changes object have precedence over the values set on the parent container.
-
-For example, the time range on a dashboard is _inherited_ by all children _unless_ they explicitly override their time range.
-This is the way the per panel time range works. In that case, there is a call `item.updateInput({ timeRange })` that detaches the time range from the container.
-
-### Containers
-
-The plugin provides a way to organize a collection of embeddable widgets inside containers.
-In this case, the container holds the state of all the children and manages all the input state updates.
-
-```typescript
-import { Container } from '@kbn/embeddable-plugin/public';
-
-export class HelloWorldContainer extends Container {
-  protected getInhertedInput() {
-    return {
-      timeRange: this.input.timeRange,
-      viewMode: this.input.viewMode,
-    };
-  }
-}
-```
-
-_Note 1:_ The `getInhertedInput` may also return values not from the input state, but it is an uncommon case.
-
-_Note 2:_ Keep in mind that this input state will be passed down to all the children, which can be redundant in most cases.
-It is better to return only necessary generic information that all children will likely consume.
-
-### Inheritance
-
-In the example above, all the container children will share the `timeRange` and `viewMode` properties.
-If the container has other properties in the input state, they will not be shared with the children.
-From the embeddable point, that works transparently, and there is no difference whether the embeddable is placed inside a container or not.
-
-Let's take, for example, a container with the following input:
-
-```typescript
-{
-  gridData: { /* ... */ },
-  timeRange: 'now-15m to now',
-
-  // Every embeddable container has a panels mapping.
-  // It's how the base container class manages common changes like children being added, removed or edited.
-  panels: {
-    '1': {
-      // The `type` is used to grab the right embeddable factory.
-      // Every PanelState must specify one.
-      type: 'clock',
-
-      // The `explicitInput` is combined with the `inheritedInput`.
-      explicitInput: {
-
-        // The `explicitInput` requires to have an `id`.
-        // This is needed for the embeddable to know where it stays in the panels array if it's inside a container.
-        // This is not a saved object id even though it can be the same sometimes.
-        id: '1',
-      }
-    }
-  }
-}
-```
-
-That could result in the following input being passed to a child embeddable:
-
-```typescript
-{
-  timeRange: 'now-15m to now',
-  id: '1',
-}
-```
-
-#### Input Overriding
-
-There is a way of _overriding_ this inherited state.
-For example, the _inherited_ `timeRange` input can be overridden by the _explicit_ `timeRange` input.
-
-Let's take this example dashboard container input:
-
-```javascript
-{
-  gridData: { /* ... */ },
-  timeRange: 'now-15m to now',
-  panels: {
-    ['1']: {
-      type: 'clock',
-      explicitInput: {
-        timeRange: 'now-30m to now',
-        id: '1',
-      }
-    },
-    ['2']: {
-      type: 'clock',
-      explicitInput: {
-        id: '2',
-      }
-    },
-}
-```
-
-The first child embeddable will get the following state:
-
-```javascript
-{
-  timeRange: 'now-30m to now',
-  id: '1',
-}
-```
-
-This override wouldn't affect other children, so the second child would get:
-
-```javascript
-{
-  timeRange: 'now-15m to now',
-  id: '2',
-}
-```
-
-#### Embeddable Id
-
-The `id` parameter in the input is marked as required even though it is only used when the embeddable is inside a container.
-That is done to guarantee consistency.
-
-This has nothing to do with a saved object id, even though in the dashboard app, the saved object happens to be the same.
-
-#### Accessing Container
-
-The parent container can be retrieved via either `embeddabble.parent` or `embeddable.getRoot()`.
-The `getRoot` variety will walk up to find the root parent.
-
-We can use those to get an explicit input from the child embeddable:
-
-```typescript
-return parent.getInput().panels[embeddable.id].explicitInput;
-```
-
-#### Encapsulated Explicit Input
-
-It is possible for a container to store an explicit input state on the embeddable side. It would be encapsulated from a container in this case.
-
-This can ne achieved in two ways by implementing one of the following:
-
-- `EmbeddableFactory.getExplicitInput` was intended as a way for an embeddable to retrieve input state it needs that is not provided by a container.
-- `EmbeddableFactory.getDefaultInput` will provide default values, only if the container did not supply them through inheritance.
-  Explicit input will always provide these values, and will always be stored in a containers `panel[id].explicitInput`, even if the container _did_ provide it.
-
-### React
-
-The plugin provides a set of ready-to-use React components that abstract rendering of an embeddable behind a React component:
-
-- `EmbeddablePanel` provides a way to render an embeddable inside a rectangular panel. This also provides error handling and a basic user interface over some of the embeddable properties.
-- `EmbeddableRoot` is the most straightforward wrapper performing rendering of an embeddable.
-- `EmbeddableRenderer` is a helper component to render an embeddable or an embeddable factory.
-
-Apart from the React components, there is also a way to construct an embeddable object using `useEmbeddableFactory` hook.
-This React hook takes care of producing an embeddable and updating its input state if passed state changes.
-
-### Redux
-
-The plugin provides an adapter for Redux over the embeddable state.
-It uses the Redux Toolkit library underneath and works as a decorator on top of the [`configureStore`](https://redux-toolkit.js.org/api/configureStore) function.
-In other words, it provides a way to use the full power of the library together with the embeddable plugin features.
-
-The adapter implements a bi-directional sync mechanism between the embeddable instance and the Redux state.
-To perform state mutations, the plugin also exposes a pre-defined state of the actions that can be extended by an additional reducer.
-
-Here is an example of initializing a Redux store:
-
-```tsx
-import React from 'react';
-import { connect, Provider } from 'react-redux';
-import { Embeddable, IEmbeddable } from '@kbn/embeddable-plugin/public';
-import { createStore, State } from '@kbn/embeddable-plugin/public/store';
-import { HelloWorldComponent } from './hello_world_component';
-
-export const HELLO_WORLD = 'HELLO_WORLD';
-
-export class HelloWorld extends Embeddable {
-  readonly type = HELLO_WORLD;
-
-  readonly store = createStore(this);
-
-  reload() {}
-
-  render() {
-    const Component = connect((state: State<HelloWorld>) => ({ title: state.input.title }))(
-      HelloWorldComponent
-    );
-
-    return (
-      <Provider store={this.store}>
-        <Component />
-      </Provider>
-    );
-  }
-}
-```
-
-Then inside the embedded component, it is possible to use the [`useSelector`](https://react-redux.js.org/api/hooks#useselector) and [`useDispatch`](https://react-redux.js.org/api/hooks#usedispatch) hooks.
-
-```tsx
-import React from 'react';
-import { useDispatch, useSelector } from 'react-redux';
-import { actions, State } from '@kbn/embeddable-plugin/public/store';
-import { ViewMode } from '@kbn/embeddable-plugin/public';
-import type { HelloWorld } from './hello_world';
-
-interface HelloWorldComponentProps {
-  title?: string;
-}
-
-export function HelloWorldComponent({ title }: HelloWorldComponentProps) {
-  const viewMode = useSelector<State<HelloWorld>>(({ input }) => input.viewMode);
-  const dispatch = useDispatch();
-
-  return (
-    <div>
-      <h1>{title}</h1>
-      {viewMode === ViewMode.EDIT && (
-        <input
-          type="text"
-          value={title}
-          onChange={({ target }) => dispatch(actions.input.setTitle(target.value))}
-        />
-      )}
-    </div>
-  );
-}
-```
-
-#### Custom Properties
-
-The `createStore` function provides an option to pass a custom reducer in the second argument.
-That reducer will be merged with the one the embeddable plugin provides.
-That means there is no need to reimplement already existing actions.
-
-```tsx
-import React from 'react';
-import { createSlice } from '@reduxjs/toolkit';
-import {
-  Embeddable,
-  EmbeddableInput,
-  EmbeddableOutput,
-  IEmbeddable,
-} from '@kbn/embeddable-plugin/public';
-import { createStore, State } from '@kbn/embeddable-plugin/public/store';
-
-interface HelloWorldInput extends EmbeddableInput {
-  greeting?: string;
-}
-
-interface HelloWorldOutput extends EmbeddableOutput {
-  message?: string;
-}
-
-const input = createSlice({
-  name: 'hello-world-input',
-  initialState: {} as HelloWorldInput,
-  reducers: {
-    setGreeting(state, action: PayloadAction<HelloWorldInput['greeting']>) {
-      state.greeting = action.payload;
-    },
-  },
-});
-
-const output = createSlice({
-  name: 'hello-world-input',
-  initialState: {} as HelloWorldOutput,
-  reducers: {
-    setMessage(state, action: PayloadAction<HelloWorldOutput['message']>) {
-      state.message = action.payload;
-    },
-  },
-});
-
-export const actions = {
-  ...input.actions,
-  ...output.actions,
-};
-
-export class HelloWorld extends Embeddable<HelloWorldInput, HelloWorldOutput> {
-  readonly store = createStore(this, {
-    reducer: {
-      input: input.reducer,
-      output: output.reducer,
-    },
-  });
-
-  // ...
-}
-```
-
-There is a way to provide a custom reducer that will manipulate the root state:
-
-```typescript
-// ...
-
-import { createAction, createRducer } from '@reduxjs/toolkit';
-
-// ...
-
-const setGreeting = createAction<HelloWorldInput['greeting']>('greeting');
-const setMessage = createAction<HelloWorldOutput['message']>('message');
-const reducer = createReducer({} as State<HelloWorld>, (builder) =>
-  builder
-    .addCase(setGreeting, (state, action) => ({
-      ...state,
-      input: { ...state.input, greeting: action.payload },
-    }))
-    .addCase(setMessage, (state, action) => ({
-      ...state,
-      output: { ...state.output, message: action.payload },
-    }))
-);
-
-export const actions = {
-  setGreeting,
-  setMessage,
-};
-
-export class HelloWorld extends Embeddable<HelloWorldInput, HelloWorldOutput> {
-  readonly store = createStore(this, { reducer });
-
-  // ...
-}
-```
-
-#### Custom State
-
-Sometimes, there is a need to store a custom state next to the embeddable state.
-This can be achieved by passing a custom reducer.
-
-```tsx
-import React from 'react';
-import { createSlice } from '@reduxjs/toolkit';
-import { Embeddable, IEmbeddable } from '@kbn/embeddable-plugin/public';
-import { createStore, State } from '@kbn/embeddable-plugin/public/store';
-
-interface ComponentState {
-  foo?: string;
-  bar?: string;
-}
-
-export interface HelloWorldState extends State<HelloWorld> {
-  component: ComponentState;
-}
-
-const component = createSlice({
-  name: 'hello-world-component',
-  initialState: {} as ComponentState,
-  reducers: {
-    setFoo(state, action: PayloadAction<ComponentState['foo']>) {
-      state.foo = action.payload;
-    },
-    setBar(state, action: PayloadAction<ComponentState['bar']>) {
-      state.bar = action.payload;
-    },
-  },
-});
-
-export const { actions } = component;
-
-export class HelloWorld extends Embeddable {
-  readonly store = createStore<HelloWorld, HelloWorldState>(this, {
-    preloadedState: {
-      component: {
-        foo: 'bar',
-        bar: 'foo',
-      },
-    },
-    reducer: { component: component.reducer },
-  });
-
-  // ...
-}
-```
-
-#### Typings
-
-When using the `useSelector` hook, it is convenient to have a `State` type to guarantee type safety and determine types implicitly.
-
-For the state containing input and output substates only, it is enough to use a utility type `State`:
-
-```typescript
-import { useSelector } from 'react-redux';
-import type { State } from '@kbn/embeddable-plugin/public/store';
-import type { Embeddable } from './some_embeddable';
-
-// ...
-const title = useSelector<State<Embeddable>>((state) => state.input.title);
-```
-
-For the more complex case, the best way would be to define a state type separately:
-
-```typescript
-import { useSelector } from 'react-redux';
-import type { State } from '@kbn/embeddable-plugin/public/store';
-import type { Embeddable } from './some_embeddable';
-
-interface EmbeddableState extends State<Embeddable> {
-  foo?: string;
-  bar?: Bar;
-}
-
-// ...
-const foo = useSelector<EmbeddableState>((state) => state.foo);
-```
-
-#### Advanced Usage
-
-In case when there is a need to enhance the produced store in some way (e.g., perform custom serialization or debugging), it is possible to use [parameters](https://redux-toolkit.js.org/api/configureStore#parameters) supported by the `configureStore` function.
-
-In case when custom serialization is needed, that should be done using middleware. The embeddable plugin's `createStore` function does not apply any middleware, so all the synchronization job is done outside the store.
-
-## API
-
-Please use automatically generated API reference or generated TypeDoc comments to find the complete documentation.
-
-## Examples
-
-- Multiple embeddable examples are implemented and registered [here](https://github.com/elastic/kibana/tree/HEAD/examples/embeddable_examples).
-- They can be played around with and explored in the [Embeddable Explorer](https://github.com/elastic/kibana/tree/HEAD/examples/embeddable_explorer) example plugin.
-- There is an [example](https://github.com/elastic/kibana/tree/HEAD/examples/portable_dashboards_example) of rendering a dashboard container outside the dashboard app.
-- There are storybook [stories](https://github.com/elastic/kibana/tree/HEAD/src/plugins/embeddable/public/__stories__) that demonstrate usage of the embeddable components.
-
-To run the examples plugin use the following command:
-
-```bash
-yarn start --run-examples
-```
-
-To run the storybook:
-
-```bash
-yarn storybook embeddable
-```
+Embeddable documentation and examples are bundled with Kibana and accessable by running `yarn start --run-examples`.
+Navigate to `http://localhost:5601/app/embeddablesApp`.
\ No newline at end of file
diff --git a/src/plugins/embeddable/public/index.ts b/src/plugins/embeddable/public/index.ts
index 0a943736d0a753..93f98dbf29eae0 100644
--- a/src/plugins/embeddable/public/index.ts
+++ b/src/plugins/embeddable/public/index.ts
@@ -25,6 +25,7 @@ export {
   EmbeddableStateTransfer,
   ErrorEmbeddable,
   genericEmbeddableInputIsEqual,
+  getReactEmbeddableSavedObjects,
   isContextMenuTriggerContext,
   isEmbeddable,
   isErrorEmbeddable,
@@ -46,7 +47,6 @@ export {
   PANEL_BADGE_TRIGGER,
   PANEL_HOVER_TRIGGER,
   PANEL_NOTIFICATION_TRIGGER,
-  registerReactEmbeddableSavedObject,
   runEmbeddableFactoryMigrations,
   SELECT_RANGE_TRIGGER,
   shouldFetch$,
@@ -80,6 +80,7 @@ export type {
   PanelState,
   PropertySpec,
   RangeSelectContext,
+  ReactEmbeddableSavedObject,
   ReferenceOrValueEmbeddable,
   SavedObjectEmbeddableInput,
   SelfStyledEmbeddable,
@@ -96,16 +97,12 @@ export type { EnhancementRegistryDefinition } from './types';
 
 export {
   ReactEmbeddableRenderer,
-  reactEmbeddableRegistryHasKey,
-  registerReactEmbeddableFactory,
   type DefaultEmbeddableApi,
   type ReactEmbeddableFactory,
   type ReactEmbeddableRegistration,
   startTrackingEmbeddableUnsavedChanges,
 } from './react_embeddable_system';
 
-export { registerSavedObjectToPanelMethod } from './registry/saved_object_to_panel_methods';
-
 export function plugin(initializerContext: PluginInitializerContext) {
   return new EmbeddablePublicPlugin(initializerContext);
 }
diff --git a/src/plugins/embeddable/public/mocks.tsx b/src/plugins/embeddable/public/mocks.tsx
index 8e0ee094e8a4d6..52495ccddce579 100644
--- a/src/plugins/embeddable/public/mocks.tsx
+++ b/src/plugins/embeddable/public/mocks.tsx
@@ -32,8 +32,14 @@ import {
   SelfStyledEmbeddable,
 } from '.';
 import { setKibanaServices } from './kibana_services';
+import { registerReactEmbeddableSavedObject } from './lib';
 import { SelfStyledOptions } from './lib/self_styled_embeddable/types';
 import { EmbeddablePublicPlugin } from './plugin';
+import {
+  reactEmbeddableRegistryHasKey,
+  registerReactEmbeddableFactory,
+} from './react_embeddable_system';
+import { registerSavedObjectToPanelMethod } from './registry/saved_object_to_panel_methods';
 
 export { mockAttributeService } from './lib/attribute_service/attribute_service.mock';
 export type Setup = jest.Mocked<EmbeddableSetup>;
@@ -93,6 +99,13 @@ export function mockFilterableEmbeddable<OriginalEmbeddableType>(
 
 const createSetupContract = (): Setup => {
   const setupContract: Setup = {
+    registerSavedObjectToPanelMethod: jest
+      .fn()
+      .mockImplementation(registerSavedObjectToPanelMethod),
+    registerReactEmbeddableSavedObject: jest
+      .fn()
+      .mockImplementation(registerReactEmbeddableSavedObject),
+    registerReactEmbeddableFactory: jest.fn().mockImplementation(registerReactEmbeddableFactory),
     registerEmbeddableFactory: jest.fn(),
     registerEnhancement: jest.fn(),
     setCustomEmbeddableFactoryProvider: jest.fn(),
@@ -102,6 +115,7 @@ const createSetupContract = (): Setup => {
 
 const createStartContract = (): Start => {
   const startContract: Start = {
+    reactEmbeddableRegistryHasKey: jest.fn().mockImplementation(reactEmbeddableRegistryHasKey),
     getEmbeddableFactories: jest.fn(),
     getEmbeddableFactory: jest.fn(),
     telemetry: jest.fn(),
diff --git a/src/plugins/embeddable/public/plugin.tsx b/src/plugins/embeddable/public/plugin.tsx
index b041ac41cb560f..c7a146fd569b13 100644
--- a/src/plugins/embeddable/public/plugin.tsx
+++ b/src/plugins/embeddable/public/plugin.tsx
@@ -39,6 +39,7 @@ import {
   defaultEmbeddableFactoryProvider,
   IEmbeddable,
   SavedObjectEmbeddableInput,
+  registerReactEmbeddableSavedObject,
 } from './lib';
 import { EmbeddableFactoryDefinition } from './lib/embeddables/embeddable_factory_definition';
 import { EmbeddableStateTransfer } from './lib/state_transfer';
@@ -53,6 +54,13 @@ import {
 } from '../common/lib';
 import { getAllMigrations } from '../common/lib/get_all_migrations';
 import { setKibanaServices } from './kibana_services';
+import {
+  DefaultEmbeddableApi,
+  ReactEmbeddableFactory,
+  reactEmbeddableRegistryHasKey,
+  registerReactEmbeddableFactory,
+} from './react_embeddable_system';
+import { registerSavedObjectToPanelMethod } from './registry/saved_object_to_panel_methods';
 
 export interface EmbeddableSetupDependencies {
   uiActions: UiActionsSetup;
@@ -68,6 +76,23 @@ export interface EmbeddableStartDependencies {
 }
 
 export interface EmbeddableSetup {
+  registerReactEmbeddableSavedObject: typeof registerReactEmbeddableSavedObject;
+  registerSavedObjectToPanelMethod: typeof registerSavedObjectToPanelMethod;
+
+  /**
+   * Registers an async {@link ReactEmbeddableFactory} getter.
+   */
+  registerReactEmbeddableFactory: <
+    StateType extends object = object,
+    APIType extends DefaultEmbeddableApi<StateType> = DefaultEmbeddableApi<StateType>
+  >(
+    type: string,
+    getFactory: () => Promise<ReactEmbeddableFactory<StateType, APIType>>
+  ) => void;
+
+  /**
+   * @deprecated use {@link registerReactEmbeddableFactory} instead.
+   */
   registerEmbeddableFactory: <
     I extends EmbeddableInput,
     O extends EmbeddableOutput,
@@ -76,11 +101,25 @@ export interface EmbeddableSetup {
     id: string,
     factory: EmbeddableFactoryDefinition<I, O, E>
   ) => () => EmbeddableFactory<I, O, E>;
+  /**
+   * @deprecated
+   */
   registerEnhancement: (enhancement: EnhancementRegistryDefinition) => void;
+  /**
+   * @deprecated
+   */
   setCustomEmbeddableFactoryProvider: (customProvider: EmbeddableFactoryProvider) => void;
 }
 
 export interface EmbeddableStart extends PersistableStateService<EmbeddableStateWithType> {
+  /**
+   * Checks if a {@link ReactEmbeddableFactory} has been registered using {@link registerReactEmbeddableFactory}
+   */
+  reactEmbeddableRegistryHasKey: (type: string) => boolean;
+
+  /**
+   * @deprecated use {@link registerReactEmbeddableFactory} instead.
+   */
   getEmbeddableFactory: <
     I extends EmbeddableInput = EmbeddableInput,
     O extends EmbeddableOutput = EmbeddableOutput,
@@ -88,6 +127,10 @@ export interface EmbeddableStart extends PersistableStateService<EmbeddableState
   >(
     embeddableFactoryId: string
   ) => EmbeddableFactory<I, O, E> | undefined;
+
+  /**
+   * @deprecated
+   */
   getEmbeddableFactories: () => IterableIterator<EmbeddableFactory>;
   getStateTransfer: (storage?: Storage) => EmbeddableStateTransfer;
   getAttributeService: <
@@ -121,6 +164,10 @@ export class EmbeddablePublicPlugin implements Plugin<EmbeddableSetup, Embeddabl
     bootstrap(uiActions);
 
     return {
+      registerReactEmbeddableFactory,
+      registerSavedObjectToPanelMethod,
+      registerReactEmbeddableSavedObject,
+
       registerEmbeddableFactory: this.registerEmbeddableFactory,
       registerEnhancement: this.registerEnhancement,
       setCustomEmbeddableFactoryProvider: (provider: EmbeddableFactoryProvider) => {
@@ -169,6 +216,8 @@ export class EmbeddablePublicPlugin implements Plugin<EmbeddableSetup, Embeddabl
       );
 
     const embeddableStart: EmbeddableStart = {
+      reactEmbeddableRegistryHasKey,
+
       getEmbeddableFactory: this.getEmbeddableFactory,
       getEmbeddableFactories: this.getEmbeddableFactories,
       getAttributeService: (type: string, options) =>
diff --git a/src/plugins/embeddable/public/react_embeddable_system/types.ts b/src/plugins/embeddable/public/react_embeddable_system/types.ts
index e79879a5b44878..89b2ac3d98af43 100644
--- a/src/plugins/embeddable/public/react_embeddable_system/types.ts
+++ b/src/plugins/embeddable/public/react_embeddable_system/types.ts
@@ -40,7 +40,6 @@ export type ReactEmbeddableApiRegistration<
  *
  * Embeddables are React components that manage their own state, can be serialized and
  * deserialized, and return an API that can be used to interact with them imperatively.
- * provided by the parent, and will not save any state to an external store.
  **/
 export interface ReactEmbeddableFactory<
   SerializedState extends object = object,
diff --git a/src/plugins/image_embeddable/public/plugin.ts b/src/plugins/image_embeddable/public/plugin.ts
index 3b1f8e907e9bb8..3af5c4da14b859 100644
--- a/src/plugins/image_embeddable/public/plugin.ts
+++ b/src/plugins/image_embeddable/public/plugin.ts
@@ -7,7 +7,7 @@
  */
 
 import { CoreSetup, CoreStart, Plugin } from '@kbn/core/public';
-import { EmbeddableSetup, registerReactEmbeddableFactory } from '@kbn/embeddable-plugin/public';
+import { EmbeddableSetup, EmbeddableStart } from '@kbn/embeddable-plugin/public';
 import { FilesSetup, FilesStart } from '@kbn/files-plugin/public';
 import {
   ScreenshotModePluginSetup,
@@ -33,6 +33,7 @@ export interface ImageEmbeddableStartDependencies {
   files: FilesStart;
   security?: SecurityPluginStart;
   uiActions: UiActionsStart;
+  embeddable: EmbeddableStart;
   screenshotMode?: ScreenshotModePluginStart;
   embeddableEnhanced?: EmbeddableEnhancedPluginStart;
 }
@@ -59,6 +60,15 @@ export class ImageEmbeddablePlugin
     plugins: ImageEmbeddableSetupDependencies
   ): SetupContract {
     plugins.uiActions.registerTrigger(imageClickTrigger);
+
+    plugins.embeddable.registerReactEmbeddableFactory(IMAGE_EMBEDDABLE_TYPE, async () => {
+      const [_, { getImageEmbeddableFactory }, [__, { embeddableEnhanced }]] = await Promise.all([
+        untilPluginStartServicesReady(),
+        import('./image_embeddable/get_image_embeddable_factory'),
+        core.getStartServices(),
+      ]);
+      return getImageEmbeddableFactory({ embeddableEnhanced });
+    });
     return {};
   }
 
@@ -68,13 +78,6 @@ export class ImageEmbeddablePlugin
     untilPluginStartServicesReady().then(() => {
       registerCreateImageAction();
     });
-    registerReactEmbeddableFactory(IMAGE_EMBEDDABLE_TYPE, async () => {
-      const [_, { getImageEmbeddableFactory }] = await Promise.all([
-        untilPluginStartServicesReady(),
-        import('./image_embeddable/get_image_embeddable_factory'),
-      ]);
-      return getImageEmbeddableFactory({ embeddableEnhanced: plugins.embeddableEnhanced });
-    });
 
     return {};
   }
diff --git a/src/plugins/kibana_usage_collection/server/collectors/core/core_usage_collector.ts b/src/plugins/kibana_usage_collection/server/collectors/core/core_usage_collector.ts
index 8d5f0db7a669d9..e8a6050b9ce595 100644
--- a/src/plugins/kibana_usage_collection/server/collectors/core/core_usage_collector.ts
+++ b/src/plugins/kibana_usage_collection/server/collectors/core/core_usage_collector.ts
@@ -342,6 +342,20 @@ export function getCoreUsageCollector(
       },
       environment: {
         memory: {
+          arrayBuffersBytes: {
+            type: 'long',
+            _meta: {
+              description:
+                'Memory allocated for array buffers. This is also included in the external value.',
+            },
+          },
+          externalBytes: {
+            type: 'long',
+            _meta: {
+              description: 'Memory usage of C++ objects bound to JavaScript objects managed by V8.',
+            },
+          },
+          residentSetSizeBytes: { type: 'long', _meta: { description: 'Node RSS.' } },
           heapSizeLimit: { type: 'long', _meta: { description: 'Host memory heap size limit.' } },
           heapTotalBytes: {
             type: 'long',
diff --git a/src/plugins/kibana_usage_collection/server/collectors/management/schema.ts b/src/plugins/kibana_usage_collection/server/collectors/management/schema.ts
index 1cf68fdf92f366..fc4786dd5ca3fd 100644
--- a/src/plugins/kibana_usage_collection/server/collectors/management/schema.ts
+++ b/src/plugins/kibana_usage_collection/server/collectors/management/schema.ts
@@ -468,6 +468,10 @@ export const stackManagementSchema: MakeSchemaFrom<UsageStats> = {
     type: 'boolean',
     _meta: { description: 'Non-default value of setting.' },
   },
+  'observability:apmEnableMultiSignal': {
+    type: 'boolean',
+    _meta: { description: 'Non-default value of setting.' },
+  },
   'observability:apmAWSLambdaPriceFactor': {
     type: 'text',
     _meta: { description: 'Non-default value of setting.' },
diff --git a/src/plugins/kibana_usage_collection/server/collectors/management/types.ts b/src/plugins/kibana_usage_collection/server/collectors/management/types.ts
index 8464207aaa1d60..bc1c315edae296 100644
--- a/src/plugins/kibana_usage_collection/server/collectors/management/types.ts
+++ b/src/plugins/kibana_usage_collection/server/collectors/management/types.ts
@@ -161,6 +161,7 @@ export interface UsageStats {
   'observability:apmTraceExplorerTab': boolean;
   'observability:apmEnableCriticalPath': boolean;
   'observability:apmEnableProfilingIntegration': boolean;
+  'observability:apmEnableMultiSignal': boolean;
   'observability:profilingShowErrorFrames': boolean;
   'securitySolution:enableGroupedNav': boolean;
   'securitySolution:showRelatedIntegrations': boolean;
diff --git a/src/plugins/navigation/public/plugin.test.ts b/src/plugins/navigation/public/plugin.test.ts
index 1aad72a3344f3c..07de4ff3483a51 100644
--- a/src/plugins/navigation/public/plugin.test.ts
+++ b/src/plugins/navigation/public/plugin.test.ts
@@ -160,8 +160,7 @@ describe('Navigation Plugin', () => {
       expect(coreStart.chrome.project.updateSolutionNavigations).toHaveBeenCalled();
 
       expect(coreStart.chrome.project.changeActiveSolutionNavigation).toHaveBeenCalledWith(
-        'security',
-        { onlyIfNotSet: true }
+        'security'
       );
     });
 
diff --git a/src/plugins/navigation/public/plugin.tsx b/src/plugins/navigation/public/plugin.tsx
index 79f7a032daf720..e62eb5c2c104f7 100644
--- a/src/plugins/navigation/public/plugin.tsx
+++ b/src/plugins/navigation/public/plugin.tsx
@@ -10,6 +10,7 @@ import {
   combineLatest,
   debounceTime,
   distinctUntilChanged,
+  firstValueFrom,
   from,
   map,
   Observable,
@@ -139,9 +140,11 @@ export class NavigationPublicPlugin
       isSolutionNavExperiementEnabled$ =
         !onCloud || isServerless
           ? of(false)
-          : from(cloudExperiments.getVariation(SOLUTION_NAV_FEATURE_FLAG_NAME, false)).pipe(
-              shareReplay(1)
-            );
+          : from(
+              cloudExperiments
+                .getVariation(SOLUTION_NAV_FEATURE_FLAG_NAME, false)
+                .catch(() => false)
+            ).pipe(shareReplay(1));
 
       this.isSolutionNavEnabled$ = isSolutionNavExperiementEnabled$.pipe(
         switchMap((isFeatureEnabled) => {
@@ -171,22 +174,14 @@ export class NavigationPublicPlugin
       });
 
     // Initialize the solution navigation if it is enabled
-    isSolutionNavExperiementEnabled$.pipe(take(1)).subscribe((isFeatureEnabled) => {
-      if (!isFeatureEnabled) return;
+    isSolutionNavExperiementEnabled$.pipe(take(1)).subscribe((isEnabled) => {
+      if (!isEnabled) return;
 
       chrome.project.setCloudUrls(cloud!);
       this.addDefaultSolutionNavigation({ chrome });
       this.susbcribeToSolutionNavUiSettings({ core, security, defaultSolution });
     });
 
-    // Keep track of the solution navigation enabled state
-    let isSolutionNavEnabled = false;
-    isSolutionNavExperiementEnabled$
-      .pipe(takeUntil(this.stop$))
-      .subscribe((_isSolutionNavEnabled) => {
-        isSolutionNavEnabled = _isSolutionNavEnabled;
-      });
-
     return {
       ui: {
         TopNavMenu: createTopNav(unifiedSearch, extensions),
@@ -194,8 +189,10 @@ export class NavigationPublicPlugin
         createTopNavWithCustomContext: createCustomTopNav,
       },
       addSolutionNavigation: (solutionNavigation) => {
-        if (!isSolutionNavEnabled) return;
-        return this.addSolutionNavigation(solutionNavigation);
+        firstValueFrom(isSolutionNavExperiementEnabled$).then((isEnabled) => {
+          if (!isEnabled) return;
+          this.addSolutionNavigation(solutionNavigation);
+        });
       },
       isSolutionNavEnabled$: this.isSolutionNavEnabled$,
     };
@@ -234,7 +231,7 @@ export class NavigationPublicPlugin
           chrome.project.changeActiveSolutionNavigation(null);
           chrome.setChromeStyle('classic');
         } else {
-          chrome.project.changeActiveSolutionNavigation(defaultSolution, { onlyIfNotSet: true });
+          chrome.project.changeActiveSolutionNavigation(defaultSolution);
         }
       });
   }
diff --git a/src/plugins/navigation/server/plugin.ts b/src/plugins/navigation/server/plugin.ts
index 6724ed8c20c534..979a2285a42ede 100644
--- a/src/plugins/navigation/server/plugin.ts
+++ b/src/plugins/navigation/server/plugin.ts
@@ -33,15 +33,21 @@ export class NavigationServerPlugin
     core: CoreSetup<NavigationServerStartDependencies>,
     plugins: NavigationServerSetupDependencies
   ) {
-    if (plugins.cloud?.isCloudEnabled && !this.isServerless()) {
-      const config = this.initializerContext.config.get<NavigationConfig>();
+    const config = this.initializerContext.config.get<NavigationConfig>();
+    const isSolutionNavExperiementEnabled =
+      Boolean(plugins.cloud?.isCloudEnabled) && !this.isServerless();
 
-      void core.getStartServices().then(async ([coreStart, deps]) => {
-        if (await deps.cloudExperiments?.getVariation(SOLUTION_NAV_FEATURE_FLAG_NAME, false)) {
-          core.uiSettings.registerGlobal(getUiSettings(config));
-        } else {
-          await this.removeUiSettings(coreStart, getUiSettings(config));
-        }
+    if (isSolutionNavExperiementEnabled) {
+      void core.getStartServices().then(([coreStart, deps]) => {
+        return deps.cloudExperiments
+          ?.getVariation(SOLUTION_NAV_FEATURE_FLAG_NAME, false)
+          .then(async (enabled) => {
+            if (enabled) {
+              core.uiSettings.registerGlobal(getUiSettings(config));
+            } else {
+              await this.removeUiSettings(coreStart, getUiSettings(config));
+            }
+          });
       });
     }
 
diff --git a/src/plugins/presentation_util/public/components/field_picker/field_picker.tsx b/src/plugins/presentation_util/public/components/field_picker/field_picker.tsx
index ef14a6c88dcb72..c65b6be13674ef 100644
--- a/src/plugins/presentation_util/public/components/field_picker/field_picker.tsx
+++ b/src/plugins/presentation_util/public/components/field_picker/field_picker.tsx
@@ -8,6 +8,7 @@
 
 import classNames from 'classnames';
 import { sortBy, uniq } from 'lodash';
+import { comboBoxFieldOptionMatcher } from '@kbn/field-utils';
 import React, { useCallback, useEffect, useMemo, useRef, useState } from 'react';
 
 import { i18n } from '@kbn/i18n';
@@ -63,6 +64,7 @@ export const FieldPicker = ({
     const options: EuiSelectableOption[] = (availableFields ?? []).map((field) => {
       return {
         key: field.name,
+        name: field.name,
         label: field.displayName ?? field.name,
         className: 'presFieldPicker__fieldButton',
         checked: field.name === selectedFieldName ? 'on' : undefined,
@@ -129,6 +131,7 @@ export const FieldPicker = ({
         const field = dataView.getFieldByName(changedOption.key);
         if (field) onSelectField?.(field);
       }}
+      optionMatcher={comboBoxFieldOptionMatcher}
       searchProps={{
         'data-test-subj': 'field-search-input',
         placeholder: i18n.translate('presentationUtil.fieldSearch.searchPlaceHolder', {
diff --git a/src/plugins/saved_objects/public/saved_object/saved_object.test.ts b/src/plugins/saved_objects/public/saved_object/saved_object.test.ts
index 0ceb0ad32a9dd7..a03b1ea92be245 100644
--- a/src/plugins/saved_objects/public/saved_object/saved_object.test.ts
+++ b/src/plugins/saved_objects/public/saved_object/saved_object.test.ts
@@ -426,7 +426,7 @@ describe('Saved Object', () => {
               },
             });
 
-            savedObject.searchSource!.setFields({ index: indexPattern });
+            savedObject.searchSource!.setField('index', indexPattern);
             return savedObject.save(saveOptionsMock).then(() => {
               const args = (savedObjectsClientStub.create as jest.Mock).mock.calls[0];
               expect(args[1]).toEqual({
diff --git a/src/plugins/saved_search/common/service/get_saved_searches.test.ts b/src/plugins/saved_search/common/service/get_saved_searches.test.ts
index ea9403fda64760..5b4462c77aa07d 100644
--- a/src/plugins/saved_search/common/service/get_saved_searches.test.ts
+++ b/src/plugins/saved_search/common/service/get_saved_searches.test.ts
@@ -128,7 +128,6 @@ describe('getSavedSearch', () => {
           "removeField": [MockFunction],
           "serialize": [MockFunction],
           "setField": [MockFunction],
-          "setFields": [MockFunction],
           "setOverwriteDataViewType": [MockFunction],
           "setParent": [MockFunction],
           "toExpressionAst": [MockFunction],
@@ -237,7 +236,6 @@ describe('getSavedSearch', () => {
           "removeField": [MockFunction],
           "serialize": [MockFunction],
           "setField": [MockFunction],
-          "setFields": [MockFunction],
           "setOverwriteDataViewType": [MockFunction],
           "setParent": [MockFunction],
           "toExpressionAst": [MockFunction],
diff --git a/src/plugins/saved_search/public/plugin.ts b/src/plugins/saved_search/public/plugin.ts
index 5b2d1e4e79fbf2..8f9ffc459e72af 100644
--- a/src/plugins/saved_search/public/plugin.ts
+++ b/src/plugins/saved_search/public/plugin.ts
@@ -17,7 +17,7 @@ import type {
   ContentManagementPublicStart,
 } from '@kbn/content-management-plugin/public';
 import type { SOWithMetadata } from '@kbn/content-management-utils';
-import { EmbeddableStart, registerSavedObjectToPanelMethod } from '@kbn/embeddable-plugin/public';
+import { EmbeddableSetup, EmbeddableStart } from '@kbn/embeddable-plugin/public';
 import {
   getSavedSearch,
   saveSavedSearch,
@@ -68,6 +68,7 @@ export interface SavedSearchPublicPluginStart {
  * Saved search plugin public Setup contract
  */
 export interface SavedSearchPublicSetupDependencies {
+  embeddable: EmbeddableSetup;
   contentManagement: ContentManagementPublicSetup;
   expressions: ExpressionsSetup;
 }
@@ -94,7 +95,7 @@ export class SavedSearchPublicPlugin
 {
   public setup(
     { getStartServices }: CoreSetup,
-    { contentManagement, expressions }: SavedSearchPublicSetupDependencies
+    { contentManagement, expressions, embeddable }: SavedSearchPublicSetupDependencies
   ) {
     contentManagement.registry.register({
       id: SavedSearchType,
@@ -117,7 +118,7 @@ export class SavedSearchPublicPlugin
 
     expressions.registerType(kibanaContext);
 
-    registerSavedObjectToPanelMethod<SavedSearchAttributes, SearchByValueInput>(
+    embeddable.registerSavedObjectToPanelMethod<SavedSearchAttributes, SearchByValueInput>(
       SavedSearchType,
       (savedObject) => {
         if (!savedObject.managed) {
diff --git a/src/plugins/saved_search/public/services/saved_searches/saved_search_attribute_service.test.ts b/src/plugins/saved_search/public/services/saved_searches/saved_search_attribute_service.test.ts
index ae1e457fc7d4bb..812ff0ece7d457 100644
--- a/src/plugins/saved_search/public/services/saved_searches/saved_search_attribute_service.test.ts
+++ b/src/plugins/saved_search/public/services/saved_searches/saved_search_attribute_service.test.ts
@@ -224,7 +224,6 @@ describe('getSavedSearchAttributeService', () => {
             "removeField": [MockFunction],
             "serialize": [MockFunction],
             "setField": [MockFunction],
-            "setFields": [MockFunction],
             "setOverwriteDataViewType": [MockFunction],
             "setParent": [MockFunction],
             "toExpressionAst": [MockFunction],
diff --git a/src/plugins/telemetry/schema/oss_plugins.json b/src/plugins/telemetry/schema/oss_plugins.json
index f5eb21f859bca1..717e5ebabbe1b9 100644
--- a/src/plugins/telemetry/schema/oss_plugins.json
+++ b/src/plugins/telemetry/schema/oss_plugins.json
@@ -8017,6 +8017,24 @@
           "properties": {
             "memory": {
               "properties": {
+                "arrayBuffersBytes": {
+                  "type": "long",
+                  "_meta": {
+                    "description": "Memory allocated for array buffers. This is also included in the external value."
+                  }
+                },
+                "externalBytes": {
+                  "type": "long",
+                  "_meta": {
+                    "description": "Memory usage of C++ objects bound to JavaScript objects managed by V8."
+                  }
+                },
+                "residentSetSizeBytes": {
+                  "type": "long",
+                  "_meta": {
+                    "description": "Node RSS."
+                  }
+                },
                 "heapSizeLimit": {
                   "type": "long",
                   "_meta": {
@@ -10149,6 +10167,12 @@
             "description": "Non-default value of setting."
           }
         },
+        "observability:apmEnableMultiSignal": {
+          "type": "boolean",
+          "_meta": {
+            "description": "Non-default value of setting."
+          }
+        },
         "observability:apmAWSLambdaPriceFactor": {
           "type": "text",
           "_meta": {
@@ -10161,15 +10185,6 @@
             "description": "Non-default value of setting."
           }
         },
-        "observability:logsExplorer:allowedDataViews": {
-          "type": "array",
-          "items": {
-            "type": "keyword",
-            "_meta": {
-              "description": "Non-default value of setting."
-            }
-          }
-        },
         "observability:aiAssistantLogsIndexPattern": {
           "type": "keyword",
           "_meta": {
@@ -10188,6 +10203,15 @@
             "description": "Non-default value of setting."
           }
         },
+        "observability:logsExplorer:allowedDataViews": {
+          "type": "array",
+          "items": {
+            "type": "keyword",
+            "_meta": {
+              "description": "Non-default value of setting."
+            }
+          }
+        },
         "banners:placement": {
           "type": "keyword",
           "_meta": {
@@ -11893,4 +11917,4 @@
       }
     }
   }
-}
\ No newline at end of file
+}
diff --git a/src/plugins/telemetry/server/telemetry_collection/get_local_stats.ts b/src/plugins/telemetry/server/telemetry_collection/get_local_stats.ts
index 43d52aae125961..3cf0e8b502f6be 100644
--- a/src/plugins/telemetry/server/telemetry_collection/get_local_stats.ts
+++ b/src/plugins/telemetry/server/telemetry_collection/get_local_stats.ts
@@ -25,6 +25,8 @@ import { getDataTelemetry, DATA_TELEMETRY_ID, DataTelemetryPayload } from './get
  * @param {Object} clusterInfo Cluster info (GET /)
  * @param {Object} clusterStats Cluster stats (GET /_cluster/stats)
  * @param {Object} kibana The Kibana Usage stats
+ * @param dataTelemetry The telemetry data
+ * @param context The context
  */
 export function handleLocalStats<ClusterStats extends estypes.ClusterStatsResponse>(
   // eslint-disable-next-line @typescript-eslint/naming-convention
diff --git a/src/plugins/telemetry_collection_manager/server/plugin.test.ts b/src/plugins/telemetry_collection_manager/server/plugin.test.ts
index adfe2c64a49161..a19f203c154fd1 100644
--- a/src/plugins/telemetry_collection_manager/server/plugin.test.ts
+++ b/src/plugins/telemetry_collection_manager/server/plugin.test.ts
@@ -94,9 +94,7 @@ describe('Telemetry Collection Manager', () => {
         cluster_uuid: 'clusterUuid',
         cluster_name: 'clusterName',
         timestamp: new Date().toISOString(),
-        cluster_stats: {
-          cluster_uuid: 'clusterUuid',
-        },
+        cluster_stats: {},
         stack_stats: {},
         version: 'version',
       };
diff --git a/src/plugins/telemetry_collection_manager/server/plugin.ts b/src/plugins/telemetry_collection_manager/server/plugin.ts
index f4685576c1ef83..958d7439b59366 100644
--- a/src/plugins/telemetry_collection_manager/server/plugin.ts
+++ b/src/plugins/telemetry_collection_manager/server/plugin.ts
@@ -285,10 +285,7 @@ export class TelemetryCollectionManagerPlugin
           retrieveSnapshotTelemetryTransaction.startSpan('Prepare response');
           const results = await Promise.all(
             usageData.map(async (clusterStats) => {
-              const { cluster_uuid: clusterUuid } = clusterStats.cluster_stats as Record<
-                string,
-                string
-              >;
+              const { cluster_uuid: clusterUuid } = clusterStats;
 
               return {
                 clusterUuid,
diff --git a/src/plugins/unified_histogram/public/chart/breakdown_field_selector.tsx b/src/plugins/unified_histogram/public/chart/breakdown_field_selector.tsx
index b52ba919ecff17..06ee853ee89ebd 100644
--- a/src/plugins/unified_histogram/public/chart/breakdown_field_selector.tsx
+++ b/src/plugins/unified_histogram/public/chart/breakdown_field_selector.tsx
@@ -8,7 +8,7 @@
 
 import React, { useCallback, useMemo } from 'react';
 import { EuiSelectableOption } from '@elastic/eui';
-import { FieldIcon, getFieldIconProps } from '@kbn/field-utils';
+import { FieldIcon, getFieldIconProps, comboBoxFieldOptionMatcher } from '@kbn/field-utils';
 import { css } from '@emotion/react';
 import type { DataView, DataViewField } from '@kbn/data-views-plugin/common';
 import { i18n } from '@kbn/i18n';
@@ -37,6 +37,7 @@ export const BreakdownFieldSelector = ({
       .filter(fieldSupportsBreakdown)
       .map((field) => ({
         key: field.name,
+        name: field.name,
         label: field.displayName,
         value: field.name,
         checked:
@@ -102,6 +103,7 @@ export const BreakdownFieldSelector = ({
           defaultMessage: 'Select breakdown field',
         }
       )}
+      optionMatcher={comboBoxFieldOptionMatcher}
       options={fieldOptions}
       onChange={onChange}
     />
diff --git a/src/plugins/unified_histogram/public/chart/toolbar_selector.tsx b/src/plugins/unified_histogram/public/chart/toolbar_selector.tsx
index 025e599c0dfadf..b9115847b7b03a 100644
--- a/src/plugins/unified_histogram/public/chart/toolbar_selector.tsx
+++ b/src/plugins/unified_histogram/public/chart/toolbar_selector.tsx
@@ -35,6 +35,7 @@ export interface ToolbarSelectorProps {
   options: SelectableEntry[];
   searchable: boolean;
   onChange?: (chosenOption: SelectableEntry | undefined) => void;
+  optionMatcher?: EuiSelectableProps['optionMatcher'];
 }
 
 export const ToolbarSelector: React.FC<ToolbarSelectorProps> = ({
@@ -45,6 +46,7 @@ export const ToolbarSelector: React.FC<ToolbarSelectorProps> = ({
   options,
   searchable,
   onChange,
+  optionMatcher,
 }) => {
   const { euiTheme } = useEuiTheme();
   const [isOpen, setIsOpen] = useState<boolean>(false);
@@ -144,6 +146,7 @@ export const ToolbarSelector: React.FC<ToolbarSelectorProps> = ({
         data-test-subj={`${dataTestSubj}Selectable`}
         options={options}
         onChange={onSelectionChange}
+        optionMatcher={optionMatcher}
         listProps={{
           truncationProps: { truncation: 'middle' },
           isVirtualized: searchable,
diff --git a/src/plugins/unified_histogram/public/services/lens_vis_service.attributes.test.ts b/src/plugins/unified_histogram/public/services/lens_vis_service.attributes.test.ts
index 2e4f5a873aeb73..ae503a85d1d390 100644
--- a/src/plugins/unified_histogram/public/services/lens_vis_service.attributes.test.ts
+++ b/src/plugins/unified_histogram/public/services/lens_vis_service.attributes.test.ts
@@ -539,13 +539,7 @@ describe('LensVisService attributes', () => {
     expect(lensVis.visContext).toMatchInlineSnapshot(`
       Object {
         "attributes": Object {
-          "references": Array [
-            Object {
-              "id": "index-pattern-with-timefield-id",
-              "name": "textBasedLanguages-datasource-layer-suggestion",
-              "type": "index-pattern",
-            },
-          ],
+          "references": Array [],
           "state": Object {
             "datasourceStates": Object {
               "textBased": Object {
@@ -736,13 +730,7 @@ describe('LensVisService attributes', () => {
           'index-pattern-with-timefield-id': {},
         },
       }),
-      references: [
-        {
-          id: 'index-pattern-with-timefield-id',
-          name: 'textBasedLanguages-datasource-layer-suggestion',
-          type: 'index-pattern',
-        },
-      ],
+      references: [],
       title: 'Heat map',
       visualizationType: 'lnsHeatmap',
     });
diff --git a/src/plugins/unified_histogram/public/utils/__snapshots__/external_vis_context.test.ts.snap b/src/plugins/unified_histogram/public/utils/__snapshots__/external_vis_context.test.ts.snap
index fb4014f9697009..15c32f0bf761b5 100644
--- a/src/plugins/unified_histogram/public/utils/__snapshots__/external_vis_context.test.ts.snap
+++ b/src/plugins/unified_histogram/public/utils/__snapshots__/external_vis_context.test.ts.snap
@@ -3,13 +3,7 @@
 exports[`external_vis_context exportVisContext should work correctly 1`] = `
 Object {
   "attributes": Object {
-    "references": Array [
-      Object {
-        "id": "index-pattern-with-timefield-id",
-        "name": "textBasedLanguages-datasource-layer-suggestion",
-        "type": "index-pattern",
-      },
-    ],
+    "references": Array [],
     "state": Object {
       "datasourceStates": Object {
         "textBased": Object {
@@ -192,13 +186,7 @@ Object {
 exports[`external_vis_context exportVisContext should work correctly 2`] = `
 Object {
   "attributes": Object {
-    "references": Array [
-      Object {
-        "id": "index-pattern-with-timefield-id",
-        "name": "textBasedLanguages-datasource-layer-suggestion",
-        "type": "index-pattern",
-      },
-    ],
+    "references": Array [],
     "state": Object {
       "datasourceStates": Object {
         "textBased": Object {
diff --git a/src/plugins/unified_search/public/filters_builder/filter_item/field_input.tsx b/src/plugins/unified_search/public/filters_builder/filter_item/field_input.tsx
index cc87c3de789369..15437b24ab4806 100644
--- a/src/plugins/unified_search/public/filters_builder/filter_item/field_input.tsx
+++ b/src/plugins/unified_search/public/filters_builder/filter_item/field_input.tsx
@@ -8,6 +8,7 @@
 
 import React, { useCallback, useContext, useRef } from 'react';
 import { i18n } from '@kbn/i18n';
+import { comboBoxFieldOptionMatcher } from '@kbn/field-utils';
 import { FieldIcon } from '@kbn/react-field';
 import { KBN_FIELD_TYPES } from '@kbn/field-types';
 import type { DataView, DataViewField } from '@kbn/data-views-plugin/common';
@@ -54,6 +55,7 @@ export function FieldInput({ field, dataView, onHandleField }: FieldInputProps)
       }
       return {
         label,
+        name: dataViewField.name,
         value: dataViewField.type as KBN_FIELD_TYPES,
         prepend: <FieldIcon type={dataViewField.type} fill="none" className="eui-alignMiddle" />,
       };
@@ -82,6 +84,7 @@ export function FieldInput({ field, dataView, onHandleField }: FieldInputProps)
       inputRef={(ref) => {
         inputRef.current = ref;
       }}
+      optionMatcher={comboBoxFieldOptionMatcher}
       options={euiOptions}
       selectedOptions={selectedEuiOptions}
       onChange={onComboBoxChange}
diff --git a/src/plugins/unified_search/tsconfig.json b/src/plugins/unified_search/tsconfig.json
index d3dfaff1ef6bb6..82df1ffe507cfd 100644
--- a/src/plugins/unified_search/tsconfig.json
+++ b/src/plugins/unified_search/tsconfig.json
@@ -47,7 +47,8 @@
     "@kbn/react-kibana-context-render",
     "@kbn/data-view-utils",
     "@kbn/esql-utils",
-    "@kbn/react-kibana-mount"
+    "@kbn/react-kibana-mount",
+    "@kbn/field-utils"
   ],
   "exclude": [
     "target/**/*",
diff --git a/src/plugins/visualizations/public/plugin.ts b/src/plugins/visualizations/public/plugin.ts
index 814f55e712e6fa..bc208c6bb785ae 100644
--- a/src/plugins/visualizations/public/plugin.ts
+++ b/src/plugins/visualizations/public/plugin.ts
@@ -47,11 +47,7 @@ import type { UsageCollectionStart } from '@kbn/usage-collection-plugin/public';
 import type { DataPublicPluginSetup, DataPublicPluginStart } from '@kbn/data-plugin/public';
 import type { DataViewsPublicPluginStart } from '@kbn/data-views-plugin/public';
 import type { ExpressionsSetup, ExpressionsStart } from '@kbn/expressions-plugin/public';
-import {
-  EmbeddableSetup,
-  EmbeddableStart,
-  registerSavedObjectToPanelMethod,
-} from '@kbn/embeddable-plugin/public';
+import { EmbeddableSetup, EmbeddableStart } from '@kbn/embeddable-plugin/public';
 import type { SavedObjectTaggingOssPluginStart } from '@kbn/saved-objects-tagging-oss-plugin/public';
 import type { NavigationPublicPluginStart as NavigationStart } from '@kbn/navigation-plugin/public';
 import type { SharePluginSetup, SharePluginStart } from '@kbn/share-plugin/public';
@@ -410,36 +406,36 @@ export class VisualizationsPlugin
       name: 'Visualize Library',
     });
 
-    registerSavedObjectToPanelMethod<VisualizationSavedObjectAttributes, VisualizeByValueInput>(
-      CONTENT_ID,
-      (savedObject) => {
-        const visState = savedObject.attributes.visState;
-
-        // not sure if visState actually is ever undefined, but following the type
-        if (!savedObject.managed || !visState) {
-          return {
-            savedObjectId: savedObject.id,
-          };
-        }
+    embeddable.registerSavedObjectToPanelMethod<
+      VisualizationSavedObjectAttributes,
+      VisualizeByValueInput
+    >(CONTENT_ID, (savedObject) => {
+      const visState = savedObject.attributes.visState;
 
-        // data is not always defined, so I added a default value since the extract
-        // routine in the embeddable factory expects it to be there
-        const savedVis = JSON.parse(visState) as Omit<SerializedVis, 'data'> & {
-          data?: SerializedVisData;
+      // not sure if visState actually is ever undefined, but following the type
+      if (!savedObject.managed || !visState) {
+        return {
+          savedObjectId: savedObject.id,
         };
+      }
 
-        if (!savedVis.data) {
-          savedVis.data = {
-            searchSource: {},
-            aggs: [],
-          };
-        }
+      // data is not always defined, so I added a default value since the extract
+      // routine in the embeddable factory expects it to be there
+      const savedVis = JSON.parse(visState) as Omit<SerializedVis, 'data'> & {
+        data?: SerializedVisData;
+      };
 
-        return {
-          savedVis: savedVis as SerializedVis, // now we're sure we have "data" prop
+      if (!savedVis.data) {
+        savedVis.data = {
+          searchSource: {},
+          aggs: [],
         };
       }
-    );
+
+      return {
+        savedVis: savedVis as SerializedVis, // now we're sure we have "data" prop
+      };
+    });
 
     return {
       ...this.types.setup(),
diff --git a/test/functional/apps/dashboard/group2/dashboard_filtering.ts b/test/functional/apps/dashboard/group2/dashboard_filtering.ts
index 24f276b8310363..92f89280e7f90c 100644
--- a/test/functional/apps/dashboard/group2/dashboard_filtering.ts
+++ b/test/functional/apps/dashboard/group2/dashboard_filtering.ts
@@ -28,7 +28,8 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const dashboardPanelActions = getService('dashboardPanelActions');
   const PageObjects = getPageObjects(['common', 'dashboard', 'header', 'visualize', 'timePicker']);
 
-  describe('dashboard filtering', function () {
+  // Failing: See https://github.com/elastic/kibana/issues/160062
+  describe.skip('dashboard filtering', function () {
     const populateDashboard = async () => {
       await PageObjects.dashboard.clickNewDashboard();
       await PageObjects.timePicker.setDefaultDataRange();
diff --git a/test/functional/apps/discover/group1/_errors.ts b/test/functional/apps/discover/group1/_errors.ts
index 0d3e20fba11ce9..a882b2a11b7b0d 100644
--- a/test/functional/apps/discover/group1/_errors.ts
+++ b/test/functional/apps/discover/group1/_errors.ts
@@ -38,11 +38,11 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       });
     });
 
-    // FLAKY: https://github.com/elastic/kibana/issues/166291
-    describe.skip('not found', () => {
+    describe('not found', () => {
       it('should redirect to main page when trying to access invalid route', async () => {
         await PageObjects.common.navigateToUrl('discover', '#/invalid-route', {
           useActualUrl: true,
+          ensureCurrentUrl: false,
         });
         await PageObjects.header.awaitKibanaChrome();
 
diff --git a/test/functional/page_objects/settings_page.ts b/test/functional/page_objects/settings_page.ts
index e3e68613d88733..9cb54c9ffd7fe6 100644
--- a/test/functional/page_objects/settings_page.ts
+++ b/test/functional/page_objects/settings_page.ts
@@ -621,18 +621,7 @@ export class SettingsPageObject extends FtrService {
 
   async clickAddNewIndexPatternButton() {
     await this.common.scrollKibanaBodyTop();
-
-    // if showing no data view prompt
-    const noDataView = await this.testSubjects.exists('createDataViewButton');
-    if (noDataView) {
-      await this.testSubjects.click('createDataViewButton');
-      return;
-    }
-
-    const tableView = await this.testSubjects.exists('createIndexPatternButton');
-    if (tableView) {
-      await this.testSubjects.click('createIndexPatternButton');
-    }
+    await this.testSubjects.click('createDataViewButton');
   }
 
   async selectRollupIndexPatternType() {
diff --git a/test/package/Vagrantfile b/test/package/Vagrantfile
index 73be8e0a32659e..ea7e87d74b7850 100644
--- a/test/package/Vagrantfile
+++ b/test/package/Vagrantfile
@@ -19,6 +19,9 @@ Vagrant.configure("2") do |config|
       vb.cpus = 2
     end
     rpm.vm.box = 'almalinux/9'
+    # `rpm -i` is broken in 9.4 when installing from a shared folder
+    # alternative workaround is to copy /packages/kibana.tar.gz to the cwd
+    rpm.vm.box_version = '9.3.20231118'
     rpm.vm.provision "ansible" do |ansible|
       ansible.playbook = "rpm.yml"
     end
diff --git a/tsconfig.base.json b/tsconfig.base.json
index 9dddb7c5d67d5b..814033d8be3949 100644
--- a/tsconfig.base.json
+++ b/tsconfig.base.json
@@ -806,6 +806,8 @@
       "@kbn/eso-plugin/*": ["x-pack/test/encrypted_saved_objects_api_integration/plugins/api_consumer_plugin/*"],
       "@kbn/esql-ast": ["packages/kbn-esql-ast"],
       "@kbn/esql-ast/*": ["packages/kbn-esql-ast/*"],
+      "@kbn/esql-ast-inspector-plugin": ["examples/esql_ast_inspector"],
+      "@kbn/esql-ast-inspector-plugin/*": ["examples/esql_ast_inspector/*"],
       "@kbn/esql-utils": ["packages/kbn-esql-utils"],
       "@kbn/esql-utils/*": ["packages/kbn-esql-utils/*"],
       "@kbn/esql-validation-autocomplete": ["packages/kbn-esql-validation-autocomplete"],
@@ -1058,6 +1060,8 @@
       "@kbn/logging/*": ["packages/kbn-logging/*"],
       "@kbn/logging-mocks": ["packages/kbn-logging-mocks"],
       "@kbn/logging-mocks/*": ["packages/kbn-logging-mocks/*"],
+      "@kbn/logs-data-access-plugin": ["x-pack/plugins/observability_solution/logs_data_access"],
+      "@kbn/logs-data-access-plugin/*": ["x-pack/plugins/observability_solution/logs_data_access/*"],
       "@kbn/logs-explorer-plugin": ["x-pack/plugins/observability_solution/logs_explorer"],
       "@kbn/logs-explorer-plugin/*": ["x-pack/plugins/observability_solution/logs_explorer/*"],
       "@kbn/logs-shared-plugin": ["x-pack/plugins/observability_solution/logs_shared"],
diff --git a/versions.json b/versions.json
index 0a088e0c7d1e5e..1b77d36b6b7a73 100644
--- a/versions.json
+++ b/versions.json
@@ -13,12 +13,6 @@
       "currentMajor": true,
       "previousMinor": true
     },
-    {
-      "version": "8.13.4",
-      "branch": "8.13",
-      "currentMajor": true,
-      "previousMinor": true
-    },
     {
       "version": "7.17.22",
       "branch": "7.17",
diff --git a/x-pack/packages/kbn-elastic-assistant-common/impl/capabilities/index.ts b/x-pack/packages/kbn-elastic-assistant-common/impl/capabilities/index.ts
index 86c3b26f200e68..2a6cce1adbdbbc 100644
--- a/x-pack/packages/kbn-elastic-assistant-common/impl/capabilities/index.ts
+++ b/x-pack/packages/kbn-elastic-assistant-common/impl/capabilities/index.ts
@@ -15,5 +15,4 @@ export type AssistantFeatures = { [K in keyof typeof defaultAssistantFeatures]:
  */
 export const defaultAssistantFeatures = Object.freeze({
   assistantModelEvaluation: false,
-  attackDiscoveryEnabled: false,
 });
diff --git a/x-pack/packages/kbn-elastic-assistant-common/impl/schemas/attack_discovery/post_attack_discovery_route.gen.ts b/x-pack/packages/kbn-elastic-assistant-common/impl/schemas/attack_discovery/post_attack_discovery_route.gen.ts
index b492dfe2dc9f28..290376c6d31e47 100644
--- a/x-pack/packages/kbn-elastic-assistant-common/impl/schemas/attack_discovery/post_attack_discovery_route.gen.ts
+++ b/x-pack/packages/kbn-elastic-assistant-common/impl/schemas/attack_discovery/post_attack_discovery_route.gen.ts
@@ -68,6 +68,7 @@ export type AttackDiscoveryPostRequestBodyInput = z.input<typeof AttackDiscovery
 export type AttackDiscoveryPostResponse = z.infer<typeof AttackDiscoveryPostResponse>;
 export const AttackDiscoveryPostResponse = z.object({
   connector_id: z.string().optional(),
+  alertsContextCount: z.number().optional(),
   attackDiscoveries: z.array(AttackDiscovery).optional(),
   replacements: Replacements.optional(),
   status: z.string().optional(),
diff --git a/x-pack/packages/kbn-elastic-assistant-common/impl/schemas/attack_discovery/post_attack_discovery_route.schema.yaml b/x-pack/packages/kbn-elastic-assistant-common/impl/schemas/attack_discovery/post_attack_discovery_route.schema.yaml
index b32708536f9689..44acb268700a5a 100644
--- a/x-pack/packages/kbn-elastic-assistant-common/impl/schemas/attack_discovery/post_attack_discovery_route.schema.yaml
+++ b/x-pack/packages/kbn-elastic-assistant-common/impl/schemas/attack_discovery/post_attack_discovery_route.schema.yaml
@@ -98,6 +98,8 @@ paths:
                 properties:
                   connector_id:
                     type: string
+                  alertsContextCount:
+                    type: number
                   attackDiscoveries:
                     type: array
                     items:
diff --git a/x-pack/packages/kbn-elastic-assistant-common/impl/schemas/capabilities/get_capabilities_route.gen.ts b/x-pack/packages/kbn-elastic-assistant-common/impl/schemas/capabilities/get_capabilities_route.gen.ts
index 6e90724097fc8a..5d218afd481311 100644
--- a/x-pack/packages/kbn-elastic-assistant-common/impl/schemas/capabilities/get_capabilities_route.gen.ts
+++ b/x-pack/packages/kbn-elastic-assistant-common/impl/schemas/capabilities/get_capabilities_route.gen.ts
@@ -19,5 +19,4 @@ import { z } from 'zod';
 export type GetCapabilitiesResponse = z.infer<typeof GetCapabilitiesResponse>;
 export const GetCapabilitiesResponse = z.object({
   assistantModelEvaluation: z.boolean(),
-  attackDiscoveryEnabled: z.boolean(),
 });
diff --git a/x-pack/packages/kbn-elastic-assistant-common/impl/schemas/capabilities/get_capabilities_route.schema.yaml b/x-pack/packages/kbn-elastic-assistant-common/impl/schemas/capabilities/get_capabilities_route.schema.yaml
index 8d28a6b95d55a2..4664405cfef338 100644
--- a/x-pack/packages/kbn-elastic-assistant-common/impl/schemas/capabilities/get_capabilities_route.schema.yaml
+++ b/x-pack/packages/kbn-elastic-assistant-common/impl/schemas/capabilities/get_capabilities_route.schema.yaml
@@ -21,11 +21,8 @@ paths:
                 properties:
                   assistantModelEvaluation:
                     type: boolean
-                  attackDiscoveryEnabled:
-                    type: boolean
                 required:
                   - assistantModelEvaluation
-                  - attackDiscoveryEnabled
         '400':
           description: Generic Error
           content:
diff --git a/x-pack/packages/kbn-elastic-assistant/impl/assistant/api/capabilities/use_capabilities.test.tsx b/x-pack/packages/kbn-elastic-assistant/impl/assistant/api/capabilities/use_capabilities.test.tsx
index df1f399dadcc31..29ad65929bc4c2 100644
--- a/x-pack/packages/kbn-elastic-assistant/impl/assistant/api/capabilities/use_capabilities.test.tsx
+++ b/x-pack/packages/kbn-elastic-assistant/impl/assistant/api/capabilities/use_capabilities.test.tsx
@@ -16,7 +16,6 @@ import { API_VERSIONS } from '@kbn/elastic-assistant-common';
 const statusResponse = {
   assistantModelEvaluation: true,
   assistantStreamingEnabled: false,
-  attackDiscoveryEnabled: false,
 };
 
 const http = {
diff --git a/x-pack/packages/kbn-elastic-assistant/impl/assistant/index.tsx b/x-pack/packages/kbn-elastic-assistant/impl/assistant/index.tsx
index 07f35981017099..b589cd5626a870 100644
--- a/x-pack/packages/kbn-elastic-assistant/impl/assistant/index.tsx
+++ b/x-pack/packages/kbn-elastic-assistant/impl/assistant/index.tsx
@@ -894,7 +894,7 @@ const AssistantComponent: React.FC<Props> = ({
                     selectedConversation={currentConversation}
                     defaultConnector={defaultConnector}
                     docLinks={docLinks}
-                    isDisabled={isDisabled}
+                    isDisabled={isDisabled || isLoadingChatSend}
                     isSettingsModalVisible={isSettingsModalVisible}
                     onToggleShowAnonymizedValues={onToggleShowAnonymizedValues}
                     setIsSettingsModalVisible={setIsSettingsModalVisible}
diff --git a/x-pack/packages/kbn-elastic-assistant/impl/assistant_context/index.tsx b/x-pack/packages/kbn-elastic-assistant/impl/assistant_context/index.tsx
index 7726f54f4637a4..7d9cc86941f34a 100644
--- a/x-pack/packages/kbn-elastic-assistant/impl/assistant_context/index.tsx
+++ b/x-pack/packages/kbn-elastic-assistant/impl/assistant_context/index.tsx
@@ -277,7 +277,7 @@ export const AssistantProvider: React.FC<AssistantProviderProps> = ({
 
   // Fetch assistant capabilities
   const { data: capabilities } = useCapabilities({ http, toasts });
-  const { assistantModelEvaluation: modelEvaluatorEnabled, attackDiscoveryEnabled } =
+  const { assistantModelEvaluation: modelEvaluatorEnabled } =
     capabilities ?? defaultAssistantFeatures;
 
   const value = useMemo(
@@ -286,7 +286,6 @@ export const AssistantProvider: React.FC<AssistantProviderProps> = ({
       alertsIndexPattern,
       assistantAvailability,
       assistantTelemetry,
-      attackDiscoveryEnabled,
       augmentMessageCodeBlocks,
       allQuickPrompts: localStorageQuickPrompts ?? [],
       allSystemPrompts: localStorageSystemPrompts ?? [],
@@ -326,7 +325,6 @@ export const AssistantProvider: React.FC<AssistantProviderProps> = ({
       alertsIndexPattern,
       assistantAvailability,
       assistantTelemetry,
-      attackDiscoveryEnabled,
       augmentMessageCodeBlocks,
       localStorageQuickPrompts,
       localStorageSystemPrompts,
diff --git a/x-pack/packages/kbn-elastic-assistant/impl/connectorland/connector_setup/index.test.tsx b/x-pack/packages/kbn-elastic-assistant/impl/connectorland/connector_setup/index.test.tsx
index 4d30ab549f4c8c..cf46b5886a3893 100644
--- a/x-pack/packages/kbn-elastic-assistant/impl/connectorland/connector_setup/index.test.tsx
+++ b/x-pack/packages/kbn-elastic-assistant/impl/connectorland/connector_setup/index.test.tsx
@@ -95,6 +95,33 @@ describe('useConnectorSetup', () => {
     });
   });
 
+  it('should NOT set the api config for each conversation when a new connector is saved and updateConversationsOnSaveConnector is false', async () => {
+    await act(async () => {
+      const { result, waitForNextUpdate } = renderHook(
+        () =>
+          useConnectorSetup({
+            ...defaultProps,
+            updateConversationsOnSaveConnector: false, // <-- don't update the conversations
+          }),
+        {
+          wrapper: ({ children }) => <TestProviders>{children}</TestProviders>,
+        }
+      );
+      await waitForNextUpdate();
+      const { getByTestId, queryByTestId, rerender } = render(result.current.prompt, {
+        wrapper: TestProviders,
+      });
+      expect(getByTestId('connectorButton')).toBeInTheDocument();
+      expect(queryByTestId('skip-setup-button')).not.toBeInTheDocument();
+      fireEvent.click(getByTestId('connectorButton'));
+
+      rerender(result.current.prompt);
+      fireEvent.click(getByTestId('modal-mock'));
+
+      expect(setApiConfig).not.toHaveBeenCalled();
+    });
+  });
+
   it('should show skip button if message has presentation data', async () => {
     await act(async () => {
       const { result, waitForNextUpdate } = renderHook(
diff --git a/x-pack/packages/kbn-elastic-assistant/impl/connectorland/connector_setup/index.tsx b/x-pack/packages/kbn-elastic-assistant/impl/connectorland/connector_setup/index.tsx
index e074fdc1a3d03c..ab552656fc57f8 100644
--- a/x-pack/packages/kbn-elastic-assistant/impl/connectorland/connector_setup/index.tsx
+++ b/x-pack/packages/kbn-elastic-assistant/impl/connectorland/connector_setup/index.tsx
@@ -36,6 +36,7 @@ export interface ConnectorSetupProps {
   isFlyoutMode?: boolean;
   onSetupComplete?: () => void;
   onConversationUpdate: ({ cId, cTitle }: { cId: string; cTitle: string }) => Promise<void>;
+  updateConversationsOnSaveConnector?: boolean;
 }
 
 export const useConnectorSetup = ({
@@ -43,6 +44,7 @@ export const useConnectorSetup = ({
   isFlyoutMode,
   onSetupComplete,
   onConversationUpdate,
+  updateConversationsOnSaveConnector = true,
 }: ConnectorSetupProps): {
   comments: EuiCommentProps[];
   prompt: React.ReactElement;
@@ -180,27 +182,38 @@ export const useConnectorSetup = ({
 
   const onSaveConnector = useCallback(
     async (connector: ActionConnector) => {
-      const config = getGenAiConfig(connector);
-      // persist only the active conversation
-      const updatedConversation = await setApiConfig({
-        conversation,
-        apiConfig: {
-          ...conversation.apiConfig,
-          connectorId: connector.id,
-          actionTypeId: connector.actionTypeId,
-          provider: config?.apiProvider,
-          model: config?.defaultModel,
-        },
-      });
+      if (updateConversationsOnSaveConnector) {
+        // this side effect is not required for Attack discovery, because the connector is not used in a conversation
+        const config = getGenAiConfig(connector);
+        // persist only the active conversation
+        const updatedConversation = await setApiConfig({
+          conversation,
+          apiConfig: {
+            ...conversation.apiConfig,
+            connectorId: connector.id,
+            actionTypeId: connector.actionTypeId,
+            provider: config?.apiProvider,
+            model: config?.defaultModel,
+          },
+        });
 
-      if (updatedConversation) {
-        onConversationUpdate({ cId: updatedConversation.id, cTitle: updatedConversation.title });
+        if (updatedConversation) {
+          onConversationUpdate({ cId: updatedConversation.id, cTitle: updatedConversation.title });
 
+          refetchConnectors?.();
+          setIsConnectorModalVisible(false);
+        }
+      } else {
         refetchConnectors?.();
-        setIsConnectorModalVisible(false);
       }
     },
-    [conversation, onConversationUpdate, refetchConnectors, setApiConfig]
+    [
+      conversation,
+      onConversationUpdate,
+      refetchConnectors,
+      setApiConfig,
+      updateConversationsOnSaveConnector,
+    ]
   );
 
   const handleClose = useCallback(() => {
diff --git a/x-pack/packages/kbn-slo-schema/src/rest_specs/routes/find_group.ts b/x-pack/packages/kbn-slo-schema/src/rest_specs/routes/find_group.ts
index 4294dde52b4ceb..3c04134c833128 100644
--- a/x-pack/packages/kbn-slo-schema/src/rest_specs/routes/find_group.ts
+++ b/x-pack/packages/kbn-slo-schema/src/rest_specs/routes/find_group.ts
@@ -28,7 +28,7 @@ const findSLOGroupsParamsSchema = t.partial({
 
 const sloGroupWithSummaryResponseSchema = t.type({
   group: t.string,
-  groupBy: t.string,
+  groupBy: groupBySchema,
   summary: groupSummarySchema,
 });
 
diff --git a/x-pack/packages/security-solution/ecs_data_quality_dashboard/impl/data_quality/data_quality_panel/data_quality_summary/summary_actions/index.tsx b/x-pack/packages/security-solution/ecs_data_quality_dashboard/impl/data_quality/data_quality_panel/data_quality_summary/summary_actions/index.tsx
index 974f44c4c6644d..ed9aeaa8f59d8b 100644
--- a/x-pack/packages/security-solution/ecs_data_quality_dashboard/impl/data_quality/data_quality_panel/data_quality_summary/summary_actions/index.tsx
+++ b/x-pack/packages/security-solution/ecs_data_quality_dashboard/impl/data_quality/data_quality_panel/data_quality_summary/summary_actions/index.tsx
@@ -8,7 +8,6 @@
 import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
 import { sortBy } from 'lodash/fp';
 import React, { useCallback, useState } from 'react';
-import styled from 'styled-components';
 
 import { CheckAll } from './check_all';
 import { CheckStatus } from '../check_status';
@@ -34,10 +33,6 @@ import type {
 import { getSizeInBytes } from '../../../helpers';
 import { useDataQualityContext } from '../../data_quality_context';
 
-const SummaryActionsFlexGroup = styled(EuiFlexGroup)`
-  gap: ${({ theme }) => theme.eui.euiSizeS};
-`;
-
 export const getResultsSortedByDocsCount = (
   results: Record<string, DataQualityCheckResult> | undefined
 ): DataQualityCheckResult[] =>
@@ -237,7 +232,7 @@ const SummaryActionsComponent: React.FC<Props> = ({
 
   return (
     <>
-      <SummaryActionsFlexGroup data-test-subj="summaryActions" direction="column" gutterSize="none">
+      <EuiFlexGroup data-test-subj="summaryActions" direction="column" gutterSize="s">
         <EuiFlexItem grow={false}>
           <CheckAll
             formatBytes={formatBytes}
@@ -274,7 +269,7 @@ const SummaryActionsComponent: React.FC<Props> = ({
             openCreateCaseFlyout={openCreateCaseFlyout}
           />
         </EuiFlexItem>
-      </SummaryActionsFlexGroup>
+      </EuiFlexGroup>
     </>
   );
 };
diff --git a/x-pack/packages/security-solution/ecs_data_quality_dashboard/impl/data_quality/data_quality_panel/ilm_phase_counts/index.tsx b/x-pack/packages/security-solution/ecs_data_quality_dashboard/impl/data_quality/data_quality_panel/ilm_phase_counts/index.tsx
index 82664778becb08..b24014bb400e65 100644
--- a/x-pack/packages/security-solution/ecs_data_quality_dashboard/impl/data_quality/data_quality_panel/ilm_phase_counts/index.tsx
+++ b/x-pack/packages/security-solution/ecs_data_quality_dashboard/impl/data_quality/data_quality_panel/ilm_phase_counts/index.tsx
@@ -14,7 +14,6 @@ import type { IlmExplainPhaseCounts, IlmPhase } from '../../types';
 
 const PhaseCountsFlexGroup = styled(EuiFlexGroup)`
   display: inline-flex;
-  gap: ${({ theme }) => theme.eui.euiSizeS};
 `;
 
 export const phases: IlmPhase[] = ['hot', 'unmanaged', 'warm', 'cold', 'frozen'];
@@ -25,7 +24,7 @@ interface Props {
 }
 
 const IlmPhaseCountsComponent: React.FC<Props> = ({ ilmExplainPhaseCounts, pattern }) => (
-  <PhaseCountsFlexGroup data-test-subj="ilmPhaseCounts" gutterSize="none">
+  <PhaseCountsFlexGroup data-test-subj="ilmPhaseCounts" gutterSize="s">
     {phases.map((phase) =>
       ilmExplainPhaseCounts[phase] != null && ilmExplainPhaseCounts[phase] > 0 ? (
         <EuiFlexItem key={phase} grow={false}>
diff --git a/x-pack/packages/security-solution/ecs_data_quality_dashboard/impl/data_quality/data_quality_panel/pattern/pattern_summary/stats_rollup/index.tsx b/x-pack/packages/security-solution/ecs_data_quality_dashboard/impl/data_quality/data_quality_panel/pattern/pattern_summary/stats_rollup/index.tsx
index 32d157839351a7..8925eb8118dc54 100644
--- a/x-pack/packages/security-solution/ecs_data_quality_dashboard/impl/data_quality/data_quality_panel/pattern/pattern_summary/stats_rollup/index.tsx
+++ b/x-pack/packages/security-solution/ecs_data_quality_dashboard/impl/data_quality/data_quality_panel/pattern/pattern_summary/stats_rollup/index.tsx
@@ -13,10 +13,6 @@ import { EMPTY_STAT, getIncompatibleStatColor } from '../../../../helpers';
 import { StatLabel } from '../../../stat_label';
 import * as i18n from '../../../stat_label/translations';
 
-const StatsFlexGroup = styled(EuiFlexGroup)`
-  gap: ${({ theme }) => theme.eui.euiSizeS};
-`;
-
 const IndicesStatContainer = styled.div`
   min-width: 100px;
 `;
@@ -61,10 +57,10 @@ const StatsRollupComponent: React.FC<Props> = ({
   const indicesDescription = useMemo(() => <StatLabel line2={i18n.INDICES} />, []);
 
   return (
-    <StatsFlexGroup
+    <EuiFlexGroup
       alignItems="flexEnd"
       data-test-subj="statsRollup"
-      gutterSize="none"
+      gutterSize="s"
       justifyContent="flexEnd"
     >
       <EuiFlexItem grow={false}>
@@ -155,7 +151,7 @@ const StatsRollupComponent: React.FC<Props> = ({
           </EuiToolTip>
         </DocsContainer>
       </EuiFlexItem>
-    </StatsFlexGroup>
+    </EuiFlexGroup>
   );
 };
 
diff --git a/x-pack/packages/security-solution/side_nav/src/solution_side_nav.test.tsx b/x-pack/packages/security-solution/side_nav/src/solution_side_nav.test.tsx
index b5db8e66f10dd0..91ba09202a13eb 100644
--- a/x-pack/packages/security-solution/side_nav/src/solution_side_nav.test.tsx
+++ b/x-pack/packages/security-solution/side_nav/src/solution_side_nav.test.tsx
@@ -167,5 +167,11 @@ describe('SolutionSideNav', () => {
       expect(result.queryByTestId('solutionSideNavPanel')).toBeInTheDocument();
       expect(result.getByText('Users')).toBeInTheDocument();
     });
+
+    it('should call onMount when function is provided', () => {
+      const onMount = jest.fn();
+      renderNav({ onMount });
+      expect(onMount).toHaveBeenCalled();
+    });
   });
 });
diff --git a/x-pack/packages/security-solution/side_nav/src/solution_side_nav.tsx b/x-pack/packages/security-solution/side_nav/src/solution_side_nav.tsx
index d146985aadf7a1..1615df71011f7a 100644
--- a/x-pack/packages/security-solution/side_nav/src/solution_side_nav.tsx
+++ b/x-pack/packages/security-solution/side_nav/src/solution_side_nav.tsx
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import React, { useCallback, useMemo, useRef, useState } from 'react';
+import React, { useCallback, useEffect, useMemo, useRef, useState } from 'react';
 import {
   EuiListGroup,
   EuiFlexGroup,
@@ -50,6 +50,7 @@ export interface SolutionSideNavProps {
    * e.g.: usageCollection?.reportUiCounter?.bind(null, appId)
    * */
   tracker?: Tracker;
+  onMount?: () => void;
 }
 type ActivePanelNav = string | null;
 /**
@@ -62,6 +63,7 @@ export const SolutionSideNav: React.FC<SolutionSideNavProps> = React.memo(functi
   panelBottomOffset,
   panelTopOffset,
   tracker,
+  onMount,
 }) {
   const isMobileSize = useIsWithinBreakpoints(['xs', 's']);
 
@@ -73,6 +75,10 @@ export const SolutionSideNav: React.FC<SolutionSideNavProps> = React.memo(functi
     setActivePanelNavId(id);
   };
 
+  useEffect(() => {
+    if (onMount) onMount();
+  }, [onMount]);
+
   const onClosePanelNav = useCallback(() => {
     activePanelNavIdRef.current = null;
     setActivePanelNavId(null);
@@ -290,6 +296,7 @@ const SolutionSideNavItem: React.FC<SolutionSideNavItemProps> = React.memo(
                 className={itemClassNames}
                 color="text"
                 size="s"
+                id={`solutionSideNavItemLink-${id}`}
                 data-test-subj={`solutionSideNavItemLink-${id}`}
               />
             </EuiListGroup>
diff --git a/x-pack/packages/security/plugin_types_common/index.ts b/x-pack/packages/security/plugin_types_common/index.ts
index c5771f69828072..9d4d690e524a09 100644
--- a/x-pack/packages/security/plugin_types_common/index.ts
+++ b/x-pack/packages/security/plugin_types_common/index.ts
@@ -16,6 +16,7 @@ export type {
   RoleIndexPrivilege,
   RoleKibanaPrivilege,
   RoleRemoteIndexPrivilege,
+  RoleRemoteClusterPrivilege,
   FeaturesPrivileges,
 } from './src/authorization';
 export type { SecurityLicense, SecurityLicenseFeatures, LoginLayout } from './src/licensing';
diff --git a/x-pack/packages/security/plugin_types_common/src/authorization/index.ts b/x-pack/packages/security/plugin_types_common/src/authorization/index.ts
index 29cb395ccfe4f0..89857a18865afc 100644
--- a/x-pack/packages/security/plugin_types_common/src/authorization/index.ts
+++ b/x-pack/packages/security/plugin_types_common/src/authorization/index.ts
@@ -11,4 +11,5 @@ export type {
   RoleKibanaPrivilege,
   RoleIndexPrivilege,
   RoleRemoteIndexPrivilege,
+  RoleRemoteClusterPrivilege,
 } from './role';
diff --git a/x-pack/packages/security/plugin_types_common/src/authorization/role.ts b/x-pack/packages/security/plugin_types_common/src/authorization/role.ts
index cce0b811c58750..3a20b64d4d06cb 100644
--- a/x-pack/packages/security/plugin_types_common/src/authorization/role.ts
+++ b/x-pack/packages/security/plugin_types_common/src/authorization/role.ts
@@ -28,11 +28,17 @@ export interface RoleKibanaPrivilege {
   _reserved?: string[];
 }
 
+export interface RoleRemoteClusterPrivilege {
+  clusters: string[];
+  privileges: string[];
+}
+
 export interface Role {
   name: string;
   description?: string;
   elasticsearch: {
     cluster: string[];
+    remote_cluster?: RoleRemoteClusterPrivilege[];
     indices: RoleIndexPrivilege[];
     remote_indices?: RoleRemoteIndexPrivilege[];
     run_as: string[];
diff --git a/x-pack/packages/security/plugin_types_common/src/licensing/license_features.ts b/x-pack/packages/security/plugin_types_common/src/licensing/license_features.ts
index c5f05c83c8e482..58fb081a5760d2 100644
--- a/x-pack/packages/security/plugin_types_common/src/licensing/license_features.ts
+++ b/x-pack/packages/security/plugin_types_common/src/licensing/license_features.ts
@@ -59,6 +59,11 @@ export interface SecurityLicenseFeatures {
    */
   readonly allowRoleRemoteIndexPrivileges: boolean;
 
+  /**
+   * Indicates whether we allow users to define remote cluster privileges in roles.
+   */
+  readonly allowRemoteClusterPrivileges: boolean;
+
   /**
    * Indicates whether we allow Role-based access control (RBAC).
    */
diff --git a/x-pack/packages/security/plugin_types_server/src/authorization/role_schema.ts b/x-pack/packages/security/plugin_types_server/src/authorization/role_schema.ts
index ea7f8969279057..3d673fa25dc5ff 100644
--- a/x-pack/packages/security/plugin_types_server/src/authorization/role_schema.ts
+++ b/x-pack/packages/security/plugin_types_server/src/authorization/role_schema.ts
@@ -22,6 +22,19 @@ export const elasticsearchRoleSchema = schema.object({
    */
   cluster: schema.maybe(schema.arrayOf(schema.string())),
 
+  /**
+   * An optional list of remote cluster privileges. These privileges define the remote cluster level actions that
+   * users with this role are able to execute
+   */
+  remote_cluster: schema.maybe(
+    schema.arrayOf(
+      schema.object({
+        privileges: schema.arrayOf(schema.string(), { minSize: 1 }),
+        clusters: schema.arrayOf(schema.string(), { minSize: 1 }),
+      })
+    )
+  ),
+
   /**
    * An optional list of indices permissions entries.
    */
diff --git a/x-pack/plugins/actions/docs/openapi/bundled.json b/x-pack/plugins/actions/docs/openapi/bundled.json
index a1f84cf94cb5b3..81033683ee0385 100644
--- a/x-pack/plugins/actions/docs/openapi/bundled.json
+++ b/x-pack/plugins/actions/docs/openapi/bundled.json
@@ -2340,11 +2340,7 @@
             "type": "string",
             "description": "A JSON payload sent to the create comment URL to create a case comment. You can use variables to add Kibana Cases data to the payload. The required variable is `case.comment`. Due to Mustache template variables (the text enclosed in triple braces, for example, `{{{case.title}}}`), the JSON is not validated when you create the connector. The JSON is validated once the Mustache variables have been placed when the REST method runs. Manually ensure that the JSON is valid, disregarding the Mustache variables, so the later validation will pass.\n",
             "examples": [
-              {
-                "body": {
-                  "[object Object]": null
-                }
-              }
+              "{\"body\": {{{case.comment}}}}"
             ]
           },
           "createCommentMethod": {
@@ -2368,19 +2364,7 @@
             "type": "string",
             "description": "A JSON payload sent to the create case URL to create a case. You can use variables to add case data to the payload. Required variables are `case.title` and `case.description`. Due to Mustache template variables (which is the text enclosed in triple braces, for example, `{{{case.title}}}`), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid to avoid future validation errors; disregard Mustache variables during your review.\n",
             "examples": [
-              {
-                "fields": {
-                  "summary": {
-                    "[object Object]": null
-                  },
-                  "description": {
-                    "[object Object]": null
-                  },
-                  "labels": {
-                    "[object Object]": null
-                  }
-                }
-              }
+              "{\"fields\": {\"summary\": {{{case.title}}},\"description\": {{{case.description}}},\"labels\": {{{case.tags}}}}}"
             ]
           },
           "createIncidentMethod": {
@@ -2425,19 +2409,7 @@
             "type": "string",
             "description": "The JSON payload sent to the update case URL to update the case. You can use variables to add Kibana Cases data to the payload. Required variables are `case.title` and `case.description`. Due to Mustache template variables (which is the text enclosed in triple braces, for example, `{{{case.title}}}`), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid to avoid future validation errors; disregard Mustache variables during your review.\n",
             "examples": [
-              {
-                "fields": {
-                  "summary": {
-                    "[object Object]": null
-                  },
-                  "description": {
-                    "[object Object]": null
-                  },
-                  "labels": {
-                    "[object Object]": null
-                  }
-                }
-              }
+              "{\"fields\": {\"summary\": {{{case.title}}},\"description\": {{{case.description}}},\"labels\": {{{case.tags}}}}}"
             ]
           },
           "updateIncidentMethod": {
diff --git a/x-pack/plugins/actions/docs/openapi/bundled.yaml b/x-pack/plugins/actions/docs/openapi/bundled.yaml
index a7173fd0ffeb27..599567cf08150d 100644
--- a/x-pack/plugins/actions/docs/openapi/bundled.yaml
+++ b/x-pack/plugins/actions/docs/openapi/bundled.yaml
@@ -1574,8 +1574,7 @@ components:
           description: |
             A JSON payload sent to the create comment URL to create a case comment. You can use variables to add Kibana Cases data to the payload. The required variable is `case.comment`. Due to Mustache template variables (the text enclosed in triple braces, for example, `{{{case.title}}}`), the JSON is not validated when you create the connector. The JSON is validated once the Mustache variables have been placed when the REST method runs. Manually ensure that the JSON is valid, disregarding the Mustache variables, so the later validation will pass.
           examples:
-            - body:
-                '[object Object]': null
+            - '{"body": {{{case.comment}}}}'
         createCommentMethod:
           type: string
           description: |
@@ -1596,13 +1595,7 @@ components:
           description: |
             A JSON payload sent to the create case URL to create a case. You can use variables to add case data to the payload. Required variables are `case.title` and `case.description`. Due to Mustache template variables (which is the text enclosed in triple braces, for example, `{{{case.title}}}`), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid to avoid future validation errors; disregard Mustache variables during your review.
           examples:
-            - fields:
-                summary:
-                  '[object Object]': null
-                description:
-                  '[object Object]': null
-                labels:
-                  '[object Object]': null
+            - '{"fields": {"summary": {{{case.title}}},"description": {{{case.description}}},"labels": {{{case.tags}}}}}'
         createIncidentMethod:
           type: string
           description: |
@@ -1641,13 +1634,7 @@ components:
           description: |
             The JSON payload sent to the update case URL to update the case. You can use variables to add Kibana Cases data to the payload. Required variables are `case.title` and `case.description`. Due to Mustache template variables (which is the text enclosed in triple braces, for example, `{{{case.title}}}`), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid to avoid future validation errors; disregard Mustache variables during your review.
           examples:
-            - fields:
-                summary:
-                  '[object Object]': null
-                description:
-                  '[object Object]': null
-                labels:
-                  '[object Object]': null
+            - '{"fields": {"summary": {{{case.title}}},"description": {{{case.description}}},"labels": {{{case.tags}}}}}'
         updateIncidentMethod:
           type: string
           description: |
diff --git a/x-pack/plugins/actions/docs/openapi/bundled_serverless.json b/x-pack/plugins/actions/docs/openapi/bundled_serverless.json
index f9620ac896058f..0f55981305631d 100644
--- a/x-pack/plugins/actions/docs/openapi/bundled_serverless.json
+++ b/x-pack/plugins/actions/docs/openapi/bundled_serverless.json
@@ -1308,11 +1308,7 @@
             "type": "string",
             "description": "A JSON payload sent to the create comment URL to create a case comment. You can use variables to add Kibana Cases data to the payload. The required variable is `case.comment`. Due to Mustache template variables (the text enclosed in triple braces, for example, `{{{case.title}}}`), the JSON is not validated when you create the connector. The JSON is validated once the Mustache variables have been placed when the REST method runs. Manually ensure that the JSON is valid, disregarding the Mustache variables, so the later validation will pass.\n",
             "examples": [
-              {
-                "body": {
-                  "[object Object]": null
-                }
-              }
+              "{\"body\": {{{case.comment}}}}"
             ]
           },
           "createCommentMethod": {
@@ -1336,19 +1332,7 @@
             "type": "string",
             "description": "A JSON payload sent to the create case URL to create a case. You can use variables to add case data to the payload. Required variables are `case.title` and `case.description`. Due to Mustache template variables (which is the text enclosed in triple braces, for example, `{{{case.title}}}`), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid to avoid future validation errors; disregard Mustache variables during your review.\n",
             "examples": [
-              {
-                "fields": {
-                  "summary": {
-                    "[object Object]": null
-                  },
-                  "description": {
-                    "[object Object]": null
-                  },
-                  "labels": {
-                    "[object Object]": null
-                  }
-                }
-              }
+              "{\"fields\": {\"summary\": {{{case.title}}},\"description\": {{{case.description}}},\"labels\": {{{case.tags}}}}}"
             ]
           },
           "createIncidentMethod": {
@@ -1393,19 +1377,7 @@
             "type": "string",
             "description": "The JSON payload sent to the update case URL to update the case. You can use variables to add Kibana Cases data to the payload. Required variables are `case.title` and `case.description`. Due to Mustache template variables (which is the text enclosed in triple braces, for example, `{{{case.title}}}`), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid to avoid future validation errors; disregard Mustache variables during your review.\n",
             "examples": [
-              {
-                "fields": {
-                  "summary": {
-                    "[object Object]": null
-                  },
-                  "description": {
-                    "[object Object]": null
-                  },
-                  "labels": {
-                    "[object Object]": null
-                  }
-                }
-              }
+              "{\"fields\": {\"summary\": {{{case.title}}},\"description\": {{{case.description}}},\"labels\": {{{case.tags}}}}}"
             ]
           },
           "updateIncidentMethod": {
diff --git a/x-pack/plugins/actions/docs/openapi/bundled_serverless.yaml b/x-pack/plugins/actions/docs/openapi/bundled_serverless.yaml
index ecb03fcb20df40..047216dd7f6c48 100644
--- a/x-pack/plugins/actions/docs/openapi/bundled_serverless.yaml
+++ b/x-pack/plugins/actions/docs/openapi/bundled_serverless.yaml
@@ -921,8 +921,7 @@ components:
           description: |
             A JSON payload sent to the create comment URL to create a case comment. You can use variables to add Kibana Cases data to the payload. The required variable is `case.comment`. Due to Mustache template variables (the text enclosed in triple braces, for example, `{{{case.title}}}`), the JSON is not validated when you create the connector. The JSON is validated once the Mustache variables have been placed when the REST method runs. Manually ensure that the JSON is valid, disregarding the Mustache variables, so the later validation will pass.
           examples:
-            - body:
-                '[object Object]': null
+            - '{"body": {{{case.comment}}}}'
         createCommentMethod:
           type: string
           description: |
@@ -943,13 +942,7 @@ components:
           description: |
             A JSON payload sent to the create case URL to create a case. You can use variables to add case data to the payload. Required variables are `case.title` and `case.description`. Due to Mustache template variables (which is the text enclosed in triple braces, for example, `{{{case.title}}}`), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid to avoid future validation errors; disregard Mustache variables during your review.
           examples:
-            - fields:
-                summary:
-                  '[object Object]': null
-                description:
-                  '[object Object]': null
-                labels:
-                  '[object Object]': null
+            - '{"fields": {"summary": {{{case.title}}},"description": {{{case.description}}},"labels": {{{case.tags}}}}}'
         createIncidentMethod:
           type: string
           description: |
@@ -988,13 +981,7 @@ components:
           description: |
             The JSON payload sent to the update case URL to update the case. You can use variables to add Kibana Cases data to the payload. Required variables are `case.title` and `case.description`. Due to Mustache template variables (which is the text enclosed in triple braces, for example, `{{{case.title}}}`), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid to avoid future validation errors; disregard Mustache variables during your review.
           examples:
-            - fields:
-                summary:
-                  '[object Object]': null
-                description:
-                  '[object Object]': null
-                labels:
-                  '[object Object]': null
+            - '{"fields": {"summary": {{{case.title}}},"description": {{{case.description}}},"labels": {{{case.tags}}}}}'
         updateIncidentMethod:
           type: string
           description: |
diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/config_properties_cases_webhook.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/config_properties_cases_webhook.yaml
index da803ba7f31289..a452a1fdfd0601 100644
--- a/x-pack/plugins/actions/docs/openapi/components/schemas/config_properties_cases_webhook.yaml
+++ b/x-pack/plugins/actions/docs/openapi/components/schemas/config_properties_cases_webhook.yaml
@@ -23,7 +23,7 @@ properties:
       placed when the REST method runs. Manually ensure that the JSON is valid,
       disregarding the Mustache variables, so the later validation will pass.
     examples:
-      - {"body": {{{case.comment}}}}
+      - '{"body": {{{case.comment}}}}'
   createCommentMethod:
     type: string
     description: >
@@ -55,7 +55,7 @@ properties:
       placed when REST method runs. Manually ensure that the JSON is valid to
       avoid future validation errors; disregard Mustache variables during your review.
     examples:
-      - {"fields": {"summary": {{{case.title}}},"description": {{{case.description}}},"labels": {{{case.tags}}}}}
+      - '{"fields": {"summary": {{{case.title}}},"description": {{{case.description}}},"labels": {{{case.tags}}}}}'
   createIncidentMethod:
     type: string
     description: >
@@ -112,7 +112,7 @@ properties:
       placed when REST method runs. Manually ensure that the JSON is valid to
       avoid future validation errors; disregard Mustache variables during your review.
     examples:
-      - {"fields": {"summary": {{{case.title}}},"description": {{{case.description}}},"labels": {{{case.tags}}}}}
+      - '{"fields": {"summary": {{{case.title}}},"description": {{{case.description}}},"labels": {{{case.tags}}}}}'
   updateIncidentMethod:
     type: string
     description: >
diff --git a/x-pack/plugins/alerting/common/constants/backfill.ts b/x-pack/plugins/alerting/common/constants/backfill.ts
index 0a8281cba81862..b78d18f5550b65 100644
--- a/x-pack/plugins/alerting/common/constants/backfill.ts
+++ b/x-pack/plugins/alerting/common/constants/backfill.ts
@@ -6,3 +6,7 @@
  */
 
 export const MAX_SCHEDULE_BACKFILL_BULK_SIZE = 100;
+// Only allow scheduling backfills up to 90 days in the past
+export const MAX_SCHEDULE_BACKFILL_LOOKBACK_WINDOW_DAYS = 90;
+export const MAX_SCHEDULE_BACKFILL_LOOKBACK_WINDOW_MS =
+  MAX_SCHEDULE_BACKFILL_LOOKBACK_WINDOW_DAYS * 24 * 60 * 60 * 1000;
diff --git a/x-pack/plugins/alerting/common/constants/index.ts b/x-pack/plugins/alerting/common/constants/index.ts
index 5dc50b91a4163e..0acc25785d1943 100644
--- a/x-pack/plugins/alerting/common/constants/index.ts
+++ b/x-pack/plugins/alerting/common/constants/index.ts
@@ -7,5 +7,9 @@
 
 export type { AdHocRunStatus } from './ad_hoc_run_status';
 export { adHocRunStatus } from './ad_hoc_run_status';
-export { MAX_SCHEDULE_BACKFILL_BULK_SIZE } from './backfill';
+export {
+  MAX_SCHEDULE_BACKFILL_BULK_SIZE,
+  MAX_SCHEDULE_BACKFILL_LOOKBACK_WINDOW_DAYS,
+  MAX_SCHEDULE_BACKFILL_LOOKBACK_WINDOW_MS,
+} from './backfill';
 export { PLUGIN } from './plugin';
diff --git a/x-pack/plugins/alerting/common/index.ts b/x-pack/plugins/alerting/common/index.ts
index 2c71a3a17379f0..320a5b29f69564 100644
--- a/x-pack/plugins/alerting/common/index.ts
+++ b/x-pack/plugins/alerting/common/index.ts
@@ -13,6 +13,7 @@ import { AlertsHealth } from './rule';
 export * from './rule';
 export * from './rules_settings';
 export * from './rule_type';
+export * from './lib';
 export type {
   ThrottledActions,
   LastScheduledActions,
diff --git a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/embeddables/grid_embeddable/constants.ts b/x-pack/plugins/alerting/common/lib/index.ts
similarity index 76%
rename from x-pack/plugins/data_visualizer/public/application/index_data_visualizer/embeddables/grid_embeddable/constants.ts
rename to x-pack/plugins/alerting/common/lib/index.ts
index 26004db8fd5299..35888ab08952d5 100644
--- a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/embeddables/grid_embeddable/constants.ts
+++ b/x-pack/plugins/alerting/common/lib/index.ts
@@ -5,4 +5,4 @@
  * 2.0.
  */
 
-export const DATA_VISUALIZER_GRID_EMBEDDABLE_TYPE = 'data_visualizer_grid';
+export { validateBackfillSchedule } from './validate_backfill_schedule';
diff --git a/x-pack/plugins/alerting/common/lib/validate_backfill_schedule.test.ts b/x-pack/plugins/alerting/common/lib/validate_backfill_schedule.test.ts
new file mode 100644
index 00000000000000..fa512c1635afb4
--- /dev/null
+++ b/x-pack/plugins/alerting/common/lib/validate_backfill_schedule.test.ts
@@ -0,0 +1,65 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { validateBackfillSchedule } from './validate_backfill_schedule';
+
+describe('validateBackfillSchedule', () => {
+  beforeAll(() => {
+    jest.useFakeTimers();
+    jest.setSystemTime(new Date('2023-11-16T08:00:00.000Z'));
+  });
+  afterAll(() => jest.useRealTimers());
+
+  test('validates valid start date', () => {
+    expect(validateBackfillSchedule('2023-10-16T08:00:00.000Z')).toBeUndefined();
+  });
+
+  test('validates valid end date', () => {
+    expect(
+      validateBackfillSchedule('2023-10-16T08:00:00.000Z', '2023-10-17T08:00:00.000Z')
+    ).toBeUndefined();
+  });
+
+  test('returns error if start date is not a valid date', () => {
+    expect(validateBackfillSchedule('foo')).toMatchInlineSnapshot(
+      `"Backfill start must be valid date"`
+    );
+  });
+
+  test('returns error if end date is not a valid date', () => {
+    expect(validateBackfillSchedule('2023-10-16T08:00:00.000Z', 'foo')).toMatchInlineSnapshot(
+      `"Backfill end must be valid date"`
+    );
+  });
+
+  test('returns error if start date is too far in the past', () => {
+    expect(validateBackfillSchedule('2023-08-18T07:59:59.999Z')).toMatchInlineSnapshot(
+      `"Backfill cannot look back more than 90 days"`
+    );
+  });
+
+  test('returns error if end date is less than or equal to start date', () => {
+    expect(
+      validateBackfillSchedule('2023-10-16T08:00:00.000Z', '2023-10-16T08:00:00.000Z')
+    ).toMatchInlineSnapshot(`"Backfill end must be greater than backfill start"`);
+    expect(
+      validateBackfillSchedule('2023-10-16T08:00:00.000Z', '2023-10-15T08:00:00.000Z')
+    ).toMatchInlineSnapshot(`"Backfill end must be greater than backfill start"`);
+  });
+
+  test('returns error if start date is greater than current date', () => {
+    expect(validateBackfillSchedule('2023-11-16T08:00:00.001Z')).toMatchInlineSnapshot(
+      `"Backfill cannot be scheduled for the future"`
+    );
+  });
+
+  test('returns error if end date is greater than current date', () => {
+    expect(
+      validateBackfillSchedule('2023-10-16T08:00:00.000Z', '2023-11-16T08:00:00.001Z')
+    ).toMatchInlineSnapshot(`"Backfill cannot be scheduled for the future"`);
+  });
+});
diff --git a/x-pack/plugins/alerting/common/lib/validate_backfill_schedule.ts b/x-pack/plugins/alerting/common/lib/validate_backfill_schedule.ts
new file mode 100644
index 00000000000000..c8bc1467296e47
--- /dev/null
+++ b/x-pack/plugins/alerting/common/lib/validate_backfill_schedule.ts
@@ -0,0 +1,48 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  MAX_SCHEDULE_BACKFILL_LOOKBACK_WINDOW_DAYS,
+  MAX_SCHEDULE_BACKFILL_LOOKBACK_WINDOW_MS,
+} from '../constants';
+
+export function validateBackfillSchedule(start: string, end?: string): string | void {
+  try {
+    const now = new Date().valueOf();
+
+    const parsedStart = Date.parse(start);
+    if (isNaN(parsedStart)) {
+      return `Backfill start must be valid date`;
+    }
+
+    if (now - parsedStart > MAX_SCHEDULE_BACKFILL_LOOKBACK_WINDOW_MS) {
+      return `Backfill cannot look back more than ${MAX_SCHEDULE_BACKFILL_LOOKBACK_WINDOW_DAYS} days`;
+    }
+
+    if (now < parsedStart) {
+      return `Backfill cannot be scheduled for the future`;
+    }
+
+    if (end) {
+      const parsedEnd = Date.parse(end);
+      if (isNaN(parsedEnd)) {
+        return `Backfill end must be valid date`;
+      }
+      const startMs = new Date(start).valueOf();
+      const endMs = new Date(end).valueOf();
+      if (endMs <= startMs) {
+        return `Backfill end must be greater than backfill start`;
+      }
+
+      if (now < parsedEnd) {
+        return `Backfill cannot be scheduled for the future`;
+      }
+    }
+  } catch (err) {
+    return `Error validating backfill schedule - ${err.message}`;
+  }
+}
diff --git a/x-pack/plugins/alerting/common/routes/backfill/apis/schedule/schemas/v1.ts b/x-pack/plugins/alerting/common/routes/backfill/apis/schedule/schemas/v1.ts
index 791a5cce9ac383..527134a2b51386 100644
--- a/x-pack/plugins/alerting/common/routes/backfill/apis/schedule/schemas/v1.ts
+++ b/x-pack/plugins/alerting/common/routes/backfill/apis/schedule/schemas/v1.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 import { schema } from '@kbn/config-schema';
+import { validateBackfillSchedule } from '../../../../..';
 import { MAX_SCHEDULE_BACKFILL_BULK_SIZE } from '../../../../../constants';
 import { backfillResponseSchemaV1, errorResponseSchemaV1 } from '../../../response';
 
@@ -17,22 +18,7 @@ export const scheduleBodySchema = schema.arrayOf(
     },
     {
       validate({ start, end }) {
-        const parsedStart = Date.parse(start);
-        if (isNaN(parsedStart)) {
-          return `Backfill start must be valid date`;
-        }
-
-        if (end) {
-          const parsedEnd = Date.parse(end);
-          if (isNaN(parsedEnd)) {
-            return `Backfill end must be valid date`;
-          }
-          const startMs = new Date(start).valueOf();
-          const endMs = new Date(end).valueOf();
-          if (endMs <= startMs) {
-            return `Backfill end must be greater than backfill start`;
-          }
-        }
+        return validateBackfillSchedule(start, end);
       },
     }
   ),
diff --git a/x-pack/plugins/alerting/server/application/backfill/methods/schedule/schedule_backfill.test.ts b/x-pack/plugins/alerting/server/application/backfill/methods/schedule/schedule_backfill.test.ts
index 4767a344f5153a..7edcb26b9718e7 100644
--- a/x-pack/plugins/alerting/server/application/backfill/methods/schedule/schedule_backfill.test.ts
+++ b/x-pack/plugins/alerting/server/application/backfill/methods/schedule/schedule_backfill.test.ts
@@ -185,6 +185,10 @@ function getMockData(overwrites: Record<string, unknown> = {}): ScheduleBackfill
 describe('scheduleBackfill()', () => {
   let rulesClient: RulesClient;
 
+  beforeAll(() => {
+    jest.useFakeTimers();
+    jest.setSystemTime(new Date('2023-12-16T08:00:00.000Z'));
+  });
   beforeEach(async () => {
     jest.resetAllMocks();
     rulesClient = new RulesClient(rulesClientParams);
@@ -239,6 +243,7 @@ describe('scheduleBackfill()', () => {
     });
     backfillClient.bulkQueue.mockResolvedValue(mockBulkQueueResult);
   });
+  afterAll(() => jest.useRealTimers());
 
   test('should successfully schedule backfill', async () => {
     const mockData = [getMockData(), getMockData({ ruleId: '2', end: '2023-11-17T08:00:00.000Z' })];
diff --git a/x-pack/plugins/alerting/server/application/backfill/methods/schedule/schemas/schedule_backfill_params_schema.ts b/x-pack/plugins/alerting/server/application/backfill/methods/schedule/schemas/schedule_backfill_params_schema.ts
index 0082181e759a69..c4a469da1b5dbf 100644
--- a/x-pack/plugins/alerting/server/application/backfill/methods/schedule/schemas/schedule_backfill_params_schema.ts
+++ b/x-pack/plugins/alerting/server/application/backfill/methods/schedule/schemas/schedule_backfill_params_schema.ts
@@ -6,6 +6,7 @@
  */
 
 import { schema } from '@kbn/config-schema';
+import { validateBackfillSchedule } from '../../../../../../common';
 import { MAX_SCHEDULE_BACKFILL_BULK_SIZE } from '../../../../../../common/constants';
 
 export const scheduleBackfillParamSchema = schema.object(
@@ -16,22 +17,7 @@ export const scheduleBackfillParamSchema = schema.object(
   },
   {
     validate({ start, end }) {
-      const parsedStart = Date.parse(start);
-      if (isNaN(parsedStart)) {
-        return `Backfill start must be valid date`;
-      }
-
-      if (end) {
-        const parsedEnd = Date.parse(end);
-        if (isNaN(parsedEnd)) {
-          return `Backfill end must be valid date`;
-        }
-        const startMs = new Date(start).valueOf();
-        const endMs = new Date(end).valueOf();
-        if (endMs <= startMs) {
-          return `Backfill end must be greater than backfill start`;
-        }
-      }
+      return validateBackfillSchedule(start, end);
     },
   }
 );
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/renderers/embeddable/embeddable.tsx b/x-pack/plugins/canvas/canvas_plugin_src/renderers/embeddable/embeddable.tsx
index f1e0387c3a5d65..696243680782b9 100644
--- a/x-pack/plugins/canvas/canvas_plugin_src/renderers/embeddable/embeddable.tsx
+++ b/x-pack/plugins/canvas/canvas_plugin_src/renderers/embeddable/embeddable.tsx
@@ -12,7 +12,6 @@ import {
   EmbeddablePanel,
   IEmbeddable,
   isErrorEmbeddable,
-  reactEmbeddableRegistryHasKey,
   ReactEmbeddableRenderer,
 } from '@kbn/embeddable-plugin/public';
 import { PresentationContainer } from '@kbn/presentation-containers';
@@ -21,6 +20,7 @@ import { KibanaRenderContextProvider } from '@kbn/react-kibana-context-render';
 import React, { FC } from 'react';
 import ReactDOM from 'react-dom';
 import useObservable from 'react-use/lib/useObservable';
+import { pluginServices } from '../../../public/services';
 import { CANVAS_APP, CANVAS_EMBEDDABLE_CLASSNAME } from '../../../common/lib';
 import { RendererStrings } from '../../../i18n';
 import {
@@ -46,30 +46,39 @@ const renderReactEmbeddable = ({
   input,
   container,
   handlers,
+  core,
 }: {
   type: string;
   uuid: string;
   input: EmbeddableInput;
   container: CanvasContainerApi;
   handlers: RendererHandlers;
+  core: CoreStart;
 }) => {
   return (
-    <ReactEmbeddableRenderer
-      type={type}
-      maybeId={uuid}
-      parentApi={container as unknown as PresentationContainer}
-      key={`${type}_${uuid}`}
-      state={{ rawState: input }}
-      onAnyStateChange={(newState) => {
-        const newExpression = embeddableInputToExpression(
-          newState.rawState as unknown as EmbeddableInput,
-          type,
-          undefined,
-          true
-        );
-        if (newExpression) handlers.onEmbeddableInputChange(newExpression);
-      }}
-    />
+    <KibanaRenderContextProvider {...core}>
+      <div
+        className={CANVAS_EMBEDDABLE_CLASSNAME}
+        style={{ width: '100%', height: '100%', cursor: 'auto' }}
+      >
+        <ReactEmbeddableRenderer
+          type={type}
+          maybeId={uuid}
+          parentApi={container as unknown as PresentationContainer}
+          key={`${type}_${uuid}`}
+          state={{ rawState: input }}
+          onAnyStateChange={(newState) => {
+            const newExpression = embeddableInputToExpression(
+              newState.rawState as unknown as EmbeddableInput,
+              type,
+              undefined,
+              true
+            );
+            if (newExpression) handlers.onEmbeddableInputChange(newExpression);
+          }}
+        />
+      </div>
+    </KibanaRenderContextProvider>
   );
 };
 
@@ -121,12 +130,13 @@ export const embeddableRendererFactory = (
     help: strings.getHelpDescription(),
     reuseDomNode: true,
     render: async (domNode, { input, embeddableType, canvasApi }, handlers) => {
+      const { embeddables } = pluginServices.getServices();
       const uniqueId = handlers.getElementId();
       const isByValueEnabled = plugins.presentationUtil.labsService.isProjectEnabled(
         'labs:canvas:byValueEmbeddable'
       );
 
-      if (reactEmbeddableRegistryHasKey(embeddableType)) {
+      if (embeddables.reactEmbeddableRegistryHasKey(embeddableType)) {
         /**
          * Prioritize React embeddables
          */
@@ -137,6 +147,7 @@ export const embeddableRendererFactory = (
             uuid: uniqueId,
             type: embeddableType,
             container: canvasApi,
+            core,
           }),
           domNode,
           () => handlers.done()
diff --git a/x-pack/plugins/canvas/public/components/embeddable_flyout/flyout.component.tsx b/x-pack/plugins/canvas/public/components/embeddable_flyout/flyout.component.tsx
index 87a575ee44b121..0ce1bd6702b66c 100644
--- a/x-pack/plugins/canvas/public/components/embeddable_flyout/flyout.component.tsx
+++ b/x-pack/plugins/canvas/public/components/embeddable_flyout/flyout.component.tsx
@@ -5,11 +5,17 @@
  * 2.0.
  */
 
-import React, { FC, useCallback } from 'react';
+import React, { FC, useCallback, useMemo } from 'react';
 import { EuiFlyout, EuiFlyoutHeader, EuiFlyoutBody, EuiTitle } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 
 import { SavedObjectFinder, SavedObjectMetaData } from '@kbn/saved-objects-finder-plugin/public';
+import { FinderAttributes } from '@kbn/saved-objects-finder-plugin/common';
+import {
+  EmbeddableFactory,
+  ReactEmbeddableSavedObject,
+  getReactEmbeddableSavedObjects,
+} from '@kbn/embeddable-plugin/public';
 import { useEmbeddablesService, usePlatformService } from '../../services';
 
 const strings = {
@@ -22,6 +28,14 @@ const strings = {
       defaultMessage: 'Add from library',
     }),
 };
+
+interface LegacyFactoryMap {
+  [key: string]: EmbeddableFactory;
+}
+interface FactoryMap<TSavedObjectAttributes extends FinderAttributes = FinderAttributes> {
+  [key: string]: ReactEmbeddableSavedObject<TSavedObjectAttributes> & { type: string };
+}
+
 export interface Props {
   onClose: () => void;
   onSelect: (id: string, embeddableType: string, isByValueEnabled?: boolean) => void;
@@ -40,8 +54,67 @@ export const AddEmbeddableFlyout: FC<Props> = ({
   const { getEmbeddableFactories } = embeddablesService;
   const { getContentManagement, getUISettings } = platformService;
 
+  const legacyFactoriesBySavedObjectType: LegacyFactoryMap = useMemo(() => {
+    return [...getEmbeddableFactories()]
+      .filter(
+        (embeddableFactory) =>
+          Boolean(embeddableFactory.savedObjectMetaData?.type) && !embeddableFactory.isContainerType
+      )
+      .reduce((acc, factory) => {
+        acc[factory.savedObjectMetaData!.type] = factory;
+        return acc;
+      }, {} as LegacyFactoryMap);
+  }, [getEmbeddableFactories]);
+
+  const factoriesBySavedObjectType: FactoryMap = useMemo(() => {
+    return [...getReactEmbeddableSavedObjects()]
+      .filter(([type, embeddableFactory]) => {
+        return Boolean(embeddableFactory.savedObjectMetaData?.type);
+      })
+      .reduce((acc, [type, factory]) => {
+        acc[factory.savedObjectMetaData!.type] = {
+          ...factory,
+          type,
+        };
+        return acc;
+      }, {} as FactoryMap);
+  }, []);
+
+  const metaData = useMemo(
+    () =>
+      [
+        ...Object.values(factoriesBySavedObjectType),
+        ...Object.values(legacyFactoriesBySavedObjectType),
+      ]
+        .filter((factory) =>
+          Boolean(
+            factory.type !== 'links' && // Links panels only exist on Dashboards
+              (isByValueEnabled || availableEmbeddables.includes(factory.type))
+          )
+        )
+        .map((factory) => factory.savedObjectMetaData)
+        .filter<SavedObjectMetaData<{}>>(function (
+          maybeSavedObjectMetaData
+        ): maybeSavedObjectMetaData is SavedObjectMetaData<{}> {
+          return maybeSavedObjectMetaData !== undefined;
+        })
+        .sort((a, b) => a.type.localeCompare(b.type)),
+    [
+      availableEmbeddables,
+      factoriesBySavedObjectType,
+      isByValueEnabled,
+      legacyFactoriesBySavedObjectType,
+    ]
+  );
+
   const onAddPanel = useCallback(
     (id: string, savedObjectType: string) => {
+      if (factoriesBySavedObjectType[savedObjectType]) {
+        const factory = factoriesBySavedObjectType[savedObjectType];
+        const { type } = factory;
+        onSelect(id, type, isByValueEnabled);
+        return;
+      }
       const embeddableFactories = getEmbeddableFactories();
       // Find the embeddable type from the saved object type
       const found = Array.from(embeddableFactories).find((embeddableFactory) => {
@@ -55,24 +128,9 @@ export const AddEmbeddableFlyout: FC<Props> = ({
 
       onSelect(id, foundEmbeddableType, isByValueEnabled);
     },
-    [isByValueEnabled, getEmbeddableFactories, onSelect]
+    [isByValueEnabled, getEmbeddableFactories, onSelect, factoriesBySavedObjectType]
   );
 
-  const embeddableFactories = getEmbeddableFactories();
-
-  const availableSavedObjects = Array.from(embeddableFactories)
-    .filter(
-      (factory) =>
-        factory.type !== 'links' && // Links panels only exist on Dashboards
-        (isByValueEnabled || availableEmbeddables.includes(factory.type))
-    )
-    .map((factory) => factory.savedObjectMetaData)
-    .filter<SavedObjectMetaData<{}>>(function (
-      maybeSavedObjectMetaData
-    ): maybeSavedObjectMetaData is SavedObjectMetaData<{}> {
-      return maybeSavedObjectMetaData !== undefined;
-    });
-
   return (
     <EuiFlyout ownFocus onClose={onClose} data-test-subj="dashboardAddPanel">
       <EuiFlyoutHeader hasBorder>
@@ -83,7 +141,7 @@ export const AddEmbeddableFlyout: FC<Props> = ({
       <EuiFlyoutBody>
         <SavedObjectFinder
           onChoose={onAddPanel}
-          savedObjectMetaData={availableSavedObjects}
+          savedObjectMetaData={metaData}
           showFilter={true}
           noItemsMessage={strings.getNoItemsText()}
           services={{
diff --git a/x-pack/plugins/canvas/public/services/embeddables.ts b/x-pack/plugins/canvas/public/services/embeddables.ts
index 2dad3da3d330b4..9bc553e3d924d6 100644
--- a/x-pack/plugins/canvas/public/services/embeddables.ts
+++ b/x-pack/plugins/canvas/public/services/embeddables.ts
@@ -8,6 +8,7 @@
 import { EmbeddableFactory, EmbeddableStateTransfer } from '@kbn/embeddable-plugin/public';
 
 export interface CanvasEmbeddablesService {
+  reactEmbeddableRegistryHasKey: (key: string) => boolean;
   getEmbeddableFactories: () => IterableIterator<EmbeddableFactory>;
   getStateTransfer: () => EmbeddableStateTransfer;
 }
diff --git a/x-pack/plugins/canvas/public/services/kibana/embeddables.ts b/x-pack/plugins/canvas/public/services/kibana/embeddables.ts
index c0bfdcbb8aa1d4..b458b8bac2e8f9 100644
--- a/x-pack/plugins/canvas/public/services/kibana/embeddables.ts
+++ b/x-pack/plugins/canvas/public/services/kibana/embeddables.ts
@@ -15,6 +15,7 @@ export type EmbeddablesServiceFactory = KibanaPluginServiceFactory<
 >;
 
 export const embeddablesServiceFactory: EmbeddablesServiceFactory = ({ startPlugins }) => ({
+  reactEmbeddableRegistryHasKey: startPlugins.embeddable.reactEmbeddableRegistryHasKey,
   getEmbeddableFactories: startPlugins.embeddable.getEmbeddableFactories,
   getStateTransfer: startPlugins.embeddable.getStateTransfer,
 });
diff --git a/x-pack/plugins/canvas/public/services/stubs/embeddables.ts b/x-pack/plugins/canvas/public/services/stubs/embeddables.ts
index 435992bd3b5d9b..53280decf1e247 100644
--- a/x-pack/plugins/canvas/public/services/stubs/embeddables.ts
+++ b/x-pack/plugins/canvas/public/services/stubs/embeddables.ts
@@ -13,6 +13,7 @@ type EmbeddablesServiceFactory = PluginServiceFactory<CanvasEmbeddablesService>;
 const noop = (..._args: any[]): any => {};
 
 export const embeddablesServiceFactory: EmbeddablesServiceFactory = () => ({
+  reactEmbeddableRegistryHasKey: noop,
   getEmbeddableFactories: noop,
   getStateTransfer: noop,
 });
diff --git a/x-pack/plugins/canvas/shareable_runtime/components/__snapshots__/app.test.tsx.snap b/x-pack/plugins/canvas/shareable_runtime/components/__snapshots__/app.test.tsx.snap
index 262f95589c62ae..010847e63a023a 100644
--- a/x-pack/plugins/canvas/shareable_runtime/components/__snapshots__/app.test.tsx.snap
+++ b/x-pack/plugins/canvas/shareable_runtime/components/__snapshots__/app.test.tsx.snap
@@ -1,3 +1,3 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
-exports[`<App /> App renders properly 1`] = `"<div class=\\"root\\" style=\\"height: 768px; width: 1080px;\\"><div class=\\"container\\" style=\\"height: 720px; width: 1080px;\\"><div class=\\"page\\" style=\\"height: 720px; transform: scale3d(1, 1, 1); width: 1080px;\\"><div id=\\"page-7186b301-f8a7-4c65-8b89-38d68d31cfc4\\" class=\\"root\\" style=\\"height: 720px; width: 1080px; background: rgb(119, 119, 119);\\"><div class=\\"canvasPositionable canvasInteractable\\" style=\\"width: 1082px; height: 205.37748344370857px; margin-left: -541px; margin-top: -102.68874172185429px; position: absolute; transform: matrix3d(1,0,0,0,0,1,0,0,0,0,1,0,540,367,1,1);\\"><div class=\\"root\\"><div css=\\"css-159kt7d\\" class=\\"container\\" style=\\"overflow: hidden;\\"><div class=\\"content\\"><div class=\\"renderContainer\\"><div data-renderer=\\"markdown\\" class=\\"render\\"><div>markdown mock</div></div></div></div></div></div></div></div></div></div><div class=\\"root\\" style=\\"height: 48px;\\"><div class=\\"root\\"><div class=\\"slideContainer\\"><div class=\\"root\\" style=\\"height: 100px; width: 150px;\\"><div class=\\"preview\\" style=\\"height: 720px; width: 1080px; transform: scale3d(0.1388888888888889, 0.1388888888888889, 1);\\"><div id=\\"page-7186b301-f8a7-4c65-8b89-38d68d31cfc4\\" class=\\"root\\" style=\\"height: 720px; width: 1080px; background: rgb(119, 119, 119);\\"><div class=\\"canvasPositionable canvasInteractable\\" style=\\"width: 1082px; height: 205.37748344370857px; margin-left: -541px; margin-top: -102.68874172185429px; position: absolute; transform: matrix3d(1,0,0,0,0,1,0,0,0,0,1,0,540,367,1,1);\\"><div class=\\"root\\"><div css=\\"css-159kt7d\\" class=\\"container\\" style=\\"overflow: hidden;\\"><div class=\\"content\\"><div class=\\"renderContainer\\"><div data-renderer=\\"markdown\\" class=\\"render\\"><div>markdown mock</div></div></div></div></div></div></div></div></div></div></div></div><div><section aria-label=\\"Page level controls\\" class=\\"euiBottomBar euiBottomBar--fixed css-1wujudg-euiBottomBar-fixed-m-euiColorMode-dark\\" style=\\"left: 0px; right: 0px; bottom: 0px;\\"><h2 class=\\"css-gb1zbv-euiScreenReaderOnly\\">Page level controls</h2><div class=\\"euiFlexGroup css-17fmf16-euiFlexGroup-wrap-none-flexStart-stretch-row\\"><div class=\\"euiFlexItem title css-9sbomz-euiFlexItem-grow-1\\"><div class=\\"euiFlexGroup css-dhjvmj-euiFlexGroup-s-flexStart-center-row\\"><div class=\\"euiFlexItem css-kpsrin-euiFlexItem-growZero\\" style=\\"flex-shrink: 0;\\"><a class=\\"euiLink css-1kmcgj6-euiLink-primary\\" href=\\"https://www.elastic.co\\" rel=\\"noreferrer\\" title=\\"Powered by Elastic.co\\"><span data-euiicon-type=\\"logoElastic\\"></span></a></div><div class=\\"euiFlexItem css-kpsrin-euiFlexItem-growZero\\" style=\\"min-width: 0; cursor: default;\\"><div class=\\"euiText css-1jf5aee-euiText-s-euiTextColor-ghost\\"><div class=\\"eui-textTruncate\\">My Canvas Workpad</div></div></div></div></div><div class=\\"euiFlexItem css-kpsrin-euiFlexItem-growZero\\"><div class=\\"euiFlexGroup css-165wgfw-euiFlexGroup-m-flexStart-stretch-row\\"><div class=\\"euiFlexGroup css-bjkil0-euiFlexGroup-none-flexStart-center-row\\"><div class=\\"euiFlexItem css-kpsrin-euiFlexItem-growZero\\"><button disabled=\\"\\" class=\\"euiButtonIcon css-2b6ttw-euiButtonIcon-xs-empty-disabled-isDisabled\\" type=\\"button\\" data-test-subj=\\"pageControlsPrevPage\\" aria-label=\\"Previous Page\\"><span data-euiicon-type=\\"arrowLeft\\" class=\\"euiButtonIcon__icon\\" aria-hidden=\\"true\\" color=\\"inherit\\"></span></button></div><div class=\\"euiFlexItem css-kpsrin-euiFlexItem-growZero\\"><button class=\\"euiButtonEmpty css-kfcnxw-euiButtonDisplay-euiButtonEmpty-s-empty-text\\" type=\\"button\\" data-test-subj=\\"pageControlsCurrentPage\\"><span class=\\"euiButtonEmpty__content css-cf8eum-euiButtonDisplayContent\\"><span class=\\"eui-textTruncate euiButtonEmpty__text\\"><div class=\\"euiText css-18n0kkh-euiText-s-euiTextColor-customColor\\">Page 1</div></span></span></button></div><div class=\\"euiFlexItem css-kpsrin-euiFlexItem-growZero\\"><button disabled=\\"\\" class=\\"euiButtonIcon css-2b6ttw-euiButtonIcon-xs-empty-disabled-isDisabled\\" type=\\"button\\" data-test-subj=\\"pageControlsNextPage\\" aria-label=\\"Next Page\\"><span data-euiicon-type=\\"arrowRight\\" class=\\"euiButtonIcon__icon\\" aria-hidden=\\"true\\" color=\\"inherit\\"></span></button></div></div><div class=\\"euiFlexGroup css-718pcz-euiFlexGroup-none-center-flexEnd-column\\"><div class=\\"euiFlexItem css-kpsrin-euiFlexItem-growZero\\"><div class=\\"euiPopover css-n7tnex-euiPopover-inline-block\\" id=\\"settings\\"><button class=\\"euiButtonIcon css-fexdhu-euiButtonIcon-xs-empty-text\\" type=\\"button\\" aria-label=\\"Settings\\"><span data-euiicon-type=\\"gear\\" class=\\"euiButtonIcon__icon\\" aria-hidden=\\"true\\" color=\\"inherit\\"></span></button></div></div></div></div></div></div></section><p aria-live=\\"assertive\\" class=\\"css-gb1zbv-euiScreenReaderOnly\\">There is a new region landmark with page level controls at the end of the document.</p></div></div></div>"`;
+exports[`<App /> App renders properly 1`] = `"<div class=\\"root\\" style=\\"height: 768px; width: 1080px;\\"><div class=\\"container\\" style=\\"height: 720px; width: 1080px;\\"><div class=\\"page\\" style=\\"height: 720px; transform: scale3d(1, 1, 1); width: 1080px;\\"><div id=\\"page-7186b301-f8a7-4c65-8b89-38d68d31cfc4\\" class=\\"root\\" style=\\"height: 720px; width: 1080px; background: rgb(119, 119, 119);\\"><div class=\\"canvasPositionable canvasInteractable\\" style=\\"width: 1082px; height: 205.37748344370857px; margin-left: -541px; margin-top: -102.68874172185429px; position: absolute; transform: matrix3d(1,0,0,0,0,1,0,0,0,0,1,0,540,367,1,1);\\"><div class=\\"root\\"><div css=\\"css-159kt7d\\" class=\\"container\\" style=\\"overflow: hidden;\\"><div class=\\"content\\"><div class=\\"renderContainer\\"><div data-renderer=\\"markdown\\" class=\\"render\\"><div>markdown mock</div></div></div></div></div></div></div></div></div></div><div class=\\"root\\" style=\\"height: 48px;\\"><div class=\\"root\\"><div class=\\"slideContainer\\"><div class=\\"root\\" style=\\"height: 100px; width: 150px;\\"><div class=\\"preview\\" style=\\"height: 720px; width: 1080px; transform: scale3d(0.1388888888888889, 0.1388888888888889, 1);\\"><div id=\\"page-7186b301-f8a7-4c65-8b89-38d68d31cfc4\\" class=\\"root\\" style=\\"height: 720px; width: 1080px; background: rgb(119, 119, 119);\\"><div class=\\"canvasPositionable canvasInteractable\\" style=\\"width: 1082px; height: 205.37748344370857px; margin-left: -541px; margin-top: -102.68874172185429px; position: absolute; transform: matrix3d(1,0,0,0,0,1,0,0,0,0,1,0,540,367,1,1);\\"><div class=\\"root\\"><div css=\\"css-159kt7d\\" class=\\"container\\" style=\\"overflow: hidden;\\"><div class=\\"content\\"><div class=\\"renderContainer\\"><div data-renderer=\\"markdown\\" class=\\"render\\"><div>markdown mock</div></div></div></div></div></div></div></div></div></div></div></div><div><section aria-label=\\"Page level controls\\" class=\\"euiBottomBar euiBottomBar--fixed css-1wujudg-euiBottomBar-fixed-m-euiColorMode-dark\\" style=\\"left: 0px; right: 0px; bottom: 0px;\\"><h2 class=\\"css-gb1zbv-euiScreenReaderOnly\\">Page level controls</h2><div class=\\"euiFlexGroup css-17fmf16-euiFlexGroup-wrap-none-flexStart-stretch-row\\"><div class=\\"euiFlexItem title css-9sbomz-euiFlexItem-grow-1\\"><div class=\\"euiFlexGroup css-dhjvmj-euiFlexGroup-s-flexStart-center-row\\"><div style=\\"flex-shrink: 0;\\" class=\\"euiFlexItem css-kpsrin-euiFlexItem-growZero\\"><a class=\\"euiLink css-1kmcgj6-euiLink-primary\\" href=\\"https://www.elastic.co\\" rel=\\"noreferrer\\" title=\\"Powered by Elastic.co\\"><span data-euiicon-type=\\"logoElastic\\"></span></a></div><div style=\\"min-width: 0; cursor: default;\\" class=\\"euiFlexItem css-kpsrin-euiFlexItem-growZero\\"><div class=\\"euiText css-1jf5aee-euiText-s-euiTextColor-ghost\\"><div class=\\"eui-textTruncate\\">My Canvas Workpad</div></div></div></div></div><div class=\\"euiFlexItem css-kpsrin-euiFlexItem-growZero\\"><div class=\\"euiFlexGroup css-165wgfw-euiFlexGroup-m-flexStart-stretch-row\\"><div class=\\"euiFlexGroup css-bjkil0-euiFlexGroup-none-flexStart-center-row\\"><div class=\\"euiFlexItem css-kpsrin-euiFlexItem-growZero\\"><button disabled=\\"\\" class=\\"euiButtonIcon css-2b6ttw-euiButtonIcon-xs-empty-disabled-isDisabled\\" type=\\"button\\" data-test-subj=\\"pageControlsPrevPage\\" aria-label=\\"Previous Page\\"><span data-euiicon-type=\\"arrowLeft\\" class=\\"euiButtonIcon__icon\\" aria-hidden=\\"true\\" color=\\"inherit\\"></span></button></div><div class=\\"euiFlexItem css-kpsrin-euiFlexItem-growZero\\"><button class=\\"euiButtonEmpty css-kfcnxw-euiButtonDisplay-euiButtonEmpty-s-empty-text\\" type=\\"button\\" data-test-subj=\\"pageControlsCurrentPage\\"><span class=\\"euiButtonEmpty__content css-cf8eum-euiButtonDisplayContent\\"><span class=\\"eui-textTruncate euiButtonEmpty__text\\"><div class=\\"euiText css-18n0kkh-euiText-s-euiTextColor-customColor\\">Page 1</div></span></span></button></div><div class=\\"euiFlexItem css-kpsrin-euiFlexItem-growZero\\"><button disabled=\\"\\" class=\\"euiButtonIcon css-2b6ttw-euiButtonIcon-xs-empty-disabled-isDisabled\\" type=\\"button\\" data-test-subj=\\"pageControlsNextPage\\" aria-label=\\"Next Page\\"><span data-euiicon-type=\\"arrowRight\\" class=\\"euiButtonIcon__icon\\" aria-hidden=\\"true\\" color=\\"inherit\\"></span></button></div></div><div class=\\"euiFlexGroup css-718pcz-euiFlexGroup-none-center-flexEnd-column\\"><div class=\\"euiFlexItem css-kpsrin-euiFlexItem-growZero\\"><div class=\\"euiPopover css-n7tnex-euiPopover-inline-block\\" id=\\"settings\\"><button class=\\"euiButtonIcon css-fexdhu-euiButtonIcon-xs-empty-text\\" type=\\"button\\" aria-label=\\"Settings\\"><span data-euiicon-type=\\"gear\\" class=\\"euiButtonIcon__icon\\" aria-hidden=\\"true\\" color=\\"inherit\\"></span></button></div></div></div></div></div></div></section><p aria-live=\\"assertive\\" class=\\"css-gb1zbv-euiScreenReaderOnly\\">There is a new region landmark with page level controls at the end of the document.</p></div></div></div>"`;
diff --git a/x-pack/plugins/cases/public/components/files/file_preview.test.tsx b/x-pack/plugins/cases/public/components/files/file_preview.test.tsx
index c1d7fe20bee483..8f24a9073c9bea 100644
--- a/x-pack/plugins/cases/public/components/files/file_preview.test.tsx
+++ b/x-pack/plugins/cases/public/components/files/file_preview.test.tsx
@@ -16,7 +16,8 @@ import { createAppMockRenderer, mockedTestProvidersOwner } from '../../common/mo
 import { basicFileMock } from '../../containers/mock';
 import { FilePreview } from './file_preview';
 
-describe('FilePreview', () => {
+// FLAKY: https://github.com/elastic/kibana/issues/182364
+describe.skip('FilePreview', () => {
   let appMockRender: AppMockRenderer;
 
   beforeEach(() => {
diff --git a/x-pack/plugins/cloud_integrations/cloud_experiments/common/metadata_service/metadata_service.test.ts b/x-pack/plugins/cloud_integrations/cloud_experiments/common/metadata_service/metadata_service.test.ts
index 7230bb716c091f..0c0f5f5127f0f7 100644
--- a/x-pack/plugins/cloud_integrations/cloud_experiments/common/metadata_service/metadata_service.test.ts
+++ b/x-pack/plugins/cloud_integrations/cloud_experiments/common/metadata_service/metadata_service.test.ts
@@ -9,6 +9,7 @@ import moment from 'moment';
 import { fakeSchedulers } from 'rxjs-marbles/jest';
 import { firstValueFrom } from 'rxjs';
 import { MetadataService } from './metadata_service';
+import { loggerMock, type MockedLogger } from '@kbn/logging-mocks';
 
 jest.mock('rxjs', () => {
   const RxJs = jest.requireActual('rxjs');
@@ -23,9 +24,14 @@ describe('MetadataService', () => {
   jest.useFakeTimers({ legacyFakeTimers: true });
 
   let metadataService: MetadataService;
+  let logger: MockedLogger;
 
   beforeEach(() => {
-    metadataService = new MetadataService({ metadata_refresh_interval: moment.duration(1, 's') });
+    logger = loggerMock.create();
+    metadataService = new MetadataService(
+      { metadata_refresh_interval: moment.duration(1, 's') },
+      logger
+    );
   });
 
   afterEach(() => {
@@ -93,5 +99,47 @@ describe('MetadataService', () => {
         });
       })
     );
+
+    test(
+      'handles errors in hasDataFetcher',
+      fakeSchedulers(async (advance) => {
+        let count = 0;
+        metadataService.start({
+          hasDataFetcher: async () => {
+            if (count++ > 0) {
+              return { hasData: true };
+            } else {
+              throw new Error('Something went wrong');
+            }
+          },
+        });
+
+        // Still equals initialMetadata
+        await expect(firstValueFrom(metadataService.userMetadata$)).resolves.toStrictEqual(
+          initialMetadata
+        );
+
+        // After scheduler kicks in...
+        advance(1); // The timer kicks in first on 0 (but let's give us 1ms so the trial is expired)
+        await new Promise((resolve) => process.nextTick(resolve)); // The timer triggers a promise, so we need to skip to the next tick
+
+        // Still equals initialMetadata
+        await expect(firstValueFrom(metadataService.userMetadata$)).resolves.toStrictEqual(
+          initialMetadata
+        );
+        expect(logger.warn).toHaveBeenCalledTimes(1);
+        expect(logger.warn.mock.calls[0][0]).toMatchInlineSnapshot(
+          `"Failed to update metadata because Error: Something went wrong"`
+        );
+
+        // After scheduler kicks in...
+        advance(1_001);
+        await new Promise((resolve) => process.nextTick(resolve)); // The timer triggers a promise, so we need to skip to the next tick
+        await expect(firstValueFrom(metadataService.userMetadata$)).resolves.toStrictEqual({
+          ...initialMetadata,
+          hasData: true,
+        });
+      })
+    );
   });
 });
diff --git a/x-pack/plugins/cloud_integrations/cloud_experiments/common/metadata_service/metadata_service.ts b/x-pack/plugins/cloud_integrations/cloud_experiments/common/metadata_service/metadata_service.ts
index dacdd7d3b47995..ddb2bc86d7dcab 100644
--- a/x-pack/plugins/cloud_integrations/cloud_experiments/common/metadata_service/metadata_service.ts
+++ b/x-pack/plugins/cloud_integrations/cloud_experiments/common/metadata_service/metadata_service.ts
@@ -19,6 +19,7 @@ import {
   timer,
 } from 'rxjs';
 import { type Duration } from 'moment';
+import type { Logger } from '@kbn/logging';
 
 export interface MetadataServiceStartContract {
   hasDataFetcher: () => Promise<{ hasData: boolean }>;
@@ -43,7 +44,7 @@ export class MetadataService {
   private readonly _userMetadata$ = new BehaviorSubject<UserMetadata | undefined>(undefined);
   private readonly stop$ = new Subject<void>();
 
-  constructor(private readonly config: MetadataServiceConfig) {}
+  constructor(private readonly config: MetadataServiceConfig, private readonly logger: Logger) {}
 
   public setup(initialUserMetadata: UserMetadata) {
     this._userMetadata$.next(initialUserMetadata);
@@ -99,10 +100,14 @@ export class MetadataService {
       .pipe(
         takeUntil(this.stop$),
         exhaustMap(async () => {
-          this._userMetadata$.next({
-            ...this._userMetadata$.value!, // We are running the schedules after the initial user metadata is set
-            ...(await fn()),
-          });
+          try {
+            this._userMetadata$.next({
+              ...this._userMetadata$.value!, // We are running the schedules after the initial user metadata is set
+              ...(await fn()),
+            });
+          } catch (err) {
+            this.logger.warn(`Failed to update metadata because ${err}`);
+          }
         }),
         takeWhile(() => {
           return !untilFn(this._userMetadata$.value!);
diff --git a/x-pack/plugins/cloud_integrations/cloud_experiments/public/plugin.ts b/x-pack/plugins/cloud_integrations/cloud_experiments/public/plugin.ts
index c4a76a0c388d3a..a201c98df1ea36 100755
--- a/x-pack/plugins/cloud_integrations/cloud_experiments/public/plugin.ts
+++ b/x-pack/plugins/cloud_integrations/cloud_experiments/public/plugin.ts
@@ -55,9 +55,10 @@ export class CloudExperimentsPlugin
       metadata_refresh_interval: string;
     }>();
 
-    this.metadataService = new MetadataService({
-      metadata_refresh_interval: duration(config.metadata_refresh_interval),
-    });
+    this.metadataService = new MetadataService(
+      { metadata_refresh_interval: duration(config.metadata_refresh_interval) },
+      this.logger.get('metadata')
+    );
 
     if (config.flag_overrides) {
       this.flagOverrides = config.flag_overrides;
diff --git a/x-pack/plugins/cloud_integrations/cloud_experiments/server/plugin.ts b/x-pack/plugins/cloud_integrations/cloud_experiments/server/plugin.ts
index 151cabd81c495a..834784a11f2c5f 100755
--- a/x-pack/plugins/cloud_integrations/cloud_experiments/server/plugin.ts
+++ b/x-pack/plugins/cloud_integrations/cloud_experiments/server/plugin.ts
@@ -50,9 +50,10 @@ export class CloudExperimentsPlugin
     this.logger = initializerContext.logger.get();
     const config = initializerContext.config.get<CloudExperimentsConfigType>();
 
-    this.metadataService = new MetadataService({
-      metadata_refresh_interval: config.metadata_refresh_interval,
-    });
+    this.metadataService = new MetadataService(
+      { metadata_refresh_interval: config.metadata_refresh_interval },
+      this.logger.get('metadata')
+    );
 
     if (config.flag_overrides) {
       this.flagOverrides = config.flag_overrides;
diff --git a/x-pack/plugins/cross_cluster_replication/public/shared_imports.ts b/x-pack/plugins/cross_cluster_replication/public/shared_imports.ts
index 6a6f968627a65c..f96a1d48047467 100644
--- a/x-pack/plugins/cross_cluster_replication/public/shared_imports.ts
+++ b/x-pack/plugins/cross_cluster_replication/public/shared_imports.ts
@@ -13,7 +13,7 @@ export {
   PageLoading,
 } from '@kbn/es-ui-shared-plugin/public';
 
-export { KibanaThemeProvider, useExecutionContext } from '@kbn/kibana-react-plugin/public';
+export { useExecutionContext } from '@kbn/kibana-react-plugin/public';
 
 export { KibanaRenderContextProvider } from '@kbn/react-kibana-context-render';
 
diff --git a/x-pack/plugins/data_visualizer/kibana.jsonc b/x-pack/plugins/data_visualizer/kibana.jsonc
index e3c6e8514dabdf..e80ccf5d3bb9c5 100644
--- a/x-pack/plugins/data_visualizer/kibana.jsonc
+++ b/x-pack/plugins/data_visualizer/kibana.jsonc
@@ -12,7 +12,6 @@
       "usageCollection",
       "embeddable",
       "share",
-      "discover",
       "fileUpload",
       "uiActions",
       "charts",
diff --git a/x-pack/plugins/data_visualizer/public/application/common/components/field_data_row/action_menu/actions.ts b/x-pack/plugins/data_visualizer/public/application/common/components/field_data_row/action_menu/actions.ts
index 74d16b6814bd77..1290b607dbc97e 100644
--- a/x-pack/plugins/data_visualizer/public/application/common/components/field_data_row/action_menu/actions.ts
+++ b/x-pack/plugins/data_visualizer/public/application/common/components/field_data_row/action_menu/actions.ts
@@ -9,8 +9,10 @@ import { i18n } from '@kbn/i18n';
 import type { Action } from '@elastic/eui/src/components/basic_table/action_types';
 import type { MutableRefObject } from 'react';
 import type { DataView } from '@kbn/data-views-plugin/public';
-import type { VisualizeFieldContext } from '@kbn/ui-actions-plugin/public';
-import { VISUALIZE_GEO_FIELD_TRIGGER } from '@kbn/ui-actions-plugin/public';
+import {
+  type VisualizeFieldContext,
+  VISUALIZE_GEO_FIELD_TRIGGER,
+} from '@kbn/ui-actions-plugin/public';
 import type { Refresh } from '@kbn/ml-date-picker';
 import { mlTimefilterRefresh$ } from '@kbn/ml-date-picker';
 import { getCompatibleLensDataType, getLensAttributes } from './lens_utils';
diff --git a/x-pack/plugins/data_visualizer/public/application/common/components/fields_stats_grid/fields_stats_grid.tsx b/x-pack/plugins/data_visualizer/public/application/common/components/fields_stats_grid/fields_stats_grid.tsx
index 7700b584f1beb9..08ccc91fce6fe3 100644
--- a/x-pack/plugins/data_visualizer/public/application/common/components/fields_stats_grid/fields_stats_grid.tsx
+++ b/x-pack/plugins/data_visualizer/public/application/common/components/fields_stats_grid/fields_stats_grid.tsx
@@ -47,10 +47,9 @@ function getItemIdToExpandedRowMap(
     return m;
   }, {} as ItemIdToExpandedRowMap);
 }
+const restorableDefaults = getDefaultDataVisualizerListState();
 
 export const FieldsStatsGrid: FC<Props> = ({ results }) => {
-  const restorableDefaults = getDefaultDataVisualizerListState();
-
   const [dataVisualizerListState, setDataVisualizerListState] =
     useState<DataVisualizerTableState>(restorableDefaults);
 
diff --git a/x-pack/plugins/data_visualizer/public/application/common/components/results_links/results_links.tsx b/x-pack/plugins/data_visualizer/public/application/common/components/results_links/results_links.tsx
index 1cb916007e3c5a..2f3dabec566c16 100644
--- a/x-pack/plugins/data_visualizer/public/application/common/components/results_links/results_links.tsx
+++ b/x-pack/plugins/data_visualizer/public/application/common/components/results_links/results_links.tsx
@@ -74,8 +74,8 @@ export const ResultsLinks: FC<Props> = ({
   const {
     services: {
       fileUpload,
+      share: { url },
       application: { getUrlForApp, capabilities },
-      discover,
     },
   } = useDataVisualizerKibana();
 
@@ -96,12 +96,14 @@ export const ResultsLinks: FC<Props> = ({
     const getDiscoverUrl = async (): Promise<void> => {
       const isDiscoverAvailable = capabilities.discover?.show ?? false;
       if (!isDiscoverAvailable) return;
-      if (!discover.locator) {
+      const discoverLocator = url?.locators.get('DISCOVER_APP_LOCATOR');
+
+      if (!discoverLocator) {
         // eslint-disable-next-line no-console
         console.error('Discover locator not available');
         return;
       }
-      const discoverUrl = await discover.locator.getUrl({
+      const discoverUrl = await discoverLocator.getUrl({
         indexPatternId: dataViewId,
         timeRange: globalState?.time ? globalState.time : undefined,
       });
@@ -155,7 +157,7 @@ export const ResultsLinks: FC<Props> = ({
       unmounted = true;
     };
     // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [dataViewId, discover, JSON.stringify(globalState)]);
+  }, [dataViewId, url, JSON.stringify(globalState)]);
 
   useEffect(() => {
     updateTimeValues();
diff --git a/x-pack/plugins/data_visualizer/public/application/common/components/stats_table/data_visualizer_stats_table.tsx b/x-pack/plugins/data_visualizer/public/application/common/components/stats_table/data_visualizer_stats_table.tsx
index 9f52a00a3b2be3..f597d9274e9b71 100644
--- a/x-pack/plugins/data_visualizer/public/application/common/components/stats_table/data_visualizer_stats_table.tsx
+++ b/x-pack/plugins/data_visualizer/public/application/common/components/stats_table/data_visualizer_stats_table.tsx
@@ -26,6 +26,7 @@ import { i18n } from '@kbn/i18n';
 import type { EuiTableComputedColumnType } from '@elastic/eui/src/components/basic_table/table_types';
 import { throttle } from 'lodash';
 import { css } from '@emotion/react';
+import useMountedState from 'react-use/lib/useMountedState';
 import { SUPPORTED_FIELD_TYPES } from '../../../../../common/constants';
 import type { SupportedFieldType, DataVisualizerTableState } from '../../../../../common/types';
 import { DocumentStat } from './components/field_data_row/document_stats';
@@ -102,13 +103,16 @@ export const DataVisualizerTable = <T extends DataVisualizerTableItem>({
     },
     [items]
   );
+  const isMounted = useMountedState();
 
   // eslint-disable-next-line react-hooks/exhaustive-deps
   const resizeHandler = useCallback(
     throttle((e: { width: number; height: number }) => {
       // When window or table is resized,
       // update the column widths and other settings accordingly
-      setDimensions(calculateTableColumnsDimensions(e.width));
+      if (isMounted()) {
+        setDimensions(calculateTableColumnsDimensions(e.width));
+      }
     }, 500),
     []
   );
@@ -466,7 +470,11 @@ export const DataVisualizerTable = <T extends DataVisualizerTableItem>({
   return (
     <EuiResizeObserver onResize={resizeHandler}>
       {(resizeRef) => (
-        <div data-test-subj="dataVisualizerTableContainer" ref={resizeRef}>
+        <div
+          data-test-subj="dataVisualizerTableContainer"
+          ref={resizeRef}
+          data-shared-item="" // TODO: Remove data-shared-item as part of https://github.com/elastic/kibana/issues/179376
+        >
           <EuiInMemoryTable<T>
             message={
               loading
diff --git a/x-pack/plugins/data_visualizer/public/application/common/components/top_values/top_values.tsx b/x-pack/plugins/data_visualizer/public/application/common/components/top_values/top_values.tsx
index cc574f048a0d77..ef056c4c12f14d 100644
--- a/x-pack/plugins/data_visualizer/public/application/common/components/top_values/top_values.tsx
+++ b/x-pack/plugins/data_visualizer/public/application/common/components/top_values/top_values.tsx
@@ -75,7 +75,7 @@ export const TopValues: FC<Props> = ({
   if (originalTopValues?.length === 0) return null;
   const totalDocuments = showSampledValues
     ? stats.topValuesSampleSize ?? 0
-    : Math.min(sampleCount ?? 0, stats.totalDocuments ?? 0);
+    : Math.min(sampleCount ?? Infinity, stats.totalDocuments ?? Infinity);
 
   const getMessage = () => {
     if (showSampledValues && stats.topValuesSampleSize !== undefined) {
diff --git a/x-pack/plugins/data_visualizer/public/application/common/types/data_visualizer_plugin.ts b/x-pack/plugins/data_visualizer/public/application/common/types/data_visualizer_plugin.ts
new file mode 100644
index 00000000000000..cb2c3d680e5b4b
--- /dev/null
+++ b/x-pack/plugins/data_visualizer/public/application/common/types/data_visualizer_plugin.ts
@@ -0,0 +1,47 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import type { AnalyticsServiceStart } from '@kbn/core/public';
+
+import type { ChartsPluginStart } from '@kbn/charts-plugin/public';
+import type { CloudStart } from '@kbn/cloud-plugin/public';
+import type { EmbeddableSetup, EmbeddableStart } from '@kbn/embeddable-plugin/public';
+import type { SharePluginSetup, SharePluginStart } from '@kbn/share-plugin/public';
+import type { DataPublicPluginStart } from '@kbn/data-plugin/public';
+import type { HomePublicPluginSetup } from '@kbn/home-plugin/public';
+import type { SavedSearchPublicPluginStart } from '@kbn/saved-search-plugin/public';
+import type { FileUploadPluginStart } from '@kbn/file-upload-plugin/public';
+import type { UnifiedSearchPublicPluginStart } from '@kbn/unified-search-plugin/public';
+import type { MapsStartApi } from '@kbn/maps-plugin/public';
+import type { SecurityPluginSetup } from '@kbn/security-plugin/public';
+import type { LensPublicStart } from '@kbn/lens-plugin/public';
+import type { IndexPatternFieldEditorStart } from '@kbn/data-view-field-editor-plugin/public';
+import type { FieldFormatsStart } from '@kbn/field-formats-plugin/public';
+import type { UiActionsSetup, UiActionsStart } from '@kbn/ui-actions-plugin/public';
+
+export interface DataVisualizerSetupDependencies {
+  home?: HomePublicPluginSetup;
+  embeddable: EmbeddableSetup;
+  share: SharePluginSetup;
+  uiActions?: UiActionsSetup;
+}
+export interface DataVisualizerStartDependencies {
+  analytics: AnalyticsServiceStart;
+  data: DataPublicPluginStart;
+  unifiedSearch: UnifiedSearchPublicPluginStart;
+  fileUpload: FileUploadPluginStart;
+  maps: MapsStartApi;
+  embeddable: EmbeddableStart;
+  security?: SecurityPluginSetup;
+  share: SharePluginStart;
+  lens?: LensPublicStart;
+  charts: ChartsPluginStart;
+  dataViewFieldEditor?: IndexPatternFieldEditorStart;
+  fieldFormats: FieldFormatsStart;
+  uiActions?: UiActionsStart;
+  cloud?: CloudStart;
+  savedSearch: SavedSearchPublicPluginStart;
+}
diff --git a/x-pack/plugins/data_visualizer/public/application/data_drift/data_drift_app_state.tsx b/x-pack/plugins/data_visualizer/public/application/data_drift/data_drift_app_state.tsx
index 64b89251fd50a3..a7d4af94a62c80 100644
--- a/x-pack/plugins/data_visualizer/public/application/data_drift/data_drift_app_state.tsx
+++ b/x-pack/plugins/data_visualizer/public/application/data_drift/data_drift_app_state.tsx
@@ -67,7 +67,6 @@ export const DataDriftDetectionAppState: FC<DataDriftDetectionAppStateProps> = (
     data,
     maps,
     embeddable,
-    discover,
     share,
     security,
     fileUpload,
@@ -82,7 +81,6 @@ export const DataDriftDetectionAppState: FC<DataDriftDetectionAppStateProps> = (
     data,
     maps,
     embeddable,
-    discover,
     share,
     security,
     fileUpload,
diff --git a/x-pack/plugins/data_visualizer/public/application/file_data_visualizer/file_data_visualizer.tsx b/x-pack/plugins/data_visualizer/public/application/file_data_visualizer/file_data_visualizer.tsx
index 86e85fb1cb87f7..13b3511fc7fc15 100644
--- a/x-pack/plugins/data_visualizer/public/application/file_data_visualizer/file_data_visualizer.tsx
+++ b/x-pack/plugins/data_visualizer/public/application/file_data_visualizer/file_data_visualizer.tsx
@@ -25,14 +25,13 @@ export type FileDataVisualizerSpec = typeof FileDataVisualizer;
 
 export const FileDataVisualizer: FC<Props> = ({ getAdditionalLinks, resultLinks }) => {
   const coreStart = getCoreStart();
-  const { data, maps, embeddable, discover, share, security, fileUpload, cloud, fieldFormats } =
+  const { data, maps, embeddable, share, security, fileUpload, cloud, fieldFormats } =
     getPluginsStart();
   const services = {
     ...coreStart,
     data,
     maps,
     embeddable,
-    discover,
     share,
     security,
     fileUpload,
diff --git a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/actions_panel/actions_panel.tsx b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/actions_panel/actions_panel.tsx
index e26ab29116f819..525ea4f5877ebd 100644
--- a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/actions_panel/actions_panel.tsx
+++ b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/actions_panel/actions_panel.tsx
@@ -46,7 +46,7 @@ export const ActionsPanel: FC<Props> = ({
     services: {
       data,
       application: { capabilities },
-      discover,
+      share: { url },
     },
   } = useDataVisualizerKibana();
 
@@ -58,12 +58,14 @@ export const ActionsPanel: FC<Props> = ({
     const getDiscoverUrl = async (): Promise<void> => {
       const isDiscoverAvailable = capabilities.discover?.show ?? false;
       if (!isDiscoverAvailable) return;
-      if (!discover.locator) {
+      const discoverLocator = url?.locators.get('DISCOVER_APP_LOCATOR');
+
+      if (!discoverLocator) {
         // eslint-disable-next-line no-console
         console.error('Discover locator not available');
         return;
       }
-      const discoverUrl = await discover.locator.getUrl({
+      const discoverUrl = await discoverLocator.getUrl({
         indexPatternId: dataViewId,
         filters: data.query.filterManager.getFilters() ?? [],
         query:
@@ -113,7 +115,7 @@ export const ActionsPanel: FC<Props> = ({
     searchQueryLanguage,
     globalState,
     capabilities,
-    discover,
+    url,
     data.query,
     getAdditionalLinks,
   ]);
diff --git a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/index_data_visualizer_view/index_data_visualizer_esql.tsx b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/index_data_visualizer_view/index_data_visualizer_esql.tsx
index a40c8d04efda91..899c27d8f5d5f7 100644
--- a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/index_data_visualizer_view/index_data_visualizer_esql.tsx
+++ b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/index_data_visualizer_view/index_data_visualizer_esql.tsx
@@ -42,7 +42,7 @@ import {
   useESQLDataVisualizerData,
 } from '../../hooks/esql/use_data_visualizer_esql_data';
 import type {
-  DataVisualizerGridInput,
+  ESQLDataVisualizerGridEmbeddableState,
   ESQLDataVisualizerIndexBasedPageUrlState,
   ESQLDefaultLimitSizeOption,
 } from '../../embeddables/grid_embeddable/types';
@@ -136,7 +136,7 @@ export const IndexDataVisualizerESQL: FC<IndexDataVisualizerESQLProps> = (dataVi
     [indexPattern, data.dataViews, currentDataView]
   );
 
-  const input: DataVisualizerGridInput<ESQLQuery> = useMemo(() => {
+  const input: ESQLDataVisualizerGridEmbeddableState = useMemo(() => {
     return {
       dataView: currentDataView,
       query,
@@ -146,6 +146,7 @@ export const IndexDataVisualizerESQL: FC<IndexDataVisualizerESQLProps> = (dataVi
       allowEditDataView: true,
       id: 'esql_data_visualizer',
       indexPattern,
+      esql: true,
     };
   }, [currentDataView, query?.esql]);
 
diff --git a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/index_data_visualizer_view/index_data_visualizer_view.tsx b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/index_data_visualizer_view/index_data_visualizer_view.tsx
index 7afb626b13b92f..c6e66b4e291a03 100644
--- a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/index_data_visualizer_view/index_data_visualizer_view.tsx
+++ b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/index_data_visualizer_view/index_data_visualizer_view.tsx
@@ -73,7 +73,7 @@ import {
   RANDOM_SAMPLER_OPTION,
   type RandomSamplerOption,
 } from '../../constants/random_sampler';
-import type { DataVisualizerGridInput } from '../../embeddables/grid_embeddable/types';
+import type { FieldStatisticsTableEmbeddableState } from '../../embeddables/grid_embeddable/types';
 
 const defaultSearchQuery = {
   match_all: {},
@@ -217,7 +217,7 @@ export const IndexDataVisualizerView: FC<IndexDataVisualizerViewProps> = (dataVi
     });
   };
 
-  const input: Required<DataVisualizerGridInput, 'dataView'> = useMemo(() => {
+  const input: Required<FieldStatisticsTableEmbeddableState, 'dataView'> = useMemo(() => {
     return {
       dataView: currentDataView,
       savedSearch: currentSavedSearch,
diff --git a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/embeddables/grid_embeddable/embeddable_esql_field_stats_table.tsx b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/embeddables/grid_embeddable/embeddable_esql_field_stats_table.tsx
index 8b8e245f8fcfb2..e5f6c5f3c1835d 100644
--- a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/embeddables/grid_embeddable/embeddable_esql_field_stats_table.tsx
+++ b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/embeddables/grid_embeddable/embeddable_esql_field_stats_table.tsx
@@ -5,7 +5,6 @@
  * 2.0.
  */
 import React, { useCallback, useEffect, useState } from 'react';
-import type { EmbeddableInput } from '@kbn/embeddable-plugin/public';
 import type { FieldVisConfig } from '../../../../../common/types/field_vis_config';
 import type { DataVisualizerTableState } from '../../../../../common/types';
 import { DataVisualizerTable } from '../../../common/components/stats_table';
@@ -15,31 +14,26 @@ import {
   useESQLDataVisualizerData,
 } from '../../hooks/esql/use_data_visualizer_esql_data';
 import type {
-  ESQLDataVisualizerGridEmbeddableInput,
+  ESQLDataVisualizerGridEmbeddableState,
   ESQLDataVisualizerIndexBasedAppState,
 } from './types';
 import { EmbeddableNoResultsEmptyPrompt } from './embeddable_field_stats_no_results';
 
 const restorableDefaults = getDefaultESQLDataVisualizerListState();
 
-export const EmbeddableESQLFieldStatsTableWrapper = ({
-  input,
-  onOutputChange,
-}: {
-  input: EmbeddableInput & ESQLDataVisualizerGridEmbeddableInput;
-  onOutputChange?: (ouput: any) => void;
-}) => {
+const EmbeddableESQLFieldStatsTableWrapper = (props: ESQLDataVisualizerGridEmbeddableState) => {
+  const { onTableUpdate, ...state } = props;
   const [dataVisualizerListState, setDataVisualizerListState] =
     useState<Required<ESQLDataVisualizerIndexBasedAppState>>(restorableDefaults);
 
   const onTableChange = useCallback(
     (update: DataVisualizerTableState) => {
       setDataVisualizerListState({ ...dataVisualizerListState, ...update });
-      if (onOutputChange) {
-        onOutputChange(update);
+      if (onTableUpdate) {
+        onTableUpdate(update);
       }
     },
-    [dataVisualizerListState, onOutputChange]
+    [dataVisualizerListState, onTableUpdate]
   );
 
   const {
@@ -49,11 +43,11 @@ export const EmbeddableESQLFieldStatsTableWrapper = ({
     overallStatsProgress,
     setLastRefresh,
     getItemIdToExpandedRowMap,
-  } = useESQLDataVisualizerData(input, dataVisualizerListState);
+  } = useESQLDataVisualizerData(state, dataVisualizerListState);
 
   useEffect(() => {
     setLastRefresh(Date.now());
-  }, [input?.lastReloadRequestTime, setLastRefresh]);
+  }, [state?.lastReloadRequestTime, setLastRefresh]);
 
   if (progress === 100 && configs.length === 0) {
     return <EmbeddableNoResultsEmptyPrompt />;
@@ -65,10 +59,13 @@ export const EmbeddableESQLFieldStatsTableWrapper = ({
       updatePageState={onTableChange}
       getItemIdToExpandedRowMap={getItemIdToExpandedRowMap}
       extendedColumns={extendedColumns}
-      showPreviewByDefault={input?.showPreviewByDefault}
-      onChange={onOutputChange}
+      showPreviewByDefault={state?.showPreviewByDefault}
+      onChange={onTableUpdate}
       loading={progress < 100}
       overallStatsRunning={overallStatsProgress.isRunning}
     />
   );
 };
+// exporting as default so it be lazy-loaded
+// eslint-disable-next-line import/no-default-export
+export default EmbeddableESQLFieldStatsTableWrapper;
diff --git a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/embeddables/grid_embeddable/embeddable_field_stats_table.tsx b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/embeddables/grid_embeddable/embeddable_field_stats_table.tsx
index dcc3a80e28df3d..6974de820c4e63 100644
--- a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/embeddables/grid_embeddable/embeddable_field_stats_table.tsx
+++ b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/embeddables/grid_embeddable/embeddable_field_stats_table.tsx
@@ -7,7 +7,7 @@
 
 import React, { useCallback, useEffect, useState } from 'react';
 import type { Required } from 'utility-types';
-import type { DataVisualizerGridEmbeddableInput } from './types';
+import type { FieldStatisticTableEmbeddableProps } from './types';
 import type { ItemIdToExpandedRowMap } from '../../../common/components/stats_table';
 import { DataVisualizerTable } from '../../../common/components/stats_table';
 import type { FieldVisConfig } from '../../../common/components/stats_table/types';
@@ -20,24 +20,22 @@ import { EmbeddableNoResultsEmptyPrompt } from './embeddable_field_stats_no_resu
 
 const restorableDefaults = getDefaultDataVisualizerListState();
 
-export const EmbeddableFieldStatsTableWrapper = ({
-  input,
-  onOutputChange,
-}: {
-  input: Required<DataVisualizerGridEmbeddableInput, 'dataView'>;
-  onOutputChange?: (ouput: any) => void;
-}) => {
+const EmbeddableFieldStatsTableWrapper = (
+  props: Required<FieldStatisticTableEmbeddableProps, 'dataView'>
+) => {
+  const { onTableUpdate, onAddFilter, ...state } = props;
+
   const [dataVisualizerListState, setDataVisualizerListState] =
     useState<Required<DataVisualizerIndexBasedAppState>>(restorableDefaults);
 
   const onTableChange = useCallback(
     (update: DataVisualizerTableState) => {
       setDataVisualizerListState({ ...dataVisualizerListState, ...update });
-      if (onOutputChange) {
-        onOutputChange(update);
+      if (onTableUpdate) {
+        onTableUpdate(update);
       }
     },
-    [dataVisualizerListState, onOutputChange]
+    [dataVisualizerListState, onTableUpdate]
   );
 
   const {
@@ -48,11 +46,11 @@ export const EmbeddableFieldStatsTableWrapper = ({
     progress,
     overallStatsProgress,
     setLastRefresh,
-  } = useDataVisualizerGridData(input, dataVisualizerListState);
+  } = useDataVisualizerGridData(state, dataVisualizerListState);
 
   useEffect(() => {
     setLastRefresh(Date.now());
-  }, [input?.lastReloadRequestTime, setLastRefresh]);
+  }, [state?.lastReloadRequestTime, setLastRefresh]);
 
   const getItemIdToExpandedRowMap = useCallback(
     function (itemIds: string[], items: FieldVisConfig[]): ItemIdToExpandedRowMap {
@@ -62,17 +60,17 @@ export const EmbeddableFieldStatsTableWrapper = ({
           m[fieldName] = (
             <IndexBasedDataVisualizerExpandedRow
               item={item}
-              dataView={input.dataView}
+              dataView={state.dataView}
               combinedQuery={{ searchQueryLanguage, searchString }}
-              onAddFilter={input.onAddFilter}
-              totalDocuments={input.totalDocuments}
+              onAddFilter={onAddFilter}
+              totalDocuments={state.totalDocuments}
             />
           );
         }
         return m;
       }, {} as ItemIdToExpandedRowMap);
     },
-    [input, searchQueryLanguage, searchString]
+    [state.dataView, searchQueryLanguage, searchString, state.totalDocuments, onAddFilter]
   );
 
   if (progress === 100 && configs.length === 0) {
@@ -85,10 +83,14 @@ export const EmbeddableFieldStatsTableWrapper = ({
       updatePageState={onTableChange}
       getItemIdToExpandedRowMap={getItemIdToExpandedRowMap}
       extendedColumns={extendedColumns}
-      showPreviewByDefault={input?.showPreviewByDefault}
-      onChange={onOutputChange}
+      showPreviewByDefault={state?.showPreviewByDefault}
+      onChange={onTableUpdate}
       loading={progress < 100}
       overallStatsRunning={overallStatsProgress.isRunning}
     />
   );
 };
+
+// exporting as default so it be lazy-loaded
+// eslint-disable-next-line import/no-default-export
+export default EmbeddableFieldStatsTableWrapper;
diff --git a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/embeddables/grid_embeddable/field_stats_embeddable_wrapper.tsx b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/embeddables/grid_embeddable/field_stats_embeddable_wrapper.tsx
new file mode 100644
index 00000000000000..c07e748ce2151e
--- /dev/null
+++ b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/embeddables/grid_embeddable/field_stats_embeddable_wrapper.tsx
@@ -0,0 +1,125 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import React from 'react';
+import { EuiEmptyPrompt } from '@elastic/eui';
+import type { Required } from 'utility-types';
+import { FormattedMessage } from '@kbn/i18n-react';
+import { isPopulatedObject } from '@kbn/ml-is-populated-object';
+import { dynamic } from '@kbn/shared-ux-utility';
+import { KibanaRenderContextProvider } from '@kbn/react-kibana-context-render';
+import { KibanaContextProvider } from '@kbn/kibana-react-plugin/public';
+import { DatePickerContextProvider } from '@kbn/ml-date-picker';
+import type { DatePickerDependencies } from '@kbn/ml-date-picker';
+import { UI_SETTINGS } from '@kbn/data-plugin/common';
+import { pick } from 'lodash';
+import { getCoreStart, getPluginsStart } from '../../../../kibana_services';
+import type {
+  FieldStatisticTableEmbeddableProps,
+  ESQLDataVisualizerGridEmbeddableState,
+} from './types';
+
+const EmbeddableESQLFieldStatsTableWrapper = dynamic(
+  () => import('./embeddable_esql_field_stats_table')
+);
+const EmbeddableFieldStatsTableWrapper = dynamic(() => import('./embeddable_field_stats_table'));
+
+function isESQLFieldStatisticTableEmbeddableState(
+  input: unknown
+): input is ESQLDataVisualizerGridEmbeddableState {
+  return isPopulatedObject(input, ['esql']) && input.esql === true;
+}
+
+function isFieldStatisticTableEmbeddableState(
+  input: unknown
+): input is Required<FieldStatisticTableEmbeddableProps, 'dataView'> {
+  return (
+    isPopulatedObject(input, ['dataView']) &&
+    (!isPopulatedObject(input, ['esql']) || input.esql === false)
+  );
+}
+
+const FieldStatisticsWrapperContent = (props: FieldStatisticTableEmbeddableProps) => {
+  if (isESQLFieldStatisticTableEmbeddableState(props)) {
+    return <EmbeddableESQLFieldStatsTableWrapper {...props} />;
+  }
+  if (isFieldStatisticTableEmbeddableState(props)) {
+    return <EmbeddableFieldStatsTableWrapper {...props} />;
+  } else {
+    return (
+      <EuiEmptyPrompt
+        iconType="warning"
+        iconColor="danger"
+        title={
+          <h2>
+            <FormattedMessage
+              id="xpack.dataVisualizer.index.embeddableErrorTitle"
+              defaultMessage="Error loading embeddable"
+            />
+          </h2>
+        }
+        body={
+          <p>
+            <FormattedMessage
+              id="xpack.dataVisualizer.index.embeddableErrorDescription"
+              defaultMessage="There was an error loading the embeddable. Please check if all the required input is valid."
+            />
+          </p>
+        }
+      />
+    );
+  }
+};
+
+const FieldStatisticsWrapper = (props: FieldStatisticTableEmbeddableProps) => {
+  const coreStart = getCoreStart();
+  const {
+    data,
+    maps,
+    embeddable,
+    share,
+    security,
+    fileUpload,
+    lens,
+    dataViewFieldEditor,
+    uiActions,
+    charts,
+    unifiedSearch,
+  } = getPluginsStart();
+  const services = {
+    ...coreStart,
+    data,
+    maps,
+    embeddable,
+    share,
+    security,
+    fileUpload,
+    lens,
+    dataViewFieldEditor,
+    uiActions,
+    charts,
+    unifiedSearch,
+  };
+
+  const kibanaRenderServices = pick(coreStart, 'analytics', 'i18n', 'theme');
+  const datePickerDeps: DatePickerDependencies = {
+    ...pick(services, ['data', 'http', 'notifications', 'theme', 'uiSettings', 'i18n']),
+    uiSettingsKeys: UI_SETTINGS,
+  };
+
+  return (
+    <KibanaRenderContextProvider {...kibanaRenderServices}>
+      <KibanaContextProvider services={services}>
+        <DatePickerContextProvider {...datePickerDeps}>
+          <FieldStatisticsWrapperContent {...props} />
+        </DatePickerContextProvider>
+      </KibanaContextProvider>
+    </KibanaRenderContextProvider>
+  );
+};
+// exporting as default so it can be used with React.lazy
+// eslint-disable-next-line import/no-default-export
+export default FieldStatisticsWrapper;
diff --git a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/embeddables/grid_embeddable/grid_embeddable.tsx b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/embeddables/grid_embeddable/grid_embeddable.tsx
deleted file mode 100644
index 1b0fcb2d688d21..00000000000000
--- a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/embeddables/grid_embeddable/grid_embeddable.tsx
+++ /dev/null
@@ -1,151 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { pick } from 'lodash';
-import type { Observable } from 'rxjs';
-import { Subject } from 'rxjs';
-import type { CoreStart } from '@kbn/core/public';
-import ReactDOM from 'react-dom';
-import React, { Suspense } from 'react';
-import useObservable from 'react-use/lib/useObservable';
-import { EuiEmptyPrompt } from '@elastic/eui';
-import type { Required } from 'utility-types';
-import { FormattedMessage } from '@kbn/i18n-react';
-import type { IContainer } from '@kbn/embeddable-plugin/public';
-import { Embeddable } from '@kbn/embeddable-plugin/public';
-import { UI_SETTINGS } from '@kbn/data-plugin/common';
-import { KibanaContextProvider } from '@kbn/kibana-react-plugin/public';
-import { KibanaRenderContextProvider } from '@kbn/react-kibana-context-render';
-import { DatePickerContextProvider } from '@kbn/ml-date-picker';
-import { isPopulatedObject } from '@kbn/ml-is-populated-object';
-import type { DataVisualizerStartDependencies } from '../../../../plugin';
-import { DATA_VISUALIZER_GRID_EMBEDDABLE_TYPE } from './constants';
-import { EmbeddableLoading } from './embeddable_loading_fallback';
-import { EmbeddableESQLFieldStatsTableWrapper } from './embeddable_esql_field_stats_table';
-import { EmbeddableFieldStatsTableWrapper } from './embeddable_field_stats_table';
-import type {
-  DataVisualizerGridEmbeddableInput,
-  ESQLDataVisualizerGridEmbeddableInput,
-  DataVisualizerGridEmbeddableOutput,
-} from './types';
-
-export type DataVisualizerGridEmbeddableServices = [CoreStart, DataVisualizerStartDependencies];
-export type IDataVisualizerGridEmbeddable = typeof DataVisualizerGridEmbeddable;
-
-function isESQLDataVisualizerEmbeddableInput(
-  input: unknown
-): input is ESQLDataVisualizerGridEmbeddableInput {
-  return isPopulatedObject(input, ['esql']) && input.esql === true;
-}
-
-function isDataVisualizerEmbeddableInput(
-  input: unknown
-): input is Required<DataVisualizerGridEmbeddableInput, 'dataView'> {
-  return isPopulatedObject(input, ['dataView']);
-}
-
-export const IndexDataVisualizerViewWrapper = (props: {
-  id: string;
-  embeddableContext: InstanceType<IDataVisualizerGridEmbeddable>;
-  embeddableInput: Readonly<Observable<DataVisualizerGridEmbeddableInput>>;
-  onOutputChange?: (output: any) => void;
-}) => {
-  const { embeddableInput, onOutputChange } = props;
-
-  const input = useObservable(embeddableInput);
-
-  if (isESQLDataVisualizerEmbeddableInput(input)) {
-    return <EmbeddableESQLFieldStatsTableWrapper input={input} onOutputChange={onOutputChange} />;
-  }
-  if (isDataVisualizerEmbeddableInput(input)) {
-    return <EmbeddableFieldStatsTableWrapper input={input} onOutputChange={onOutputChange} />;
-  } else {
-    return (
-      <EuiEmptyPrompt
-        iconType="warning"
-        iconColor="danger"
-        title={
-          <h2>
-            <FormattedMessage
-              id="xpack.dataVisualizer.index.embeddableErrorTitle"
-              defaultMessage="Error loading embeddable"
-            />
-          </h2>
-        }
-        body={
-          <p>
-            <FormattedMessage
-              id="xpack.dataVisualizer.index.embeddableErrorDescription"
-              defaultMessage="There was an error loading the embeddable. Please check if all the required input is valid."
-            />
-          </p>
-        }
-      />
-    );
-  }
-};
-export class DataVisualizerGridEmbeddable extends Embeddable<
-  DataVisualizerGridEmbeddableInput,
-  DataVisualizerGridEmbeddableOutput
-> {
-  private node?: HTMLElement;
-  private reload$ = new Subject<void>();
-  public readonly type: string = DATA_VISUALIZER_GRID_EMBEDDABLE_TYPE;
-
-  constructor(
-    initialInput: DataVisualizerGridEmbeddableInput,
-    public services: DataVisualizerGridEmbeddableServices,
-    parent?: IContainer
-  ) {
-    super(initialInput, {}, parent);
-  }
-
-  public render(node: HTMLElement) {
-    super.render(node);
-    this.node = node;
-
-    const services = { ...this.services[0], ...this.services[1] };
-    const startServices = pick(this.services[0], 'analytics', 'i18n', 'theme');
-    const datePickerDeps = {
-      ...pick(services, ['data', 'http', 'notifications', 'theme', 'uiSettings', 'i18n']),
-      uiSettingsKeys: UI_SETTINGS,
-    };
-
-    ReactDOM.render(
-      <KibanaRenderContextProvider {...startServices}>
-        <KibanaContextProvider services={services}>
-          <DatePickerContextProvider {...datePickerDeps}>
-            <Suspense fallback={<EmbeddableLoading />}>
-              <IndexDataVisualizerViewWrapper
-                id={this.input.id}
-                embeddableContext={this}
-                embeddableInput={this.getInput$()}
-                onOutputChange={(output) => this.updateOutput(output)}
-              />
-            </Suspense>
-          </DatePickerContextProvider>
-        </KibanaContextProvider>
-      </KibanaRenderContextProvider>,
-      node
-    );
-  }
-
-  public destroy() {
-    super.destroy();
-    if (this.node) {
-      ReactDOM.unmountComponentAtNode(this.node);
-    }
-  }
-
-  public reload() {
-    this.reload$.next();
-  }
-
-  public supportedTriggers() {
-    return [];
-  }
-}
diff --git a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/embeddables/grid_embeddable/grid_embeddable_factory.tsx b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/embeddables/grid_embeddable/grid_embeddable_factory.tsx
deleted file mode 100644
index e1741ca675ef58..00000000000000
--- a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/embeddables/grid_embeddable/grid_embeddable_factory.tsx
+++ /dev/null
@@ -1,68 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { i18n } from '@kbn/i18n';
-import type { StartServicesAccessor } from '@kbn/core/public';
-import type { EmbeddableFactoryDefinition, IContainer } from '@kbn/embeddable-plugin/public';
-import { DATA_VISUALIZER_GRID_EMBEDDABLE_TYPE } from './constants';
-import type { DataVisualizerGridEmbeddableServices } from './grid_embeddable';
-import type {
-  DataVisualizerPluginStart,
-  DataVisualizerStartDependencies,
-} from '../../../../plugin';
-import type { DataVisualizerGridEmbeddableInput } from './types';
-
-export class DataVisualizerGridEmbeddableFactory
-  implements EmbeddableFactoryDefinition<DataVisualizerGridEmbeddableInput>
-{
-  public readonly type = DATA_VISUALIZER_GRID_EMBEDDABLE_TYPE;
-
-  public readonly grouping = [
-    {
-      id: 'data_visualizer_grid',
-      getDisplayName: () => 'Data Visualizer Grid',
-    },
-  ];
-
-  constructor(
-    private getStartServices: StartServicesAccessor<
-      DataVisualizerStartDependencies,
-      DataVisualizerPluginStart
-    >
-  ) {}
-
-  public async isEditable() {
-    return false;
-  }
-
-  public canCreateNew() {
-    return false;
-  }
-
-  public getDisplayName() {
-    return i18n.translate('xpack.dataVisualizer.index.components.grid.displayName', {
-      defaultMessage: 'Data visualizer grid',
-    });
-  }
-
-  public getDescription() {
-    return i18n.translate('xpack.dataVisualizer.index.components.grid.description', {
-      defaultMessage: 'Visualize data',
-    });
-  }
-
-  private async getServices(): Promise<DataVisualizerGridEmbeddableServices> {
-    const [coreStart, pluginsStart] = await this.getStartServices();
-    return [coreStart, pluginsStart];
-  }
-
-  public async create(initialInput: DataVisualizerGridEmbeddableInput, parent?: IContainer) {
-    const [coreStart, pluginsStart] = await this.getServices();
-    const { DataVisualizerGridEmbeddable } = await import('./grid_embeddable');
-    return new DataVisualizerGridEmbeddable(initialInput, [coreStart, pluginsStart], parent);
-  }
-}
diff --git a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/embeddables/grid_embeddable/index.ts b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/embeddables/grid_embeddable/index.ts
deleted file mode 100644
index 91ca8e1633eb90..00000000000000
--- a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/embeddables/grid_embeddable/index.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-export { DataVisualizerGridEmbeddable } from './grid_embeddable';
-export { DataVisualizerGridEmbeddableFactory } from './grid_embeddable_factory';
diff --git a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/embeddables/grid_embeddable/types.ts b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/embeddables/grid_embeddable/types.ts
index 8fa168e2e3984a..10fffb106ad652 100644
--- a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/embeddables/grid_embeddable/types.ts
+++ b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/embeddables/grid_embeddable/types.ts
@@ -5,32 +5,76 @@
  * 2.0.
  */
 
-import type { Filter } from '@kbn/es-query';
-import type { EmbeddableInput, EmbeddableOutput } from '@kbn/embeddable-plugin/public';
+import type { AggregateQuery, Filter } from '@kbn/es-query';
 import type { Query } from '@kbn/es-query';
 import type { DataView, DataViewField } from '@kbn/data-views-plugin/public';
 import type { SavedSearch } from '@kbn/saved-search-plugin/public';
+import type { BehaviorSubject } from 'rxjs';
+import type { DefaultEmbeddableApi } from '@kbn/embeddable-plugin/public';
+import type { SerializedTitles } from '@kbn/presentation-publishing';
+import type { DataVisualizerTableState } from '../../../../../common/types';
 import type { SamplingOption } from '../../../../../common/types/field_stats';
 import type { DATA_VISUALIZER_INDEX_VIEWER } from '../../constants/index_data_visualizer_viewer';
 import type { DataVisualizerIndexBasedAppState } from '../../types/index_data_visualizer_state';
+import type { DataVisualizerStartDependencies } from '../../../common/types/data_visualizer_plugin';
 import type { ESQLQuery } from '../../search_strategy/requests/esql_utils';
 
-export interface DataVisualizerGridInput<T = Query> {
+export interface FieldStatisticTableEmbeddableProps {
+  /**
+   * Data view is required for esql:false or non-ESQL mode
+   */
   dataView?: DataView;
+  /**
+   * Kibana saved search object
+   */
   savedSearch?: SavedSearch | null;
-  query?: T;
+  /**
+   * Kibana query
+   */
+  query?: Query | AggregateQuery;
+  /**
+   * List of fields to visibile show in the table
+   * set shouldGetSubfields: true if table needs to show the sub multi-field like .keyword
+   */
   visibleFieldNames?: string[];
+  /**
+   * List of filters
+   */
   filters?: Filter[];
+  /**
+   * Whether to show the preview/mini distribution chart on the tables upon first table mounting
+   */
   showPreviewByDefault?: boolean;
+  /**
+   * If true, will show a button action to edit the data view field in every row
+   */
   allowEditDataView?: boolean;
+  /**
+   * Optional id to identify the embeddable
+   */
   id?: string;
   /**
    * Callback to add a filter to filter bar
    */
   onAddFilter?: (field: DataViewField | string, value: string, type: '+' | '-') => void;
+  /**
+   * Optional search sessionId to save and restore long running search
+   * If not provided, will generate its own sessionId
+   */
   sessionId?: string;
+  /**
+   * Optional list of fields provided to table to fetch a subset of fields only
+   * so it doesn't need to fetch all fields
+   */
   fieldsToFetch?: string[];
+  /**
+   * Optional total documents count provided to help table have context of the fetch size
+   * so it can reduce redundant API requests
+   */
   totalDocuments?: number;
+  /**
+   * For non-ESQL mode, the sampling option is used to determine the sampling strategy
+   */
   samplingOption?: SamplingOption;
   /**
    * If esql:true, switch table to ES|QL mode
@@ -40,17 +84,46 @@ export interface DataVisualizerGridInput<T = Query> {
    * If esql:true, the index pattern is used to validate time field
    */
   indexPattern?: string;
+  /**
+   * If true, the table will try to retrieve subfield information as well based on visibleFields
+   * For example: visibleFields: ['field1', 'field2'] => will show ['field1', 'field1.keyword', 'field2', 'field2.keyword']
+   */
+  shouldGetSubfields?: boolean;
+  lastReloadRequestTime?: number;
+  onTableUpdate?: (update: Partial<DataVisualizerTableState>) => void;
+}
+
+export type ESQLDataVisualizerGridEmbeddableState = Omit<
+  FieldStatisticTableEmbeddableProps,
+  'query'
+> & { query?: ESQLQuery };
+
+export type FieldStatisticsTableEmbeddableState = FieldStatisticTableEmbeddableProps &
+  SerializedTitles;
+interface FieldStatisticsTableEmbeddableComponentApi {
+  showDistributions$?: BehaviorSubject<boolean>;
+}
+
+export type OnAddFilter = (field: DataViewField | string, value: string, type: '+' | '-') => void;
+export interface FieldStatisticsTableEmbeddableParentApi {
+  executionContext?: { value: string };
+  embeddableState$: BehaviorSubject<FieldStatisticsTableEmbeddableState>;
+  overrideServices?: Partial<DataVisualizerStartDependencies>;
+  onAddFilter?: OnAddFilter;
 }
 
-export type ESQLDataVisualizerGridEmbeddableInput = DataVisualizerGridInput<ESQLQuery>;
+export type FieldStatisticsTableEmbeddableApi =
+  DefaultEmbeddableApi<FieldStatisticsTableEmbeddableState> &
+    FieldStatisticsTableEmbeddableComponentApi;
 
-export type DataVisualizerGridEmbeddableInput = EmbeddableInput & DataVisualizerGridInput;
-export type DataVisualizerGridEmbeddableOutput = EmbeddableOutput;
+export type DataVisualizerGridEmbeddableApi = Partial<FieldStatisticsTableEmbeddableState>;
 
 export type ESQLDefaultLimitSizeOption = '5000' | '10000' | '100000';
 
-export interface ESQLDataVisualizerIndexBasedAppState extends DataVisualizerIndexBasedAppState {
+export interface ESQLDataVisualizerIndexBasedAppState
+  extends Omit<DataVisualizerIndexBasedAppState, 'query'> {
   limitSize: ESQLDefaultLimitSizeOption;
+  query?: ESQLQuery;
 }
 
 export interface ESQLDataVisualizerIndexBasedPageUrlState {
diff --git a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/embeddables/index.ts b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/embeddables/index.ts
deleted file mode 100644
index a6e98061e45fca..00000000000000
--- a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/embeddables/index.ts
+++ /dev/null
@@ -1,24 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import type { CoreSetup } from '@kbn/core/public';
-import type { EmbeddableSetup } from '@kbn/embeddable-plugin/public';
-import { DataVisualizerGridEmbeddableFactory } from './grid_embeddable/grid_embeddable_factory';
-import type { DataVisualizerPluginStart, DataVisualizerStartDependencies } from '../../../plugin';
-
-export function registerEmbeddables(
-  embeddable: EmbeddableSetup,
-  core: CoreSetup<DataVisualizerStartDependencies, DataVisualizerPluginStart>
-) {
-  const dataVisualizerGridEmbeddableFactory = new DataVisualizerGridEmbeddableFactory(
-    core.getStartServices
-  );
-  embeddable.registerEmbeddableFactory(
-    dataVisualizerGridEmbeddableFactory.type,
-    dataVisualizerGridEmbeddableFactory
-  );
-}
diff --git a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/hooks/esql/use_data_visualizer_esql_data.tsx b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/hooks/esql/use_data_visualizer_esql_data.tsx
index 10b5d8ca069051..59638a485a3f0b 100644
--- a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/hooks/esql/use_data_visualizer_esql_data.tsx
+++ b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/hooks/esql/use_data_visualizer_esql_data.tsx
@@ -37,9 +37,8 @@ import { DEFAULT_BAR_TARGET } from '../../../common/constants';
 import { type Column, useESQLOverallStatsData } from './use_esql_overall_stats_data';
 import { type AggregatableField } from '../../types/esql_data_visualizer';
 import { useDataVisualizerKibana } from '../../../kibana_context';
-import { DATA_VISUALIZER_GRID_EMBEDDABLE_TYPE } from '../../embeddables/grid_embeddable/constants';
 import type {
-  ESQLDataVisualizerGridEmbeddableInput,
+  ESQLDataVisualizerGridEmbeddableState,
   ESQLDataVisualizerIndexBasedAppState,
 } from '../../embeddables/grid_embeddable/types';
 import { getDefaultPageState } from '../../constants/index_data_visualizer_viewer';
@@ -78,10 +77,11 @@ export const getDefaultESQLDataVisualizerListState = (
   showEmptyFields: false,
   probability: null,
   rndSamplerPref: 'off',
+  query: { esql: '' },
   ...overrides,
 });
 export const useESQLDataVisualizerData = (
-  input: ESQLDataVisualizerGridEmbeddableInput,
+  input: ESQLDataVisualizerGridEmbeddableState,
   dataVisualizerListState: ESQLDataVisualizerIndexBasedAppState,
   setQuery?: React.Dispatch<React.SetStateAction<ESQLQuery>>
 ) => {
@@ -91,10 +91,10 @@ export const useESQLDataVisualizerData = (
 
   const parentExecutionContext = useObservable(executionContext?.context$);
 
-  const embeddableExecutionContext: KibanaExecutionContext = useMemo(() => {
+  const componentExecutionContext: KibanaExecutionContext = useMemo(() => {
     const child: KibanaExecutionContext = {
       type: 'visualization',
-      name: DATA_VISUALIZER_GRID_EMBEDDABLE_TYPE,
+      name: 'esql_field_statistics_table',
       id: input.id,
     };
 
@@ -104,7 +104,7 @@ export const useESQLDataVisualizerData = (
     };
   }, [parentExecutionContext, input.id]);
 
-  useExecutionContext(executionContext, embeddableExecutionContext);
+  useExecutionContext(executionContext, componentExecutionContext);
 
   const _timeBuckets = useTimeBuckets(uiSettings);
   const timefilter = useTimefilter({
diff --git a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/hooks/use_data_visualizer_grid_data.ts b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/hooks/use_data_visualizer_grid_data.ts
index daca7b988f3bf9..699cfaf787295f 100644
--- a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/hooks/use_data_visualizer_grid_data.ts
+++ b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/hooks/use_data_visualizer_grid_data.ts
@@ -13,7 +13,6 @@ import { i18n } from '@kbn/i18n';
 import { UI_SETTINGS, type DataViewField } from '@kbn/data-plugin/common';
 import { ES_FIELD_TYPES, KBN_FIELD_TYPES } from '@kbn/field-types';
 import seedrandom from 'seedrandom';
-import type { SamplingOption } from '@kbn/discover-plugin/public/application/main/components/field_stats_table/field_stats_table';
 import type { Dictionary } from '@kbn/ml-url-state';
 import { mlTimefilterRefresh$, useTimefilter } from '@kbn/ml-date-picker';
 import useObservable from 'react-use/lib/useObservable';
@@ -21,7 +20,6 @@ import type { KibanaExecutionContext } from '@kbn/core-execution-context-common'
 import { useExecutionContext } from '@kbn/kibana-react-plugin/public';
 import { reportPerformanceMetricEvent } from '@kbn/ebt-tools';
 import { useTimeBuckets } from '@kbn/ml-time-buckets';
-import { DATA_VISUALIZER_GRID_EMBEDDABLE_TYPE } from '../embeddables/grid_embeddable/constants';
 import { filterFields } from '../../common/components/fields_stats_grid/filter_fields';
 import type { RandomSamplerOption } from '../constants/random_sampler';
 import type { DataVisualizerIndexBasedAppState } from '../types/index_data_visualizer_state';
@@ -39,16 +37,19 @@ import { kbnTypeToSupportedType } from '../../common/util/field_types_utils';
 import { getActions } from '../../common/components/field_data_row/action_menu';
 import { useFieldStatsSearchStrategy } from './use_field_stats';
 import { useOverallStats } from './use_overall_stats';
-import type { OverallStatsSearchStrategyParams } from '../../../../common/types/field_stats';
+import type {
+  OverallStatsSearchStrategyParams,
+  SamplingOption,
+} from '../../../../common/types/field_stats';
 import type { AggregatableField, NonAggregatableField } from '../types/overall_stats';
 import { getSupportedAggs } from '../utils/get_supported_aggs';
 import { DEFAULT_BAR_TARGET } from '../../common/constants';
-import type { DataVisualizerGridInput } from '../embeddables/grid_embeddable/types';
 import {
   DATA_VISUALIZER_INDEX_VIEWER_ID,
   getDefaultPageState,
 } from '../constants/index_data_visualizer_viewer';
 import { getFieldsWithSubFields } from '../utils/get_fields_with_subfields_utils';
+import type { FieldStatisticsTableEmbeddableState } from '../embeddables/grid_embeddable/types';
 
 const defaults = getDefaultPageState();
 
@@ -63,7 +64,7 @@ const DEFAULT_SAMPLING_OPTION: SamplingOption = {
 };
 export const useDataVisualizerGridData = (
   // Data view is required for non-ES|QL queries like kuery or lucene
-  input: Required<DataVisualizerGridInput, 'dataView'>,
+  input: Required<FieldStatisticsTableEmbeddableState, 'dataView'>,
   dataVisualizerListState: Required<DataVisualizerIndexBasedAppState>,
   savedRandomSamplerPreference?: RandomSamplerOption,
   onUpdate?: (params: Dictionary<unknown>) => void
@@ -74,10 +75,10 @@ export const useDataVisualizerGridData = (
 
   const parentExecutionContext = useObservable(executionContext?.context$);
 
-  const embeddableExecutionContext: KibanaExecutionContext = useMemo(() => {
+  const componentExecutionContext: KibanaExecutionContext = useMemo(() => {
     const child: KibanaExecutionContext = {
       type: 'visualization',
-      name: DATA_VISUALIZER_GRID_EMBEDDABLE_TYPE,
+      name: 'field_statistics_table',
       id: input.id,
     };
 
@@ -87,7 +88,7 @@ export const useDataVisualizerGridData = (
     };
   }, [parentExecutionContext, input.id]);
 
-  useExecutionContext(executionContext, embeddableExecutionContext);
+  useExecutionContext(executionContext, componentExecutionContext);
 
   const { visibleFieldTypes, showEmptyFields } = dataVisualizerListState;
 
@@ -127,7 +128,10 @@ export const useDataVisualizerGridData = (
     return getFieldsWithSubFields({
       input,
       currentDataView,
-      shouldGetSubfields: input.id !== DATA_VISUALIZER_INDEX_VIEWER_ID,
+      shouldGetSubfields:
+        input.shouldGetSubfields !== undefined
+          ? input.shouldGetSubfields
+          : input.id !== DATA_VISUALIZER_INDEX_VIEWER_ID,
     });
     // eslint-disable-next-line react-hooks/exhaustive-deps
   }, [input.id, input.fieldsToFetch, input.visibleFieldNames, currentDataView]);
@@ -261,7 +265,7 @@ export const useDataVisualizerGridData = (
         nonAggregatableFields,
         browserSessionSeed,
         samplingOption: { ...samplingOption, seed: browserSessionSeed.toString() },
-        embeddableExecutionContext,
+        componentExecutionContext,
       };
     },
     // eslint-disable-next-line react-hooks/exhaustive-deps
@@ -277,7 +281,7 @@ export const useDataVisualizerGridData = (
       lastRefresh,
       fieldsToFetch,
       browserSessionSeed,
-      embeddableExecutionContext,
+      componentExecutionContext,
     ]
   );
 
diff --git a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/hooks/use_overall_stats.ts b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/hooks/use_overall_stats.ts
index 56ba706c3b3b91..e70e3b810cdb8d 100644
--- a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/hooks/use_overall_stats.ts
+++ b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/hooks/use_overall_stats.ts
@@ -161,7 +161,8 @@ export function useOverallStats<TParams extends OverallStatsSearchStrategyParams
       searchStrategyParams?.timeFieldName,
       searchStrategyParams?.earliest,
       searchStrategyParams?.latest,
-      searchStrategyParams?.searchQuery,
+      // eslint-disable-next-line react-hooks/exhaustive-deps
+      JSON.stringify({ query: searchStrategyParams?.searchQuery }),
       searchStrategyParams?.index,
     ]
   );
diff --git a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/index_data_visualizer.tsx b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/index_data_visualizer.tsx
index d5f8f17b9ee17a..2ad7500f7e693a 100644
--- a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/index_data_visualizer.tsx
+++ b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/index_data_visualizer.tsx
@@ -310,7 +310,6 @@ export const IndexDataVisualizer: FC<Props> = ({
     data,
     maps,
     embeddable,
-    discover,
     share,
     security,
     fileUpload,
@@ -325,7 +324,6 @@ export const IndexDataVisualizer: FC<Props> = ({
     data,
     maps,
     embeddable,
-    discover,
     share,
     security,
     fileUpload,
diff --git a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/utils/get_fields_with_subfields_utils.ts b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/utils/get_fields_with_subfields_utils.ts
index 3b8ae5db928812..0c159878e8b2a0 100644
--- a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/utils/get_fields_with_subfields_utils.ts
+++ b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/utils/get_fields_with_subfields_utils.ts
@@ -6,7 +6,7 @@
  */
 import type { DataView, DataViewField } from '@kbn/data-views-plugin/common';
 import { isDefined } from '@kbn/ml-is-defined';
-import type { DataVisualizerGridInput } from '../embeddables/grid_embeddable/types';
+import type { FieldStatisticsTableEmbeddableState } from '../embeddables/grid_embeddable/types';
 
 /**
  * Helper logic to add multi-fields to the table for embeddables outside of Index data visualizer
@@ -19,7 +19,7 @@ export const getFieldsWithSubFields = ({
   currentDataView,
   shouldGetSubfields = false,
 }: {
-  input: DataVisualizerGridInput;
+  input: FieldStatisticsTableEmbeddableState;
   currentDataView: DataView;
   shouldGetSubfields: boolean;
 }) => {
diff --git a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/utils/saved_search_utils.test.ts b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/utils/saved_search_utils.test.ts
index ce8e1269492764..48cdc10a0a5c51 100644
--- a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/utils/saved_search_utils.test.ts
+++ b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/utils/saved_search_utils.test.ts
@@ -14,9 +14,19 @@ import { DataView } from '@kbn/data-views-plugin/public';
 import { fieldFormatsMock } from '@kbn/field-formats-plugin/common/mocks';
 import { uiSettingsServiceMock } from '@kbn/core/public/mocks';
 import { createSearchSourceMock } from '@kbn/data-plugin/public/mocks';
-import type { Query } from '@kbn/es-query';
+import type { Query, Filter } from '@kbn/es-query';
 import type { FilterMetaParams } from '@kbn/es-query/src/filters/build_filters';
+import type { FilterManager } from '@kbn/data-plugin/public';
 
+function createMockFilterManager() {
+  const filters: Filter[] = [];
+  return {
+    getFilters: () => filters,
+    addFilters: (value: Filter[]) => {
+      filters.push(...value);
+    },
+  } as unknown as jest.Mocked<FilterManager>;
+}
 // helper function to create data views
 function createMockDataView(id: string) {
   const {
@@ -229,6 +239,7 @@ describe('getEsQueryFromSavedSearch()', () => {
         dataView: mockDataView,
         savedSearch: luceneSavedSearch,
         uiSettings: mockUiSettings,
+        filterManager: createMockFilterManager(),
       })
     ).toEqual({
       queryLanguage: 'lucene',
@@ -281,6 +292,7 @@ describe('getEsQueryFromSavedSearch()', () => {
           query: 'responsetime:>100',
           language: 'lucene',
         },
+        filterManager: createMockFilterManager(),
       })
     ).toEqual({
       queryLanguage: 'lucene',
@@ -354,13 +366,38 @@ describe('getEsQueryFromSavedSearch()', () => {
             },
           },
         ],
+        filterManager: createMockFilterManager(),
       })
     ).toEqual({
       queryLanguage: 'lucene',
       queryOrAggregateQuery: { language: 'lucene', query: 'responsetime:>100' },
       searchQuery: {
         bool: {
-          filter: [],
+          filter: [
+            {
+              bool: {
+                should: [
+                  {
+                    bool: {
+                      must: [],
+                      filter: [{ match_phrase: { airline: 'ACA' } }],
+                      should: [],
+                      must_not: [],
+                    },
+                  },
+                  {
+                    bool: {
+                      must: [],
+                      filter: [{ match_phrase: { airline: 'FFT' } }],
+                      should: [],
+                      must_not: [],
+                    },
+                  },
+                ],
+                minimum_should_match: 1,
+              },
+            },
+          ],
           must: [{ query_string: { query: 'responsetime:>100' } }],
           must_not: [{ match_phrase: { airline: 'JZA' } }],
           should: [],
diff --git a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/utils/saved_search_utils.ts b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/utils/saved_search_utils.ts
index 29344925f30397..0e0efb057706ca 100644
--- a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/utils/saved_search_utils.ts
+++ b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/utils/saved_search_utils.ts
@@ -9,17 +9,17 @@
 // `x-pack/plugins/observability_solution/apm/public/components/app/correlations/progress_controls.tsx`
 import { cloneDeep } from 'lodash';
 import type { IUiSettingsClient } from '@kbn/core/public';
-import type { Query, Filter } from '@kbn/es-query';
+import type { Query, Filter, AggregateQuery } from '@kbn/es-query';
 import { buildEsQuery } from '@kbn/es-query';
 import type { QueryDslQueryContainer } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import type { DataView } from '@kbn/data-views-plugin/public';
 import type { SavedSearch } from '@kbn/saved-search-plugin/public';
 import { getEsQueryConfig, SearchSource } from '@kbn/data-plugin/common';
 import type { FilterManager } from '@kbn/data-plugin/public';
-import { mapAndFlattenFilters } from '@kbn/data-plugin/public';
 import { getDefaultDSLQuery } from '@kbn/ml-query-utils';
 import type { SearchQueryLanguage } from '@kbn/ml-query-utils';
 import { isDefined } from '@kbn/ml-is-defined';
+import { isPopulatedObject } from '@kbn/ml-is-populated-object';
 import type { SavedSearchSavedObject } from '../../../../common/types';
 import { isSavedSearchSavedObject } from '../../../../common/types';
 
@@ -63,6 +63,10 @@ function getSavedSearchSource(savedSearch?: SavedSearch | null) {
     : undefined;
 }
 
+function isNonAggregateQuery(query?: Query | AggregateQuery): query is Query {
+  return isPopulatedObject(query, ['query', 'language']);
+}
+
 /**
  * Extract query data from the saved search object
  * with overrides from the provided query data and/or filters
@@ -78,19 +82,18 @@ export function getEsQueryFromSavedSearch({
   dataView: DataView;
   uiSettings: IUiSettingsClient;
   savedSearch: SavedSearch | null | undefined;
-  query?: Query;
+  query?: Query | AggregateQuery;
   filters?: Filter[];
   filterManager?: FilterManager;
 }) {
   if (!dataView && !savedSearch) return;
 
+  // Cannot support AggregateQuery (esql or sql) here
+  if (query && !isNonAggregateQuery(query)) return;
+
   const userQuery = query;
   const userFilters = filters;
 
-  if (filterManager && userFilters) {
-    filterManager.addFilters(userFilters);
-  }
-
   const savedSearchSource = getSavedSearchSource(savedSearch);
 
   // If saved search has a search source with nested parent
@@ -126,7 +129,7 @@ export function getEsQueryFromSavedSearch({
     const combinedQuery = buildEsQuery(
       dataView,
       userQuery ?? [],
-      filterManager?.getFilters() ?? [],
+      [...(filterManager?.getFilters() ?? []), ...(userFilters ?? [])],
       uiSettings ? getEsQueryConfig(uiSettings) : undefined
     );
 
@@ -140,16 +143,17 @@ export function getEsQueryFromSavedSearch({
   // If saved search available, merge saved search with the latest user query or filters
   // which might differ from extracted saved search data
   if (savedSearchSource) {
-    // FIXME: Add support for AggregateQuery type #150091
     const currentQuery = userQuery ?? (savedSearchSource.getField('query') as Query);
-    const currentFilters =
-      userFilters ?? mapAndFlattenFilters(savedSearchSource.getField('filter') as Filter[]);
-    if (filterManager) filterManager.addFilters(currentFilters);
-
+    if (savedSearchSource.getField('filter')) {
+      // Rehydrate filter from saved search object into filter manager's store
+      if (filterManager) {
+        filterManager.addFilters(savedSearchSource.getField('filter') as Filter[]);
+      }
+    }
     const combinedQuery = buildEsQuery(
       dataView,
       currentQuery,
-      filterManager ? filterManager?.getFilters() : currentFilters,
+      [...(filterManager?.getFilters() ?? []), ...(userFilters ?? [])],
       uiSettings ? getEsQueryConfig(uiSettings) : undefined
     );
 
diff --git a/x-pack/plugins/data_visualizer/public/application/kibana_context.ts b/x-pack/plugins/data_visualizer/public/application/kibana_context.ts
index f0867b67ae8b8b..6b3cfc85f6b89c 100644
--- a/x-pack/plugins/data_visualizer/public/application/kibana_context.ts
+++ b/x-pack/plugins/data_visualizer/public/application/kibana_context.ts
@@ -9,8 +9,7 @@ import type { CoreStart } from '@kbn/core/public';
 import type { KibanaReactContextValue } from '@kbn/kibana-react-plugin/public';
 import { useKibana } from '@kbn/kibana-react-plugin/public';
 import type { IStorageWrapper } from '@kbn/kibana-utils-plugin/public';
-import type { DataVisualizerStartDependencies } from '../plugin';
-
+import type { DataVisualizerStartDependencies } from './common/types/data_visualizer_plugin';
 export type StartServices = CoreStart &
   DataVisualizerStartDependencies & {
     storage: IStorageWrapper;
diff --git a/x-pack/plugins/data_visualizer/public/kibana_services.ts b/x-pack/plugins/data_visualizer/public/kibana_services.ts
index cf2449ea2b013a..02b813cb37e26e 100644
--- a/x-pack/plugins/data_visualizer/public/kibana_services.ts
+++ b/x-pack/plugins/data_visualizer/public/kibana_services.ts
@@ -6,7 +6,7 @@
  */
 
 import type { CoreStart } from '@kbn/core/public';
-import type { DataVisualizerStartDependencies } from './plugin';
+import type { DataVisualizerStartDependencies } from './application/common/types/data_visualizer_plugin';
 
 let coreStart: CoreStart;
 let pluginsStart: DataVisualizerStartDependencies;
diff --git a/x-pack/plugins/data_visualizer/public/plugin.ts b/x-pack/plugins/data_visualizer/public/plugin.ts
index 98225774e2120c..15e1cb88eb1ba3 100644
--- a/x-pack/plugins/data_visualizer/public/plugin.ts
+++ b/x-pack/plugins/data_visualizer/public/plugin.ts
@@ -5,66 +5,29 @@
  * 2.0.
  */
 
-import type {
-  AnalyticsServiceStart,
-  CoreSetup,
-  CoreStart,
-  PluginInitializerContext,
-} from '@kbn/core/public';
-import type { ChartsPluginStart } from '@kbn/charts-plugin/public';
-import type { CloudStart } from '@kbn/cloud-plugin/public';
-import type { EmbeddableSetup, EmbeddableStart } from '@kbn/embeddable-plugin/public';
-import type { SharePluginSetup, SharePluginStart } from '@kbn/share-plugin/public';
-import type { DiscoverSetup, DiscoverStart } from '@kbn/discover-plugin/public';
+import type { CoreStart, PluginInitializerContext } from '@kbn/core/public';
 import type { Plugin } from '@kbn/core/public';
 
-import type { DataPublicPluginStart } from '@kbn/data-plugin/public';
-import type { HomePublicPluginSetup } from '@kbn/home-plugin/public';
-import type { SavedSearchPublicPluginStart } from '@kbn/saved-search-plugin/public';
-import type { FileUploadPluginStart } from '@kbn/file-upload-plugin/public';
-import type { UnifiedSearchPublicPluginStart } from '@kbn/unified-search-plugin/public';
-import type { MapsStartApi } from '@kbn/maps-plugin/public';
-import type { SecurityPluginSetup } from '@kbn/security-plugin/public';
-import type { LensPublicStart } from '@kbn/lens-plugin/public';
-import type { IndexPatternFieldEditorStart } from '@kbn/data-view-field-editor-plugin/public';
-import type { FieldFormatsStart } from '@kbn/field-formats-plugin/public';
-import type { UiActionsStart } from '@kbn/ui-actions-plugin/public';
+import type { CoreSetup } from '@kbn/core/public';
+import { dynamic } from '@kbn/shared-ux-utility';
 import { getComponents } from './api';
 import { getMaxBytesFormatted } from './application/common/util/get_max_bytes';
 import { registerHomeAddData, registerHomeFeatureCatalogue } from './register_home';
-import { registerEmbeddables } from './application/index_data_visualizer/embeddables';
 import { setStartServices } from './kibana_services';
 import { IndexDataVisualizerLocatorDefinition } from './application/index_data_visualizer/locator';
 import type { ConfigSchema } from '../common/app';
-
-export interface DataVisualizerSetupDependencies {
-  home?: HomePublicPluginSetup;
-  embeddable: EmbeddableSetup;
-  share: SharePluginSetup;
-  discover: DiscoverSetup;
-}
-export interface DataVisualizerStartDependencies {
-  analytics: AnalyticsServiceStart;
-  data: DataPublicPluginStart;
-  unifiedSearch: UnifiedSearchPublicPluginStart;
-  fileUpload: FileUploadPluginStart;
-  maps: MapsStartApi;
-  embeddable: EmbeddableStart;
-  security?: SecurityPluginSetup;
-  share: SharePluginStart;
-  discover: DiscoverStart;
-  lens?: LensPublicStart;
-  charts: ChartsPluginStart;
-  dataViewFieldEditor?: IndexPatternFieldEditorStart;
-  fieldFormats: FieldFormatsStart;
-  uiActions?: UiActionsStart;
-  cloud?: CloudStart;
-  savedSearch: SavedSearchPublicPluginStart;
-}
-
+import type {
+  DataVisualizerSetupDependencies,
+  DataVisualizerStartDependencies,
+} from './application/common/types/data_visualizer_plugin';
 export type DataVisualizerPluginSetup = ReturnType<DataVisualizerPlugin['setup']>;
 export type DataVisualizerPluginStart = ReturnType<DataVisualizerPlugin['start']>;
 
+export type DataVisualizerCoreSetup = CoreSetup<
+  DataVisualizerStartDependencies,
+  DataVisualizerPluginStart
+>;
+
 export class DataVisualizerPlugin
   implements
     Plugin<
@@ -87,16 +50,12 @@ export class DataVisualizerPlugin
     }
   }
 
-  public setup(
-    core: CoreSetup<DataVisualizerStartDependencies, DataVisualizerPluginStart>,
-    plugins: DataVisualizerSetupDependencies
-  ) {
+  public setup(core: DataVisualizerCoreSetup, plugins: DataVisualizerSetupDependencies) {
     if (plugins.home) {
       registerHomeAddData(plugins.home, this.resultsLinks);
       registerHomeFeatureCatalogue(plugins.home);
     }
 
-    registerEmbeddables(plugins.embeddable, core);
     plugins.share.url.locators.create(new IndexDataVisualizerLocatorDefinition());
   }
 
@@ -107,11 +66,18 @@ export class DataVisualizerPlugin
       getIndexDataVisualizerComponent,
       getDataDriftComponent,
     } = getComponents(this.resultsLinks);
+
     return {
       getFileDataVisualizerComponent,
       getIndexDataVisualizerComponent,
       getDataDriftComponent,
       getMaxBytesFormatted,
+      FieldStatisticsTable: dynamic(
+        async () =>
+          import(
+            './application/index_data_visualizer/embeddables/grid_embeddable/field_stats_embeddable_wrapper'
+          )
+      ),
     };
   }
 }
diff --git a/x-pack/plugins/data_visualizer/tsconfig.json b/x-pack/plugins/data_visualizer/tsconfig.json
index 957c1b8eccb6ff..70d967d2a7128c 100644
--- a/x-pack/plugins/data_visualizer/tsconfig.json
+++ b/x-pack/plugins/data_visualizer/tsconfig.json
@@ -27,7 +27,6 @@
     "@kbn/data-view-field-editor-plugin",
     "@kbn/data-views-plugin",
     "@kbn/datemath",
-    "@kbn/discover-plugin",
     "@kbn/ebt-tools",
     "@kbn/embeddable-plugin",
     "@kbn/embeddable-plugin",
@@ -80,6 +79,8 @@
     "@kbn/aiops-log-rate-analysis",
     "@kbn/react-kibana-context-render",
     "@kbn/react-kibana-context-theme",
+    "@kbn/presentation-publishing",
+    "@kbn/shared-ux-utility",
     "@kbn/search-types"
   ],
   "exclude": [
diff --git a/x-pack/plugins/elastic_assistant/server/routes/attack_discovery/helpers.ts b/x-pack/plugins/elastic_assistant/server/routes/attack_discovery/helpers.ts
index 7fd11c5d525828..f11802c206693e 100644
--- a/x-pack/plugins/elastic_assistant/server/routes/attack_discovery/helpers.ts
+++ b/x-pack/plugins/elastic_assistant/server/routes/attack_discovery/helpers.ts
@@ -16,7 +16,7 @@ import { ActionsClientLlm } from '@kbn/elastic-assistant-common/impl/language_mo
 import { AnonymizationFieldResponse } from '@kbn/elastic-assistant-common/impl/schemas/anonymization_fields/bulk_crud_anonymization_fields_route.gen';
 import { v4 as uuidv4 } from 'uuid';
 
-import { AssistantToolParams, ElasticAssistantApiRequestHandlerContext } from '../../types';
+import { AssistantToolParams } from '../../types';
 
 export const REQUIRED_FOR_ATTACK_DISCOVERY: AnonymizationFieldResponse[] = [
   {
@@ -68,15 +68,3 @@ export const getAssistantToolParams = ({
   request,
   size,
 });
-
-export const isAttackDiscoveryFeatureEnabled = ({
-  assistantContext,
-  pluginName,
-}: {
-  assistantContext: ElasticAssistantApiRequestHandlerContext;
-  pluginName: string;
-}): boolean => {
-  const registeredFeatures = assistantContext.getRegisteredFeatures(pluginName);
-
-  return registeredFeatures.attackDiscoveryEnabled === true;
-};
diff --git a/x-pack/plugins/elastic_assistant/server/routes/attack_discovery/post_attack_discovery.ts b/x-pack/plugins/elastic_assistant/server/routes/attack_discovery/post_attack_discovery.ts
index 60c2451ff1f84d..12546ddbb25b8e 100644
--- a/x-pack/plugins/elastic_assistant/server/routes/attack_discovery/post_attack_discovery.ts
+++ b/x-pack/plugins/elastic_assistant/server/routes/attack_discovery/post_attack_discovery.ts
@@ -17,7 +17,7 @@ import {
 import { transformError } from '@kbn/securitysolution-es-utils';
 
 import { ATTACK_DISCOVERY } from '../../../common/constants';
-import { getAssistantToolParams, isAttackDiscoveryFeatureEnabled } from './helpers';
+import { getAssistantToolParams } from './helpers';
 import { DEFAULT_PLUGIN_NAME, getPluginNameFromRequest } from '../helpers';
 import { getLangSmithTracer } from '../evaluate/utils';
 import { buildResponse } from '../../lib/build_response';
@@ -63,16 +63,6 @@ export const postAttackDiscoveryRoute = (
             logger,
           });
 
-          // feature flag check:
-          const attackDiscoveryFeatureEnabled = isAttackDiscoveryFeatureEnabled({
-            assistantContext,
-            pluginName,
-          });
-
-          if (!attackDiscoveryFeatureEnabled) {
-            return response.notFound();
-          }
-
           // get parameters from the request body
           const alertsIndexPattern = decodeURIComponent(request.body.alertsIndexPattern);
           const connectorId = decodeURIComponent(request.body.connectorId);
@@ -143,12 +133,13 @@ export const postAttackDiscoveryRoute = (
             });
           }
 
-          const parsedAttackDiscoveries = JSON.parse(rawAttackDiscoveries);
+          const { alertsContextCount, attackDiscoveries } = JSON.parse(rawAttackDiscoveries);
 
           return response.ok({
             body: {
+              alertsContextCount,
+              attackDiscoveries,
               connector_id: connectorId,
-              attackDiscoveries: parsedAttackDiscoveries,
               replacements: latestReplacements,
             },
           });
diff --git a/x-pack/plugins/elastic_assistant/server/routes/evaluate/post_evaluate.test.ts b/x-pack/plugins/elastic_assistant/server/routes/evaluate/post_evaluate.test.ts
index d0cca8f4d4e09b..0555b313f27f92 100644
--- a/x-pack/plugins/elastic_assistant/server/routes/evaluate/post_evaluate.test.ts
+++ b/x-pack/plugins/elastic_assistant/server/routes/evaluate/post_evaluate.test.ts
@@ -46,7 +46,6 @@ describe('Post Evaluate Route', () => {
     it('returns a 404 if evaluate feature is not registered', async () => {
       context.elasticAssistant.getRegisteredFeatures.mockReturnValueOnce({
         assistantModelEvaluation: false,
-        attackDiscoveryEnabled: false,
       });
 
       const response = await server.inject(
diff --git a/x-pack/plugins/elastic_assistant/server/services/app_context.test.ts b/x-pack/plugins/elastic_assistant/server/services/app_context.test.ts
index aac4e53dfae22f..57ca4ea18651c8 100644
--- a/x-pack/plugins/elastic_assistant/server/services/app_context.test.ts
+++ b/x-pack/plugins/elastic_assistant/server/services/app_context.test.ts
@@ -54,7 +54,6 @@ describe('AppContextService', () => {
       appContextService.start(mockAppContext);
       appContextService.registerFeatures('super', {
         assistantModelEvaluation: true,
-        attackDiscoveryEnabled: false,
       });
       appContextService.stop();
 
@@ -104,7 +103,6 @@ describe('AppContextService', () => {
       const pluginName = 'pluginName';
       const features: AssistantFeatures = {
         assistantModelEvaluation: true,
-        attackDiscoveryEnabled: false,
       };
 
       appContextService.start(mockAppContext);
@@ -119,12 +117,10 @@ describe('AppContextService', () => {
       const pluginOne = 'plugin1';
       const featuresOne: AssistantFeatures = {
         assistantModelEvaluation: true,
-        attackDiscoveryEnabled: false,
       };
       const pluginTwo = 'plugin2';
       const featuresTwo: AssistantFeatures = {
         assistantModelEvaluation: false,
-        attackDiscoveryEnabled: false,
       };
 
       appContextService.start(mockAppContext);
@@ -139,11 +135,9 @@ describe('AppContextService', () => {
       const pluginName = 'pluginName';
       const featuresOne: AssistantFeatures = {
         assistantModelEvaluation: true,
-        attackDiscoveryEnabled: false,
       };
       const featuresTwo: AssistantFeatures = {
         assistantModelEvaluation: false,
-        attackDiscoveryEnabled: false,
       };
 
       appContextService.start(mockAppContext);
diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/connector_detail/connector_configuration.tsx b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/connector_detail/connector_configuration.tsx
index 0d114f7cd41913..3f2c7e2978985c 100644
--- a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/connector_detail/connector_configuration.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/connector_detail/connector_configuration.tsx
@@ -133,7 +133,7 @@ export const ConnectorConfiguration: React.FC = () => {
                           <EuiText size="s">
                             <FormattedMessage
                               id="xpack.enterpriseSearch.content.connector_detail.configurationConnector.connectorPackage.description.thirdParagraph"
-                              defaultMessage="In this step, you will need to clone or fork the elastic/connectors repository, and copy the API key and connector ID values to the config.yml file. Here's an {exampleLink}."
+                              defaultMessage="In this step, you will need the API key and connector ID values for your config.yml file. Here's an {exampleLink}."
                               values={{
                                 exampleLink: (
                                   <EuiLink
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/layout/personal_dashboard_layout/personal_dashboard_layout.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/layout/personal_dashboard_layout/personal_dashboard_layout.tsx
index a833eff37fbc70..12414f6318860a 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/layout/personal_dashboard_layout/personal_dashboard_layout.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/layout/personal_dashboard_layout/personal_dashboard_layout.tsx
@@ -10,14 +10,7 @@ import { useRouteMatch } from 'react-router-dom';
 
 import { useValues } from 'kea';
 
-import {
-  EuiPageSidebar,
-  EuiPageBody,
-  EuiPageSection,
-  EuiCallOut,
-  EuiSpacer,
-  EuiPageTemplate,
-} from '@elastic/eui';
+import { EuiCallOut, EuiSpacer, EuiPageTemplate } from '@elastic/eui';
 
 import { AccountHeader, AccountSettingsSidebar, PrivateSourcesSidebar } from '..';
 import { FlashMessages } from '../../../../shared/flash_messages';
@@ -47,8 +40,8 @@ export const PersonalDashboardLayout: FC<PropsWithChildren<LayoutProps>> = ({
     <>
       {pageChrome && <SetWorkplaceSearchChrome trail={pageChrome} />}
       <AccountHeader />
-      <EuiPageTemplate className="personalDashboardLayout" paddingSize="none">
-        <EuiPageSidebar
+      <EuiPageTemplate className="personalDashboardLayout" paddingSize="none" panelled>
+        <EuiPageTemplate.Sidebar
           role="navigation"
           className="personalDashboardLayout__sideBar"
           sticky
@@ -56,28 +49,26 @@ export const PersonalDashboardLayout: FC<PropsWithChildren<LayoutProps>> = ({
         >
           {useRouteMatch(PRIVATE_SOURCES_PATH) && <PrivateSourcesSidebar />}
           {useRouteMatch(PERSONAL_SETTINGS_PATH) && <AccountSettingsSidebar />}
-        </EuiPageSidebar>
-        <EuiPageBody component="main" panelled role="main">
-          <EuiPageSection
-            className="personalDashboardLayout__body"
-            paddingSize="none"
-            restrictWidth
-          >
-            {readOnlyMode && (
-              <>
-                <EuiCallOut
-                  color="warning"
-                  iconType="lock"
-                  title={PERSONAL_DASHBOARD_READ_ONLY_MODE_WARNING}
-                />
-                <EuiSpacer />
-              </>
-            )}
-            <FlashMessages />
+        </EuiPageTemplate.Sidebar>
+        <EuiPageTemplate.Section
+          className="personalDashboardLayout__body"
+          paddingSize="none"
+          restrictWidth
+        >
+          {readOnlyMode && (
+            <>
+              <EuiCallOut
+                color="warning"
+                iconType="lock"
+                title={PERSONAL_DASHBOARD_READ_ONLY_MODE_WARNING}
+              />
+              <EuiSpacer />
+            </>
+          )}
+          <FlashMessages />
 
-            {isLoading ? <Loading /> : children}
-          </EuiPageSection>
-        </EuiPageBody>
+          {isLoading ? <Loading /> : children}
+        </EuiPageTemplate.Section>
       </EuiPageTemplate>
     </>
   );
diff --git a/x-pack/plugins/fleet/common/authz.ts b/x-pack/plugins/fleet/common/authz.ts
index 8c5868616e2d40..463ab7dc90c971 100644
--- a/x-pack/plugins/fleet/common/authz.ts
+++ b/x-pack/plugins/fleet/common/authz.ts
@@ -158,8 +158,8 @@ export const calculateAuthz = ({
       removePackages: writeIntegrationPolicies && integrations.all,
       uploadPackages: writeIntegrationPolicies && integrations.all,
 
-      readPackageSettings: hasFleetAll && integrations.all,
-      writePackageSettings: hasFleetAll && integrations.all,
+      readPackageSettings: integrations.read,
+      writePackageSettings: writeIntegrationPolicies && integrations.all,
 
       readIntegrationPolicies,
       writeIntegrationPolicies,
diff --git a/x-pack/plugins/fleet/common/constants/agent.ts b/x-pack/plugins/fleet/common/constants/agent.ts
index 251db5db24806e..cf1e97090804e4 100644
--- a/x-pack/plugins/fleet/common/constants/agent.ts
+++ b/x-pack/plugins/fleet/common/constants/agent.ts
@@ -47,3 +47,8 @@ export const AgentStatuses = [
   'updating',
   'degraded',
 ] as const;
+
+// Kueries for finding unprivileged and privileged agents
+// Privileged is `not` because the metadata field can be undefined
+export const UNPRIVILEGED_AGENT_KUERY = `${AGENTS_PREFIX}.local_metadata.elastic.agent.unprivileged: true`;
+export const PRIVILEGED_AGENT_KUERY = `not ${AGENTS_PREFIX}.local_metadata.elastic.agent.unprivileged: true`;
diff --git a/x-pack/plugins/fleet/common/experimental_features.ts b/x-pack/plugins/fleet/common/experimental_features.ts
index a12711012f3074..0350af4f24620a 100644
--- a/x-pack/plugins/fleet/common/experimental_features.ts
+++ b/x-pack/plugins/fleet/common/experimental_features.ts
@@ -30,6 +30,7 @@ export const allowedExperimentalValues = Object.freeze<Record<string, boolean>>(
   subfeaturePrivileges: false,
   enablePackagesStateMachine: true,
   advancedPolicySettings: true,
+  useSpaceAwareness: false,
 });
 
 type ExperimentalConfigKeys = Array<keyof ExperimentalFeatures>;
diff --git a/x-pack/plugins/fleet/common/openapi/bundled.json b/x-pack/plugins/fleet/common/openapi/bundled.json
index 1e8a9ba75b0e80..f9ebd7d84653a1 100644
--- a/x-pack/plugins/fleet/common/openapi/bundled.json
+++ b/x-pack/plugins/fleet/common/openapi/bundled.json
@@ -7571,6 +7571,9 @@
           "agents": {
             "type": "number"
           },
+          "unprivileged_agents": {
+            "type": "number"
+          },
           "agent_features": {
             "type": "array",
             "items": {
@@ -7602,6 +7605,10 @@
             "type": "object",
             "description": "Advanced settings stored in the agent policy, e.g. agent_limits_go_max_procs",
             "nullable": true
+          },
+          "supports_agentless": {
+            "type": "boolean",
+            "description": "Indicates whether the agent policy supports agentless integrations. Only allowed in a serverless environment."
           }
         },
         "required": [
diff --git a/x-pack/plugins/fleet/common/openapi/bundled.yaml b/x-pack/plugins/fleet/common/openapi/bundled.yaml
index 4f48786da4fbf6..3bf9514e08147e 100644
--- a/x-pack/plugins/fleet/common/openapi/bundled.yaml
+++ b/x-pack/plugins/fleet/common/openapi/bundled.yaml
@@ -4864,6 +4864,8 @@ components:
           type: number
         agents:
           type: number
+        unprivileged_agents:
+          type: number
         agent_features:
           type: array
           items:
@@ -4894,6 +4896,11 @@ components:
             Advanced settings stored in the agent policy, e.g.
             agent_limits_go_max_procs
           nullable: true
+        supports_agentless:
+          type: boolean
+          description: >-
+            Indicates whether the agent policy supports agentless integrations.
+            Only allowed in a serverless environment.
       required:
         - id
         - status
diff --git a/x-pack/plugins/fleet/common/openapi/components/schemas/agent_policy.yaml b/x-pack/plugins/fleet/common/openapi/components/schemas/agent_policy.yaml
index 070d72a5ec3534..02f302e025d67f 100644
--- a/x-pack/plugins/fleet/common/openapi/components/schemas/agent_policy.yaml
+++ b/x-pack/plugins/fleet/common/openapi/components/schemas/agent_policy.yaml
@@ -50,6 +50,8 @@ properties:
     type: number
   agents:
     type: number
+  unprivileged_agents:
+    type: number
   agent_features:
     type: array
     items:
@@ -73,6 +75,9 @@ properties:
     type: object
     description: Advanced settings stored in the agent policy, e.g. agent_limits_go_max_procs
     nullable: true
+  supports_agentless:
+    type: boolean
+    description: Indicates whether the agent policy supports agentless integrations. Only allowed in a serverless environment.
 required:
   - id
   - status
diff --git a/x-pack/plugins/fleet/common/types/models/agent_policy.ts b/x-pack/plugins/fleet/common/types/models/agent_policy.ts
index 1bff10bcdf5646..9bae6421050ded 100644
--- a/x-pack/plugins/fleet/common/types/models/agent_policy.ts
+++ b/x-pack/plugins/fleet/common/types/models/agent_policy.ts
@@ -41,6 +41,7 @@ export interface NewAgentPolicy {
   overrides?: { [key: string]: any } | null;
   advanced_settings?: { [key: string]: any } | null;
   keep_monitoring_alive?: boolean | null;
+  supports_agentless?: boolean | null;
 }
 
 // SO definition for this type is declared in server/types/interfaces
@@ -53,6 +54,7 @@ export interface AgentPolicy extends Omit<NewAgentPolicy, 'id'> {
   updated_by: string;
   revision: number;
   agents?: number;
+  unprivileged_agents?: number;
   is_protected: boolean;
 }
 
diff --git a/x-pack/plugins/fleet/common/types/rest_spec/agent_policy.ts b/x-pack/plugins/fleet/common/types/rest_spec/agent_policy.ts
index 9b89e194a10470..3b35e986a5d55e 100644
--- a/x-pack/plugins/fleet/common/types/rest_spec/agent_policy.ts
+++ b/x-pack/plugins/fleet/common/types/rest_spec/agent_policy.ts
@@ -16,7 +16,7 @@ export interface GetAgentPoliciesRequest {
   };
 }
 
-export type GetAgentPoliciesResponseItem = AgentPolicy & { agents?: number };
+export type GetAgentPoliciesResponseItem = AgentPolicy;
 
 export type BulkGetAgentPoliciesResponse = BulkGetResult<GetAgentPoliciesResponseItem>;
 export type GetAgentPoliciesResponse = ListResult<GetAgentPoliciesResponseItem>;
diff --git a/x-pack/plugins/fleet/cypress/e2e/agents/agent_list.cy.ts b/x-pack/plugins/fleet/cypress/e2e/agents/agent_list.cy.ts
index 27a1098fe82564..459fa5f53bfc5b 100644
--- a/x-pack/plugins/fleet/cypress/e2e/agents/agent_list.cy.ts
+++ b/x-pack/plugins/fleet/cypress/e2e/agents/agent_list.cy.ts
@@ -91,7 +91,7 @@ describe('View agents list', () => {
     deleteAgentDocs(true);
     cleanupAgentPolicies();
     setupFleetServer();
-    setUISettings('hideAgentActivityTour', true);
+    setUISettings('hideAnnouncements', true);
 
     cy.getKibanaVersion().then((version) => {
       docs = createAgentDocs(version);
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/create_package_policy_page/single_page_layout/hooks/form.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/create_package_policy_page/single_page_layout/hooks/form.tsx
index 83453496507b00..b256349f5d6b96 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/create_package_policy_page/single_page_layout/hooks/form.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/create_package_policy_page/single_page_layout/hooks/form.tsx
@@ -272,7 +272,8 @@ export function useOnSubmit({
           setFormState('LOADING');
           if ((withSysMonitoring || newAgentPolicy.monitoring_enabled?.length) ?? 0 > 0) {
             const packagesToPreinstall: Array<string | { name: string; version: string }> = [];
-            if (packageInfo) {
+            // skip preinstall of input package, to be able to rollback when package policy creation fails
+            if (packageInfo && packageInfo.type !== 'input') {
               packagesToPreinstall.push({ name: packageInfo.name, version: packageInfo.version });
             }
             if (withSysMonitoring) {
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/details_page/components/header/right_content.stories.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/details_page/components/header/right_content.stories.tsx
index d59b00abc311f6..c39b3dfdd04700 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/details_page/components/header/right_content.stories.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/details_page/components/header/right_content.stories.tsx
@@ -18,7 +18,6 @@ export const HeaderRightContent = () => {
   return (
     <div style={{ maxWidth: '800px' }}>
       <Component
-        policyId="test123"
         isLoading={false}
         addAgent={() => {}}
         isAddAgentHelpPopoverOpen={false}
@@ -31,11 +30,6 @@ export const HeaderRightContent = () => {
             package_policies: ['test1', 'test2'],
           } as any
         }
-        agentStatus={
-          {
-            total: 0,
-          } as any
-        }
       />
     </div>
   );
@@ -45,7 +39,6 @@ export const HeaderRightContentWithManagedPolicy = () => {
   return (
     <div style={{ maxWidth: '800px' }}>
       <Component
-        policyId="test123"
         isLoading={false}
         addAgent={() => {}}
         isAddAgentHelpPopoverOpen={false}
@@ -59,11 +52,6 @@ export const HeaderRightContentWithManagedPolicy = () => {
             is_managed: true,
           } as any
         }
-        agentStatus={
-          {
-            total: 0,
-          } as any
-        }
       />
     </div>
   );
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/details_page/components/header/right_content.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/details_page/components/header/right_content.tsx
index cfbf4d79eea9a8..743dd5186d3b57 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/details_page/components/header/right_content.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/details_page/components/header/right_content.tsx
@@ -18,19 +18,18 @@ import {
   EuiDescriptionListTitle,
   EuiDescriptionListDescription,
   EuiLink,
+  EuiToolTip,
 } from '@elastic/eui';
 
 import { useAuthz, useLink } from '../../../../../hooks';
-import type { AgentPolicy, GetAgentStatusResponse } from '../../../../../types';
+import type { AgentPolicy } from '../../../../../types';
 import { AgentPolicyActionMenu, LinkedAgentCount } from '../../../components';
 import { AddAgentHelpPopover } from '../../../../../components';
 import { FLEET_SERVER_PACKAGE } from '../../../../../../../../common/constants';
 
 export interface HeaderRightContentProps {
   isLoading: boolean;
-  policyId: string;
   agentPolicy?: AgentPolicy | null;
-  agentStatus?: GetAgentStatusResponse['results'];
   addAgent: () => void;
   onCancelEnrollment?: () => void;
   isAddAgentHelpPopoverOpen: boolean;
@@ -45,9 +44,7 @@ const Divider = styled.div`
 
 export const HeaderRightContent: React.FunctionComponent<HeaderRightContentProps> = ({
   isLoading,
-  policyId,
   agentPolicy,
-  agentStatus,
   addAgent,
   onCancelEnrollment,
   isAddAgentHelpPopoverOpen,
@@ -86,118 +83,134 @@ export const HeaderRightContent: React.FunctionComponent<HeaderRightContentProps
 
   return (
     <EuiFlexGroup justifyContent={'flexEnd'} direction="row">
-      {[
-        {
-          label: i18n.translate('xpack.fleet.policyDetails.summary.revision', {
-            defaultMessage: 'Revision',
-          }),
-          content: agentPolicy?.revision ?? 0,
-        },
-        { isDivider: true },
-        {
-          label: i18n.translate('xpack.fleet.policyDetails.summary.integrations', {
-            defaultMessage: 'Integrations',
-          }),
-          content: (
-            <EuiI18nNumber
-              value={
-                (agentPolicy &&
-                  agentPolicy.package_policies &&
-                  agentPolicy.package_policies.length) ||
-                0
-              }
-            />
-          ),
-        },
-        { isDivider: true },
-        ...(authz.fleet.readAgents
-          ? [
-              {
-                label: i18n.translate('xpack.fleet.policyDetails.summary.usedBy', {
-                  defaultMessage: 'Agents',
-                }),
-                content:
-                  agentStatus && agentStatus!.total ? (
-                    <LinkedAgentCount
-                      count={agentStatus.total}
-                      agentPolicyId={(agentPolicy && agentPolicy.id) || ''}
-                      showAgentText
-                    />
-                  ) : isFleetServerPolicy && authz.fleet.addFleetServers ? (
-                    <AddAgentHelpPopover
-                      button={addFleetServerLink}
-                      isOpen={isAddAgentHelpPopoverOpen}
-                      offset={15}
-                      closePopover={() => {
-                        setIsAddAgentHelpPopoverOpen(false);
-                      }}
-                    />
-                  ) : !isFleetServerPolicy && authz.fleet.addAgents ? (
-                    <AddAgentHelpPopover
-                      button={addAgentLink}
-                      isOpen={isAddAgentHelpPopoverOpen}
-                      offset={15}
-                      closePopover={() => {
-                        setIsAddAgentHelpPopoverOpen(false);
-                      }}
-                    />
-                  ) : (
-                    <LinkedAgentCount
-                      count={0}
-                      agentPolicyId={(agentPolicy && agentPolicy.id) || ''}
-                      showAgentText
-                    />
-                  ),
-              },
-              { isDivider: true },
-            ]
-          : []),
-        {
-          label: i18n.translate('xpack.fleet.policyDetails.summary.lastUpdated', {
-            defaultMessage: 'Last updated on',
-          }),
-          content:
-            (agentPolicy && (
-              <FormattedDate
-                value={agentPolicy?.updated_at}
-                year="numeric"
-                month="short"
-                day="2-digit"
-              />
-            )) ||
-            '',
-        },
-        { isDivider: true },
-        {
-          content: agentPolicy && (
-            <AgentPolicyActionMenu
-              agentPolicy={agentPolicy}
-              fullButton={true}
-              onCopySuccess={(newAgentPolicy: AgentPolicy) => {
-                history.push(getPath('policy_details', { policyId: newAgentPolicy.id }));
-              }}
-              onCancelEnrollment={onCancelEnrollment}
-            />
-          ),
-        },
-      ].map((item, index) => (
-        <EuiFlexItem grow={false} key={index}>
-          {item.isDivider ?? false ? (
-            <Divider />
-          ) : item.label ? (
-            <EuiDescriptionList compressed textStyle="reverse" style={{ textAlign: 'right' }}>
-              <EuiDescriptionListTitle className="eui-textNoWrap">
-                {item.label}
-              </EuiDescriptionListTitle>
-              <EuiDescriptionListDescription className="eui-textNoWrap">
-                {item.content}
-              </EuiDescriptionListDescription>
-            </EuiDescriptionList>
-          ) : (
-            item.content
-          )}
-        </EuiFlexItem>
-      ))}
+      {isLoading || !agentPolicy
+        ? null
+        : [
+            {
+              label: i18n.translate('xpack.fleet.policyDetails.summary.revision', {
+                defaultMessage: 'Revision',
+              }),
+              content: agentPolicy.revision ?? 0,
+            },
+            { isDivider: true },
+            {
+              label: i18n.translate('xpack.fleet.policyDetails.summary.integrations', {
+                defaultMessage: 'Integrations',
+              }),
+              content: (
+                <EuiI18nNumber
+                  value={(agentPolicy.package_policies && agentPolicy.package_policies.length) || 0}
+                />
+              ),
+            },
+            { isDivider: true },
+            ...(authz.fleet.readAgents
+              ? [
+                  {
+                    label: i18n.translate('xpack.fleet.policyDetails.summary.usedBy', {
+                      defaultMessage: 'Agents',
+                    }),
+                    content:
+                      !agentPolicy.agents && isFleetServerPolicy && authz.fleet.addFleetServers ? (
+                        <AddAgentHelpPopover
+                          button={addFleetServerLink}
+                          isOpen={isAddAgentHelpPopoverOpen}
+                          offset={15}
+                          closePopover={() => {
+                            setIsAddAgentHelpPopoverOpen(false);
+                          }}
+                        />
+                      ) : !agentPolicy.agents && !isFleetServerPolicy && authz.fleet.addAgents ? (
+                        <AddAgentHelpPopover
+                          button={addAgentLink}
+                          isOpen={isAddAgentHelpPopoverOpen}
+                          offset={15}
+                          closePopover={() => {
+                            setIsAddAgentHelpPopoverOpen(false);
+                          }}
+                        />
+                      ) : (
+                        <EuiToolTip
+                          content={
+                            <EuiFlexGroup direction="column" gutterSize="xs">
+                              <EuiFlexItem>
+                                <FormattedMessage
+                                  id="xpack.fleet.policyDetails.summary.usedByUnprivilegedTooltip"
+                                  defaultMessage="{count, plural, one {# unprivileged agent} other {# unprivileged agents}}"
+                                  values={{ count: agentPolicy.unprivileged_agents || 0 }}
+                                />
+                              </EuiFlexItem>
+                              <EuiFlexItem>
+                                <FormattedMessage
+                                  id="xpack.fleet.policyDetails.summary.usedByPrivilegedTooltip"
+                                  defaultMessage="{count, plural, one {# privileged agent} other {# privileged agents}}"
+                                  values={{
+                                    count:
+                                      (agentPolicy.agents || 0) -
+                                      (agentPolicy.unprivileged_agents || 0),
+                                  }}
+                                />
+                              </EuiFlexItem>
+                            </EuiFlexGroup>
+                          }
+                        >
+                          <LinkedAgentCount
+                            count={agentPolicy.agents || 0}
+                            agentPolicyId={agentPolicy.id}
+                            showAgentText={true}
+                          />
+                        </EuiToolTip>
+                      ),
+                  },
+                  { isDivider: true },
+                ]
+              : []),
+            {
+              label: i18n.translate('xpack.fleet.policyDetails.summary.lastUpdated', {
+                defaultMessage: 'Last updated on',
+              }),
+              content:
+                (agentPolicy && (
+                  <FormattedDate
+                    value={agentPolicy?.updated_at}
+                    year="numeric"
+                    month="short"
+                    day="2-digit"
+                  />
+                )) ||
+                '',
+            },
+            { isDivider: true },
+            {
+              content: agentPolicy && (
+                <AgentPolicyActionMenu
+                  agentPolicy={agentPolicy}
+                  fullButton={true}
+                  onCopySuccess={(newAgentPolicy: AgentPolicy) => {
+                    history.push(getPath('policy_details', { policyId: newAgentPolicy.id }));
+                  }}
+                  onCancelEnrollment={onCancelEnrollment}
+                />
+              ),
+            },
+          ].map((item, index) => (
+            <EuiFlexItem grow={false} key={index}>
+              {item.isDivider ?? false ? (
+                <Divider />
+              ) : item.label ? (
+                <EuiDescriptionList compressed textStyle="reverse" style={{ textAlign: 'right' }}>
+                  <EuiDescriptionListTitle className="eui-textNoWrap">
+                    {item.label}
+                  </EuiDescriptionListTitle>
+                  <EuiDescriptionListDescription className="eui-textNoWrap">
+                    {item.content}
+                  </EuiDescriptionListDescription>
+                </EuiDescriptionList>
+              ) : (
+                item.content
+              )}
+            </EuiFlexItem>
+          ))}
     </EuiFlexGroup>
   );
 };
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/details_page/index.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/details_page/index.tsx
index 855d6017a79c3a..0c92d8064ae8b7 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/details_page/index.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/details_page/index.tsx
@@ -28,7 +28,6 @@ import {
 import { Loading, Error, AgentEnrollmentFlyout } from '../../../components';
 import { WithHeaderLayout } from '../../../layouts';
 
-import { useGetAgentStatus, AgentStatusRefreshContext } from './hooks';
 import {
   PackagePoliciesView,
   SettingsView,
@@ -55,13 +54,10 @@ export const AgentPolicyDetailsPage: React.FunctionComponent = () => {
     openAddAgentHelpPopoverOpenByDefault
   );
 
-  const agentStatusRequest = useGetAgentStatus(policyId);
-  const { refreshAgentStatus } = agentStatusRequest;
   const {
     application: { navigateToApp },
   } = useStartServices();
   const routeState = useIntraAppState<AgentPolicyDetailsDeployAgentAction>();
-  const agentStatus = agentStatusRequest.data?.results;
 
   const { isReady: isFleetReady } = useFleetStatus();
 
@@ -170,8 +166,6 @@ export const AgentPolicyDetailsPage: React.FunctionComponent = () => {
   const headerRightContent = (
     <HeaderRightContent
       agentPolicy={agentPolicy}
-      agentStatus={agentStatus}
-      policyId={policyId}
       onCancelEnrollment={onCancelEnrollment}
       isLoading={isLoading}
       isAddAgentHelpPopoverOpen={isAddAgentHelpPopoverOpen}
@@ -182,15 +176,13 @@ export const AgentPolicyDetailsPage: React.FunctionComponent = () => {
 
   return (
     <AgentPolicyRefreshContext.Provider value={{ refresh: refreshAgentPolicy }}>
-      <AgentStatusRefreshContext.Provider value={{ refresh: refreshAgentStatus }}>
-        <WithHeaderLayout
-          leftColumn={headerLeftContent}
-          rightColumn={headerRightContent}
-          tabs={headerTabs as unknown as EuiTabProps[]}
-        >
-          {content}
-        </WithHeaderLayout>
-      </AgentStatusRefreshContext.Provider>
+      <WithHeaderLayout
+        leftColumn={headerLeftContent}
+        rightColumn={headerRightContent}
+        tabs={headerTabs as unknown as EuiTabProps[]}
+      >
+        {content}
+      </WithHeaderLayout>
     </AgentPolicyRefreshContext.Provider>
   );
 };
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/list_page/index.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/list_page/index.tsx
index cdd804f60d4847..b96a2e75ec5379 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/list_page/index.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/list_page/index.tsx
@@ -15,7 +15,7 @@ import {
   EuiEmptyPrompt,
   EuiBasicTable,
   EuiLink,
-  EuiTextColor,
+  EuiToolTip,
 } from '@elastic/eui';
 import type { CriteriaWithPagination } from '@elastic/eui/src/components/basic_table/basic_table';
 import { i18n } from '@kbn/i18n';
@@ -104,21 +104,9 @@ export const AgentPolicyListPage: React.FunctionComponent<{}> = () => {
         name: i18n.translate('xpack.fleet.agentPolicyList.nameColumnTitle', {
           defaultMessage: 'Name',
         }),
-        width: '25%',
-        render: (name: string, agentPolicy: AgentPolicy) => (
-          <AgentPolicySummaryLine policy={agentPolicy} />
-        ),
-      },
-      {
-        field: 'description',
-        name: i18n.translate('xpack.fleet.agentPolicyList.descriptionColumnTitle', {
-          defaultMessage: 'Description',
-        }),
         width: '35%',
-        render: (value: string) => (
-          <EuiTextColor color="subdued" className="eui-textTruncate" title={value}>
-            {value}
-          </EuiTextColor>
+        render: (name: string, agentPolicy: AgentPolicy) => (
+          <AgentPolicySummaryLine policy={agentPolicy} withDescription={true} />
         ),
       },
       {
@@ -134,11 +122,67 @@ export const AgentPolicyListPage: React.FunctionComponent<{}> = () => {
       {
         field: 'agents',
         name: i18n.translate('xpack.fleet.agentPolicyList.agentsColumnTitle', {
-          defaultMessage: 'Agents',
+          defaultMessage: 'Unprivileged / Privileged',
         }),
         dataType: 'number',
         render: (agents: number, agentPolicy: AgentPolicy) => (
-          <LinkedAgentCount count={agents} agentPolicyId={agentPolicy.id} />
+          <EuiFlexGroup direction="row" gutterSize="xs" justifyContent="flexEnd">
+            <EuiFlexItem grow={false}>
+              <EuiToolTip
+                content={
+                  <FormattedMessage
+                    id="xpack.fleet.agentPolicyList.agentsColumn.unprivilegedAgentsTooltip"
+                    defaultMessage="Unprivileged agents"
+                  />
+                }
+              >
+                <LinkedAgentCount
+                  count={agentPolicy.unprivileged_agents || 0}
+                  agentPolicyId={agentPolicy.id}
+                  showAgentText={false}
+                  privilegeMode="unprivileged"
+                />
+              </EuiToolTip>
+            </EuiFlexItem>
+            <EuiFlexItem grow={false}>/</EuiFlexItem>
+            <EuiFlexItem grow={false}>
+              <EuiToolTip
+                content={
+                  <FormattedMessage
+                    id="xpack.fleet.agentPolicyList.agentsColumn.privilegedAgentsTooltip"
+                    defaultMessage="Privileged agents"
+                  />
+                }
+              >
+                <LinkedAgentCount
+                  count={agents - (agentPolicy.unprivileged_agents || 0)}
+                  agentPolicyId={agentPolicy.id}
+                  showAgentText={false}
+                  privilegeMode="privileged"
+                />
+              </EuiToolTip>
+            </EuiFlexItem>
+            <EuiFlexItem grow={false}>
+              <span>
+                {'('}
+                <EuiToolTip
+                  content={
+                    <FormattedMessage
+                      id="xpack.fleet.agentPolicyList.agentsColumn.totalAgentsTooltip"
+                      defaultMessage="Total agents"
+                    />
+                  }
+                >
+                  <LinkedAgentCount
+                    count={agents}
+                    agentPolicyId={agentPolicy.id}
+                    showAgentText={false}
+                  />
+                </EuiToolTip>
+                {')'}
+              </span>
+            </EuiFlexItem>
+          </EuiFlexGroup>
         ),
       },
       {
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_details/agent_details_overview.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_details/agent_details_overview.tsx
index 44c4138b16650b..197d64810c1990 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_details/agent_details_overview.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_details/agent_details_overview.tsx
@@ -206,6 +206,23 @@ export const AgentDetailsOverviewSection: React.FunctionComponent<{
                   ? agent.local_metadata.elastic.agent.log_level
                   : '-',
             },
+            {
+              title: i18n.translate('xpack.fleet.agentDetails.privilegeModeLabel', {
+                defaultMessage: 'Privilege mode',
+              }),
+              description:
+                agent.local_metadata.elastic.agent.unprivileged === true ? (
+                  <FormattedMessage
+                    id="xpack.fleet.agentDetails.privilegeModeUnprivilegedText"
+                    defaultMessage="Running as non-root"
+                  />
+                ) : (
+                  <FormattedMessage
+                    id="xpack.fleet.agentDetails.privilegeModePrivilegedText"
+                    defaultMessage="Running as root"
+                  />
+                ),
+            },
             {
               title: i18n.translate('xpack.fleet.agentDetails.releaseLabel', {
                 defaultMessage: 'Agent release',
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/components/agent_activity_button.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/components/agent_activity_button.tsx
index 7df5fc6ed01105..e8dad92b448d34 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/components/agent_activity_button.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/components/agent_activity_button.tsx
@@ -9,19 +9,31 @@ import { EuiButtonEmpty, EuiText, EuiTourStep } from '@elastic/eui';
 import React, { useEffect, useState } from 'react';
 import { FormattedMessage } from '@kbn/i18n-react';
 
+import type { TOUR_STORAGE_CONFIG } from '../../../../constants';
+import { TOUR_STORAGE_KEYS } from '../../../../constants';
 import { useStartServices } from '../../../../hooks';
 
 export const AgentActivityButton: React.FC<{
   onClickAgentActivity: () => void;
   showAgentActivityTour: { isOpen: boolean };
 }> = ({ onClickAgentActivity, showAgentActivityTour }) => {
-  const { uiSettings } = useStartServices();
+  const { storage, uiSettings } = useStartServices();
 
   const [agentActivityTourState, setAgentActivityTourState] = useState(showAgentActivityTour);
 
-  const isTourHidden = uiSettings.get('hideAgentActivityTour', false);
+  const isTourHidden =
+    uiSettings.get('hideAnnouncements', false) ||
+    (
+      storage.get(TOUR_STORAGE_KEYS.AGENT_ACTIVITY) as
+        | TOUR_STORAGE_CONFIG['AGENT_ACTIVITY']
+        | undefined
+    )?.active === false;
 
-  const setTourAsHidden = () => uiSettings.set('hideAgentActivityTour', true);
+  const setTourAsHidden = () => {
+    storage.set(TOUR_STORAGE_KEYS.AGENT_ACTIVITY, {
+      active: false,
+    } as TOUR_STORAGE_CONFIG['AGENT_ACTIVITY']);
+  };
 
   useEffect(() => {
     setAgentActivityTourState(showAgentActivityTour);
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/components/agent_status_filter.test.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/components/agent_status_filter.test.tsx
index f8e3465557a813..d840ea4a74f87b 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/components/agent_status_filter.test.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/components/agent_status_filter.test.tsx
@@ -11,6 +11,21 @@ import { __IntlProvider as IntlProvider } from '@kbn/i18n-react';
 import { AgentStatusFilter } from './agent_status_filter';
 
 const PARTIAL_TOUR_TEXT = 'Some agents have become inactive and have been hidden';
+const mockStorage: Record<any, any> = {};
+
+jest.mock('../../../../../../hooks', () => {
+  return {
+    useStartServices: jest.fn(() => ({
+      uiSettings: {
+        get: jest.fn(() => false),
+      },
+      storage: {
+        get: jest.fn((key) => mockStorage[key]),
+        set: jest.fn((key, val) => (mockStorage[key] = val)),
+      },
+    })),
+  };
+});
 
 const renderComponent = (props: React.ComponentProps<typeof AgentStatusFilter>) => {
   return render(
@@ -20,18 +35,7 @@ const renderComponent = (props: React.ComponentProps<typeof AgentStatusFilter>)
   );
 };
 
-const mockLocalStorage: Record<any, any> = {};
 describe('AgentStatusFilter', () => {
-  beforeEach(() => {
-    Object.defineProperty(window, 'localStorage', {
-      value: {
-        getItem: jest.fn((key) => mockLocalStorage[key]),
-        setItem: jest.fn((key, val) => (mockLocalStorage[key] = val)),
-      },
-      writable: true,
-    });
-  });
-
   it('Renders all statuses', () => {
     const { getByText } = renderComponent({
       selectedStatus: [],
@@ -70,12 +74,12 @@ describe('AgentStatusFilter', () => {
 
       expect(getByText('999')).toBeInTheDocument();
 
-      expect(mockLocalStorage['fleet.inactiveAgentsCalloutHasBeenDismissed']).toBe('true');
+      expect(mockStorage['fleet.inactiveAgentsTour']).toEqual({ active: false });
     });
   });
 
   it('Should not show tour if previously been dismissed', async () => {
-    mockLocalStorage['fleet.inactiveAgentsCalloutHasBeenDismissed'] = 'true';
+    mockStorage['fleet.inactiveAgentsTour'] = { active: false };
 
     const { getByText } = renderComponent({
       selectedStatus: [],
@@ -89,7 +93,7 @@ describe('AgentStatusFilter', () => {
   });
 
   it('Should should show difference between last seen inactive agents and total agents', async () => {
-    mockLocalStorage['fleet.lastSeenInactiveAgentsCount'] = '100';
+    mockStorage['fleet.lastSeenInactiveAgentsCount'] = '100';
 
     const { getByText, getByTestId } = renderComponent({
       selectedStatus: [],
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/hooks/use_inactive_agents_callout_has_been_dismissed.ts b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/hooks/use_inactive_agents_callout_has_been_dismissed.ts
index c9b3d1248a68bd..2858b4be25f7c3 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/hooks/use_inactive_agents_callout_has_been_dismissed.ts
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/hooks/use_inactive_agents_callout_has_been_dismissed.ts
@@ -7,21 +7,31 @@
 
 import { useState, useEffect } from 'react';
 
-const LOCAL_STORAGE_KEY = 'fleet.inactiveAgentsCalloutHasBeenDismissed';
+import type { TOUR_STORAGE_CONFIG } from '../../../../../../constants';
+import { TOUR_STORAGE_KEYS } from '../../../../../../constants';
+import { useStartServices } from '../../../../../../hooks';
 
 export const useInactiveAgentsCalloutHasBeenDismissed = (): [boolean, (val: boolean) => void] => {
+  const { uiSettings, storage } = useStartServices();
+
   const [inactiveAgentsCalloutHasBeenDismissed, setInactiveAgentsCalloutHasBeenDismissed] =
     useState(false);
 
   useEffect(() => {
-    const storageValue = localStorage.getItem(LOCAL_STORAGE_KEY);
-    if (storageValue) {
-      setInactiveAgentsCalloutHasBeenDismissed(Boolean(storageValue));
-    }
-  }, []);
+    setInactiveAgentsCalloutHasBeenDismissed(
+      uiSettings.get('hideAnnouncements', false) ||
+        (
+          storage.get(TOUR_STORAGE_KEYS.INACTIVE_AGENTS) as
+            | TOUR_STORAGE_CONFIG['INACTIVE_AGENTS']
+            | undefined
+        )?.active === false
+    );
+  }, [storage, uiSettings]);
 
   const updateInactiveAgentsCalloutHasBeenDismissed = (newValue: boolean) => {
-    localStorage.setItem(LOCAL_STORAGE_KEY, newValue.toString());
+    storage.set(TOUR_STORAGE_KEYS.INACTIVE_AGENTS, {
+      active: false,
+    } as TOUR_STORAGE_CONFIG['INACTIVE_AGENTS']);
     setInactiveAgentsCalloutHasBeenDismissed(newValue);
   };
 
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/hooks/use_last_seen_inactive_agents_count.ts b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/hooks/use_last_seen_inactive_agents_count.ts
index e1baf8f277ff10..f875d093061f34 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/hooks/use_last_seen_inactive_agents_count.ts
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/hooks/use_last_seen_inactive_agents_count.ts
@@ -7,19 +7,22 @@
 
 import { useState, useEffect } from 'react';
 
+import { useStartServices } from '../../../../../../hooks';
+
 const LOCAL_STORAGE_KEY = 'fleet.lastSeenInactiveAgentsCount';
 
 export const useLastSeenInactiveAgentsCount = (): [number, (val: number) => void] => {
+  const { storage } = useStartServices();
   const [lastSeenInactiveAgentsCount, setLastSeenInactiveAgentsCount] = useState(0);
   useEffect(() => {
-    const storageValue = localStorage.getItem(LOCAL_STORAGE_KEY);
+    const storageValue = storage.get(LOCAL_STORAGE_KEY);
     if (storageValue) {
       setLastSeenInactiveAgentsCount(parseInt(storageValue, 10));
     }
-  }, []);
+  }, [storage]);
 
   const updateLastSeenInactiveAgentsCount = (inactiveAgents: number) => {
-    localStorage.setItem(LOCAL_STORAGE_KEY, inactiveAgents.toString());
+    storage.set(LOCAL_STORAGE_KEY, inactiveAgents.toString());
     setLastSeenInactiveAgentsCount(inactiveAgents);
   };
 
diff --git a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/index.tsx b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/index.tsx
index 8e594f6c8d7d9d..c688da76819d4d 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/index.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/index.tsx
@@ -137,6 +137,7 @@ export function Detail() {
   const prerelease = useMemo(() => Boolean(queryParams.get('prerelease')), [queryParams]);
 
   const authz = useAuthz();
+  const canAddAgent = authz.fleet.addAgents;
   const canInstallPackages = authz.integrations.installPackages;
   const canReadPackageSettings = authz.integrations.readPackageSettings;
   const canReadIntegrationPolicies = authz.integrations.readIntegrationPolicies;
@@ -268,7 +269,8 @@ export function Detail() {
     useUIExtension(packageInfoData?.item?.name ?? '', 'package-detail-custom') !== undefined;
 
   // Only show config tab if package has `inputs`
-  const showConfigTab = packageInfo ? packageToPackagePolicyInputs(packageInfo).length > 0 : false;
+  const showConfigTab =
+    canAddAgent && (packageInfo ? packageToPackagePolicyInputs(packageInfo).length > 0 : false);
 
   // Only show API references tab if it is allowed & has documentation to show
   const showDocumentationTab =
diff --git a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/settings/settings.tsx b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/settings/settings.tsx
index 5c7d73f3e67942..aa722b5eb8d489 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/settings/settings.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/settings/settings.tsx
@@ -81,20 +81,21 @@ const UpdatesAvailableMsg = ({
       defaultMessage: 'New version available',
     })}
   >
-    <EuiFlexGroup gutterSize="xs">
-      <EuiFlexItem grow={false}>
-        <FormattedMessage
-          id="xpack.fleet.integration.settings.versionInfo.updatesAvailableBody"
-          defaultMessage="Upgrade to version {latestVersion} to get the latest features."
-          values={{ latestVersion }}
-        />
-      </EuiFlexItem>
-      <EuiFlexItem>
-        <p>
-          <EuiLink onClick={toggleChangelogModal}>{'View changelog.'}</EuiLink>
-        </p>
-      </EuiFlexItem>
-    </EuiFlexGroup>
+    <FormattedMessage
+      id="xpack.fleet.integration.settings.versionInfo.updatesAvailableBody"
+      defaultMessage="Upgrade to version {latestVersion} to get the latest features. {changelogLink}"
+      values={{
+        latestVersion,
+        changelogLink: (
+          <EuiLink onClick={toggleChangelogModal}>
+            <FormattedMessage
+              id="xpack.fleet.integration.settings.versionInfo.updatesAvailableChangelogLink"
+              defaultMessage="View changelog."
+            />
+          </EuiLink>
+        ),
+      }}
+    />
   </EuiCallOut>
 );
 
diff --git a/x-pack/plugins/fleet/public/components/add_agent_help_popover.tsx b/x-pack/plugins/fleet/public/components/add_agent_help_popover.tsx
index 7d48db2436cdc9..51cc95ffe46209 100644
--- a/x-pack/plugins/fleet/public/components/add_agent_help_popover.tsx
+++ b/x-pack/plugins/fleet/public/components/add_agent_help_popover.tsx
@@ -15,6 +15,8 @@ import { useTheme } from 'styled-components';
 
 import type { EuiTheme } from '@kbn/kibana-react-plugin/common';
 
+import type { TOUR_STORAGE_CONFIG } from '../constants';
+import { TOUR_STORAGE_KEYS } from '../constants';
 import { useStartServices } from '../hooks';
 
 export const AddAgentHelpPopover = ({
@@ -28,19 +30,31 @@ export const AddAgentHelpPopover = ({
   offset?: number;
   closePopover: NoArgCallback<void>;
 }) => {
-  const { docLinks, uiSettings } = useStartServices();
+  const { docLinks, uiSettings, storage } = useStartServices();
   const theme = useTheme() as EuiTheme;
   const optionalProps: { offset?: number } = {};
-  const hideAnnouncements: boolean = useMemo(
-    () => uiSettings.get('hideAnnouncements'),
-    [uiSettings]
-  );
+  const hideAddAgentTour: boolean = useMemo(() => {
+    return (
+      uiSettings.get('hideAnnouncements', false) ||
+      (
+        storage.get(TOUR_STORAGE_KEYS.ADD_AGENT_POPOVER) as
+          | TOUR_STORAGE_CONFIG['ADD_AGENT_POPOVER']
+          | undefined
+      )?.active === false
+    );
+  }, [storage, uiSettings]);
+
+  const onFinish = () => {
+    storage.set(TOUR_STORAGE_KEYS.ADD_AGENT_POPOVER, {
+      active: false,
+    } as TOUR_STORAGE_CONFIG['ADD_AGENT_POPOVER']);
+  };
 
   if (offset !== undefined) {
     optionalProps.offset = offset; // offset being present in props sets it to 0 so only add if specified
   }
 
-  return hideAnnouncements ? (
+  return hideAddAgentTour ? (
     button
   ) : (
     <EuiTourStep
@@ -67,7 +81,7 @@ export const AddAgentHelpPopover = ({
       zIndex={theme.eui.euiZLevel1 - 1} // put popover behind any modals that happen to be open
       isStepOpen={isOpen}
       minWidth={300}
-      onFinish={() => {}}
+      onFinish={onFinish}
       step={1}
       stepsTotal={1}
       title={
@@ -82,6 +96,7 @@ export const AddAgentHelpPopover = ({
       footerAction={
         <EuiLink
           onClick={() => {
+            onFinish();
             closePopover();
           }}
         >
diff --git a/x-pack/plugins/fleet/public/components/link_and_revision.tsx b/x-pack/plugins/fleet/public/components/link_and_revision.tsx
index 00c7e8f76371c2..5d0f0070f6668e 100644
--- a/x-pack/plugins/fleet/public/components/link_and_revision.tsx
+++ b/x-pack/plugins/fleet/public/components/link_and_revision.tsx
@@ -20,59 +20,74 @@ export const AgentPolicySummaryLine = memo<{
   policy: AgentPolicy;
   agent?: Agent;
   direction?: 'column' | 'row';
-}>(({ policy, agent, direction = 'row' }) => {
+  withDescription?: boolean;
+}>(({ policy, agent, direction = 'row', withDescription = false }) => {
   const { getHref } = useLink();
-  const { name, id, is_managed: isManaged } = policy;
+  const { name, id, is_managed: isManaged, description } = policy;
 
   const revision = agent ? agent.policy_revision : policy.revision;
 
   return (
-    <EuiFlexGroup
-      direction={direction}
-      gutterSize={direction === 'column' ? 'none' : 's'}
-      alignItems="baseline"
-      style={MIN_WIDTH}
-      responsive={false}
-      justifyContent={'flexStart'}
-    >
-      <EuiFlexItem grow={false} className="eui-textTruncate">
-        <EuiFlexGroup style={MIN_WIDTH} gutterSize="s" alignItems="baseline" responsive={false}>
+    <EuiFlexGroup direction="column" gutterSize="xs">
+      <EuiFlexItem>
+        <EuiFlexGroup
+          direction={direction}
+          gutterSize={direction === 'column' ? 'none' : 's'}
+          alignItems="baseline"
+          style={MIN_WIDTH}
+          responsive={false}
+          justifyContent={'flexStart'}
+        >
           <EuiFlexItem grow={false} className="eui-textTruncate">
-            <EuiLink
-              className={`eui-textTruncate`}
-              href={getHref('policy_details', { policyId: id })}
-              title={name || id}
-              data-test-subj="agentPolicyNameLink"
-            >
-              {name || id}
-            </EuiLink>
+            <EuiFlexGroup style={MIN_WIDTH} gutterSize="s" alignItems="baseline" responsive={false}>
+              <EuiFlexItem grow={false} className="eui-textTruncate">
+                <EuiLink
+                  className={`eui-textTruncate`}
+                  href={getHref('policy_details', { policyId: id })}
+                  title={name || id}
+                  data-test-subj="agentPolicyNameLink"
+                >
+                  {name || id}
+                </EuiLink>
+              </EuiFlexItem>
+
+              {isManaged && (
+                <EuiFlexItem grow={false}>
+                  <EuiIconTip
+                    title="Hosted agent policy"
+                    content={i18n.translate(
+                      'xpack.fleet.agentPolicySummaryLine.hostedPolicyTooltip',
+                      {
+                        defaultMessage:
+                          'This policy is managed outside of Fleet. Most actions related to this policy are unavailable.',
+                      }
+                    )}
+                    type="lock"
+                    size="m"
+                    color="subdued"
+                  />
+                </EuiFlexItem>
+              )}
+            </EuiFlexGroup>
           </EuiFlexItem>
 
-          {isManaged && (
+          {revision && (
             <EuiFlexItem grow={false}>
-              <EuiIconTip
-                title="Hosted agent policy"
-                content={i18n.translate('xpack.fleet.agentPolicySummaryLine.hostedPolicyTooltip', {
-                  defaultMessage:
-                    'This policy is managed outside of Fleet. Most actions related to this policy are unavailable.',
-                })}
-                type="lock"
-                size="m"
-                color="subdued"
-              />
+              <EuiText color="subdued" size="xs" style={NO_WRAP_WHITE_SPACE}>
+                <FormattedMessage
+                  id="xpack.fleet.agentPolicySummaryLine.revisionNumber"
+                  defaultMessage="rev. {revNumber}"
+                  values={{ revNumber: revision }}
+                />
+              </EuiText>
             </EuiFlexItem>
           )}
         </EuiFlexGroup>
       </EuiFlexItem>
-
-      {revision && (
-        <EuiFlexItem grow={false}>
-          <EuiText color="subdued" size="xs" style={NO_WRAP_WHITE_SPACE}>
-            <FormattedMessage
-              id="xpack.fleet.agentPolicySummaryLine.revisionNumber"
-              defaultMessage="rev. {revNumber}"
-              values={{ revNumber: revision }}
-            />
+      {withDescription && description && (
+        <EuiFlexItem>
+          <EuiText color="subdued" className="eui-textTruncate" title={description} size="xs">
+            {description}
           </EuiText>
         </EuiFlexItem>
       )}
diff --git a/x-pack/plugins/fleet/public/components/linked_agent_count.tsx b/x-pack/plugins/fleet/public/components/linked_agent_count.tsx
index ce0a21e7759eb0..9626e055609e8e 100644
--- a/x-pack/plugins/fleet/public/components/linked_agent_count.tsx
+++ b/x-pack/plugins/fleet/public/components/linked_agent_count.tsx
@@ -11,7 +11,7 @@ import type { EuiLinkAnchorProps } from '@elastic/eui';
 import { EuiLink } from '@elastic/eui';
 
 import { useLink } from '../hooks';
-import { AGENTS_PREFIX } from '../constants';
+import { AGENTS_PREFIX, UNPRIVILEGED_AGENT_KUERY, PRIVILEGED_AGENT_KUERY } from '../constants';
 
 /**
  * Displays the provided `count` number as a link to the Agents list if it is greater than zero
@@ -21,8 +21,9 @@ export const LinkedAgentCount = memo<
     count: number;
     agentPolicyId: string;
     showAgentText?: boolean;
+    privilegeMode?: 'privileged' | 'unprivileged';
   }
->(({ count, agentPolicyId, showAgentText, ...otherEuiLinkProps }) => {
+>(({ count, agentPolicyId, showAgentText, privilegeMode, ...otherEuiLinkProps }) => {
   const { getHref } = useLink();
   const displayValue = showAgentText ? (
     <FormattedMessage
@@ -33,13 +34,13 @@ export const LinkedAgentCount = memo<
   ) : (
     count
   );
+  const kuery = `${AGENTS_PREFIX}.policy_id : ${agentPolicyId}${
+    privilegeMode &&
+    ` and ${privilegeMode === 'unprivileged' ? UNPRIVILEGED_AGENT_KUERY : PRIVILEGED_AGENT_KUERY}`
+  }`;
+
   return count > 0 ? (
-    <EuiLink
-      {...otherEuiLinkProps}
-      href={getHref('agent_list', {
-        kuery: `${AGENTS_PREFIX}.policy_id : ${agentPolicyId}`,
-      })}
-    >
+    <EuiLink {...otherEuiLinkProps} href={getHref('agent_list', { kuery })}>
       {displayValue}
     </EuiLink>
   ) : (
diff --git a/x-pack/plugins/fleet/public/constants/index.ts b/x-pack/plugins/fleet/public/constants/index.ts
index cfcc38df4cf703..ae14fae94627c9 100644
--- a/x-pack/plugins/fleet/public/constants/index.ts
+++ b/x-pack/plugins/fleet/public/constants/index.ts
@@ -15,6 +15,8 @@ export {
   SO_SEARCH_LIMIT,
   AGENT_POLICY_SAVED_OBJECT_TYPE,
   AGENTS_PREFIX,
+  UNPRIVILEGED_AGENT_KUERY,
+  PRIVILEGED_AGENT_KUERY,
   PACKAGE_POLICY_SAVED_OBJECT_TYPE,
   FLEET_SERVER_PACKAGE,
   // Fleet Server index
@@ -41,3 +43,21 @@ export const DURATION_APM_SETTINGS_VARS = {
   TAIL_SAMPLING_INTERVAL: 'tail_sampling_interval',
   WRITE_TIMEOUT: 'write_timeout',
 };
+
+export const TOUR_STORAGE_KEYS = {
+  AGENT_ACTIVITY: 'fleet.agentActivityTour',
+  ADD_AGENT_POPOVER: 'fleet.addAgentPopoverTour',
+  INACTIVE_AGENTS: 'fleet.inactiveAgentsTour',
+};
+
+export interface TOUR_STORAGE_CONFIG {
+  AGENT_ACTIVITY: {
+    active: boolean;
+  };
+  ADD_AGENT_POPOVER: {
+    active: boolean;
+  };
+  INACTIVE_AGENTS: {
+    active: boolean;
+  };
+}
diff --git a/x-pack/plugins/fleet/server/constants/index.ts b/x-pack/plugins/fleet/server/constants/index.ts
index aeb946c22e62f8..55ad1f9881a8a3 100644
--- a/x-pack/plugins/fleet/server/constants/index.ts
+++ b/x-pack/plugins/fleet/server/constants/index.ts
@@ -16,6 +16,8 @@ export {
   AGENT_POLICY_ROLLOUT_RATE_LIMIT_REQUEST_PER_INTERVAL,
   AGENT_POLICY_ROLLOUT_RATE_LIMIT_INTERVAL_MS,
   AGENT_UPDATE_ACTIONS_INTERVAL_MS,
+  UNPRIVILEGED_AGENT_KUERY,
+  PRIVILEGED_AGENT_KUERY,
   MAX_TIME_COMPLETE_INSTALL,
   // Routes
   LIMITED_CONCURRENCY_ROUTE_TAG,
diff --git a/x-pack/plugins/fleet/server/plugin.ts b/x-pack/plugins/fleet/server/plugin.ts
index c24f7859b11896..02e6d7baf95776 100644
--- a/x-pack/plugins/fleet/server/plugin.ts
+++ b/x-pack/plugins/fleet/server/plugin.ts
@@ -288,10 +288,13 @@ export class FleetPlugin
 
     core.status.set(this.fleetStatus$.asObservable());
 
-    registerSavedObjects(core.savedObjects);
+    const experimentalFeatures = parseExperimentalConfigValue(config.enableExperimental ?? []);
+
+    registerSavedObjects(core.savedObjects, {
+      useSpaceAwareness: experimentalFeatures.useSpaceAwareness,
+    });
     registerEncryptedSavedObjects(deps.encryptedSavedObjects);
 
-    const experimentalFeatures = parseExperimentalConfigValue(config.enableExperimental ?? []);
     // Register feature
     if (deps.features) {
       deps.features.registerKibanaFeature({
diff --git a/x-pack/plugins/fleet/server/routes/agent_policy/handlers.ts b/x-pack/plugins/fleet/server/routes/agent_policy/handlers.ts
index c4c31214da332c..0893d93db9b33b 100644
--- a/x-pack/plugins/fleet/server/routes/agent_policy/handlers.ts
+++ b/x-pack/plugins/fleet/server/routes/agent_policy/handlers.ts
@@ -20,7 +20,7 @@ import { HTTPAuthorizationHeader } from '../../../common/http_authorization_head
 import { fullAgentPolicyToYaml } from '../../../common/services';
 import { appContextService, agentPolicyService } from '../../services';
 import { getAgentsByKuery, getLatestAvailableAgentVersion } from '../../services/agents';
-import { AGENTS_PREFIX } from '../../constants';
+import { AGENTS_PREFIX, UNPRIVILEGED_AGENT_KUERY } from '../../constants';
 import type {
   GetAgentPoliciesRequestSchema,
   GetOneAgentPolicyRequestSchema,
@@ -62,13 +62,21 @@ export async function populateAssignedAgentsCount(
 ) {
   await pMap(
     agentPolicies,
-    (agentPolicy: GetAgentPoliciesResponseItem) =>
-      getAgentsByKuery(esClient, soClient, {
+    (agentPolicy: GetAgentPoliciesResponseItem) => {
+      const totalAgents = getAgentsByKuery(esClient, soClient, {
         showInactive: false,
         perPage: 0,
         page: 1,
         kuery: `${AGENTS_PREFIX}.policy_id:${agentPolicy.id}`,
-      }).then(({ total: agentTotal }) => (agentPolicy.agents = agentTotal)),
+      }).then(({ total }) => (agentPolicy.agents = total));
+      const unprivilegedAgents = getAgentsByKuery(esClient, soClient, {
+        showInactive: false,
+        perPage: 0,
+        page: 1,
+        kuery: `${AGENTS_PREFIX}.policy_id:${agentPolicy.id} and ${UNPRIVILEGED_AGENT_KUERY}`,
+      }).then(({ total }) => (agentPolicy.unprivileged_agents = total));
+      return Promise.all([totalAgents, unprivilegedAgents]);
+    },
     { concurrency: 10 }
   );
 }
diff --git a/x-pack/plugins/fleet/server/routes/epm/index.ts b/x-pack/plugins/fleet/server/routes/epm/index.ts
index 7d2a756ffd6de5..9108ab1df32df2 100644
--- a/x-pack/plugins/fleet/server/routes/epm/index.ts
+++ b/x-pack/plugins/fleet/server/routes/epm/index.ts
@@ -192,7 +192,7 @@ export const registerRoutes = (router: FleetAuthzRouter) => {
     .put({
       path: EPM_API_ROUTES.INFO_PATTERN,
       fleetAuthz: {
-        integrations: { upgradePackages: true, writePackageSettings: true },
+        integrations: { writePackageSettings: true },
       },
     })
     .addVersion(
@@ -359,7 +359,7 @@ export const registerRoutes = (router: FleetAuthzRouter) => {
       path: EPM_API_ROUTES.INFO_PATTERN_DEPRECATED,
 
       fleetAuthz: {
-        integrations: { upgradePackages: true, writePackageSettings: true },
+        integrations: { writePackageSettings: true },
       },
     })
     .addVersion(
diff --git a/x-pack/plugins/fleet/server/routes/package_policy/handlers.ts b/x-pack/plugins/fleet/server/routes/package_policy/handlers.ts
index 7631e38f8df31a..86d9be70435a5d 100644
--- a/x-pack/plugins/fleet/server/routes/package_policy/handlers.ts
+++ b/x-pack/plugins/fleet/server/routes/package_policy/handlers.ts
@@ -48,7 +48,12 @@ import {
   PackagePolicyNotFoundError,
   PackagePolicyRequestError,
 } from '../../errors';
-import { getInstallations, getPackageInfo } from '../../services/epm/packages';
+import {
+  getInstallation,
+  getInstallations,
+  getPackageInfo,
+  removeInstallation,
+} from '../../services/epm/packages';
 import { PACKAGES_SAVED_OBJECT_TYPE, SO_SEARCH_LIMIT } from '../../constants';
 import {
   simplifiedPackagePolicytoNewPackagePolicy,
@@ -229,6 +234,7 @@ export const createPackagePolicyHandler: FleetRequestHandler<
   const user = appContextService.getSecurity()?.authc.getCurrentUser(request) || undefined;
   const { force, id, package: pkg, ...newPolicy } = request.body;
   const authorizationHeader = HTTPAuthorizationHeader.parseFromRequest(request, user?.username);
+  let wasPackageAlreadyInstalled = false;
 
   if ('output_id' in newPolicy) {
     // TODO Remove deprecated APIs https://github.com/elastic/kibana/issues/121485
@@ -258,6 +264,12 @@ export const createPackagePolicyHandler: FleetRequestHandler<
       } as NewPackagePolicy);
     }
 
+    const installation = await getInstallation({
+      savedObjectsClient: soClient,
+      pkgName: pkg!.name,
+    });
+    wasPackageAlreadyInstalled = installation?.install_status === 'installed';
+
     // Create package policy
     const packagePolicy = await fleetContext.packagePolicyService.asCurrentUser.create(
       soClient,
@@ -282,6 +294,27 @@ export const createPackagePolicyHandler: FleetRequestHandler<
       },
     });
   } catch (error) {
+    appContextService
+      .getLogger()
+      .error(`Error while creating package policy due to error: ${error.message}`);
+    if (!wasPackageAlreadyInstalled) {
+      const installation = await getInstallation({
+        savedObjectsClient: soClient,
+        pkgName: pkg!.name,
+      });
+      if (installation) {
+        appContextService
+          .getLogger()
+          .info(`rollback ${pkg!.name}-${pkg!.version} package installation after error`);
+        await removeInstallation({
+          savedObjectsClient: soClient,
+          pkgName: pkg!.name,
+          pkgVersion: pkg!.version,
+          esClient,
+        });
+      }
+    }
+
     if (error.statusCode) {
       return response.customError({
         statusCode: error.statusCode,
diff --git a/x-pack/plugins/fleet/server/saved_objects/index.ts b/x-pack/plugins/fleet/server/saved_objects/index.ts
index d1ed80cce4e437..22b5aa3f5fddbb 100644
--- a/x-pack/plugins/fleet/server/saved_objects/index.ts
+++ b/x-pack/plugins/fleet/server/saved_objects/index.ts
@@ -92,259 +92,216 @@ import { settingsV1 } from './model_versions/v1';
  * Please update typings in `/common/types` as well as
  * schemas in `/server/types` if mappings are updated.
  */
-export const getSavedObjectTypes = (): { [key: string]: SavedObjectsType } => ({
-  // Deprecated
-  [GLOBAL_SETTINGS_SAVED_OBJECT_TYPE]: {
-    name: GLOBAL_SETTINGS_SAVED_OBJECT_TYPE,
-    indexPattern: INGEST_SAVED_OBJECT_INDEX,
-    hidden: false,
-    namespaceType: 'agnostic',
-    management: {
-      importableAndExportable: false,
-    },
-    mappings: {
-      properties: {
-        fleet_server_hosts: { type: 'keyword' },
-        has_seen_add_data_notice: { type: 'boolean', index: false },
-        prerelease_integrations_enabled: { type: 'boolean' },
-        secret_storage_requirements_met: { type: 'boolean' },
-        output_secret_storage_requirements_met: { type: 'boolean' },
+export const getSavedObjectTypes = (
+  options = { useSpaceAwareness: false }
+): { [key: string]: SavedObjectsType } => {
+  const { useSpaceAwareness } = options;
+
+  return {
+    // Deprecated
+    [GLOBAL_SETTINGS_SAVED_OBJECT_TYPE]: {
+      name: GLOBAL_SETTINGS_SAVED_OBJECT_TYPE,
+      indexPattern: INGEST_SAVED_OBJECT_INDEX,
+      hidden: false,
+      namespaceType: 'agnostic',
+      management: {
+        importableAndExportable: false,
       },
-    },
-    migrations: {
-      '7.10.0': migrateSettingsToV7100,
-      '7.13.0': migrateSettingsToV7130,
-      '8.6.0': migrateSettingsToV860,
-    },
-    modelVersions: {
-      1: settingsV1,
-    },
-  },
-  [AGENT_POLICY_SAVED_OBJECT_TYPE]: {
-    name: AGENT_POLICY_SAVED_OBJECT_TYPE,
-    indexPattern: INGEST_SAVED_OBJECT_INDEX,
-    hidden: false,
-    namespaceType: 'agnostic',
-    management: {
-      importableAndExportable: false,
-    },
-    mappings: {
-      properties: {
-        name: { type: 'keyword' },
-        schema_version: { type: 'version' },
-        description: { type: 'text' },
-        namespace: { type: 'keyword' },
-        is_managed: { type: 'boolean' },
-        is_default: { type: 'boolean' },
-        is_default_fleet_server: { type: 'boolean' },
-        status: { type: 'keyword' },
-        unenroll_timeout: { type: 'integer' },
-        inactivity_timeout: { type: 'integer' },
-        updated_at: { type: 'date' },
-        updated_by: { type: 'keyword' },
-        revision: { type: 'integer' },
-        monitoring_enabled: { type: 'keyword', index: false },
-        is_preconfigured: { type: 'keyword' },
-        data_output_id: { type: 'keyword' },
-        monitoring_output_id: { type: 'keyword' },
-        download_source_id: { type: 'keyword' },
-        fleet_server_host_id: { type: 'keyword' },
-        agent_features: {
-          properties: {
-            name: { type: 'keyword' },
-            enabled: { type: 'boolean' },
-          },
+      mappings: {
+        properties: {
+          fleet_server_hosts: { type: 'keyword' },
+          has_seen_add_data_notice: { type: 'boolean', index: false },
+          prerelease_integrations_enabled: { type: 'boolean' },
+          secret_storage_requirements_met: { type: 'boolean' },
+          output_secret_storage_requirements_met: { type: 'boolean' },
         },
-        is_protected: { type: 'boolean' },
-        overrides: { type: 'flattened', index: false },
-        keep_monitoring_alive: { type: 'boolean' },
-        advanced_settings: { type: 'flattened', index: false },
       },
-    },
-    migrations: {
-      '7.10.0': migrateAgentPolicyToV7100,
-      '7.12.0': migrateAgentPolicyToV7120,
-      '8.4.0': migrateAgentPolicyToV840,
-      '8.5.0': migrateAgentPolicyToV850,
-      '8.9.0': migrateAgentPolicyToV890,
-    },
-    modelVersions: {
-      '1': {
-        changes: [
-          {
-            type: 'mappings_addition',
-            addedMappings: {
-              advanced_settings: { type: 'flattened', index: false },
-            },
-          },
-        ],
+      migrations: {
+        '7.10.0': migrateSettingsToV7100,
+        '7.13.0': migrateSettingsToV7130,
+        '8.6.0': migrateSettingsToV860,
+      },
+      modelVersions: {
+        1: settingsV1,
       },
     },
-  },
-  [OUTPUT_SAVED_OBJECT_TYPE]: {
-    name: OUTPUT_SAVED_OBJECT_TYPE,
-    indexPattern: INGEST_SAVED_OBJECT_INDEX,
-    hidden: false,
-    namespaceType: 'agnostic',
-    management: {
-      importableAndExportable: false,
-    },
-    mappings: {
-      properties: {
-        output_id: { type: 'keyword', index: false },
-        name: { type: 'keyword' },
-        type: { type: 'keyword' },
-        is_default: { type: 'boolean' },
-        is_default_monitoring: { type: 'boolean' },
-        hosts: { type: 'keyword' },
-        ca_sha256: { type: 'keyword', index: false },
-        ca_trusted_fingerprint: { type: 'keyword', index: false },
-        service_token: { type: 'keyword', index: false },
-        config: { type: 'flattened' },
-        config_yaml: { type: 'text' },
-        is_preconfigured: { type: 'boolean', index: false },
-        is_internal: { type: 'boolean', index: false },
-        ssl: { type: 'binary' },
-        proxy_id: { type: 'keyword' },
-        shipper: {
-          dynamic: false, // we aren't querying or aggregating over this data, so we don't need to specify any fields
-          properties: {},
-        },
-        allow_edit: { enabled: false },
-        version: { type: 'keyword' },
-        key: { type: 'keyword' },
-        compression: { type: 'keyword' },
-        compression_level: { type: 'integer' },
-        client_id: { type: 'keyword' },
-        auth_type: { type: 'keyword' },
-        connection_type: { type: 'keyword' },
-        username: { type: 'keyword' },
-        password: { type: 'text', index: false },
-        sasl: {
-          dynamic: false,
-          properties: {
-            mechanism: { type: 'text' },
+    [AGENT_POLICY_SAVED_OBJECT_TYPE]: {
+      name: AGENT_POLICY_SAVED_OBJECT_TYPE,
+      indexPattern: INGEST_SAVED_OBJECT_INDEX,
+      hidden: false,
+      namespaceType: useSpaceAwareness ? 'single' : 'agnostic',
+      management: {
+        importableAndExportable: false,
+      },
+      mappings: {
+        properties: {
+          name: { type: 'keyword' },
+          schema_version: { type: 'version' },
+          description: { type: 'text' },
+          namespace: { type: 'keyword' },
+          is_managed: { type: 'boolean' },
+          is_default: { type: 'boolean' },
+          is_default_fleet_server: { type: 'boolean' },
+          status: { type: 'keyword' },
+          unenroll_timeout: { type: 'integer' },
+          inactivity_timeout: { type: 'integer' },
+          updated_at: { type: 'date' },
+          updated_by: { type: 'keyword' },
+          revision: { type: 'integer' },
+          monitoring_enabled: { type: 'keyword', index: false },
+          is_preconfigured: { type: 'keyword' },
+          data_output_id: { type: 'keyword' },
+          monitoring_output_id: { type: 'keyword' },
+          download_source_id: { type: 'keyword' },
+          fleet_server_host_id: { type: 'keyword' },
+          agent_features: {
+            properties: {
+              name: { type: 'keyword' },
+              enabled: { type: 'boolean' },
+            },
           },
+          is_protected: { type: 'boolean' },
+          overrides: { type: 'flattened', index: false },
+          keep_monitoring_alive: { type: 'boolean' },
+          advanced_settings: { type: 'flattened', index: false },
+          supports_agentless: { type: 'boolean' },
         },
-        partition: { type: 'keyword' },
-        random: {
-          dynamic: false,
-          properties: {
-            group_events: { type: 'integer' },
-          },
+      },
+      migrations: {
+        '7.10.0': migrateAgentPolicyToV7100,
+        '7.12.0': migrateAgentPolicyToV7120,
+        '8.4.0': migrateAgentPolicyToV840,
+        '8.5.0': migrateAgentPolicyToV850,
+        '8.9.0': migrateAgentPolicyToV890,
+      },
+      modelVersions: {
+        '1': {
+          changes: [
+            {
+              type: 'mappings_addition',
+              addedMappings: {
+                advanced_settings: { type: 'flattened', index: false },
+              },
+            },
+          ],
         },
-        round_robin: {
-          dynamic: false,
-          properties: {
-            group_events: { type: 'integer' },
-          },
+        '2': {
+          changes: [
+            {
+              type: 'mappings_addition',
+              addedMappings: {
+                supports_agentless: { type: 'boolean' },
+              },
+            },
+          ],
         },
-        hash: {
-          dynamic: false,
-          properties: {
-            hash: { type: 'text' },
-            random: { type: 'boolean' },
+      },
+    },
+    [OUTPUT_SAVED_OBJECT_TYPE]: {
+      name: OUTPUT_SAVED_OBJECT_TYPE,
+      indexPattern: INGEST_SAVED_OBJECT_INDEX,
+      hidden: false,
+      namespaceType: 'agnostic',
+      management: {
+        importableAndExportable: false,
+      },
+      mappings: {
+        properties: {
+          output_id: { type: 'keyword', index: false },
+          name: { type: 'keyword' },
+          type: { type: 'keyword' },
+          is_default: { type: 'boolean' },
+          is_default_monitoring: { type: 'boolean' },
+          hosts: { type: 'keyword' },
+          ca_sha256: { type: 'keyword', index: false },
+          ca_trusted_fingerprint: { type: 'keyword', index: false },
+          service_token: { type: 'keyword', index: false },
+          config: { type: 'flattened' },
+          config_yaml: { type: 'text' },
+          is_preconfigured: { type: 'boolean', index: false },
+          is_internal: { type: 'boolean', index: false },
+          ssl: { type: 'binary' },
+          proxy_id: { type: 'keyword' },
+          shipper: {
+            dynamic: false, // we aren't querying or aggregating over this data, so we don't need to specify any fields
+            properties: {},
+          },
+          allow_edit: { enabled: false },
+          version: { type: 'keyword' },
+          key: { type: 'keyword' },
+          compression: { type: 'keyword' },
+          compression_level: { type: 'integer' },
+          client_id: { type: 'keyword' },
+          auth_type: { type: 'keyword' },
+          connection_type: { type: 'keyword' },
+          username: { type: 'keyword' },
+          password: { type: 'text', index: false },
+          sasl: {
+            dynamic: false,
+            properties: {
+              mechanism: { type: 'text' },
+            },
           },
-        },
-        topic: { type: 'text', index: false },
-        topics: {
-          dynamic: false,
-          properties: {
-            topic: { type: 'keyword' },
-            when: {
-              dynamic: false,
-              properties: {
-                type: { type: 'text' },
-                condition: { type: 'text' },
-              },
+          partition: { type: 'keyword' },
+          random: {
+            dynamic: false,
+            properties: {
+              group_events: { type: 'integer' },
             },
           },
-        },
-        headers: {
-          dynamic: false,
-          properties: {
-            key: { type: 'text' },
-            value: { type: 'text' },
+          round_robin: {
+            dynamic: false,
+            properties: {
+              group_events: { type: 'integer' },
+            },
           },
-        },
-        timeout: { type: 'integer' },
-        broker_timeout: { type: 'integer' },
-        broker_ack_reliability: { type: 'text' },
-        broker_buffer_size: { type: 'integer' },
-        required_acks: { type: 'integer' },
-        channel_buffer_size: { type: 'integer' },
-        secrets: {
-          dynamic: false,
-          properties: {
-            password: {
-              dynamic: false,
-              properties: {
-                id: { type: 'keyword' },
-              },
+          hash: {
+            dynamic: false,
+            properties: {
+              hash: { type: 'text' },
+              random: { type: 'boolean' },
             },
-            ssl: {
-              dynamic: false,
-              properties: {
-                key: {
-                  dynamic: false,
-                  properties: {
-                    id: { type: 'keyword' },
-                  },
+          },
+          topic: { type: 'text', index: false },
+          topics: {
+            dynamic: false,
+            properties: {
+              topic: { type: 'keyword' },
+              when: {
+                dynamic: false,
+                properties: {
+                  type: { type: 'text' },
+                  condition: { type: 'text' },
                 },
               },
             },
-            service_token: {
-              dynamic: false,
-              properties: {
-                id: { type: 'keyword' },
-              },
-            },
-          },
-        },
-        preset: {
-          type: 'keyword',
-          index: false,
-        },
-      },
-    },
-    modelVersions: {
-      '1': {
-        changes: [
-          {
-            type: 'mappings_deprecation',
-            deprecatedMappings: [
-              'broker_ack_reliability',
-              'broker_buffer_size',
-              'channel_buffer_size',
-            ],
-          },
-          {
-            type: 'data_backfill',
-            backfillFn: migrateOutputToV8100,
           },
-        ],
-        schemas: {
-          forwardCompatibility: migrateOutputEvictionsFromV8100,
-        },
-      },
-      '2': {
-        changes: [
-          {
-            type: 'mappings_addition',
-            addedMappings: {
-              service_token: { type: 'keyword', index: false },
+          headers: {
+            dynamic: false,
+            properties: {
+              key: { type: 'text' },
+              value: { type: 'text' },
             },
           },
-        ],
-      },
-      '3': {
-        changes: [
-          {
-            type: 'mappings_addition',
-            addedMappings: {
-              secrets: {
+          timeout: { type: 'integer' },
+          broker_timeout: { type: 'integer' },
+          broker_ack_reliability: { type: 'text' },
+          broker_buffer_size: { type: 'integer' },
+          required_acks: { type: 'integer' },
+          channel_buffer_size: { type: 'integer' },
+          secrets: {
+            dynamic: false,
+            properties: {
+              password: {
+                dynamic: false,
                 properties: {
-                  service_token: {
+                  id: { type: 'keyword' },
+                },
+              },
+              ssl: {
+                dynamic: false,
+                properties: {
+                  key: {
                     dynamic: false,
                     properties: {
                       id: { type: 'keyword' },
@@ -352,425 +309,488 @@ export const getSavedObjectTypes = (): { [key: string]: SavedObjectsType } => ({
                   },
                 },
               },
-            },
-          },
-        ],
-      },
-      '4': {
-        changes: [
-          {
-            type: 'mappings_addition',
-            addedMappings: {
-              preset: {
-                type: 'keyword',
-                index: false,
+              service_token: {
+                dynamic: false,
+                properties: {
+                  id: { type: 'keyword' },
+                },
               },
             },
           },
-        ],
-      },
-      '5': {
-        changes: [
-          {
-            type: 'mappings_addition',
-            addedMappings: {
-              is_internal: { type: 'boolean', index: false },
-            },
+          preset: {
+            type: 'keyword',
+            index: false,
           },
-        ],
+        },
       },
-      '6': {
-        changes: [
-          {
-            type: 'mappings_addition',
-            addedMappings: {
-              topic: { type: 'text', index: false },
+      modelVersions: {
+        '1': {
+          changes: [
+            {
+              type: 'mappings_deprecation',
+              deprecatedMappings: [
+                'broker_ack_reliability',
+                'broker_buffer_size',
+                'channel_buffer_size',
+              ],
             },
-          },
-        ],
-      },
-    },
-    migrations: {
-      '7.13.0': migrateOutputToV7130,
-      '8.0.0': migrateOutputToV800,
-    },
-  },
-  [PACKAGE_POLICY_SAVED_OBJECT_TYPE]: {
-    name: PACKAGE_POLICY_SAVED_OBJECT_TYPE,
-    indexPattern: INGEST_SAVED_OBJECT_INDEX,
-    hidden: false,
-    namespaceType: 'agnostic',
-    management: {
-      importableAndExportable: false,
-    },
-    mappings: {
-      properties: {
-        name: { type: 'keyword' },
-        description: { type: 'text' },
-        namespace: { type: 'keyword' },
-        enabled: { type: 'boolean' },
-        is_managed: { type: 'boolean' },
-        policy_id: { type: 'keyword' },
-        package: {
-          properties: {
-            name: { type: 'keyword' },
-            title: { type: 'keyword' },
-            version: { type: 'keyword' },
+            {
+              type: 'data_backfill',
+              backfillFn: migrateOutputToV8100,
+            },
+          ],
+          schemas: {
+            forwardCompatibility: migrateOutputEvictionsFromV8100,
           },
         },
-        elasticsearch: {
-          dynamic: false,
-          properties: {},
+        '2': {
+          changes: [
+            {
+              type: 'mappings_addition',
+              addedMappings: {
+                service_token: { type: 'keyword', index: false },
+              },
+            },
+          ],
         },
-        vars: { type: 'flattened' },
-        inputs: {
-          dynamic: false,
-          properties: {},
+        '3': {
+          changes: [
+            {
+              type: 'mappings_addition',
+              addedMappings: {
+                secrets: {
+                  properties: {
+                    service_token: {
+                      dynamic: false,
+                      properties: {
+                        id: { type: 'keyword' },
+                      },
+                    },
+                  },
+                },
+              },
+            },
+          ],
         },
-        secret_references: { properties: { id: { type: 'keyword' } } },
-        overrides: { type: 'flattened', index: false },
-        revision: { type: 'integer' },
-        updated_at: { type: 'date' },
-        updated_by: { type: 'keyword' },
-        created_at: { type: 'date' },
-        created_by: { type: 'keyword' },
-      },
-    },
-    modelVersions: {
-      '1': {
-        changes: [
-          {
-            type: 'data_backfill',
-            backfillFn: migratePackagePolicyToV8100,
-          },
-          {
-            type: 'data_backfill',
-            backfillFn: migrateSyntheticsPackagePolicyToV8100,
-          },
-        ],
-        schemas: {
-          forwardCompatibility: migratePackagePolicyEvictionsFromV8100,
+        '4': {
+          changes: [
+            {
+              type: 'mappings_addition',
+              addedMappings: {
+                preset: {
+                  type: 'keyword',
+                  index: false,
+                },
+              },
+            },
+          ],
         },
-      },
-      '2': {
-        changes: [
-          {
-            type: 'data_backfill',
-            backfillFn: migratePackagePolicyToV8110,
-          },
-        ],
-        schemas: {
-          forwardCompatibility: migratePackagePolicyEvictionsFromV8110,
+        '5': {
+          changes: [
+            {
+              type: 'mappings_addition',
+              addedMappings: {
+                is_internal: { type: 'boolean', index: false },
+              },
+            },
+          ],
         },
-      },
-      '3': {
-        changes: [
-          {
-            type: 'data_backfill',
-            backfillFn: migratePackagePolicyToV81102,
-          },
-        ],
-        schemas: {
-          forwardCompatibility: migratePackagePolicyEvictionsFromV81102,
+        '6': {
+          changes: [
+            {
+              type: 'mappings_addition',
+              addedMappings: {
+                topic: { type: 'text', index: false },
+              },
+            },
+          ],
         },
       },
-      '4': {
-        changes: [
-          {
-            type: 'data_backfill',
-            backfillFn: migrateCspPackagePolicyToV8110,
-          },
-        ],
-      },
-      '5': {
-        changes: [
-          {
-            type: 'data_backfill',
-            backfillFn: migrateSyntheticsPackagePolicyToV8120,
-          },
-        ],
+      migrations: {
+        '7.13.0': migrateOutputToV7130,
+        '8.0.0': migrateOutputToV800,
       },
-      '6': {
-        changes: [
-          {
-            type: 'data_backfill',
-            backfillFn: migratePackagePolicyToV8140,
-          },
-        ],
+    },
+    [PACKAGE_POLICY_SAVED_OBJECT_TYPE]: {
+      name: PACKAGE_POLICY_SAVED_OBJECT_TYPE,
+      indexPattern: INGEST_SAVED_OBJECT_INDEX,
+      hidden: false,
+      namespaceType: useSpaceAwareness ? 'single' : 'agnostic',
+      management: {
+        importableAndExportable: false,
       },
-      '7': {
-        changes: [
-          {
-            type: 'data_backfill',
-            backfillFn: migratePackagePolicyEnableCapsToV8140,
+      mappings: {
+        properties: {
+          name: { type: 'keyword' },
+          description: { type: 'text' },
+          namespace: { type: 'keyword' },
+          enabled: { type: 'boolean' },
+          is_managed: { type: 'boolean' },
+          policy_id: { type: 'keyword' },
+          package: {
+            properties: {
+              name: { type: 'keyword' },
+              title: { type: 'keyword' },
+              version: { type: 'keyword' },
+            },
           },
-        ],
+          elasticsearch: {
+            dynamic: false,
+            properties: {},
+          },
+          vars: { type: 'flattened' },
+          inputs: {
+            dynamic: false,
+            properties: {},
+          },
+          secret_references: { properties: { id: { type: 'keyword' } } },
+          overrides: { type: 'flattened', index: false },
+          revision: { type: 'integer' },
+          updated_at: { type: 'date' },
+          updated_by: { type: 'keyword' },
+          created_at: { type: 'date' },
+          created_by: { type: 'keyword' },
+        },
       },
-      '8': {
-        changes: [
-          {
-            type: 'data_backfill',
-            backfillFn: migratePackagePolicyAddAntivirusRegistrationModeToV8140,
+      modelVersions: {
+        '1': {
+          changes: [
+            {
+              type: 'data_backfill',
+              backfillFn: migratePackagePolicyToV8100,
+            },
+            {
+              type: 'data_backfill',
+              backfillFn: migrateSyntheticsPackagePolicyToV8100,
+            },
+          ],
+          schemas: {
+            forwardCompatibility: migratePackagePolicyEvictionsFromV8100,
           },
-        ],
-      },
-      '9': {
-        changes: [
-          {
-            type: 'mappings_addition',
-            addedMappings: {
-              overrides: { type: 'flattened', index: false },
+        },
+        '2': {
+          changes: [
+            {
+              type: 'data_backfill',
+              backfillFn: migratePackagePolicyToV8110,
             },
+          ],
+          schemas: {
+            forwardCompatibility: migratePackagePolicyEvictionsFromV8110,
           },
-        ],
-      },
-    },
-    migrations: {
-      '7.10.0': migratePackagePolicyToV7100,
-      '7.11.0': migratePackagePolicyToV7110,
-      '7.12.0': migratePackagePolicyToV7120,
-      '7.13.0': migratePackagePolicyToV7130,
-      '7.14.0': migratePackagePolicyToV7140,
-      '7.15.0': migratePackagePolicyToV7150,
-      '7.16.0': migratePackagePolicyToV7160,
-      '8.2.0': migratePackagePolicyToV820,
-      '8.3.0': migratePackagePolicyToV830,
-      '8.4.0': migratePackagePolicyToV840,
-      '8.5.0': migratePackagePolicyToV850,
-      '8.6.0': migratePackagePolicyToV860,
-      '8.7.0': migratePackagePolicyToV870,
-      '8.8.0': migratePackagePolicyToV880,
-    },
-  },
-  [PACKAGES_SAVED_OBJECT_TYPE]: {
-    name: PACKAGES_SAVED_OBJECT_TYPE,
-    indexPattern: INGEST_SAVED_OBJECT_INDEX,
-    hidden: false,
-    namespaceType: 'agnostic',
-    management: {
-      importableAndExportable: false,
-    },
-    mappings: {
-      properties: {
-        name: { type: 'keyword' },
-        version: { type: 'keyword' },
-        internal: { type: 'boolean' },
-        keep_policies_up_to_date: { type: 'boolean', index: false },
-        es_index_patterns: {
-          dynamic: false,
-          properties: {},
         },
-        verification_status: { type: 'keyword' },
-        verification_key_id: { type: 'keyword' },
-        installed_es: {
-          type: 'nested',
-          properties: {
-            id: { type: 'keyword' },
-            type: { type: 'keyword' },
-            version: { type: 'keyword' },
-            deferred: { type: 'boolean' },
+        '3': {
+          changes: [
+            {
+              type: 'data_backfill',
+              backfillFn: migratePackagePolicyToV81102,
+            },
+          ],
+          schemas: {
+            forwardCompatibility: migratePackagePolicyEvictionsFromV81102,
           },
         },
-        latest_install_failed_attempts: { type: 'object', enabled: false },
-        latest_executed_state: { type: 'object', enabled: false },
-        installed_kibana: {
-          dynamic: false,
-          properties: {},
+        '4': {
+          changes: [
+            {
+              type: 'data_backfill',
+              backfillFn: migrateCspPackagePolicyToV8110,
+            },
+          ],
         },
-        installed_kibana_space_id: { type: 'keyword' },
-        package_assets: {
-          dynamic: false,
-          properties: {},
+        '5': {
+          changes: [
+            {
+              type: 'data_backfill',
+              backfillFn: migrateSyntheticsPackagePolicyToV8120,
+            },
+          ],
+        },
+        '6': {
+          changes: [
+            {
+              type: 'data_backfill',
+              backfillFn: migratePackagePolicyToV8140,
+            },
+          ],
         },
-        install_started_at: { type: 'date' },
-        install_version: { type: 'keyword' },
-        install_status: { type: 'keyword' },
-        install_source: { type: 'keyword' },
-        install_format_schema_version: { type: 'version' },
-        experimental_data_stream_features: {
-          type: 'nested',
-          properties: {
-            data_stream: { type: 'keyword' },
-            features: {
-              type: 'nested',
-              dynamic: false,
-              properties: {
-                synthetic_source: { type: 'boolean' },
-                tsdb: { type: 'boolean' },
+        '7': {
+          changes: [
+            {
+              type: 'data_backfill',
+              backfillFn: migratePackagePolicyEnableCapsToV8140,
+            },
+          ],
+        },
+        '8': {
+          changes: [
+            {
+              type: 'data_backfill',
+              backfillFn: migratePackagePolicyAddAntivirusRegistrationModeToV8140,
+            },
+          ],
+        },
+        '9': {
+          changes: [
+            {
+              type: 'mappings_addition',
+              addedMappings: {
+                overrides: { type: 'flattened', index: false },
               },
             },
-          },
+          ],
         },
       },
+      migrations: {
+        '7.10.0': migratePackagePolicyToV7100,
+        '7.11.0': migratePackagePolicyToV7110,
+        '7.12.0': migratePackagePolicyToV7120,
+        '7.13.0': migratePackagePolicyToV7130,
+        '7.14.0': migratePackagePolicyToV7140,
+        '7.15.0': migratePackagePolicyToV7150,
+        '7.16.0': migratePackagePolicyToV7160,
+        '8.2.0': migratePackagePolicyToV820,
+        '8.3.0': migratePackagePolicyToV830,
+        '8.4.0': migratePackagePolicyToV840,
+        '8.5.0': migratePackagePolicyToV850,
+        '8.6.0': migratePackagePolicyToV860,
+        '8.7.0': migratePackagePolicyToV870,
+        '8.8.0': migratePackagePolicyToV880,
+      },
     },
-    modelVersions: {
-      '1': {
-        changes: [
-          {
-            type: 'mappings_addition',
-            addedMappings: {
-              latest_install_failed_attempts: { type: 'object', enabled: false },
+    [PACKAGES_SAVED_OBJECT_TYPE]: {
+      name: PACKAGES_SAVED_OBJECT_TYPE,
+      indexPattern: INGEST_SAVED_OBJECT_INDEX,
+      hidden: false,
+      namespaceType: useSpaceAwareness ? 'single' : 'agnostic',
+      management: {
+        importableAndExportable: false,
+      },
+      mappings: {
+        properties: {
+          name: { type: 'keyword' },
+          version: { type: 'keyword' },
+          internal: { type: 'boolean' },
+          keep_policies_up_to_date: { type: 'boolean', index: false },
+          es_index_patterns: {
+            dynamic: false,
+            properties: {},
+          },
+          verification_status: { type: 'keyword' },
+          verification_key_id: { type: 'keyword' },
+          installed_es: {
+            type: 'nested',
+            properties: {
+              id: { type: 'keyword' },
+              type: { type: 'keyword' },
+              version: { type: 'keyword' },
+              deferred: { type: 'boolean' },
             },
           },
-        ],
-      },
-      '2': {
-        changes: [
-          {
-            type: 'mappings_addition',
-            addedMappings: {
-              latest_executed_state: { type: 'object', enabled: false },
+          latest_install_failed_attempts: { type: 'object', enabled: false },
+          latest_executed_state: { type: 'object', enabled: false },
+          installed_kibana: {
+            dynamic: false,
+            properties: {},
+          },
+          installed_kibana_space_id: { type: 'keyword' },
+          package_assets: {
+            dynamic: false,
+            properties: {},
+          },
+          install_started_at: { type: 'date' },
+          install_version: { type: 'keyword' },
+          install_status: { type: 'keyword' },
+          install_source: { type: 'keyword' },
+          install_format_schema_version: { type: 'version' },
+          experimental_data_stream_features: {
+            type: 'nested',
+            properties: {
+              data_stream: { type: 'keyword' },
+              features: {
+                type: 'nested',
+                dynamic: false,
+                properties: {
+                  synthetic_source: { type: 'boolean' },
+                  tsdb: { type: 'boolean' },
+                },
+              },
             },
           },
-        ],
+        },
       },
-    },
-    migrations: {
-      '7.14.0': migrateInstallationToV7140,
-      '7.14.1': migrateInstallationToV7140,
-      '7.16.0': migrateInstallationToV7160,
-      '8.0.0': migrateInstallationToV800,
-      '8.3.0': migrateInstallationToV830,
-      '8.4.0': migrateInstallationToV840,
-      '8.6.0': migrateInstallationToV860,
-    },
-  },
-  [ASSETS_SAVED_OBJECT_TYPE]: {
-    name: ASSETS_SAVED_OBJECT_TYPE,
-    indexPattern: INGEST_SAVED_OBJECT_INDEX,
-    hidden: false,
-    namespaceType: 'agnostic',
-    management: {
-      importableAndExportable: false,
-    },
-    mappings: {
-      properties: {
-        package_name: { type: 'keyword' },
-        package_version: { type: 'keyword' },
-        install_source: { type: 'keyword' },
-        asset_path: { type: 'keyword' },
-        media_type: { type: 'keyword' },
-        data_utf8: { type: 'text', index: false },
-        data_base64: { type: 'binary' },
+      modelVersions: {
+        '1': {
+          changes: [
+            {
+              type: 'mappings_addition',
+              addedMappings: {
+                latest_install_failed_attempts: { type: 'object', enabled: false },
+              },
+            },
+          ],
+        },
+        '2': {
+          changes: [
+            {
+              type: 'mappings_addition',
+              addedMappings: {
+                latest_executed_state: { type: 'object', enabled: false },
+              },
+            },
+          ],
+        },
       },
-    },
-  },
-  [PRECONFIGURATION_DELETION_RECORD_SAVED_OBJECT_TYPE]: {
-    name: PRECONFIGURATION_DELETION_RECORD_SAVED_OBJECT_TYPE,
-    indexPattern: INGEST_SAVED_OBJECT_INDEX,
-    hidden: false,
-    namespaceType: 'agnostic',
-    management: {
-      importableAndExportable: false,
-    },
-    mappings: {
-      properties: {
-        id: { type: 'keyword' },
+      migrations: {
+        '7.14.0': migrateInstallationToV7140,
+        '7.14.1': migrateInstallationToV7140,
+        '7.16.0': migrateInstallationToV7160,
+        '8.0.0': migrateInstallationToV800,
+        '8.3.0': migrateInstallationToV830,
+        '8.4.0': migrateInstallationToV840,
+        '8.6.0': migrateInstallationToV860,
       },
     },
-  },
-  [DOWNLOAD_SOURCE_SAVED_OBJECT_TYPE]: {
-    name: DOWNLOAD_SOURCE_SAVED_OBJECT_TYPE,
-    indexPattern: INGEST_SAVED_OBJECT_INDEX,
-    hidden: false,
-    namespaceType: 'agnostic',
-    management: {
-      importableAndExportable: false,
-    },
-    mappings: {
-      properties: {
-        source_id: { type: 'keyword', index: false },
-        name: { type: 'keyword' },
-        is_default: { type: 'boolean' },
-        host: { type: 'keyword' },
-        proxy_id: { type: 'keyword' },
+    [ASSETS_SAVED_OBJECT_TYPE]: {
+      name: ASSETS_SAVED_OBJECT_TYPE,
+      indexPattern: INGEST_SAVED_OBJECT_INDEX,
+      hidden: false,
+      namespaceType: useSpaceAwareness ? 'single' : 'agnostic',
+      management: {
+        importableAndExportable: false,
+      },
+      mappings: {
+        properties: {
+          package_name: { type: 'keyword' },
+          package_version: { type: 'keyword' },
+          install_source: { type: 'keyword' },
+          asset_path: { type: 'keyword' },
+          media_type: { type: 'keyword' },
+          data_utf8: { type: 'text', index: false },
+          data_base64: { type: 'binary' },
+        },
       },
     },
-  },
-  [FLEET_SERVER_HOST_SAVED_OBJECT_TYPE]: {
-    name: FLEET_SERVER_HOST_SAVED_OBJECT_TYPE,
-    indexPattern: INGEST_SAVED_OBJECT_INDEX,
-    hidden: false,
-    namespaceType: 'agnostic',
-    management: {
-      importableAndExportable: false,
+    [PRECONFIGURATION_DELETION_RECORD_SAVED_OBJECT_TYPE]: {
+      name: PRECONFIGURATION_DELETION_RECORD_SAVED_OBJECT_TYPE,
+      indexPattern: INGEST_SAVED_OBJECT_INDEX,
+      hidden: false,
+      namespaceType: useSpaceAwareness ? 'single' : 'agnostic',
+      management: {
+        importableAndExportable: false,
+      },
+      mappings: {
+        properties: {
+          id: { type: 'keyword' },
+        },
+      },
     },
-    mappings: {
-      properties: {
-        name: { type: 'keyword' },
-        is_default: { type: 'boolean' },
-        is_internal: { type: 'boolean', index: false },
-        host_urls: { type: 'keyword', index: false },
-        is_preconfigured: { type: 'boolean' },
-        proxy_id: { type: 'keyword' },
+    [DOWNLOAD_SOURCE_SAVED_OBJECT_TYPE]: {
+      name: DOWNLOAD_SOURCE_SAVED_OBJECT_TYPE,
+      indexPattern: INGEST_SAVED_OBJECT_INDEX,
+      hidden: false,
+      namespaceType: useSpaceAwareness ? 'single' : 'agnostic',
+      management: {
+        importableAndExportable: false,
+      },
+      mappings: {
+        properties: {
+          source_id: { type: 'keyword', index: false },
+          name: { type: 'keyword' },
+          is_default: { type: 'boolean' },
+          host: { type: 'keyword' },
+          proxy_id: { type: 'keyword' },
+        },
       },
     },
-    modelVersions: {
-      '1': {
-        changes: [
-          {
-            type: 'mappings_addition',
-            addedMappings: {
-              is_internal: { type: 'boolean', index: false },
+    [FLEET_SERVER_HOST_SAVED_OBJECT_TYPE]: {
+      name: FLEET_SERVER_HOST_SAVED_OBJECT_TYPE,
+      indexPattern: INGEST_SAVED_OBJECT_INDEX,
+      hidden: false,
+      namespaceType: 'agnostic',
+      management: {
+        importableAndExportable: false,
+      },
+      mappings: {
+        properties: {
+          name: { type: 'keyword' },
+          is_default: { type: 'boolean' },
+          is_internal: { type: 'boolean', index: false },
+          host_urls: { type: 'keyword', index: false },
+          is_preconfigured: { type: 'boolean' },
+          proxy_id: { type: 'keyword' },
+        },
+      },
+      modelVersions: {
+        '1': {
+          changes: [
+            {
+              type: 'mappings_addition',
+              addedMappings: {
+                is_internal: { type: 'boolean', index: false },
+              },
             },
-          },
-        ],
+          ],
+        },
       },
     },
-  },
-  [FLEET_PROXY_SAVED_OBJECT_TYPE]: {
-    name: FLEET_PROXY_SAVED_OBJECT_TYPE,
-    indexPattern: INGEST_SAVED_OBJECT_INDEX,
-    hidden: false,
-    namespaceType: 'agnostic',
-    management: {
-      importableAndExportable: false,
-    },
-    mappings: {
-      properties: {
-        name: { type: 'keyword' },
-        url: { type: 'keyword', index: false },
-        proxy_headers: { type: 'text', index: false },
-        certificate_authorities: { type: 'keyword', index: false },
-        certificate: { type: 'keyword', index: false },
-        certificate_key: { type: 'keyword', index: false },
-        is_preconfigured: { type: 'boolean' },
+    [FLEET_PROXY_SAVED_OBJECT_TYPE]: {
+      name: FLEET_PROXY_SAVED_OBJECT_TYPE,
+      indexPattern: INGEST_SAVED_OBJECT_INDEX,
+      hidden: false,
+      namespaceType: 'agnostic',
+      management: {
+        importableAndExportable: false,
+      },
+      mappings: {
+        properties: {
+          name: { type: 'keyword' },
+          url: { type: 'keyword', index: false },
+          proxy_headers: { type: 'text', index: false },
+          certificate_authorities: { type: 'keyword', index: false },
+          certificate: { type: 'keyword', index: false },
+          certificate_key: { type: 'keyword', index: false },
+          is_preconfigured: { type: 'boolean' },
+        },
       },
     },
-  },
-  [MESSAGE_SIGNING_KEYS_SAVED_OBJECT_TYPE]: {
-    name: MESSAGE_SIGNING_KEYS_SAVED_OBJECT_TYPE,
-    indexPattern: INGEST_SAVED_OBJECT_INDEX,
-    hidden: true,
-    namespaceType: 'agnostic',
-    management: {
-      importableAndExportable: false,
-    },
-    mappings: {
-      dynamic: false,
-      properties: {},
-    },
-  },
-  [UNINSTALL_TOKENS_SAVED_OBJECT_TYPE]: {
-    name: UNINSTALL_TOKENS_SAVED_OBJECT_TYPE,
-    indexPattern: INGEST_SAVED_OBJECT_INDEX,
-    hidden: true,
-    namespaceType: 'agnostic',
-    management: {
-      importableAndExportable: false,
+    [MESSAGE_SIGNING_KEYS_SAVED_OBJECT_TYPE]: {
+      name: MESSAGE_SIGNING_KEYS_SAVED_OBJECT_TYPE,
+      indexPattern: INGEST_SAVED_OBJECT_INDEX,
+      hidden: true,
+      namespaceType: useSpaceAwareness ? 'single' : 'agnostic',
+      management: {
+        importableAndExportable: false,
+      },
+      mappings: {
+        dynamic: false,
+        properties: {},
+      },
     },
-    mappings: {
-      dynamic: false,
-      properties: {
-        policy_id: { type: 'keyword' },
-        token_plain: { type: 'keyword' },
+    [UNINSTALL_TOKENS_SAVED_OBJECT_TYPE]: {
+      name: UNINSTALL_TOKENS_SAVED_OBJECT_TYPE,
+      indexPattern: INGEST_SAVED_OBJECT_INDEX,
+      hidden: true,
+      namespaceType: useSpaceAwareness ? 'single' : 'agnostic',
+      management: {
+        importableAndExportable: false,
+      },
+      mappings: {
+        dynamic: false,
+        properties: {
+          policy_id: { type: 'keyword' },
+          token_plain: { type: 'keyword' },
+        },
       },
     },
-  },
-});
+  };
+};
 
-export function registerSavedObjects(savedObjects: SavedObjectsServiceSetup) {
-  const savedObjectTypes = getSavedObjectTypes();
+export function registerSavedObjects(
+  savedObjects: SavedObjectsServiceSetup,
+  options = { useSpaceAwareness: false }
+) {
+  const savedObjectTypes = getSavedObjectTypes({ useSpaceAwareness: options.useSpaceAwareness });
   Object.values(savedObjectTypes).forEach((type) => {
     savedObjects.registerType(type);
   });
diff --git a/x-pack/plugins/fleet/server/services/agent_policy.test.ts b/x-pack/plugins/fleet/server/services/agent_policy.test.ts
index f844fce46c83e1..1f6ae15606c462 100644
--- a/x-pack/plugins/fleet/server/services/agent_policy.test.ts
+++ b/x-pack/plugins/fleet/server/services/agent_policy.test.ts
@@ -17,6 +17,7 @@ import {
   PackagePolicyRestrictionRelatedError,
   FleetUnauthorizedError,
   HostedAgentPolicyRestrictionRelatedError,
+  AgentPolicyInvalidError,
 } from '../errors';
 import type {
   AgentPolicy,
@@ -114,7 +115,7 @@ function getAgentPolicyCreateMock() {
   return soClient;
 }
 let mockedLogger: jest.Mocked<Logger>;
-describe('agent policy', () => {
+describe('Agent policy', () => {
   beforeEach(() => {
     mockedLogger = loggerMock.create();
     mockedAppContextService.getLogger.mockReturnValue(mockedLogger);
@@ -228,6 +229,74 @@ describe('agent policy', () => {
         new FleetUnauthorizedError('Tamper protection requires Platinum license')
       );
     });
+
+    it('should throw AgentPolicyInvalidError if support_agentless is defined in stateful', async () => {
+      jest
+        .spyOn(appContextService, 'getExperimentalFeatures')
+        .mockReturnValue({ agentless: false } as any);
+      jest
+        .spyOn(appContextService, 'getCloud')
+        .mockReturnValue({ isServerlessEnabled: false } as any);
+
+      const soClient = getAgentPolicyCreateMock();
+      const esClient = elasticsearchServiceMock.createClusterClient().asInternalUser;
+
+      await expect(
+        agentPolicyService.create(soClient, esClient, {
+          name: 'test',
+          namespace: 'default',
+          supports_agentless: true,
+        })
+      ).rejects.toThrowError(
+        new AgentPolicyInvalidError(
+          'supports_agentless is only allowed in serverless environments that support the agentless feature'
+        )
+      );
+    });
+
+    it('should throw AgentPolicyInvalidError if agentless feature flag is disabled in serverless', async () => {
+      jest
+        .spyOn(appContextService, 'getExperimentalFeatures')
+        .mockReturnValue({ agentless: false } as any);
+      jest
+        .spyOn(appContextService, 'getCloud')
+        .mockReturnValue({ isServerlessEnabled: true } as any);
+
+      const soClient = getAgentPolicyCreateMock();
+      const esClient = elasticsearchServiceMock.createClusterClient().asInternalUser;
+
+      await expect(
+        agentPolicyService.create(soClient, esClient, {
+          name: 'test',
+          namespace: 'default',
+          supports_agentless: true,
+        })
+      ).rejects.toThrowError(
+        new AgentPolicyInvalidError(
+          'supports_agentless is only allowed in serverless environments that support the agentless feature'
+        )
+      );
+    });
+
+    it('should not throw error if support_agentless is set if agentless feature flag is set in serverless', async () => {
+      jest
+        .spyOn(appContextService, 'getExperimentalFeatures')
+        .mockReturnValue({ agentless: true } as any);
+      jest
+        .spyOn(appContextService, 'getCloud')
+        .mockReturnValue({ isServerlessEnabled: true } as any);
+
+      const soClient = getAgentPolicyCreateMock();
+      const esClient = elasticsearchServiceMock.createClusterClient().asInternalUser;
+
+      await expect(
+        agentPolicyService.create(soClient, esClient, {
+          name: 'test',
+          namespace: 'default',
+          supports_agentless: true,
+        })
+      ).resolves.not.toThrow();
+    });
   });
 
   // TODO: Add more test coverage to `get` service method
@@ -781,6 +850,93 @@ describe('agent policy', () => {
         })
       ).rejects.toThrowError(new Error('Cannot enable Agent Tamper Protection: reason'));
     });
+
+    it('should throw AgentPolicyInvalidError if support_agentless is defined in stateful', async () => {
+      jest
+        .spyOn(appContextService, 'getExperimentalFeatures')
+        .mockReturnValue({ agentless: false } as any);
+      jest
+        .spyOn(appContextService, 'getCloud')
+        .mockReturnValue({ isServerlessEnabled: false } as any);
+
+      const soClient = getAgentPolicyCreateMock();
+      const esClient = elasticsearchServiceMock.createClusterClient().asInternalUser;
+      soClient.get.mockResolvedValue({
+        attributes: {},
+        id: 'test-id',
+        type: 'mocked',
+        references: [],
+      });
+
+      await expect(
+        agentPolicyService.update(soClient, esClient, 'test-id', {
+          name: 'test',
+          namespace: 'default',
+          supports_agentless: true,
+        })
+      ).rejects.toThrowError(
+        new AgentPolicyInvalidError(
+          'supports_agentless is only allowed in serverless environments that support the agentless feature'
+        )
+      );
+    });
+
+    it('should throw AgentPolicyInvalidError if agentless flag is disabled in serverless', async () => {
+      jest
+        .spyOn(appContextService, 'getExperimentalFeatures')
+        .mockReturnValue({ agentless: false } as any);
+      jest
+        .spyOn(appContextService, 'getCloud')
+        .mockReturnValue({ isServerlessEnabled: true } as any);
+
+      const soClient = getAgentPolicyCreateMock();
+      const esClient = elasticsearchServiceMock.createClusterClient().asInternalUser;
+      soClient.get.mockResolvedValue({
+        attributes: {},
+        id: 'test-id',
+        type: 'mocked',
+        references: [],
+      });
+
+      await expect(
+        agentPolicyService.update(soClient, esClient, 'test-id', {
+          name: 'test',
+          namespace: 'default',
+          supports_agentless: true,
+        })
+      ).rejects.toThrowError(
+        new AgentPolicyInvalidError(
+          'supports_agentless is only allowed in serverless environments that support the agentless feature'
+        )
+      );
+    });
+
+    it('should not throw in serverless if support_agentless is set and agentless feature flag is set', async () => {
+      jest
+        .spyOn(appContextService, 'getExperimentalFeatures')
+        .mockReturnValue({ agentless: true } as any);
+      jest
+        .spyOn(appContextService, 'getCloud')
+        .mockReturnValue({ isServerlessEnabled: true } as any);
+
+      const soClient = getAgentPolicyCreateMock();
+      const esClient = elasticsearchServiceMock.createClusterClient().asInternalUser;
+
+      soClient.get.mockResolvedValue({
+        attributes: {},
+        id: 'test-id',
+        type: 'mocked',
+        references: [],
+      });
+
+      await expect(
+        agentPolicyService.update(soClient, esClient, 'test-id', {
+          name: 'test',
+          namespace: 'default',
+          supports_agentless: true,
+        })
+      ).resolves.not.toThrow();
+    });
   });
 
   describe('deployPolicy', () => {
diff --git a/x-pack/plugins/fleet/server/services/agent_policy.ts b/x-pack/plugins/fleet/server/services/agent_policy.ts
index 51b3e0d7972c13..a75028be595485 100644
--- a/x-pack/plugins/fleet/server/services/agent_policy.ts
+++ b/x-pack/plugins/fleet/server/services/agent_policy.ts
@@ -71,13 +71,12 @@ import type {
   FetchAllAgentPoliciesOptions,
   FetchAllAgentPolicyIdsOptions,
   FleetServerPolicy,
-  Installation,
-  Output,
   PackageInfo,
 } from '../../common/types';
 import {
   AgentPolicyNameExistsError,
   AgentPolicyNotFoundError,
+  AgentPolicyInvalidError,
   FleetError,
   FleetUnauthorizedError,
   HostedAgentPolicyRestrictionRelatedError,
@@ -88,6 +87,8 @@ import type { FullAgentConfigMap } from '../../common/types/models/agent_cm';
 
 import { fullAgentConfigMapToYaml } from '../../common/services/agent_cm_to_yaml';
 
+import { appContextService } from '.';
+
 import { mapAgentPolicySavedObjectToAgentPolicy } from './agent_policies/utils';
 
 import {
@@ -102,7 +103,6 @@ import { incrementPackagePolicyCopyName } from './package_policies';
 import { outputService } from './output';
 import { agentPolicyUpdateEventHandler } from './agent_policy_update';
 import { escapeSearchQueryPhrase, normalizeKuery } from './saved_object';
-import { appContextService } from './app_context';
 import { getFullAgentPolicy, validateOutputForPolicy } from './agent_policies';
 import { auditLoggingService } from './audit_logging';
 import { licenseService } from './license';
@@ -317,6 +317,8 @@ class AgentPolicyService {
       );
     }
 
+    this.checkAgentless(agentPolicy);
+
     await this.requireUniqueName(soClient, agentPolicy);
 
     await validateOutputForPolicy(soClient, agentPolicy);
@@ -581,6 +583,7 @@ class AgentPolicyService {
       }
     }
     this.checkTamperProtectionLicense(agentPolicy);
+    this.checkAgentless(agentPolicy);
     await this.checkForValidUninstallToken(agentPolicy, id);
 
     if (agentPolicy?.is_protected && !policyHasEndpointSecurity(existingAgentPolicy)) {
@@ -653,6 +656,7 @@ class AgentPolicyService {
           'monitoring_output_id',
           'download_source_id',
           'fleet_server_host_id',
+          'supports_agentless',
         ]),
         ...newAgentPolicyProps,
       },
@@ -1474,17 +1478,26 @@ class AgentPolicyService {
       }
     }
   }
+  private checkAgentless(agentPolicy: Partial<NewAgentPolicy>) {
+    const cloudSetup = appContextService.getCloud();
+    if (
+      (!cloudSetup?.isServerlessEnabled ||
+        !appContextService.getExperimentalFeatures().agentless) &&
+      agentPolicy?.supports_agentless !== undefined
+    ) {
+      throw new AgentPolicyInvalidError(
+        'supports_agentless is only allowed in serverless environments that support the agentless feature'
+      );
+    }
+  }
 }
 
 export const agentPolicyService = new AgentPolicyService();
 
-// TODO: remove unused parameters
 export async function addPackageToAgentPolicy(
   soClient: SavedObjectsClientContract,
   esClient: ElasticsearchClient,
-  packageToInstall: Installation,
   agentPolicy: AgentPolicy,
-  defaultOutput: Output,
   packageInfo: PackageInfo,
   packagePolicyName?: string,
   packagePolicyId?: string | number,
diff --git a/x-pack/plugins/fleet/server/services/epm/packages/install_index_template_pipeline.ts b/x-pack/plugins/fleet/server/services/epm/packages/install_index_template_pipeline.ts
index 8092a133490af7..ad738d1710fcc0 100644
--- a/x-pack/plugins/fleet/server/services/epm/packages/install_index_template_pipeline.ts
+++ b/x-pack/plugins/fleet/server/services/epm/packages/install_index_template_pipeline.ts
@@ -68,16 +68,7 @@ export async function installIndexTemplatesAndPipelines({
   // cleanup in the case that a single asset fails to install.
   let newEsReferences: EsAssetReference[] = [];
 
-  if (onlyForDataStreams) {
-    // if onlyForDataStreams is present that means we are in create package policy flow
-    // not install flow, meaning we do not have a lock on the installation SO
-    // so we need to use optimistic concurrency control
-    newEsReferences = await optimisticallyAddEsAssetReferences(
-      savedObjectsClient,
-      packageInstallContext.packageInfo.name,
-      [...preparedIngestPipelines.assetsToAdd, ...preparedIndexTemplates.assetsToAdd]
-    );
-  } else {
+  if (!onlyForDataStreams) {
     newEsReferences = await updateEsAssetReferences(
       savedObjectsClient,
       packageInstallContext.packageInfo.name,
@@ -103,6 +94,18 @@ export async function installIndexTemplatesAndPipelines({
     ),
   ]);
 
+  // only add ES references if templates and pipelines were installed successfully, to prevent upgrade issues for referencing invalid template name
+  if (onlyForDataStreams) {
+    // if onlyForDataStreams is present that means we are in create package policy flow
+    // not install flow, meaning we do not have a lock on the installation SO
+    // so we need to use optimistic concurrency control
+    newEsReferences = await optimisticallyAddEsAssetReferences(
+      savedObjectsClient,
+      packageInstallContext.packageInfo.name,
+      [...preparedIngestPipelines.assetsToAdd, ...preparedIndexTemplates.assetsToAdd]
+    );
+  }
+
   return {
     esReferences: newEsReferences,
     installedTemplates,
diff --git a/x-pack/plugins/fleet/server/services/preconfiguration.test.ts b/x-pack/plugins/fleet/server/services/preconfiguration.test.ts
index fd5dfad7372411..004d4b83a460ab 100644
--- a/x-pack/plugins/fleet/server/services/preconfiguration.test.ts
+++ b/x-pack/plugins/fleet/server/services/preconfiguration.test.ts
@@ -22,6 +22,8 @@ import type { AgentPolicy, NewPackagePolicy, Output, DownloadSource } from '../t
 
 import { AGENT_POLICY_SAVED_OBJECT_TYPE } from '../constants';
 
+import { appContextService } from './app_context';
+
 import * as agentPolicy from './agent_policy';
 
 import {
@@ -300,6 +302,10 @@ jest.mock('./app_context', () => ({
       generateTokenForPolicyId: jest.fn(),
     }),
     getExternalCallbacks: jest.fn(),
+    getCloud: jest.fn(),
+    getExperimentalFeatures: jest.fn().mockReturnValue({
+      agentless: false,
+    }),
   },
 }));
 
@@ -461,7 +467,7 @@ describe('policy preconfiguration', () => {
       );
     });
 
-    it('should install prelease packages if needed', async () => {
+    it('should install prerelease packages if needed', async () => {
       const soClient = getPutPreconfiguredPackagesMock();
       const esClient = elasticsearchServiceMock.createClusterClient().asInternalUser;
 
@@ -845,6 +851,7 @@ describe('policy preconfiguration', () => {
     it('should not create a policy and throw an error if package is not installed for an unknown reason', async () => {
       const soClient = getPutPreconfiguredPackagesMock();
       const esClient = elasticsearchServiceMock.createClusterClient().asInternalUser;
+
       const policies: PreconfiguredAgentPolicy[] = [
         {
           name: 'Test policy',
@@ -875,6 +882,113 @@ describe('policy preconfiguration', () => {
       );
     });
 
+    it('should return a non fatal error if support_agentless is defined in stateful', async () => {
+      const soClient = getPutPreconfiguredPackagesMock();
+      const esClient = elasticsearchServiceMock.createClusterClient().asInternalUser;
+      jest.mocked(appContextService.getExperimentalFeatures).mockReturnValue({
+        agentless: true,
+      } as any);
+
+      jest
+        .spyOn(appContextService, 'getCloud')
+        .mockReturnValue({ isServerlessEnabled: false } as any);
+
+      const policies: PreconfiguredAgentPolicy[] = [
+        {
+          name: 'Test policy',
+          namespace: 'default',
+          id: 'test-id',
+          supports_agentless: true,
+          package_policies: [],
+        },
+      ];
+
+      const { nonFatalErrors } = await ensurePreconfiguredPackagesAndPolicies(
+        soClient,
+        esClient,
+        policies,
+        [{ name: 'CANNOT_MATCH', version: 'x.y.z' }],
+        mockDefaultOutput,
+        mockDefaultDownloadService,
+        DEFAULT_SPACE_ID
+      );
+      // @ts-ignore-next-line
+      expect(nonFatalErrors[0].error.toString()).toEqual(
+        'FleetError: `supports_agentless` is only allowed in serverless environments that support the agentless feature'
+      );
+    });
+
+    it('should not return an error if support_agentless is defined in serverless and agentless is enabled', async () => {
+      const soClient = getPutPreconfiguredPackagesMock();
+      const esClient = elasticsearchServiceMock.createClusterClient().asInternalUser;
+      jest.mocked(appContextService.getExperimentalFeatures).mockReturnValue({
+        agentless: true,
+      } as any);
+
+      jest
+        .spyOn(appContextService, 'getCloud')
+        .mockReturnValue({ isServerlessEnabled: true } as any);
+
+      const policies: PreconfiguredAgentPolicy[] = [
+        {
+          name: 'Test policy',
+          namespace: 'default',
+          id: 'test-id',
+          supports_agentless: true,
+          package_policies: [],
+        },
+      ];
+
+      const { policies: resPolicies, nonFatalErrors } =
+        await ensurePreconfiguredPackagesAndPolicies(
+          soClient,
+          esClient,
+          policies,
+          [{ name: 'CANNOT_MATCH', version: 'x.y.z' }],
+          mockDefaultOutput,
+          mockDefaultDownloadService,
+          DEFAULT_SPACE_ID
+        );
+      expect(nonFatalErrors.length).toBe(0);
+      expect(resPolicies[0].id).toEqual('test-id');
+    });
+
+    it('should return an error if agentless feature flag is disabled on serverless', async () => {
+      const soClient = getPutPreconfiguredPackagesMock();
+      const esClient = elasticsearchServiceMock.createClusterClient().asInternalUser;
+      jest.mocked(appContextService.getExperimentalFeatures).mockReturnValue({
+        agentless: false,
+      } as any);
+
+      jest
+        .spyOn(appContextService, 'getCloud')
+        .mockReturnValue({ isServerlessEnabled: true } as any);
+
+      const policies: PreconfiguredAgentPolicy[] = [
+        {
+          name: 'Test policy',
+          namespace: 'default',
+          id: 'test-id',
+          supports_agentless: true,
+          package_policies: [],
+        },
+      ];
+
+      const { nonFatalErrors } = await ensurePreconfiguredPackagesAndPolicies(
+        soClient,
+        esClient,
+        policies,
+        [{ name: 'CANNOT_MATCH', version: 'x.y.z' }],
+        mockDefaultOutput,
+        mockDefaultDownloadService,
+        DEFAULT_SPACE_ID
+      );
+      // @ts-ignore-next-line
+      expect(nonFatalErrors[0].error.toString()).toEqual(
+        'FleetError: `supports_agentless` is only allowed in serverless environments that support the agentless feature'
+      );
+    });
+
     it('should not attempt to recreate or modify an agent policy if its ID is unchanged', async () => {
       const soClient = getPutPreconfiguredPackagesMock();
       const esClient = elasticsearchServiceMock.createClusterClient().asInternalUser;
diff --git a/x-pack/plugins/fleet/server/services/preconfiguration.ts b/x-pack/plugins/fleet/server/services/preconfiguration.ts
index 877fb343b65079..26f633cc8f0215 100644
--- a/x-pack/plugins/fleet/server/services/preconfiguration.ts
+++ b/x-pack/plugins/fleet/server/services/preconfiguration.ts
@@ -59,6 +59,7 @@ export async function ensurePreconfiguredPackagesAndPolicies(
   spaceId: string
 ): Promise<PreconfigurationResult> {
   const logger = appContextService.getLogger();
+  const cloudSetup = appContextService.getCloud();
 
   // Validate configured packages to ensure there are no version conflicts
   const packageNames = groupBy(packages, (pkg) => pkg.name);
@@ -160,6 +161,19 @@ export async function ensurePreconfiguredPackagesAndPolicies(
         );
       }
 
+      if (
+        (!cloudSetup?.isServerlessEnabled ||
+          !appContextService.getExperimentalFeatures().agentless) &&
+        preconfiguredAgentPolicy?.supports_agentless !== undefined
+      ) {
+        throw new FleetError(
+          i18n.translate('xpack.fleet.preconfiguration.support_agentless', {
+            defaultMessage:
+              '`supports_agentless` is only allowed in serverless environments that support the agentless feature',
+          })
+        );
+      }
+
       const { created, policy } = await agentPolicyService.ensurePreconfiguredAgentPolicy(
         soClient,
         esClient,
@@ -372,9 +386,7 @@ async function addPreconfiguredPolicyPackages(
       await addPackageToAgentPolicy(
         soClient,
         esClient,
-        installedPackage,
         agentPolicy,
-        defaultOutput,
         packageInfo,
         name,
         id,
diff --git a/x-pack/plugins/fleet/server/types/models/agent_policy.ts b/x-pack/plugins/fleet/server/types/models/agent_policy.ts
index 748a5c81c1bfb1..ed2a50854c58b9 100644
--- a/x-pack/plugins/fleet/server/types/models/agent_policy.ts
+++ b/x-pack/plugins/fleet/server/types/models/agent_policy.ts
@@ -83,6 +83,7 @@ export const AgentPolicyBaseSchema = {
     )
   ),
   ...getSettingsAPISchema('AGENT_POLICY_ADVANCED_SETTINGS'),
+  supports_agentless: schema.maybe(schema.boolean({ defaultValue: false })),
 };
 
 export const NewAgentPolicySchema = schema.object({
diff --git a/x-pack/plugins/grokdebugger/public/render_app.js b/x-pack/plugins/grokdebugger/public/render_app.js
index bcb2560a3c0b7a..43af7b9e6213af 100644
--- a/x-pack/plugins/grokdebugger/public/render_app.js
+++ b/x-pack/plugins/grokdebugger/public/render_app.js
@@ -7,28 +7,23 @@
 
 import React from 'react';
 import { render, unmountComponentAtNode } from 'react-dom';
-import { I18nProvider } from '@kbn/i18n-react';
 
-import { KibanaContextProvider, KibanaThemeProvider } from './shared_imports';
+import { KibanaContextProvider, KibanaRenderContextProvider } from './shared_imports';
 import { GrokDebugger } from './components/grok_debugger';
 import { GrokdebuggerService } from './services/grokdebugger/grokdebugger_service';
 import { InactiveLicenseSlate } from './components/inactive_license';
 
 export function renderApp(license, element, coreStart, theme$) {
   const content = license.isActive ? (
-    <KibanaContextProvider services={{ ...coreStart }}>
-      <I18nProvider>
-        <KibanaThemeProvider theme$={theme$}>
-          <GrokDebugger grokdebuggerService={new GrokdebuggerService(coreStart.http)} />
-        </KibanaThemeProvider>
-      </I18nProvider>
-    </KibanaContextProvider>
+    <KibanaRenderContextProvider {...coreStart}>
+      <KibanaContextProvider services={{ ...coreStart }}>
+        <GrokDebugger grokdebuggerService={new GrokdebuggerService(coreStart.http)} />
+      </KibanaContextProvider>
+    </KibanaRenderContextProvider>
   ) : (
-    <I18nProvider>
-      <KibanaThemeProvider theme$={theme$}>
-        <InactiveLicenseSlate license={license} />
-      </KibanaThemeProvider>
-    </I18nProvider>
+    <KibanaRenderContextProvider theme$={theme$}>
+      <InactiveLicenseSlate license={license} />
+    </KibanaRenderContextProvider>
   );
 
   render(content, element);
diff --git a/x-pack/plugins/grokdebugger/public/shared_imports.ts b/x-pack/plugins/grokdebugger/public/shared_imports.ts
index 0bfbb3e05f9335..7496817e21ed61 100644
--- a/x-pack/plugins/grokdebugger/public/shared_imports.ts
+++ b/x-pack/plugins/grokdebugger/public/shared_imports.ts
@@ -5,4 +5,6 @@
  * 2.0.
  */
 
-export { KibanaContextProvider, KibanaThemeProvider } from '@kbn/kibana-react-plugin/public';
+export { KibanaContextProvider } from '@kbn/kibana-react-plugin/public';
+
+export { KibanaRenderContextProvider } from '@kbn/react-kibana-context-render';
diff --git a/x-pack/plugins/grokdebugger/tsconfig.json b/x-pack/plugins/grokdebugger/tsconfig.json
index b80579da2cea7f..f2df02467d71c5 100644
--- a/x-pack/plugins/grokdebugger/tsconfig.json
+++ b/x-pack/plugins/grokdebugger/tsconfig.json
@@ -19,6 +19,7 @@
     "@kbn/i18n-react",
     "@kbn/config-schema",
     "@kbn/code-editor",
+    "@kbn/react-kibana-context-render",
   ],
   "exclude": [
     "target/**/*",
diff --git a/x-pack/plugins/index_lifecycle_management/__jest__/__snapshots__/extend_index_management.test.tsx.snap b/x-pack/plugins/index_lifecycle_management/__jest__/__snapshots__/extend_index_management.test.tsx.snap
index 219c0547093540..230e6ad33df541 100644
--- a/x-pack/plugins/index_lifecycle_management/__jest__/__snapshots__/extend_index_management.test.tsx.snap
+++ b/x-pack/plugins/index_lifecycle_management/__jest__/__snapshots__/extend_index_management.test.tsx.snap
@@ -99,7 +99,7 @@ exports[`extend index management ilm summary extension should render a phase def
   class="euiFlexGroup emotion-euiFlexGroup-responsive-wrap-l-flexStart-stretch-row"
 >
   <div
-    class="euiFlexItem emotion-EuiFlexItem"
+    class="euiFlexItem emotion-euiFlexItem-grow-1"
   >
     <div
       class="euiPanel euiPanel--plain euiPanel--paddingMedium emotion-euiPanel-m-m-plain-hasBorder"
@@ -223,7 +223,7 @@ exports[`extend index management ilm summary extension should render a phase def
     </div>
   </div>
   <div
-    class="euiFlexItem emotion-EuiFlexItem"
+    class="euiFlexItem emotion-euiFlexItem-grow-3"
   >
     <div
       class="euiPanel euiPanel--plain euiPanel--paddingMedium emotion-euiPanel-m-m-plain-hasBorder"
@@ -270,7 +270,7 @@ exports[`extend index management ilm summary extension should render a step info
   class="euiFlexGroup emotion-euiFlexGroup-responsive-wrap-l-flexStart-stretch-row"
 >
   <div
-    class="euiFlexItem emotion-EuiFlexItem"
+    class="euiFlexItem emotion-euiFlexItem-grow-1"
   >
     <div
       class="euiPanel euiPanel--plain euiPanel--paddingMedium emotion-euiPanel-m-m-plain-hasBorder"
@@ -394,7 +394,7 @@ exports[`extend index management ilm summary extension should render a step info
     </div>
   </div>
   <div
-    class="euiFlexItem emotion-EuiFlexItem"
+    class="euiFlexItem emotion-euiFlexItem-grow-3"
   >
     <div
       class="euiPanel euiPanel--plain euiPanel--paddingMedium emotion-euiPanel-m-m-plain-hasBorder"
@@ -437,7 +437,7 @@ exports[`extend index management ilm summary extension should render an error pa
   class="euiFlexGroup emotion-euiFlexGroup-responsive-wrap-l-flexStart-stretch-row"
 >
   <div
-    class="euiFlexItem emotion-EuiFlexItem"
+    class="euiFlexItem emotion-euiFlexItem-grow-1"
   >
     <div
       class="euiPanel euiPanel--plain euiPanel--paddingMedium emotion-euiPanel-m-m-plain-hasBorder"
@@ -561,7 +561,7 @@ exports[`extend index management ilm summary extension should render an error pa
     </div>
   </div>
   <div
-    class="euiFlexItem emotion-EuiFlexItem"
+    class="euiFlexItem emotion-euiFlexItem-grow-3"
   >
     <div
       class="euiPanel euiPanel--danger euiPanel--paddingMedium emotion-euiPanel-m-m-danger"
@@ -605,7 +605,7 @@ exports[`extend index management ilm summary extension should render the tab whe
   class="euiFlexGroup emotion-euiFlexGroup-responsive-wrap-l-flexStart-stretch-row"
 >
   <div
-    class="euiFlexItem emotion-EuiFlexItem"
+    class="euiFlexItem emotion-euiFlexItem-grow-1"
   >
     <div
       class="euiPanel euiPanel--plain euiPanel--paddingMedium emotion-euiPanel-m-m-plain-hasBorder"
@@ -728,7 +728,7 @@ exports[`extend index management ilm summary extension should render the tab whe
     </div>
   </div>
   <div
-    class="euiFlexItem emotion-EuiFlexItem"
+    class="euiFlexItem emotion-euiFlexItem-grow-3"
   />
 </div>
 `;
diff --git a/x-pack/plugins/index_management/public/application/components/component_templates/__jest__/client_integration/helpers/setup_environment.tsx b/x-pack/plugins/index_management/public/application/components/component_templates/__jest__/client_integration/helpers/setup_environment.tsx
index 826ef0b103447d..ee3c359a8195a7 100644
--- a/x-pack/plugins/index_management/public/application/components/component_templates/__jest__/client_integration/helpers/setup_environment.tsx
+++ b/x-pack/plugins/index_management/public/application/components/component_templates/__jest__/client_integration/helpers/setup_environment.tsx
@@ -29,16 +29,20 @@ const appDependencies = {
   plugins: { ml: {} as any },
 } as any;
 
-export const componentTemplatesDependencies = (httpSetup: HttpSetup, coreStart?: CoreStart) => ({
-  overlays: coreStart?.overlays ?? coreMock.createStart().overlays,
-  httpClient: httpSetup,
-  apiBasePath: API_BASE_PATH,
-  trackMetric: () => {},
-  docLinks: docLinksServiceMock.createStartContract(),
-  toasts: notificationServiceMock.createSetupContract().toasts,
-  getUrlForApp: applicationServiceMock.createStartContract().getUrlForApp,
-  executionContext: executionContextServiceMock.createInternalStartContract(),
-});
+export const componentTemplatesDependencies = (httpSetup: HttpSetup, coreStart?: CoreStart) => {
+  const coreMockStart = coreMock.createStart();
+  return {
+    overlays: coreStart?.overlays ?? coreMockStart.overlays,
+    httpClient: httpSetup,
+    apiBasePath: API_BASE_PATH,
+    trackMetric: () => {},
+    docLinks: docLinksServiceMock.createStartContract(),
+    toasts: notificationServiceMock.createSetupContract().toasts,
+    getUrlForApp: applicationServiceMock.createStartContract().getUrlForApp,
+    executionContext: executionContextServiceMock.createInternalStartContract(),
+    startServices: coreStart ?? coreMockStart,
+  };
+};
 
 export const setupEnvironment = () => {
   breadcrumbService.setup(() => undefined);
diff --git a/x-pack/plugins/index_management/public/application/components/component_templates/component_template_wizard/component_template_datastreams_rollover/use_datastreams_rollover.test.tsx b/x-pack/plugins/index_management/public/application/components/component_templates/component_template_wizard/component_template_datastreams_rollover/use_datastreams_rollover.test.tsx
index 5a16c8837dc3f9..903a9187a73352 100644
--- a/x-pack/plugins/index_management/public/application/components/component_templates/component_template_wizard/component_template_datastreams_rollover/use_datastreams_rollover.test.tsx
+++ b/x-pack/plugins/index_management/public/application/components/component_templates/component_template_wizard/component_template_datastreams_rollover/use_datastreams_rollover.test.tsx
@@ -20,7 +20,9 @@ describe('useStepFromQueryString', () => {
         getComponentTemplateDatastreams: jest.fn(),
         postDataStreamMappingsFromTemplate: jest.fn(),
       },
-      overlays: { openModal: jest.fn() } as any,
+      startServices: {
+        overlays: { openModal: jest.fn() },
+      },
     } as any);
   });
   it('should do nothing if there no impacted data_streams', async () => {
@@ -38,7 +40,7 @@ describe('useStepFromQueryString', () => {
   });
 
   it('should try to update mappings if there is impacted data_streams', async () => {
-    const { api, overlays } = jest.mocked(useComponentTemplatesContext());
+    const { api, startServices } = jest.mocked(useComponentTemplatesContext());
 
     api.getComponentTemplateDatastreams.mockResolvedValue({
       data: { data_streams: ['logs-test.data-default'] },
@@ -51,7 +53,7 @@ describe('useStepFromQueryString', () => {
     });
 
     jest
-      .mocked(useComponentTemplatesContext().overlays.openModal)
+      .mocked(useComponentTemplatesContext().startServices.overlays.openModal)
       .mockReturnValue({ onClose: jest.fn() } as any);
 
     const {
@@ -63,11 +65,11 @@ describe('useStepFromQueryString', () => {
     await showDatastreamRolloverModal('logs-test.data@custom');
 
     expect(api.postDataStreamMappingsFromTemplate).toBeCalledTimes(1);
-    expect(overlays.openModal).not.toBeCalled();
+    expect(startServices.overlays.openModal).not.toBeCalled();
   });
 
   it('should show datastream rollover modal if there is an error when updating mappings', async () => {
-    const { api, overlays } = jest.mocked(useComponentTemplatesContext());
+    const { api, startServices } = jest.mocked(useComponentTemplatesContext());
 
     api.getComponentTemplateDatastreams.mockResolvedValue({
       data: { data_streams: ['logs-test.data-default'] },
@@ -80,7 +82,7 @@ describe('useStepFromQueryString', () => {
     });
 
     jest
-      .mocked(useComponentTemplatesContext().overlays.openModal)
+      .mocked(useComponentTemplatesContext().startServices.overlays.openModal)
       .mockReturnValue({ onClose: jest.fn() } as any);
 
     const {
@@ -90,6 +92,6 @@ describe('useStepFromQueryString', () => {
     } = renderHook(() => useDatastreamsRollover());
 
     await showDatastreamRolloverModal('logs-test.data@custom');
-    expect(overlays.openModal).toBeCalled();
+    expect(startServices.overlays.openModal).toBeCalled();
   });
 });
diff --git a/x-pack/plugins/index_management/public/application/components/component_templates/component_template_wizard/component_template_datastreams_rollover/use_datastreams_rollover.tsx b/x-pack/plugins/index_management/public/application/components/component_templates/component_template_wizard/component_template_datastreams_rollover/use_datastreams_rollover.tsx
index ebb85f2bfa3f2c..6ea2e7c1b114d9 100644
--- a/x-pack/plugins/index_management/public/application/components/component_templates/component_template_wizard/component_template_datastreams_rollover/use_datastreams_rollover.tsx
+++ b/x-pack/plugins/index_management/public/application/components/component_templates/component_template_wizard/component_template_datastreams_rollover/use_datastreams_rollover.tsx
@@ -6,7 +6,7 @@
  */
 
 import React, { useCallback } from 'react';
-import { toMountPoint } from '@kbn/kibana-react-plugin/public';
+import { toMountPoint } from '@kbn/react-kibana-mount';
 
 import { useComponentTemplatesContext } from '../../component_templates_context';
 import { MappingsDatastreamRolloverModal } from './mappings_datastreams_rollover_modal';
@@ -14,7 +14,7 @@ import { MappingsDatastreamRolloverModal } from './mappings_datastreams_rollover
 export const test = {};
 
 export function useDatastreamsRollover() {
-  const { api, overlays } = useComponentTemplatesContext();
+  const { api, startServices } = useComponentTemplatesContext();
 
   const showDatastreamRolloverModal = useCallback(
     async (componentTemplateName: string) => {
@@ -38,6 +38,7 @@ export function useDatastreamsRollover() {
       }
 
       if (dataStreamsToRollover.length) {
+        const { overlays, ...mountServices } = startServices;
         const ref = overlays.openModal(
           toMountPoint(
             <MappingsDatastreamRolloverModal
@@ -47,14 +48,15 @@ export function useDatastreamsRollover() {
               onClose={() => {
                 ref.close();
               }}
-            />
+            />,
+            mountServices
           )
         );
 
         await ref.onClose;
       }
     },
-    [api, overlays]
+    [api, startServices]
   );
 
   return {
diff --git a/x-pack/plugins/index_management/public/application/components/component_templates/component_templates_context.tsx b/x-pack/plugins/index_management/public/application/components/component_templates/component_templates_context.tsx
index ade11c3a1b6009..bf42735068db5a 100644
--- a/x-pack/plugins/index_management/public/application/components/component_templates/component_templates_context.tsx
+++ b/x-pack/plugins/index_management/public/application/components/component_templates/component_templates_context.tsx
@@ -15,6 +15,7 @@ import {
   CoreStart,
   ExecutionContextStart,
 } from '@kbn/core/public';
+import { IndexManagementStartServices } from '../../../types';
 import { getApi, getUseRequest, getSendRequest, getDocumentation } from './lib';
 
 const ComponentTemplatesContext = createContext<Context | undefined>(undefined);
@@ -27,7 +28,7 @@ interface Props {
   toasts: NotificationsSetup['toasts'];
   getUrlForApp: CoreStart['application']['getUrlForApp'];
   executionContext: ExecutionContextStart;
-  overlays: CoreStart['overlays'];
+  startServices: IndexManagementStartServices;
 }
 
 interface Context {
@@ -37,9 +38,9 @@ interface Context {
   documentation: ReturnType<typeof getDocumentation>;
   trackMetric: (type: UiCounterMetricType, eventName: string) => void;
   toasts: NotificationsSetup['toasts'];
-  overlays: CoreStart['overlays'];
   getUrlForApp: CoreStart['application']['getUrlForApp'];
   executionContext: ExecutionContextStart;
+  startServices: IndexManagementStartServices;
 }
 
 export const ComponentTemplatesProvider = ({
@@ -50,7 +51,6 @@ export const ComponentTemplatesProvider = ({
   children: React.ReactNode;
 }) => {
   const {
-    overlays,
     httpClient,
     apiBasePath,
     trackMetric,
@@ -58,6 +58,7 @@ export const ComponentTemplatesProvider = ({
     toasts,
     getUrlForApp,
     executionContext,
+    startServices,
   } = value;
 
   const useRequest = getUseRequest(httpClient);
@@ -69,7 +70,6 @@ export const ComponentTemplatesProvider = ({
   return (
     <ComponentTemplatesContext.Provider
       value={{
-        overlays,
         api,
         documentation,
         trackMetric,
@@ -78,6 +78,7 @@ export const ComponentTemplatesProvider = ({
         apiBasePath,
         getUrlForApp,
         executionContext,
+        startServices,
       }}
     >
       {children}
diff --git a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/create_field/semantic_text/use_semantic_text.test.ts b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/create_field/semantic_text/use_semantic_text.test.ts
index 349c13fe805c0c..062c0b93c303e4 100644
--- a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/create_field/semantic_text/use_semantic_text.test.ts
+++ b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/create_field/semantic_text/use_semantic_text.test.ts
@@ -13,10 +13,15 @@ import { act } from 'react-dom/test-utils';
 const mlMock: any = {
   mlApi: {
     inferenceModels: {
-      createInferenceEndpoint: jest.fn(),
+      createInferenceEndpoint: jest.fn().mockResolvedValue({}),
     },
     trainedModels: {
-      startModelAllocation: jest.fn(),
+      startModelAllocation: jest.fn().mockResolvedValue({}),
+      getTrainedModels: jest.fn().mockResolvedValue([
+        {
+          fully_defined: true,
+        },
+      ]),
     },
   },
 };
@@ -93,6 +98,11 @@ describe('useSemanticText', () => {
       result.current.handleSemanticText(mockFieldData);
     });
 
+    expect(mlMock.mlApi.trainedModels.startModelAllocation).toHaveBeenCalledWith('.elser_model_2');
+    expect(mockDispatch).toHaveBeenCalledWith({
+      type: 'field.addSemanticText',
+      value: mockFieldData,
+    });
     expect(mlMock.mlApi.inferenceModels.createInferenceEndpoint).toHaveBeenCalledWith(
       'elser_model_2',
       'text_embedding',
@@ -105,16 +115,58 @@ describe('useSemanticText', () => {
         },
       }
     );
-    expect(mlMock.mlApi.trainedModels.startModelAllocation).toHaveBeenCalledWith('.elser_model_2');
-    expect(mockDispatch).toHaveBeenCalledWith({
-      type: 'field.addSemanticText',
-      value: mockFieldData,
+  });
+
+  it('should invoke the download api if the model does not exist', async () => {
+    const mlMockWithModelNotDownloaded: any = {
+      mlApi: {
+        inferenceModels: {
+          createInferenceEndpoint: jest.fn(),
+        },
+        trainedModels: {
+          startModelAllocation: jest.fn(),
+          getTrainedModels: jest.fn().mockResolvedValue([
+            {
+              fully_defined: false,
+            },
+          ]),
+          installElasticTrainedModelConfig: jest.fn().mockResolvedValue({}),
+        },
+      },
+    };
+    const { result } = renderHook(() =>
+      useSemanticText({
+        form,
+        setErrorsInTrainedModelDeployment: jest.fn(),
+        ml: mlMockWithModelNotDownloaded,
+      })
+    );
+
+    await act(async () => {
+      result.current.handleSemanticText(mockFieldData);
+    });
+
+    expect(
+      mlMockWithModelNotDownloaded.mlApi.trainedModels.installElasticTrainedModelConfig
+    ).toHaveBeenCalledWith('.elser_model_2');
+    expect(
+      mlMockWithModelNotDownloaded.mlApi.trainedModels.startModelAllocation
+    ).toHaveBeenCalledWith('.elser_model_2');
+    expect(
+      mlMockWithModelNotDownloaded.mlApi.inferenceModels.createInferenceEndpoint
+    ).toHaveBeenCalledWith('elser_model_2', 'text_embedding', {
+      service: 'elasticsearch',
+      service_settings: {
+        num_allocations: 1,
+        num_threads: 1,
+        model_id: '.elser_model_2',
+      },
     });
   });
 
   it('handles errors correctly', async () => {
     const mockError = new Error('Test error');
-    mlMock.mlApi.inferenceModels.createInferenceEndpoint.mockImplementationOnce(() => {
+    mlMock.mlApi?.trainedModels.startModelAllocation.mockImplementationOnce(() => {
       throw mockError;
     });
 
diff --git a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/create_field/semantic_text/use_semantic_text.ts b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/create_field/semantic_text/use_semantic_text.ts
index 9fe8e2a114645b..dda1bfe794c97f 100644
--- a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/create_field/semantic_text/use_semantic_text.ts
+++ b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/create_field/semantic_text/use_semantic_text.ts
@@ -6,7 +6,8 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { MlPluginStart } from '@kbn/ml-plugin/public';
+import { useCallback } from 'react';
+import { MlPluginStart, TrainedModelConfigResponse } from '@kbn/ml-plugin/public';
 import React, { useEffect, useState } from 'react';
 import { useComponentTemplatesContext } from '../../../../../../component_templates/component_templates_context';
 import { useDispatch, useMappingsState } from '../../../../../mappings_state_context';
@@ -64,20 +65,37 @@ export function useSemanticText(props: UseSemanticTextProps) {
     }
   }, [form, inferenceId, inferenceToModelIdMap]);
 
-  const handleSemanticText = (data: Field) => {
-    data.inferenceId = inferenceValue;
+  const isModelDownloaded = useCallback(
+    async (modelId: string) => {
+      try {
+        const response: TrainedModelConfigResponse[] | undefined =
+          await ml?.mlApi?.trainedModels.getTrainedModels(modelId, {
+            include: 'definition_status',
+          });
+        return !!response?.[0]?.fully_defined;
+      } catch (error) {
+        if (error.body.statusCode !== 404) {
+          throw error;
+        }
+      }
+      return false;
+    },
+    [ml?.mlApi?.trainedModels]
+  );
+
+  const createInferenceEndpoint = (
+    trainedModelId: string,
+    defaultInferenceEndpoint: boolean,
+    data: Field
+  ) => {
     if (data.inferenceId === undefined) {
-      return;
-    }
-
-    const inferenceData = inferenceToModelIdMap?.[data.inferenceId];
-
-    if (!inferenceData) {
-      return;
+      throw new Error(
+        i18n.translate('xpack.idxMgmt.mappingsEditor.createField.undefinedInferenceIdError', {
+          defaultMessage: 'InferenceId is undefined while creating the inference endpoint.',
+        })
+      );
     }
 
-    const { trainedModelId, defaultInferenceEndpoint, isDeployed, isDeployable } = inferenceData;
-
     if (trainedModelId && defaultInferenceEndpoint) {
       const modelConfig = {
         service: 'elasticsearch',
@@ -87,28 +105,45 @@ export function useSemanticText(props: UseSemanticTextProps) {
           model_id: trainedModelId,
         },
       };
-      try {
-        ml?.mlApi?.inferenceModels?.createInferenceEndpoint(
-          data.inferenceId,
-          'text_embedding',
-          modelConfig
-        );
-      } catch (error) {
-        setErrorsInTrainedModelDeployment?.((prevItems) => [...prevItems, trainedModelId]);
-        toasts?.addError(error.body && error.body.message ? new Error(error.body.message) : error, {
-          title: i18n.translate(
-            'xpack.idxMgmt.mappingsEditor.createField.inferenceEndpointCreationErrorTitle',
-            {
-              defaultMessage: 'Inference endpoint creation failed',
-            }
-          ),
-        });
-      }
+
+      ml?.mlApi?.inferenceModels?.createInferenceEndpoint(
+        data.inferenceId,
+        'text_embedding',
+        modelConfig
+      );
     }
+  };
+
+  const handleSemanticText = async (data: Field) => {
+    data.inferenceId = inferenceValue;
+    if (data.inferenceId === undefined) {
+      return;
+    }
+
+    const inferenceData = inferenceToModelIdMap?.[data.inferenceId];
+
+    if (!inferenceData) {
+      return;
+    }
+
+    const { trainedModelId, defaultInferenceEndpoint, isDeployed, isDeployable } = inferenceData;
 
-    if (isDeployable && trainedModelId && !isDeployed) {
+    if (isDeployable && trainedModelId) {
       try {
-        ml?.mlApi?.trainedModels.startModelAllocation(trainedModelId);
+        const modelDownloaded: boolean = await isModelDownloaded(trainedModelId);
+
+        if (isDeployed) {
+          createInferenceEndpoint(trainedModelId, defaultInferenceEndpoint, data);
+        } else if (modelDownloaded) {
+          ml?.mlApi?.trainedModels
+            .startModelAllocation(trainedModelId)
+            .then(() => createInferenceEndpoint(trainedModelId, defaultInferenceEndpoint, data));
+        } else {
+          ml?.mlApi?.trainedModels
+            .installElasticTrainedModelConfig(trainedModelId)
+            .then(() => ml?.mlApi?.trainedModels.startModelAllocation(trainedModelId))
+            .then(() => createInferenceEndpoint(trainedModelId, defaultInferenceEndpoint, data));
+        }
         toasts?.addSuccess({
           title: i18n.translate(
             'xpack.idxMgmt.mappingsEditor.createField.modelDeploymentStartedNotification',
diff --git a/x-pack/plugins/index_management/public/application/index.tsx b/x-pack/plugins/index_management/public/application/index.tsx
index 43dd90e5bc1e8f..48a19f58bbfa55 100644
--- a/x-pack/plugins/index_management/public/application/index.tsx
+++ b/x-pack/plugins/index_management/public/application/index.tsx
@@ -38,7 +38,17 @@ export const IndexManagementAppContext: React.FC<IndexManagementAppContextProps>
   core,
   dependencies,
 }) => {
-  const { docLinks, notifications, application, executionContext, overlays, theme } = core;
+  const {
+    docLinks,
+    notifications,
+    application,
+    executionContext,
+    overlays,
+    analytics,
+    i18n,
+    theme,
+  } = core;
+  const startServices = { analytics, i18n, overlays, theme };
   const { services, setBreadcrumbs, uiSettings, settings, kibanaVersion } = dependencies;
 
   // theme is required by the CodeEditor component used to edit runtime field Painless scripts.
@@ -63,6 +73,7 @@ export const IndexManagementAppContext: React.FC<IndexManagementAppContextProps>
     setBreadcrumbs,
     getUrlForApp: application.getUrlForApp,
     executionContext,
+    startServices,
   };
 
   return (
diff --git a/x-pack/plugins/index_management/public/types.ts b/x-pack/plugins/index_management/public/types.ts
index 6cbca148c47958..e6a3b9a611026d 100644
--- a/x-pack/plugins/index_management/public/types.ts
+++ b/x-pack/plugins/index_management/public/types.ts
@@ -5,6 +5,12 @@
  * 2.0.
  */
 
+import {
+  AnalyticsServiceStart,
+  I18nStart,
+  OverlayStart,
+  ThemeServiceStart,
+} from '@kbn/core/public';
 import { CloudSetup } from '@kbn/cloud-plugin/public';
 import { ConsolePluginStart } from '@kbn/console-plugin/public';
 import { ManagementSetup } from '@kbn/management-plugin/public';
@@ -12,6 +18,13 @@ import { MlPluginStart } from '@kbn/ml-plugin/public';
 import { SharePluginSetup, SharePluginStart } from '@kbn/share-plugin/public';
 import { UsageCollectionSetup } from '@kbn/usage-collection-plugin/public';
 
+export interface IndexManagementStartServices {
+  analytics: Pick<AnalyticsServiceStart, 'reportEvent'>;
+  i18n: I18nStart;
+  overlays: OverlayStart;
+  theme: Pick<ThemeServiceStart, 'theme$'>;
+}
+
 export interface SetupDependencies {
   fleet?: unknown;
   usageCollection: UsageCollectionSetup;
diff --git a/x-pack/plugins/index_management/server/routes/api/settings/register_load_route.ts b/x-pack/plugins/index_management/server/routes/api/settings/register_load_route.ts
index bcdf29af65856a..6622b07f93f458 100644
--- a/x-pack/plugins/index_management/server/routes/api/settings/register_load_route.ts
+++ b/x-pack/plugins/index_management/server/routes/api/settings/register_load_route.ts
@@ -30,7 +30,6 @@ export function registerLoadRoute({ router, lib: { handleEsError } }: RouteDepen
       const params = {
         expand_wildcards: 'none' as const,
         flat_settings: false,
-        local: false,
         include_defaults: true,
         index: indexName,
       };
diff --git a/x-pack/plugins/index_management/tsconfig.json b/x-pack/plugins/index_management/tsconfig.json
index 0707ea02a0fe81..202a755a8b21de 100644
--- a/x-pack/plugins/index_management/tsconfig.json
+++ b/x-pack/plugins/index_management/tsconfig.json
@@ -50,7 +50,8 @@
     "@kbn/inference_integration_flyout",
     "@kbn/ml-plugin",
     "@kbn/ml-error-utils",
-    "@kbn/react-kibana-context-render"
+    "@kbn/react-kibana-context-render",
+    "@kbn/react-kibana-mount"
   ],
   "exclude": ["target/**/*"]
 }
diff --git a/x-pack/plugins/ingest_pipelines/__jest__/client_integration/helpers/pipelines_list.helpers.ts b/x-pack/plugins/ingest_pipelines/__jest__/client_integration/helpers/pipelines_list.helpers.ts
index a06dab8a096980..966ed7dad57277 100644
--- a/x-pack/plugins/ingest_pipelines/__jest__/client_integration/helpers/pipelines_list.helpers.ts
+++ b/x-pack/plugins/ingest_pipelines/__jest__/client_integration/helpers/pipelines_list.helpers.ts
@@ -110,4 +110,5 @@ export type PipelineListTestSubjects =
   | 'emptyList.title'
   | 'sectionLoading'
   | 'pipelineLoadError'
+  | 'jsonCodeBlock'
   | 'reloadButton';
diff --git a/x-pack/plugins/ingest_pipelines/__jest__/client_integration/ingest_pipelines_list.test.ts b/x-pack/plugins/ingest_pipelines/__jest__/client_integration/ingest_pipelines_list.test.ts
index 0d211cfe9d3487..19babe16de1a8c 100644
--- a/x-pack/plugins/ingest_pipelines/__jest__/client_integration/ingest_pipelines_list.test.ts
+++ b/x-pack/plugins/ingest_pipelines/__jest__/client_integration/ingest_pipelines_list.test.ts
@@ -43,7 +43,18 @@ describe('<PipelinesList />', () => {
     const pipeline3 = {
       name: 'test_pipeline3',
       description: 'test_pipeline3 description',
-      processors: [],
+      processors: [
+        {
+          script: {
+            lang: 'painless',
+            source: `String[] envSplit = ctx['env'].splitOnToken(params['delimiter']);\nArrayList tags = new ArrayList();\ntags.add(envSplit[params['position']].trim());\nctx['tags'] = tags;`,
+            params: {
+              delimiter: '-',
+              position: 1,
+            },
+          },
+        },
+      ],
       deprecated: true,
     };
 
@@ -123,6 +134,14 @@ describe('<PipelinesList />', () => {
       expect(find('pipelineDetails.title').text()).toBe(pipeline1.name);
     });
 
+    test('Replaces newline characters for spaces in flyout for json blocks', async () => {
+      const { find, actions } = testBed;
+
+      await actions.clickPipelineAt(1);
+
+      expect(find('jsonCodeBlock').text()).not.toContain(`\n`);
+    });
+
     test('should delete a pipeline', async () => {
       const { actions, component } = testBed;
       const { name: pipelineName } = pipeline1;
diff --git a/x-pack/plugins/ingest_pipelines/public/application/sections/pipelines_list/details_json_block.tsx b/x-pack/plugins/ingest_pipelines/public/application/sections/pipelines_list/details_json_block.tsx
index 933b57f2a96d64..d5130d88286c0d 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/sections/pipelines_list/details_json_block.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/sections/pipelines_list/details_json_block.tsx
@@ -18,6 +18,11 @@ export const PipelineDetailsJsonBlock: FunctionComponent<Props> = ({ json }) =>
   const uuid = useRef(0);
   uuid.current++;
 
+  // Convert JSON object to string
+  const jsonString = JSON.stringify(json, null, 2);
+  // Replace all newline characters with empty spaces
+  const formattedString = jsonString.replace(/\\n/g, ' ');
+
   return (
     <EuiCodeBlock
       paddingSize="s"
@@ -25,8 +30,9 @@ export const PipelineDetailsJsonBlock: FunctionComponent<Props> = ({ json }) =>
       overflowHeight={json.length > 0 ? 300 : undefined}
       isCopyable
       key={uuid.current}
+      data-test-subj="jsonCodeBlock"
     >
-      {JSON.stringify(json, null, 2)}
+      {formattedString}
     </EuiCodeBlock>
   );
 };
diff --git a/x-pack/plugins/ingest_pipelines/public/shared_imports.ts b/x-pack/plugins/ingest_pipelines/public/shared_imports.ts
index 5880bff1d3daee..420da38be6c545 100644
--- a/x-pack/plugins/ingest_pipelines/public/shared_imports.ts
+++ b/x-pack/plugins/ingest_pipelines/public/shared_imports.ts
@@ -82,11 +82,8 @@ export {
 
 export { isJSON, isEmptyString } from '@kbn/es-ui-shared-plugin/static/validators/string';
 
-export {
-  KibanaContextProvider,
-  KibanaThemeProvider,
-  useExecutionContext,
-} from '@kbn/kibana-react-plugin/public';
+export { KibanaContextProvider, useExecutionContext } from '@kbn/kibana-react-plugin/public';
+export { KibanaThemeProvider } from '@kbn/react-kibana-context-theme';
 
 export { KibanaRenderContextProvider } from '@kbn/react-kibana-context-render';
 
diff --git a/x-pack/plugins/ingest_pipelines/tsconfig.json b/x-pack/plugins/ingest_pipelines/tsconfig.json
index 71f0cb792a92c5..8d14d5f11412dd 100644
--- a/x-pack/plugins/ingest_pipelines/tsconfig.json
+++ b/x-pack/plugins/ingest_pipelines/tsconfig.json
@@ -32,7 +32,8 @@
     "@kbn/core-ui-settings-browser",
     "@kbn/code-editor",
     "@kbn/react-kibana-context-render",
-    "@kbn/console-plugin"
+    "@kbn/console-plugin",
+    "@kbn/react-kibana-context-theme"
   ],
   "exclude": [
     "target/**/*",
diff --git a/x-pack/plugins/kubernetes_security/public/components/tree_view_container/breadcrumb/__snapshots__/index.test.tsx.snap b/x-pack/plugins/kubernetes_security/public/components/tree_view_container/breadcrumb/__snapshots__/index.test.tsx.snap
index a47ab235ddf533..98b6f1dd203cfb 100644
--- a/x-pack/plugins/kubernetes_security/public/components/tree_view_container/breadcrumb/__snapshots__/index.test.tsx.snap
+++ b/x-pack/plugins/kubernetes_security/public/components/tree_view_container/breadcrumb/__snapshots__/index.test.tsx.snap
@@ -12,7 +12,7 @@ Object {
           class="euiFlexGroup emotion-euiFlexGroup-responsive-l-spaceBetween-stretch-row"
         >
           <div
-            class="euiFlexItem emotion-EuiFlexItem"
+            class="euiFlexItem emotion-euiFlexItem-grow-1"
           >
             <span
               class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
@@ -125,7 +125,7 @@ Object {
         class="euiFlexGroup emotion-euiFlexGroup-responsive-l-spaceBetween-stretch-row"
       >
         <div
-          class="euiFlexItem emotion-EuiFlexItem"
+          class="euiFlexItem emotion-euiFlexItem-grow-1"
         >
           <span
             class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
@@ -295,7 +295,7 @@ Object {
           class="euiFlexGroup emotion-euiFlexGroup-responsive-l-spaceBetween-stretch-row"
         >
           <div
-            class="euiFlexItem emotion-EuiFlexItem"
+            class="euiFlexItem emotion-euiFlexItem-grow-1"
           >
             <span
               class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
@@ -408,7 +408,7 @@ Object {
         class="euiFlexGroup emotion-euiFlexGroup-responsive-l-spaceBetween-stretch-row"
       >
         <div
-          class="euiFlexItem emotion-EuiFlexItem"
+          class="euiFlexItem emotion-euiFlexItem-grow-1"
         >
           <span
             class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
@@ -578,7 +578,7 @@ Object {
           class="euiFlexGroup emotion-euiFlexGroup-responsive-l-spaceBetween-stretch-row"
         >
           <div
-            class="euiFlexItem emotion-EuiFlexItem"
+            class="euiFlexItem emotion-euiFlexItem-grow-1"
           >
             <span
               class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
@@ -712,7 +712,7 @@ Object {
         class="euiFlexGroup emotion-euiFlexGroup-responsive-l-spaceBetween-stretch-row"
       >
         <div
-          class="euiFlexItem emotion-EuiFlexItem"
+          class="euiFlexItem emotion-euiFlexItem-grow-1"
         >
           <span
             class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
@@ -903,7 +903,7 @@ Object {
           class="euiFlexGroup emotion-euiFlexGroup-responsive-l-spaceBetween-stretch-row"
         >
           <div
-            class="euiFlexItem emotion-EuiFlexItem"
+            class="euiFlexItem emotion-euiFlexItem-grow-1"
           >
             <span
               class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
@@ -995,7 +995,7 @@ Object {
         class="euiFlexGroup emotion-euiFlexGroup-responsive-l-spaceBetween-stretch-row"
       >
         <div
-          class="euiFlexItem emotion-EuiFlexItem"
+          class="euiFlexItem emotion-euiFlexItem-grow-1"
         >
           <span
             class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
diff --git a/x-pack/plugins/lens/public/app_plugin/shared/edit_on_the_fly/lens_configuration_flyout.tsx b/x-pack/plugins/lens/public/app_plugin/shared/edit_on_the_fly/lens_configuration_flyout.tsx
index 447b81b367e165..0f9794ac77f31d 100644
--- a/x-pack/plugins/lens/public/app_plugin/shared/edit_on_the_fly/lens_configuration_flyout.tsx
+++ b/x-pack/plugins/lens/public/app_plugin/shared/edit_on_the_fly/lens_configuration_flyout.tsx
@@ -230,7 +230,6 @@ export function LensEditConfigurationFlyout({
       },
       references,
       visualizationType: visualization.activeId,
-      title: visualization.activeId ?? '',
     };
     if (savedObjectId) {
       saveByRef?.(attrs);
diff --git a/x-pack/plugins/lens/public/plugin.ts b/x-pack/plugins/lens/public/plugin.ts
index addbd8e5128421..fa89364baf8cfa 100644
--- a/x-pack/plugins/lens/public/plugin.ts
+++ b/x-pack/plugins/lens/public/plugin.ts
@@ -63,7 +63,6 @@ import {
 } from '@kbn/content-management-plugin/public';
 import { i18n } from '@kbn/i18n';
 import type { ServerlessPluginStart } from '@kbn/serverless/public';
-import { registerSavedObjectToPanelMethod } from '@kbn/embeddable-plugin/public';
 import { LicensingPluginStart } from '@kbn/licensing-plugin/public';
 import type { EditorFrameService as EditorFrameServiceType } from './editor_frame_service';
 import type {
@@ -387,6 +386,21 @@ export class LensPlugin {
         'lens',
         new EmbeddableFactory(getStartServicesForEmbeddable)
       );
+
+      embeddable.registerSavedObjectToPanelMethod<LensSavedObjectAttributes, LensByValueInput>(
+        CONTENT_ID,
+        (savedObject) => {
+          if (!savedObject.managed) {
+            return { savedObjectId: savedObject.id };
+          }
+
+          const panel = {
+            attributes: savedObjectToEmbeddableAttributes(savedObject),
+          };
+
+          return panel;
+        }
+      );
     }
 
     if (share) {
@@ -443,21 +457,6 @@ export class LensPlugin {
       () => startServices().plugins.data.nowProvider.get()
     );
 
-    registerSavedObjectToPanelMethod<LensSavedObjectAttributes, LensByValueInput>(
-      CONTENT_ID,
-      (savedObject) => {
-        if (!savedObject.managed) {
-          return { savedObjectId: savedObject.id };
-        }
-
-        const panel = {
-          attributes: savedObjectToEmbeddableAttributes(savedObject),
-        };
-
-        return panel;
-      }
-    );
-
     const getPresentationUtilContext = () =>
       startServices().plugins.presentationUtil.ContextProvider;
 
diff --git a/x-pack/plugins/maps/kibana.jsonc b/x-pack/plugins/maps/kibana.jsonc
index fb0472100e1c2e..97b8d1b9cddc2d 100644
--- a/x-pack/plugins/maps/kibana.jsonc
+++ b/x-pack/plugins/maps/kibana.jsonc
@@ -24,7 +24,6 @@
       "navigation",
       "expressions",
       "visualizations",
-      "dashboard",
       "embeddable",
       "mapsEms",
       "share",
diff --git a/x-pack/plugins/maps/public/classes/sources/esql_source/esql_utils.ts b/x-pack/plugins/maps/public/classes/sources/esql_source/esql_utils.ts
index 90df8e174a0c22..32ab2c88cc57bb 100644
--- a/x-pack/plugins/maps/public/classes/sources/esql_source/esql_utils.ts
+++ b/x-pack/plugins/maps/public/classes/sources/esql_source/esql_utils.ts
@@ -6,14 +6,13 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { lastValueFrom } from 'rxjs';
 import type { DataView } from '@kbn/data-plugin/common';
 import {
-  ESQL_LATEST_VERSION,
   getESQLAdHocDataview,
   getIndexPatternFromESQLQuery,
+  getESQLQueryColumnsRaw,
 } from '@kbn/esql-utils';
-import type { ESQLColumn, ESQLSearchReponse } from '@kbn/es-types';
+import type { ESQLColumn } from '@kbn/es-types';
 import { ES_GEO_FIELD_TYPE } from '../../../../common/constants';
 import { getData, getIndexPatternService } from '../../../kibana_services';
 
@@ -59,7 +58,10 @@ export async function getESQLMeta(esql: string) {
     getIndexPatternService()
   );
   return {
-    columns: await getColumns(esql),
+    columns: await getESQLQueryColumnsRaw({
+      esqlQuery: esql,
+      search: getData().search.search,
+    }),
     adhocDataViewId: adhocDataView.id!,
     ...getFields(adhocDataView),
   };
@@ -87,34 +89,6 @@ export function getFieldType(column: ESQLColumn) {
   }
 }
 
-async function getColumns(esql: string) {
-  const params = {
-    query: esql + ' | limit 0',
-    version: ESQL_LATEST_VERSION,
-  };
-
-  try {
-    const resp = await lastValueFrom(
-      getData().search.search(
-        { params },
-        {
-          strategy: 'esql',
-        }
-      )
-    );
-
-    const searchResponse = resp.rawResponse as unknown as ESQLSearchReponse;
-    return searchResponse.all_columns ? searchResponse.all_columns : searchResponse.columns;
-  } catch (error) {
-    throw new Error(
-      i18n.translate('xpack.maps.source.esql.getColumnsErrorMsg', {
-        defaultMessage: 'Unable to load columns. {errorMessage}',
-        values: { errorMessage: error.message },
-      })
-    );
-  }
-}
-
 export function getFields(dataView: DataView) {
   const dateFields: string[] = [];
   const geoFields: string[] = [];
diff --git a/x-pack/plugins/maps/public/classes/styles/vector/components/field_select.tsx b/x-pack/plugins/maps/public/classes/styles/vector/components/field_select.tsx
index a2c5f69e55e680..72e55b2564e35b 100644
--- a/x-pack/plugins/maps/public/classes/styles/vector/components/field_select.tsx
+++ b/x-pack/plugins/maps/public/classes/styles/vector/components/field_select.tsx
@@ -10,6 +10,7 @@ import { calculateWidthFromEntries } from '@kbn/calculate-width-from-char-count'
 import { EuiComboBox, EuiComboBoxProps, EuiComboBoxOptionOption } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { FieldIcon } from '@kbn/react-field';
+import { comboBoxFieldOptionMatcher } from '@kbn/field-utils';
 import {
   FIELD_ORIGIN,
   MIDDLE_TRUNCATION_PROPS,
@@ -35,6 +36,7 @@ function groupFieldsByOrigin(fields: StyleField[]) {
       .map((field) => {
         return {
           value: field,
+          name: field.name,
           label: field.label,
           disabled: field.isUnsupported,
           title: field.unsupportedMsg,
@@ -132,6 +134,7 @@ export function FieldSelect({ fields, selectedFieldName, onChange, styleName, ..
       singleSelection={SINGLE_SELECTION_AS_TEXT_PROPS}
       truncationProps={MIDDLE_TRUNCATION_PROPS}
       inputPopoverProps={{ panelMinWidth }}
+      optionMatcher={comboBoxFieldOptionMatcher}
       {...rest}
     />
   );
diff --git a/x-pack/plugins/maps/public/components/single_field_select.tsx b/x-pack/plugins/maps/public/components/single_field_select.tsx
index 5a2a8f35755aa6..325779cd50d0fe 100644
--- a/x-pack/plugins/maps/public/components/single_field_select.tsx
+++ b/x-pack/plugins/maps/public/components/single_field_select.tsx
@@ -12,6 +12,7 @@ import { EuiComboBox, EuiComboBoxProps, EuiComboBoxOptionOption, EuiToolTip } fr
 import { FieldIcon } from '@kbn/react-field';
 import { DataViewField } from '@kbn/data-views-plugin/public';
 import { calculateWidthFromEntries } from '@kbn/calculate-width-from-char-count';
+import { comboBoxFieldOptionMatcher } from '@kbn/field-utils';
 import { MIDDLE_TRUNCATION_PROPS } from '../../common/constants';
 
 function fieldsToOptions(
@@ -32,6 +33,7 @@ function fieldsToOptions(
         value: field,
         label: field.displayName ? field.displayName : field.name,
         prepend: FieldTypeIcon,
+        name: field.name,
       };
       if (isFieldDisabled && isFieldDisabled(field)) {
         option.disabled = true;
@@ -119,6 +121,7 @@ export function SingleFieldSelect({
       isDisabled={!fields || fields.length === 0}
       truncationProps={MIDDLE_TRUNCATION_PROPS}
       inputPopoverProps={{ panelMinWidth }}
+      optionMatcher={comboBoxFieldOptionMatcher}
       {...rest}
     />
   );
diff --git a/x-pack/plugins/maps/public/components/tooltip_selector/__snapshots__/add_tooltip_field_popover.test.tsx.snap b/x-pack/plugins/maps/public/components/tooltip_selector/__snapshots__/add_tooltip_field_popover.test.tsx.snap
index 6592d6d4ef1fec..02152efb6ac834 100644
--- a/x-pack/plugins/maps/public/components/tooltip_selector/__snapshots__/add_tooltip_field_popover.test.tsx.snap
+++ b/x-pack/plugins/maps/public/components/tooltip_selector/__snapshots__/add_tooltip_field_popover.test.tsx.snap
@@ -34,6 +34,7 @@ exports[`Should remove selected fields from selectable 1`] = `
       Array [
         Object {
           "label": "@timestamp-label",
+          "name": "@timestamp",
           "prepend": <FieldIcon
             className="eui-alignMiddle"
             fill="none"
@@ -109,6 +110,7 @@ exports[`Should render 1`] = `
       Array [
         Object {
           "label": "@timestamp-label",
+          "name": "@timestamp",
           "prepend": <FieldIcon
             className="eui-alignMiddle"
             fill="none"
@@ -118,6 +120,7 @@ exports[`Should render 1`] = `
         },
         Object {
           "label": "custom label for prop1",
+          "name": "prop1",
           "prepend": <FieldIcon
             className="eui-alignMiddle"
             fill="none"
@@ -127,6 +130,7 @@ exports[`Should render 1`] = `
         },
         Object {
           "label": "prop2-label",
+          "name": "prop2",
           "prepend": <FieldIcon
             className="eui-alignMiddle"
             fill="none"
diff --git a/x-pack/plugins/maps/public/components/tooltip_selector/add_tooltip_field_popover.tsx b/x-pack/plugins/maps/public/components/tooltip_selector/add_tooltip_field_popover.tsx
index 5decf5f127054c..ecee6e3b25e4bb 100644
--- a/x-pack/plugins/maps/public/components/tooltip_selector/add_tooltip_field_popover.tsx
+++ b/x-pack/plugins/maps/public/components/tooltip_selector/add_tooltip_field_popover.tsx
@@ -22,6 +22,7 @@ import {
 import { FormattedMessage } from '@kbn/i18n-react';
 import { i18n } from '@kbn/i18n';
 import { FieldIcon } from '@kbn/react-field';
+import { comboBoxFieldOptionMatcher } from '@kbn/field-utils';
 
 export type FieldProps = {
   label: string;
@@ -51,6 +52,7 @@ function getOptions(fields: FieldProps[], selectedFields: FieldProps[]): EuiSele
     .map((field) => {
       return {
         value: field.name,
+        name: field.name,
         prepend:
           'type' in field ? (
             <FieldIcon className="eui-alignMiddle" type={field.type} fill="none" />
@@ -161,6 +163,7 @@ export class AddTooltipFieldPopover extends Component<Props, State> {
           searchProps={{ compressed: true }}
           options={this.state.options}
           onChange={this._onSelect}
+          optionMatcher={comboBoxFieldOptionMatcher}
         >
           {(list, search) => (
             <div style={{ width: '300px' }}>
diff --git a/x-pack/plugins/maps/public/embeddable/map_component.tsx b/x-pack/plugins/maps/public/embeddable/map_component.tsx
index a9f3fe4afbc0be..a6590703a547ba 100644
--- a/x-pack/plugins/maps/public/embeddable/map_component.tsx
+++ b/x-pack/plugins/maps/public/embeddable/map_component.tsx
@@ -13,6 +13,7 @@ import { ViewMode } from '@kbn/embeddable-plugin/public';
 import type { LayerDescriptor, MapCenterAndZoom, MapSettings } from '../../common/descriptor_types';
 import { MapEmbeddable } from './map_embeddable';
 import { createBasemapLayerDescriptor } from '../classes/layers/create_basemap_layer_descriptor';
+import { RenderToolTipContent } from '../classes/tooltips/tooltip_property';
 
 export interface Props {
   title?: string;
@@ -25,6 +26,7 @@ export interface Props {
   isLayerTOCOpen?: boolean;
   mapCenter?: MapCenterAndZoom;
   onInitialRenderComplete?: () => void;
+  getTooltipRenderer?: () => RenderToolTipContent;
   /*
    * Set to false to exclude sharing attributes 'data-*'.
    */
@@ -65,6 +67,10 @@ export class MapComponent extends Component<Props> {
       timeRange: this.props.timeRange,
     });
 
+    if (this.props.getTooltipRenderer) {
+      this._mapEmbeddable.setRenderTooltipContent(this.props.getTooltipRenderer());
+    }
+
     if (this.props.onInitialRenderComplete) {
       this._mapEmbeddable
         .getOnRenderComplete$()
diff --git a/x-pack/plugins/maps/public/index.ts b/x-pack/plugins/maps/public/index.ts
index d0281537e7a02d..4f8a1090436fe0 100644
--- a/x-pack/plugins/maps/public/index.ts
+++ b/x-pack/plugins/maps/public/index.ts
@@ -26,6 +26,7 @@ export type {
 } from './classes/tooltips/tooltip_property';
 
 export type { MapsSetupApi, MapsStartApi } from './api';
+export type { CreateLayerDescriptorParams } from './classes/sources/es_search_source/create_layer_descriptor';
 
 export type { MapEmbeddable, MapEmbeddableInput, MapEmbeddableOutput } from './embeddable';
 export { type MapApi, isMapApi } from './embeddable/map_api';
diff --git a/x-pack/plugins/maps/public/kibana_services.ts b/x-pack/plugins/maps/public/kibana_services.ts
index 398ff8630f8beb..6212c28c60f667 100644
--- a/x-pack/plugins/maps/public/kibana_services.ts
+++ b/x-pack/plugins/maps/public/kibana_services.ts
@@ -104,6 +104,3 @@ export const getEMSSettings: () => EMSSettings = () => {
 export const getEmsTileLayerId = () => mapsEms.config.emsTileLayerId;
 
 export const getShareService = () => pluginsStart.share;
-
-export const getIsAllowByValueEmbeddables = () =>
-  pluginsStart.dashboard.dashboardFeatureFlagConfig.allowByValueEmbeddables;
diff --git a/x-pack/plugins/maps/public/plugin.ts b/x-pack/plugins/maps/public/plugin.ts
index 2eaabaa00aaf64..2e9cbcba8d96ff 100644
--- a/x-pack/plugins/maps/public/plugin.ts
+++ b/x-pack/plugins/maps/public/plugin.ts
@@ -10,7 +10,6 @@ import type { Setup as InspectorSetupContract } from '@kbn/inspector-plugin/publ
 import type { UiActionsStart } from '@kbn/ui-actions-plugin/public';
 import type { NavigationPublicPluginStart } from '@kbn/navigation-plugin/public';
 import type { Start as InspectorStartContract } from '@kbn/inspector-plugin/public';
-import type { DashboardStart } from '@kbn/dashboard-plugin/public';
 import type { UsageCollectionSetup } from '@kbn/usage-collection-plugin/public';
 import type { FieldFormatsStart } from '@kbn/field-formats-plugin/public';
 import type {
@@ -25,11 +24,7 @@ import type { HomePublicPluginSetup } from '@kbn/home-plugin/public';
 import type { VisualizationsSetup, VisualizationsStart } from '@kbn/visualizations-plugin/public';
 import type { Plugin as ExpressionsPublicPlugin } from '@kbn/expressions-plugin/public';
 import { VISUALIZE_GEO_FIELD_TRIGGER } from '@kbn/ui-actions-plugin/public';
-import {
-  EmbeddableSetup,
-  EmbeddableStart,
-  registerSavedObjectToPanelMethod,
-} from '@kbn/embeddable-plugin/public';
+import { EmbeddableSetup, EmbeddableStart } from '@kbn/embeddable-plugin/public';
 import { CONTEXT_MENU_TRIGGER } from '@kbn/embeddable-plugin/public';
 import type { SharePluginSetup, SharePluginStart } from '@kbn/share-plugin/public';
 import type { MapsEmsPluginPublicStart } from '@kbn/maps-ems-plugin/public';
@@ -125,7 +120,6 @@ export interface MapsPluginStartDependencies {
   uiActions: UiActionsStart;
   share: SharePluginStart;
   visualizations: VisualizationsStart;
-  dashboard: DashboardStart;
   savedObjectsTagging?: SavedObjectTaggingPluginStart;
   presentationUtil: PresentationUtilPluginStart;
   security?: SecurityPluginStart;
@@ -230,15 +224,18 @@ export class MapsPlugin
       name: APP_NAME,
     });
 
-    registerSavedObjectToPanelMethod<MapAttributes, MapByValueInput>(CONTENT_ID, (savedObject) => {
-      if (!savedObject.managed) {
-        return { savedObjectId: savedObject.id };
-      }
+    plugins.embeddable.registerSavedObjectToPanelMethod<MapAttributes, MapByValueInput>(
+      CONTENT_ID,
+      (savedObject) => {
+        if (!savedObject.managed) {
+          return { savedObjectId: savedObject.id };
+        }
 
-      return {
-        attributes: savedObjectToEmbeddableAttributes(savedObject),
-      };
-    });
+        return {
+          attributes: savedObjectToEmbeddableAttributes(savedObject),
+        };
+      }
+    );
 
     setupLensChoroplethChart(core, plugins.expressions, plugins.lens);
 
diff --git a/x-pack/plugins/maps/public/routes/map_page/saved_map/saved_map.ts b/x-pack/plugins/maps/public/routes/map_page/saved_map/saved_map.ts
index b1118fcbf00e8e..4d7273c3fd4b27 100644
--- a/x-pack/plugins/maps/public/routes/map_page/saved_map/saved_map.ts
+++ b/x-pack/plugins/maps/public/routes/map_page/saved_map/saved_map.ts
@@ -41,7 +41,6 @@ import {
   getCoreChrome,
   getIndexPatternService,
   getToasts,
-  getIsAllowByValueEmbeddables,
   getSavedObjectsTagging,
   getTimeFilter,
   getUsageCollection,
@@ -386,8 +385,7 @@ export class SavedMap {
 
   public hasSaveAndReturnConfig() {
     const hasOriginatingApp = this.hasOriginatingApp();
-    const isNewMap = !this.getSavedObjectId();
-    return getIsAllowByValueEmbeddables() ? hasOriginatingApp : !isNewMap && hasOriginatingApp;
+    return hasOriginatingApp;
   }
 
   public getTitle(): string {
@@ -439,7 +437,7 @@ export class SavedMap {
 
   public isByValue(): boolean {
     const hasSavedObjectId = !!this.getSavedObjectId();
-    return getIsAllowByValueEmbeddables() && !!this._originatingApp && !hasSavedObjectId;
+    return !!this._originatingApp && !hasSavedObjectId;
   }
 
   public async save({
diff --git a/x-pack/plugins/maps/public/routes/map_page/top_nav_config.tsx b/x-pack/plugins/maps/public/routes/map_page/top_nav_config.tsx
index 0aabdf877cd42b..221d90ac4f2ca3 100644
--- a/x-pack/plugins/maps/public/routes/map_page/top_nav_config.tsx
+++ b/x-pack/plugins/maps/public/routes/map_page/top_nav_config.tsx
@@ -21,7 +21,6 @@ import { ScopedHistory } from '@kbn/core/public';
 import {
   getNavigateToApp,
   getMapsCapabilities,
-  getIsAllowByValueEmbeddables,
   getInspector,
   getCoreOverlays,
   getSavedObjectsTagging,
@@ -215,7 +214,7 @@ export function getTopNavConfig({
 
         let saveModal;
 
-        if (savedMap.hasOriginatingApp() || !getIsAllowByValueEmbeddables()) {
+        if (savedMap.hasOriginatingApp()) {
           saveModal = (
             <SavedObjectSaveModalOrigin
               {...saveModalProps}
diff --git a/x-pack/plugins/maps/tsconfig.json b/x-pack/plugins/maps/tsconfig.json
index 3e4cd8a1210f7e..96fa01c4c6f627 100644
--- a/x-pack/plugins/maps/tsconfig.json
+++ b/x-pack/plugins/maps/tsconfig.json
@@ -14,7 +14,6 @@
   "kbn_references": [
     "@kbn/core",
     "@kbn/maps-ems-plugin",
-    "@kbn/dashboard-plugin",
     "@kbn/inspector-plugin",
     "@kbn/data-plugin",
     "@kbn/ui-actions-plugin",
@@ -89,7 +88,8 @@
     "@kbn/esql-utils",
     "@kbn/apm-data-view",
     "@kbn/shared-ux-utility",
-    "@kbn/react-kibana-context-render"
+    "@kbn/react-kibana-context-render",
+    "@kbn/field-utils"
   ],
   "exclude": [
     "target/**/*",
diff --git a/x-pack/plugins/ml/public/alerting/anomaly_detection_rule/advanced_settings.tsx b/x-pack/plugins/ml/public/alerting/anomaly_detection_rule/advanced_settings.tsx
index 97d152c2b11151..d9d6e983e59963 100644
--- a/x-pack/plugins/ml/public/alerting/anomaly_detection_rule/advanced_settings.tsx
+++ b/x-pack/plugins/ml/public/alerting/anomaly_detection_rule/advanced_settings.tsx
@@ -5,9 +5,6 @@
  * 2.0.
  */
 
-import type { FC } from 'react';
-import React from 'react';
-import { FormattedMessage } from '@kbn/i18n-react';
 import {
   EuiAccordion,
   EuiDescribedFormGroup,
@@ -17,9 +14,14 @@ import {
   EuiSpacer,
   EuiText,
 } from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n-react';
+import { isDefined } from '@kbn/ml-is-defined';
+import type { FC } from 'react';
+import React, { useMemo } from 'react';
+import { validateTopNBucket } from '../validators';
+import { TOP_N_BUCKETS_COUNT } from '../../../common/constants/alerts';
 import { type MlAnomalyDetectionAlertAdvancedSettings } from '../../../common/types/alerts';
 import { TimeIntervalControl } from '../time_interval_control';
-import { TOP_N_BUCKETS_COUNT } from '../../../common/constants/alerts';
 
 interface AdvancedSettingsProps {
   value: MlAnomalyDetectionAlertAdvancedSettings;
@@ -27,6 +29,13 @@ interface AdvancedSettingsProps {
 }
 
 export const AdvancedSettings: FC<AdvancedSettingsProps> = React.memo(({ value, onChange }) => {
+  const topNBucketsValidationErrors = useMemo(() => {
+    if (!isDefined(value.topNBuckets)) {
+      return null;
+    }
+    return validateTopNBucket(value.topNBuckets);
+  }, [value.topNBuckets]);
+
   return (
     <EuiAccordion
       id="mlAnomalyAlertAdvancedSettings"
@@ -101,6 +110,8 @@ export const AdvancedSettings: FC<AdvancedSettingsProps> = React.memo(({ value,
               defaultMessage="Number of latest buckets"
             />
           }
+          isInvalid={topNBucketsValidationErrors !== null}
+          data-test-subj={'mlAnomalyAlertTopNBucketsFormRow'}
         >
           <EuiFieldNumber
             value={value.topNBuckets ?? TOP_N_BUCKETS_COUNT}
@@ -109,6 +120,7 @@ export const AdvancedSettings: FC<AdvancedSettingsProps> = React.memo(({ value,
               onChange({ topNBuckets: Number(e.target.value) });
             }}
             data-test-subj={'mlAnomalyAlertTopNBuckets'}
+            isInvalid={topNBucketsValidationErrors !== null}
           />
         </EuiFormRow>
       </EuiDescribedFormGroup>
diff --git a/x-pack/plugins/ml/public/alerting/job_selector.tsx b/x-pack/plugins/ml/public/alerting/job_selector.tsx
index bd28a15800cb35..5e1835ebfdfe1c 100644
--- a/x-pack/plugins/ml/public/alerting/job_selector.tsx
+++ b/x-pack/plugins/ml/public/alerting/job_selector.tsx
@@ -29,7 +29,7 @@ export interface JobSelectorControlProps {
   /**
    * Validation is handled by alerting framework
    */
-  errors: string[];
+  errors?: string[];
   /** Enables multiple selection of jobs and groups */
   multiSelect?: boolean;
   label?: ReactNode;
diff --git a/x-pack/plugins/ml/public/alerting/time_interval_control.tsx b/x-pack/plugins/ml/public/alerting/time_interval_control.tsx
index 5e664294963fa9..43eafe7acaedcf 100644
--- a/x-pack/plugins/ml/public/alerting/time_interval_control.tsx
+++ b/x-pack/plugins/ml/public/alerting/time_interval_control.tsx
@@ -37,6 +37,7 @@ export const TimeIntervalControl: FC<TimeIntervalControlProps> = ({
       label={label}
       isInvalid={isInvalid}
       error={invalidTimeIntervalMessage(value ?? undefined)}
+      data-test-subj={'mlAnomalyAlertAdvancedSettingsLookbackInterval'}
     >
       <EuiFieldText
         {...fieldTextProps}
diff --git a/x-pack/plugins/ml/public/alerting/validators.ts b/x-pack/plugins/ml/public/alerting/validators.ts
index 268f9409684241..4999c8bf45a8fd 100644
--- a/x-pack/plugins/ml/public/alerting/validators.ts
+++ b/x-pack/plugins/ml/public/alerting/validators.ts
@@ -8,4 +8,4 @@
 import { numberValidator } from '@kbn/ml-agg-utils';
 import { timeIntervalInputValidator } from '../../common/util/validators';
 export const validateLookbackInterval = timeIntervalInputValidator();
-export const validateTopNBucket = numberValidator({ min: 1 });
+export const validateTopNBucket = numberValidator({ min: 1, integerOnly: true });
diff --git a/x-pack/plugins/ml/public/application/components/anomalies_table/links_menu.tsx b/x-pack/plugins/ml/public/application/components/anomalies_table/links_menu.tsx
index a0e644e0929b1e..5038d39d0ffe59 100644
--- a/x-pack/plugins/ml/public/application/components/anomalies_table/links_menu.tsx
+++ b/x-pack/plugins/ml/public/application/components/anomalies_table/links_menu.tsx
@@ -10,6 +10,7 @@ import moment from 'moment';
 import rison from '@kbn/rison';
 import type { FC } from 'react';
 import React, { useEffect, useMemo, useState } from 'react';
+import useMountedState from 'react-use/lib/useMountedState';
 
 import {
   EuiButtonIcon,
@@ -58,7 +59,6 @@ import type { SourceIndicesWithGeoFields } from '../../explorer/explorer_utils';
 import { escapeDoubleQuotes, getDateFormatTz } from '../../explorer/explorer_utils';
 import { usePermissionCheck } from '../../capabilities/check_capabilities';
 import { useMlKibana } from '../../contexts/kibana';
-import { getFieldTypeFromMapping } from '../../services/mapping_service';
 import { useMlIndexUtils } from '../../util/index_service';
 
 import { getQueryStringForInfluencers } from './get_query_string_for_influencers';
@@ -79,8 +79,13 @@ interface LinksMenuProps {
 }
 
 export const LinksMenuUI = (props: LinksMenuProps) => {
+  const isMounted = useMountedState();
+
+  const [dataViewId, setDataViewId] = useState<string | null>(null);
+  const [dataViewIdWithTemporary, setDataViewIdWithTemporary] = useState<string | null>(null);
   const [openInDiscoverUrl, setOpenInDiscoverUrl] = useState<string | undefined>();
-  const [discoverUrlError, setDiscoverUrlError] = useState<string | undefined>();
+  const [openInDiscoverUrlError, setOpenInDiscoverUrlError] = useState<string | undefined>();
+  const [viewExamplesUrlError, setViewExamplesUrlError] = useState<string | undefined>();
   const [openInLogRateAnalysisUrl, setOpenInLogRateAnalysisUrl] = useState<string | undefined>();
 
   const [messageField, setMessageField] = useState<{
@@ -96,16 +101,46 @@ export const LinksMenuUI = (props: LinksMenuProps) => {
   const {
     services: { data, share, application, uiActions },
   } = kibana;
-  const { getDataViewIdFromName } = useMlIndexUtils();
+  const { getDataViewById, getDataViewIdFromName } = useMlIndexUtils();
 
   const job = useMemo(() => {
     return mlJobService.getJob(props.anomaly.jobId);
   }, [props.anomaly.jobId]);
 
-  const getAnomaliesMapsLink = async (anomaly: MlAnomaliesTableRecord) => {
-    const index = job.datafeed_config.indices[0];
-    const dataViewId = await getDataViewIdFromName(index);
+  const categorizationFieldName = job.analysis_config.categorization_field_name;
+  const datafeedIndices = job.datafeed_config.indices;
+  const indexPattern = datafeedIndices.join(',');
+  const autoGeneratedDiscoverLinkError = i18n.translate(
+    'xpack.ml.anomaliesTable.linksMenu.autoGeneratedDiscoverLinkErrorMessage',
+    {
+      defaultMessage: `Unable to link to Discover; no data view exists for index pattern '{index}'`,
+      values: { index: indexPattern },
+    }
+  );
+
+  useEffect(
+    () => {
+      async function initDataViewId() {
+        const newDataViewId = await getDataViewIdFromName(indexPattern);
+        setDataViewId(newDataViewId);
+        if (newDataViewId === null) {
+          setViewExamplesUrlError(autoGeneratedDiscoverLinkError);
+        }
+
+        const newDataViewIdWithTemporary = await getDataViewIdFromName(indexPattern, job);
+        setDataViewIdWithTemporary(newDataViewIdWithTemporary);
+        if (newDataViewIdWithTemporary === null) {
+          setOpenInDiscoverUrlError(autoGeneratedDiscoverLinkError);
+        }
+      }
+
+      initDataViewId();
+    },
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+    []
+  );
 
+  const getAnomaliesMapsLink = async (anomaly: MlAnomaliesTableRecord) => {
     const initialLayers = getInitialAnomaliesLayers(anomaly.jobId);
     const anomalyBucketStartMoment = moment(anomaly.source.timestamp).tz(getDateFormatTz());
     const anomalyBucketStart = anomalyBucketStartMoment.toISOString();
@@ -143,9 +178,6 @@ export const LinksMenuUI = (props: LinksMenuProps) => {
     anomaly: MlAnomaliesTableRecord,
     sourceIndicesWithGeoFields: SourceIndicesWithGeoFields
   ) => {
-    const index = job.datafeed_config.indices[0];
-    const dataViewId = await getDataViewIdFromName(index);
-
     // Create a layer for each of the geoFields
     const initialLayers = getInitialSourceIndexFieldLayers(
       sourceIndicesWithGeoFields[anomaly.jobId]
@@ -198,9 +230,10 @@ export const LinksMenuUI = (props: LinksMenuProps) => {
   };
 
   useEffect(() => {
-    let unmounted = false;
     const discoverLocator = share.url.locators.get('DISCOVER_APP_LOCATOR');
 
+    if (dataViewIdWithTemporary === null) return;
+
     if (!discoverLocator) {
       const discoverLocatorMissing = i18n.translate(
         'xpack.ml.anomaliesTable.linksMenu.discoverLocatorMissingErrorMessage',
@@ -209,39 +242,17 @@ export const LinksMenuUI = (props: LinksMenuProps) => {
         }
       );
 
-      if (!unmounted) {
-        setDiscoverUrlError(discoverLocatorMissing);
+      if (isMounted()) {
+        setOpenInDiscoverUrlError(discoverLocatorMissing);
+        setViewExamplesUrlError(discoverLocatorMissing);
       }
       return;
     }
 
-    const getDataViewId = async () => {
-      const index = job.datafeed_config.indices[0];
-
-      const dataViewId = await getDataViewIdFromName(index, job);
-
-      // If data view doesn't exist for some reasons
-      if (!dataViewId && !unmounted) {
-        const autoGeneratedDiscoverLinkError = i18n.translate(
-          'xpack.ml.anomaliesTable.linksMenu.autoGeneratedDiscoverLinkErrorMessage',
-          {
-            defaultMessage: `Unable to link to Discover; no data view exists for index '{index}'`,
-            values: { index },
-          }
-        );
-
-        setDiscoverUrlError(autoGeneratedDiscoverLinkError);
-      }
-      return dataViewId;
-    };
-
     (async () => {
-      const index = job.datafeed_config.indices[0];
-      const dataView = (await data.dataViews.find(index)).find(
-        (dv) => dv.getIndexPattern() === index
-      );
+      const dataView = dataViewId ? await getDataViewById(dataViewId) : null;
 
-      if (dataView === undefined) {
+      if (dataView === null) {
         return;
       }
 
@@ -260,7 +271,6 @@ export const LinksMenuUI = (props: LinksMenuProps) => {
     ): Promise<SerializableRecord> => {
       const interval = props.interval;
 
-      const dataViewId = await getDataViewId();
       const record = props.anomaly.source;
 
       // Use the exact timestamp for Log Rate Analysis,
@@ -333,8 +343,10 @@ export const LinksMenuUI = (props: LinksMenuProps) => {
         )}"`;
       }
 
+      const indexPatternId = dataViewIdWithTemporary;
+
       return {
-        indexPatternId: dataViewId,
+        indexPatternId,
         [timeAttribute]: {
           from,
           to,
@@ -345,9 +357,9 @@ export const LinksMenuUI = (props: LinksMenuProps) => {
           query: kqlQuery,
         },
         filters:
-          dataViewId === null
+          indexPatternId === null
             ? []
-            : getFiltersForDSLQuery(job.datafeed_config.query, dataViewId, job.job_id),
+            : getFiltersForDSLQuery(job.datafeed_config.query, indexPatternId, job.job_id),
         ...(withWindowParameters
           ? {
               wp: { bMin, bMax, dMin, dMax },
@@ -360,7 +372,7 @@ export const LinksMenuUI = (props: LinksMenuProps) => {
       const pageState = await generateRedirectUrlPageState();
       const url = await discoverLocator.getRedirectUrl(pageState);
 
-      if (!unmounted) {
+      if (isMounted()) {
         setOpenInDiscoverUrl(url);
       }
     };
@@ -373,7 +385,7 @@ export const LinksMenuUI = (props: LinksMenuProps) => {
         (job.analysis_config.summary_count_field_name !== undefined &&
           job.analysis_config.summary_count_field_name !== 'doc_count')
       ) {
-        if (!unmounted) {
+        if (isMounted()) {
           setOpenInLogRateAnalysisUrl(undefined);
         }
         return;
@@ -410,7 +422,7 @@ export const LinksMenuUI = (props: LinksMenuProps) => {
         },
       });
 
-      if (!unmounted) {
+      if (isMounted()) {
         setOpenInLogRateAnalysisUrl(url);
       }
     };
@@ -418,15 +430,10 @@ export const LinksMenuUI = (props: LinksMenuProps) => {
     if (!isCategorizationAnomalyRecord) {
       generateDiscoverUrl();
       generateLogRateAnalysisUrl();
-    } else {
-      getDataViewId();
     }
 
-    return () => {
-      unmounted = true;
-    };
     // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [JSON.stringify(props.anomaly)]);
+  }, [dataViewId, dataViewIdWithTemporary, JSON.stringify(props.anomaly)]);
 
   const openCustomUrl = (customUrl: MlKibanaUrlConfig) => {
     const { anomaly, interval, isAggregatedData } = props;
@@ -598,7 +605,7 @@ export const LinksMenuUI = (props: LinksMenuProps) => {
     window.open(singleMetricViewerLink, '_blank');
   };
 
-  const viewExamples = () => {
+  const viewExamples = async () => {
     const categoryId = props.anomaly.entityValue;
     const record = props.anomaly.source;
 
@@ -616,35 +623,10 @@ export const LinksMenuUI = (props: LinksMenuProps) => {
       );
       return;
     }
-    const categorizationFieldName = job.analysis_config.categorization_field_name;
-    const datafeedIndices = job.datafeed_config.indices;
-
-    // Find the type of the categorization field i.e. text (preferred) or keyword.
-    // Uses the first matching field found in the list of indices in the datafeed_config.
-    // attempt to load the field type using each index. we have to do it this way as _field_caps
-    // doesn't specify which index a field came from unless there is a clash.
-    let i = 0;
-    findFieldType(datafeedIndices[i]);
 
-    const error = () => {
-      // eslint-disable-next-line no-console
-      console.log(
-        `viewExamples(): error finding type of field ${categorizationFieldName} in indices:`,
-        datafeedIndices
-      );
-      const { toasts } = kibana.services.notifications;
-      toasts.addDanger(
-        i18n.translate('xpack.ml.anomaliesTable.linksMenu.noMappingCouldBeFoundErrorMessage', {
-          defaultMessage:
-            'Unable to view examples of documents with mlcategory {categoryId} ' +
-            'as no mapping could be found for the categorization field {categorizationFieldName}',
-          values: {
-            categoryId,
-            categorizationFieldName,
-          },
-        })
-      );
-    };
+    if (!categorizationFieldName) {
+      return;
+    }
 
     const createAndOpenUrl = (index: string, categorizationFieldType: string) => {
       // Get the definition of the category and use the terms or regex to view the
@@ -653,12 +635,6 @@ export const LinksMenuUI = (props: LinksMenuProps) => {
       ml.results
         .getCategoryDefinition(record.job_id, categoryId)
         .then(async (resp) => {
-          // Find the ID of the data view with a title attribute which matches the
-          // index configured in the datafeed. If a Kibana data view has not been created
-          // for this index, then the user will see a warning message on the Discover tab advising
-          // them that no matching data view has been configured.
-          const dataViewId = await getDataViewIdFromName(index);
-
           // We should not redirect to Discover if data view doesn't exist
           if (!dataViewId) return;
 
@@ -736,23 +712,39 @@ export const LinksMenuUI = (props: LinksMenuProps) => {
         });
     };
 
-    function findFieldType(index: string) {
-      getFieldTypeFromMapping(index, categorizationFieldName)
-        .then((resp: string) => {
-          if (resp !== '') {
-            createAndOpenUrl(datafeedIndices.join(), resp);
-          } else {
-            i++;
-            if (i < datafeedIndices.length) {
-              findFieldType(datafeedIndices[i]);
-            } else {
-              error();
-            }
-          }
+    // Find the type of the categorization field i.e. text (preferred) or keyword.
+    // Uses the first matching field found in the list of indices in the datafeed_config.
+    let fieldType;
+
+    const dataView = dataViewIdWithTemporary
+      ? await getDataViewById(dataViewIdWithTemporary)
+      : null;
+
+    const field = dataView?.getFieldByName(categorizationFieldName);
+    if (field && Array.isArray(field.esTypes) && field.esTypes.length > 0) {
+      fieldType = field.esTypes[0];
+    }
+
+    if (fieldType) {
+      createAndOpenUrl(datafeedIndices.join(), fieldType);
+    } else {
+      // eslint-disable-next-line no-console
+      console.log(
+        `viewExamples(): error finding type of field ${categorizationFieldName} in indices:`,
+        datafeedIndices
+      );
+      const { toasts } = kibana.services.notifications;
+      toasts.addDanger(
+        i18n.translate('xpack.ml.anomaliesTable.linksMenu.noMappingCouldBeFoundErrorMessage', {
+          defaultMessage:
+            'Unable to view examples of documents with mlcategory {categoryId} ' +
+            'as no mapping could be found for the categorization field {categorizationFieldName}',
+          values: {
+            categoryId,
+            categorizationFieldName,
+          },
         })
-        .catch(() => {
-          error();
-        });
+      );
     }
   };
 
@@ -782,18 +774,18 @@ export const LinksMenuUI = (props: LinksMenuProps) => {
 
     if (application.capabilities.discover?.show && !isCategorizationAnomalyRecord) {
       // Add item from the start, but disable it during the URL generation.
-      const isLoading = discoverUrlError === undefined && openInDiscoverUrl === undefined;
+      const isLoading = openInDiscoverUrlError === undefined && openInDiscoverUrl === undefined;
 
       items.push(
         <EuiContextMenuItem
           key={`auto_raw_data_url`}
           icon="discoverApp"
-          disabled={discoverUrlError !== undefined || isLoading}
+          disabled={openInDiscoverUrlError !== undefined || isLoading}
           href={openInDiscoverUrl}
           data-test-subj={`mlAnomaliesListRowAction_viewInDiscoverButton`}
         >
-          {discoverUrlError ? (
-            <EuiToolTip content={discoverUrlError}>
+          {openInDiscoverUrlError ? (
+            <EuiToolTip content={openInDiscoverUrlError}>
               <FormattedMessage
                 id="xpack.ml.anomaliesTable.linksMenu.viewInDiscover"
                 defaultMessage="View in Discover"
@@ -883,10 +875,10 @@ export const LinksMenuUI = (props: LinksMenuProps) => {
             viewExamples();
           }}
           data-test-subj="mlAnomaliesListRowActionViewExamplesButton"
-          disabled={discoverUrlError !== undefined}
+          disabled={viewExamplesUrlError !== undefined}
         >
-          {discoverUrlError !== undefined ? (
-            <EuiToolTip content={discoverUrlError}>
+          {viewExamplesUrlError !== undefined ? (
+            <EuiToolTip content={viewExamplesUrlError}>
               <FormattedMessage
                 id="xpack.ml.anomaliesTable.linksMenu.viewExamplesLabel"
                 defaultMessage="View examples"
@@ -976,8 +968,11 @@ export const LinksMenuUI = (props: LinksMenuProps) => {
     return items;
     // eslint-disable-next-line react-hooks/exhaustive-deps
   }, [
+    dataViewId,
+    dataViewIdWithTemporary,
     openInDiscoverUrl,
-    discoverUrlError,
+    openInDiscoverUrlError,
+    viewExamplesUrlError,
     viewExamples,
     viewSeries,
     canConfigureRules,
diff --git a/x-pack/plugins/ml/public/application/components/ml_embedded_map/ml_embedded_map.tsx b/x-pack/plugins/ml/public/application/components/ml_embedded_map/ml_embedded_map.tsx
deleted file mode 100644
index 02a713af1b7ae5..00000000000000
--- a/x-pack/plugins/ml/public/application/components/ml_embedded_map/ml_embedded_map.tsx
+++ /dev/null
@@ -1,154 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React, { useEffect, useRef, useState } from 'react';
-
-import { htmlIdGenerator } from '@elastic/eui';
-import type { LayerDescriptor } from '@kbn/maps-plugin/common';
-import { INITIAL_LOCATION, MAP_SAVED_OBJECT_TYPE } from '@kbn/maps-plugin/common';
-import type {
-  MapEmbeddable,
-  MapEmbeddableInput,
-  MapEmbeddableOutput,
-  RenderTooltipContentParams,
-} from '@kbn/maps-plugin/public';
-
-import type { EmbeddableFactory, ErrorEmbeddable } from '@kbn/embeddable-plugin/public';
-import { isErrorEmbeddable, ViewMode } from '@kbn/embeddable-plugin/public';
-import { useMlKibana } from '../../contexts/kibana';
-
-export function MlEmbeddedMapComponent({
-  layerList,
-  mapEmbeddableInput,
-  renderTooltipContent,
-}: {
-  layerList: LayerDescriptor[];
-  mapEmbeddableInput?: MapEmbeddableInput;
-  renderTooltipContent?: (params: RenderTooltipContentParams) => JSX.Element;
-}) {
-  const [embeddable, setEmbeddable] = useState<ErrorEmbeddable | MapEmbeddable | undefined>();
-
-  const embeddableRoot: React.RefObject<HTMLDivElement> = useRef<HTMLDivElement>(null);
-  const baseLayers = useRef<LayerDescriptor[]>();
-
-  const {
-    services: { embeddable: embeddablePlugin, maps: mapsPlugin },
-  } = useMlKibana();
-
-  const factory:
-    | EmbeddableFactory<MapEmbeddableInput, MapEmbeddableOutput, MapEmbeddable>
-    | undefined = embeddablePlugin
-    ? embeddablePlugin.getEmbeddableFactory(MAP_SAVED_OBJECT_TYPE)
-    : undefined;
-
-  // Update the layer list  with updated geo points upon refresh
-  useEffect(() => {
-    async function updateIndexPatternSearchLayer() {
-      if (
-        embeddable &&
-        !isErrorEmbeddable(embeddable) &&
-        Array.isArray(layerList) &&
-        Array.isArray(baseLayers.current)
-      ) {
-        embeddable.setLayerList([...baseLayers.current, ...layerList]);
-      }
-    }
-    updateIndexPatternSearchLayer();
-  }, [embeddable, layerList]);
-
-  useEffect(() => {
-    async function setupEmbeddable() {
-      if (!factory) {
-        // eslint-disable-next-line no-console
-        console.error('Map embeddable not found.');
-        return;
-      }
-      const input: MapEmbeddableInput = {
-        id: htmlIdGenerator()(),
-        attributes: { title: '' },
-        filters: [],
-        hidePanelTitles: true,
-        viewMode: ViewMode.VIEW,
-        isLayerTOCOpen: false,
-        hideFilterActions: true,
-        // can use mapSettings to center map on anomalies
-        mapSettings: {
-          disableInteractive: false,
-          hideToolbarOverlay: false,
-          hideLayerControl: false,
-          hideViewControl: false,
-          initialLocation: INITIAL_LOCATION.AUTO_FIT_TO_BOUNDS, // this will startup based on data-extent
-          autoFitToDataBounds: true, // this will auto-fit when there are changes to the filter and/or query
-        },
-      };
-
-      const embeddableObject = await factory.create(input);
-
-      if (embeddableObject && !isErrorEmbeddable(embeddableObject)) {
-        const basemapLayerDescriptor = mapsPlugin
-          ? await mapsPlugin.createLayerDescriptors.createBasemapLayerDescriptor()
-          : null;
-
-        if (basemapLayerDescriptor) {
-          baseLayers.current = [basemapLayerDescriptor];
-          await embeddableObject.setLayerList(baseLayers.current);
-        }
-      }
-
-      setEmbeddable(embeddableObject);
-    }
-
-    setupEmbeddable();
-    // we want this effect to execute exactly once after the component mounts
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, []);
-
-  useEffect(() => {
-    if (embeddable && !isErrorEmbeddable(embeddable) && mapEmbeddableInput !== undefined) {
-      embeddable.updateInput(mapEmbeddableInput);
-    }
-  }, [embeddable, mapEmbeddableInput]);
-
-  useEffect(() => {
-    if (embeddable && !isErrorEmbeddable(embeddable) && renderTooltipContent !== undefined) {
-      embeddable.setRenderTooltipContent(renderTooltipContent);
-    }
-  }, [embeddable, renderTooltipContent]);
-
-  // We can only render after embeddable has already initialized
-  useEffect(() => {
-    if (embeddableRoot.current && embeddable) {
-      embeddable.render(embeddableRoot.current);
-    }
-  }, [embeddable, embeddableRoot]);
-
-  if (!embeddablePlugin) {
-    // eslint-disable-next-line no-console
-    console.error('Embeddable start plugin not found');
-    return null;
-  }
-  if (!mapsPlugin) {
-    // eslint-disable-next-line no-console
-    console.error('Maps start plugin not found');
-    return null;
-  }
-
-  return (
-    <div
-      data-test-subj="mlEmbeddedMapContent"
-      css={{
-        width: '100%',
-        height: '100%',
-        display: 'flex',
-        flex: '1 1 100%',
-        zIndex: 1,
-        minHeight: 0, // Absolute must for Firefox to scroll contents
-      }}
-      ref={embeddableRoot}
-    />
-  );
-}
diff --git a/x-pack/plugins/ml/public/application/explorer/anomalies_map.tsx b/x-pack/plugins/ml/public/application/explorer/anomalies_map.tsx
index 60dbe1f6e845f2..74da9e66ca6fad 100644
--- a/x-pack/plugins/ml/public/application/explorer/anomalies_map.tsx
+++ b/x-pack/plugins/ml/public/application/explorer/anomalies_map.tsx
@@ -18,6 +18,7 @@ import {
   htmlIdGenerator,
 } from '@elastic/eui';
 import type { VectorLayerDescriptor } from '@kbn/maps-plugin/common';
+import { INITIAL_LOCATION } from '@kbn/maps-plugin/common';
 import {
   FIELD_ORIGIN,
   LAYER_TYPE,
@@ -29,7 +30,6 @@ import type { EMSTermJoinConfig } from '@kbn/maps-plugin/public';
 import { isDefined } from '@kbn/ml-is-defined';
 import type { MlAnomaliesTableRecord } from '@kbn/ml-anomaly-utils';
 import { useMlKibana } from '../contexts/kibana';
-import { MlEmbeddedMapComponent } from '../components/ml_embedded_map';
 
 const MAX_ENTITY_VALUES = 3;
 
@@ -253,7 +253,16 @@ export const AnomaliesMap: FC<Props> = ({ anomalies, jobIds }) => {
             data-test-subj="mlAnomalyExplorerAnomaliesMap"
             style={{ width: '100%', height: 300 }}
           >
-            <MlEmbeddedMapComponent layerList={layerList} />
+            {mapsPlugin && (
+              <mapsPlugin.Map
+                layerList={layerList}
+                hideFilterActions={true}
+                mapSettings={{
+                  initialLocation: INITIAL_LOCATION.AUTO_FIT_TO_BOUNDS,
+                  autoFitToDataBounds: true,
+                }}
+              />
+            )}
           </div>
         </EuiAccordion>
       </EuiPanel>
diff --git a/x-pack/plugins/ml/public/application/explorer/explorer_charts/explorer_chart_embedded_map.tsx b/x-pack/plugins/ml/public/application/explorer/explorer_charts/explorer_chart_embedded_map.tsx
index 5d2946358eb74f..ac8b080fb8d8c3 100644
--- a/x-pack/plugins/ml/public/application/explorer/explorer_charts/explorer_chart_embedded_map.tsx
+++ b/x-pack/plugins/ml/public/application/explorer/explorer_charts/explorer_chart_embedded_map.tsx
@@ -7,14 +7,19 @@
 
 import React, { useState, useEffect } from 'react';
 import type { LayerDescriptor } from '@kbn/maps-plugin/common';
+import { INITIAL_LOCATION } from '@kbn/maps-plugin/common';
 import type { Dictionary } from '../../../../common/types/common';
 import { getMLAnomaliesActualLayer, getMLAnomaliesTypicalLayer } from './map_config';
-import { MlEmbeddedMapComponent } from '../../components/ml_embedded_map';
+import { useMlKibana } from '../../contexts/kibana';
 interface Props {
   seriesConfig: Dictionary<any>;
 }
 
 export function EmbeddedMapComponentWrapper({ seriesConfig }: Props) {
+  const {
+    services: { maps: mapsPlugin },
+  } = useMlKibana();
+
   const [layerList, setLayerList] = useState<LayerDescriptor[]>([]);
 
   useEffect(() => {
@@ -26,9 +31,16 @@ export function EmbeddedMapComponentWrapper({ seriesConfig }: Props) {
     }
   }, [seriesConfig]);
 
-  return (
+  return mapsPlugin ? (
     <div data-test-subj="xpack.ml.explorer.embeddedMap" style={{ width: '100%', height: 300 }}>
-      <MlEmbeddedMapComponent layerList={layerList} />
+      <mapsPlugin.Map
+        layerList={layerList}
+        hideFilterActions={true}
+        mapSettings={{
+          initialLocation: INITIAL_LOCATION.AUTO_FIT_TO_BOUNDS,
+          autoFitToDataBounds: true,
+        }}
+      />
     </div>
-  );
+  ) : null;
 }
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/common/map_loader/map_loader.ts b/x-pack/plugins/ml/public/application/jobs/new_job/common/map_loader/map_loader.ts
index aefedb6a11f22d..242ce9d4724952 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/common/map_loader/map_loader.ts
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/common/map_loader/map_loader.ts
@@ -9,7 +9,7 @@ import memoizeOne from 'memoize-one';
 import { isEqual } from 'lodash';
 import type { DataView } from '@kbn/data-views-plugin/common';
 import type { ES_GEO_FIELD_TYPE, LayerDescriptor } from '@kbn/maps-plugin/common';
-import type { MapsStartApi } from '@kbn/maps-plugin/public';
+import type { CreateLayerDescriptorParams, MapsStartApi } from '@kbn/maps-plugin/public';
 import type { Query } from '@kbn/es-query';
 import type { Field, SplitField } from '@kbn/ml-anomaly-utils';
 import { ChartLoader } from '../chart_loader';
@@ -30,7 +30,6 @@ export class MapLoader extends ChartLoader {
     geoField: Field,
     splitField: SplitField,
     fieldValues: string[],
-    filters?: any[],
     savedSearchQuery?: Query
   ) {
     const layerList: LayerDescriptor[] = [];
@@ -41,11 +40,10 @@ export class MapLoader extends ChartLoader {
           ? `${splitField.name}:${fieldValues[0]} ${query ? `and ${query}` : ''}`
           : `${query ? query : ''}`;
 
-      const params: any = {
+      const params: CreateLayerDescriptorParams = {
         indexPatternId: this._dataView.id,
         geoFieldName: geoField.name,
         geoFieldType: geoField.type as unknown as ES_GEO_FIELD_TYPE,
-        filters: filters ?? [],
         query: { query: queryString, language: 'kuery' },
       };
 
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/geo_view/geo_map_examples.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/geo_view/geo_map_examples.tsx
index 4e2722e46e41b7..da95646665ffc6 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/geo_view/geo_map_examples.tsx
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/geo_view/geo_map_examples.tsx
@@ -9,9 +9,10 @@ import type { FC } from 'react';
 import React from 'react';
 import { EuiFlexGrid, EuiFlexItem, EuiSpacer } from '@elastic/eui';
 import type { LayerDescriptor } from '@kbn/maps-plugin/common';
+import { INITIAL_LOCATION } from '@kbn/maps-plugin/common';
 import type { Aggregation, Field, SplitField } from '@kbn/ml-anomaly-utils';
 import { SplitCards, useAnimateSplit } from '../split_cards';
-import { MlEmbeddedMapComponent } from '../../../../../../../components/ml_embedded_map';
+import { useMlKibana } from '../../../../../../../contexts/kibana';
 import { JOB_TYPE } from '../../../../../../../../../common/constants/new_job';
 import { DetectorTitle } from '../detector_title';
 
@@ -31,6 +32,10 @@ export const GeoMapExamples: FC<Props> = ({
   geoAgg,
   layerList,
 }) => {
+  const {
+    services: { maps: mapsPlugin },
+  } = useMlKibana();
+
   const animateSplit = useAnimateSplit();
 
   return (
@@ -46,9 +51,18 @@ export const GeoMapExamples: FC<Props> = ({
           <>
             {geoAgg && geoField ? <DetectorTitle index={0} agg={geoAgg} field={geoField} /> : null}
             <EuiSpacer size="s" />
-            <span data-test-subj="mlGeoJobWizardMap" style={{ width: '100%', height: 400 }}>
-              <MlEmbeddedMapComponent layerList={layerList} />
-            </span>
+            {mapsPlugin && (
+              <span data-test-subj="mlGeoJobWizardMap" style={{ width: '100%', height: 400 }}>
+                <mapsPlugin.Map
+                  layerList={layerList}
+                  hideFilterActions={true}
+                  mapSettings={{
+                    initialLocation: INITIAL_LOCATION.AUTO_FIT_TO_BOUNDS,
+                    autoFitToDataBounds: true,
+                  }}
+                />
+              </span>
+            )}
           </>
         </EuiFlexItem>
       </EuiFlexGrid>
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/geo_view/metric_selection.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/geo_view/metric_selection.tsx
index 1938eefc99611b..9d8a6edabe583b 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/geo_view/metric_selection.tsx
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/geo_view/metric_selection.tsx
@@ -29,7 +29,7 @@ export const GeoDetector: FC<Props> = ({ setIsValid }) => {
   const [layerList, setLayerList] = useState<LayerDescriptor[]>([]);
 
   const {
-    services: { data, notifications: toasts },
+    services: { notifications: toasts },
   } = useMlKibana();
   const { mapLoader } = useContext(JobCreatorContext);
 
@@ -72,14 +72,12 @@ export const GeoDetector: FC<Props> = ({ setIsValid }) => {
   useEffect(() => {
     async function getMapLayersForGeoJob() {
       if (jobCreator.geoField) {
-        const { filter, query } = jobCreator.savedSearchQuery ?? {};
-        const filters = [...data.query.filterManager.getFilters(), ...(filter ?? [])];
+        const { query } = jobCreator.savedSearchQuery ?? {};
 
         const layers = await mapLoader.getMapLayersForGeoJob(
           jobCreator.geoField,
           jobCreator.splitField,
           fieldValues,
-          filters,
           query
         );
         setLayerList(layers);
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/geo_view/metric_selection_summary.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/geo_view/metric_selection_summary.tsx
index 7845a62496d8cc..58ff2598973811 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/geo_view/metric_selection_summary.tsx
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/geo_view/metric_selection_summary.tsx
@@ -24,7 +24,7 @@ export const GeoDetectorsSummary: FC = () => {
   const splitField = jobCreator.splitField;
 
   const {
-    services: { data, notifications },
+    services: { notifications },
   } = useMlKibana();
 
   // Load example field values for summary view
@@ -56,14 +56,12 @@ export const GeoDetectorsSummary: FC = () => {
   useEffect(() => {
     async function getMapLayersForGeoJob() {
       if (geoField) {
-        const { filter, query } = jobCreator.savedSearchQuery ?? {};
-        const filters = [...data.query.filterManager.getFilters(), ...(filter ?? [])];
+        const { query } = jobCreator.savedSearchQuery ?? {};
 
         const layers = await mapLoader.getMapLayersForGeoJob(
           geoField,
           splitField,
           fieldValues,
-          filters,
           query
         );
         setLayerList(layers);
diff --git a/x-pack/plugins/ml/public/application/services/mapping_service.js b/x-pack/plugins/ml/public/application/services/mapping_service.js
deleted file mode 100644
index 8da54c2eccf729..00000000000000
--- a/x-pack/plugins/ml/public/application/services/mapping_service.js
+++ /dev/null
@@ -1,36 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { each } from 'lodash';
-
-import { ml } from './ml_api_service';
-
-// Returns the mapping type of the specified field.
-// Accepts fieldName containing dots representing a nested sub-field.
-export function getFieldTypeFromMapping(index, fieldName) {
-  return new Promise((resolve, reject) => {
-    if (index !== '') {
-      ml.getFieldCaps({ index, fields: [fieldName] })
-        .then((resp) => {
-          let fieldType = '';
-          each(resp.fields, (field) => {
-            each(field, (type) => {
-              if (fieldType === '') {
-                fieldType = type.type;
-              }
-            });
-          });
-          resolve(fieldType);
-        })
-        .catch((error) => {
-          reject(error);
-        });
-    } else {
-      reject();
-    }
-  });
-}
diff --git a/x-pack/plugins/ml/public/application/services/ml_api_service/index.ts b/x-pack/plugins/ml/public/application/services/ml_api_service/index.ts
index 3d25015f43e031..6d086f99bce081 100644
--- a/x-pack/plugins/ml/public/application/services/ml_api_service/index.ts
+++ b/x-pack/plugins/ml/public/application/services/ml_api_service/index.ts
@@ -439,20 +439,6 @@ export function mlApiServicesProvider(httpService: HttpService) {
       });
     },
 
-    getFieldCaps({ index, fields }: { index: string; fields: string[] }) {
-      const body = JSON.stringify({
-        ...(index !== undefined ? { index } : {}),
-        ...(fields !== undefined ? { fields } : {}),
-      });
-
-      return httpService.http<any>({
-        path: `${ML_INTERNAL_BASE_PATH}/indices/field_caps`,
-        method: 'POST',
-        body,
-        version: '1',
-      });
-    },
-
     recognizeIndex({
       indexPatternTitle,
       filter,
diff --git a/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/anomaly_swimlane_embeddable_factory.test.tsx b/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/anomaly_swimlane_embeddable_factory.test.tsx
index d58e1f00ca235a..65e09e1ef06699 100644
--- a/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/anomaly_swimlane_embeddable_factory.test.tsx
+++ b/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/anomaly_swimlane_embeddable_factory.test.tsx
@@ -8,10 +8,7 @@
 import { coreMock } from '@kbn/core/public/mocks';
 import { dataPluginMock } from '@kbn/data-plugin/public/mocks';
 import { chartPluginMock } from '@kbn/charts-plugin/public/mocks';
-import {
-  ReactEmbeddableRenderer,
-  registerReactEmbeddableFactory,
-} from '@kbn/embeddable-plugin/public';
+import { ReactEmbeddableRenderer } from '@kbn/embeddable-plugin/public';
 import { setStubKibanaServices } from '@kbn/presentation-panel-plugin/public/mocks';
 import { render, waitFor, screen } from '@testing-library/react';
 import React from 'react';
@@ -19,6 +16,7 @@ import { of } from 'rxjs';
 import { ANOMALY_SWIMLANE_EMBEDDABLE_TYPE } from '../constants';
 import { getAnomalySwimLaneEmbeddableFactory } from './anomaly_swimlane_embeddable_factory';
 import type { AnomalySwimLaneEmbeddableApi, AnomalySwimLaneEmbeddableState } from './types';
+import { embeddablePluginMock } from '@kbn/embeddable-plugin/public/mocks';
 
 // Mock dependencies
 const pluginStartDeps = {
@@ -84,7 +82,8 @@ describe('getAnomalySwimLaneEmbeddableFactory', () => {
   const factory = getAnomalySwimLaneEmbeddableFactory(getStartServices);
 
   beforeAll(() => {
-    registerReactEmbeddableFactory(ANOMALY_SWIMLANE_EMBEDDABLE_TYPE, async () => {
+    const embeddable = embeddablePluginMock.createSetupContract();
+    embeddable.registerReactEmbeddableFactory(ANOMALY_SWIMLANE_EMBEDDABLE_TYPE, async () => {
       return factory;
     });
     setStubKibanaServices();
diff --git a/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/anomaly_swimlane_embeddable_factory.tsx b/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/anomaly_swimlane_embeddable_factory.tsx
index 7306085b8d4135..4b7e066d9416f8 100644
--- a/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/anomaly_swimlane_embeddable_factory.tsx
+++ b/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/anomaly_swimlane_embeddable_factory.tsx
@@ -10,6 +10,7 @@ import { css } from '@emotion/react';
 import type { StartServicesAccessor } from '@kbn/core/public';
 import type { ReactEmbeddableFactory } from '@kbn/embeddable-plugin/public';
 import type { TimeRange } from '@kbn/es-query';
+import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n-react';
 import { KibanaContextProvider } from '@kbn/kibana-react-plugin/public';
 import { useTimeBuckets } from '@kbn/ml-time-buckets';
@@ -138,6 +139,30 @@ export const getAnomalySwimLaneEmbeddableFactory = (
 
       const api = buildApi(
         {
+          isEditingEnabled: () => true,
+          getTypeDisplayName: () =>
+            i18n.translate('xpack.ml.swimlaneEmbeddable.typeDisplayName', {
+              defaultMessage: 'swim lane',
+            }),
+          onEdit: async () => {
+            try {
+              const { resolveAnomalySwimlaneUserInput } = await import(
+                './anomaly_swimlane_setup_flyout'
+              );
+
+              const result = await resolveAnomalySwimlaneUserInput(
+                { ...coreStartServices, ...pluginsStartServices },
+                {
+                  ...serializeTitles(),
+                  ...serializeSwimLaneState(),
+                }
+              );
+
+              swimLaneControlsApi.updateUserInput(result);
+            } catch (e) {
+              return Promise.reject();
+            }
+          },
           ...titlesApi,
           ...timeRangeApi,
           ...swimLaneControlsApi,
diff --git a/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/anomaly_swimlane_initializer.tsx b/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/anomaly_swimlane_initializer.tsx
index b4dd02be726a6b..64c0d9db7b7b77 100644
--- a/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/anomaly_swimlane_initializer.tsx
+++ b/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/anomaly_swimlane_initializer.tsx
@@ -5,53 +5,101 @@
  * 2.0.
  */
 
-import type { FC } from 'react';
-import React, { useState } from 'react';
+import React, { type FC, useEffect, useRef, useState } from 'react';
 import {
   EuiButton,
   EuiButtonEmpty,
   EuiButtonGroup,
+  EuiFieldText,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiFlyoutBody,
+  EuiFlyoutFooter,
+  EuiFlyoutHeader,
   EuiForm,
   EuiFormRow,
-  EuiModalBody,
-  EuiModalFooter,
-  EuiModalHeader,
-  EuiModalHeaderTitle,
   EuiSelect,
-  EuiFieldText,
-  EuiModal,
+  EuiTitle,
 } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n-react';
 import { i18n } from '@kbn/i18n';
+import useMountedState from 'react-use/lib/useMountedState';
+import { useMlLink } from '../../application/contexts/kibana';
+import { ML_PAGES } from '../../../common/constants/locator';
+import type { MlApiServices } from '../../application/services/ml_api_service';
+import { extractInfluencers } from '../../../common/util/job_utils';
+import { JobSelectorControl } from '../../alerting/job_selector';
 import type { SwimlaneType } from '../../application/explorer/explorer_constants';
-import { SWIMLANE_TYPE } from '../../application/explorer/explorer_constants';
-import type { AnomalySwimlaneEmbeddableUserInput, AnomalySwimLaneEmbeddableState } from '..';
+import { SWIMLANE_TYPE, VIEW_BY_JOB_LABEL } from '../../application/explorer/explorer_constants';
+import type { AnomalySwimLaneEmbeddableState, AnomalySwimlaneEmbeddableUserInput } from '..';
+import { getDefaultSwimlanePanelTitle } from './anomaly_swimlane_embeddable';
 
-export type ExplicitInput = Omit<AnomalySwimlaneEmbeddableUserInput, 'jobIds'>;
+export type ExplicitInput = AnomalySwimlaneEmbeddableUserInput;
 
 export interface AnomalySwimlaneInitializerProps {
-  defaultTitle: string;
-  influencers: string[];
   initialInput?: Partial<
-    Pick<AnomalySwimLaneEmbeddableState, 'jobIds' | 'swimlaneType' | 'viewBy' | 'perPage'>
+    Pick<AnomalySwimLaneEmbeddableState, 'jobIds' | 'swimlaneType' | 'viewBy' | 'perPage' | 'title'>
   >;
   onCreate: (swimlaneProps: ExplicitInput) => void;
   onCancel: () => void;
+  adJobsApiService: MlApiServices['jobs'];
 }
 
+const getJobSelectionErrors = (jobIds: string[]) => {
+  if (jobIds.length === 0) {
+    return [
+      i18n.translate('xpack.ml.swimlaneEmbeddable.setupModal.jobSelectionRequiredError', {
+        defaultMessage: 'Job selection is required',
+      }),
+    ];
+  }
+};
+
 export const AnomalySwimlaneInitializer: FC<AnomalySwimlaneInitializerProps> = ({
-  defaultTitle,
-  influencers,
   onCreate,
   onCancel,
   initialInput,
+  adJobsApiService,
 }) => {
-  const [panelTitle, setPanelTitle] = useState(defaultTitle);
+  const isMounted = useMountedState();
+
+  const titleManuallyChanged = useRef(!!initialInput?.title);
+
+  const [jobIds, setJobIds] = useState(initialInput?.jobIds ?? []);
+
+  const [influencers, setInfluencers] = useState<string[]>([VIEW_BY_JOB_LABEL]);
+
+  useEffect(
+    function updateInfluencers() {
+      async function fetchInfluencers() {
+        const jobs = await adJobsApiService.jobs(jobIds);
+        if (isMounted()) {
+          setInfluencers([...extractInfluencers(jobs), VIEW_BY_JOB_LABEL]);
+        }
+      }
+
+      if (jobIds.length > 0) {
+        fetchInfluencers();
+      }
+    },
+    [adJobsApiService, isMounted, jobIds]
+  );
+
+  const [panelTitle, setPanelTitle] = useState(initialInput?.title ?? '');
   const [swimlaneType, setSwimlaneType] = useState<SwimlaneType>(
     initialInput?.swimlaneType ?? SWIMLANE_TYPE.OVERALL
   );
   const [viewBySwimlaneFieldName, setViewBySwimlaneFieldName] = useState(initialInput?.viewBy);
 
+  useEffect(
+    function updateDefaultTitle() {
+      if (!titleManuallyChanged.current) {
+        setPanelTitle(getDefaultSwimlanePanelTitle(jobIds));
+      }
+    },
+    [initialInput?.title, jobIds]
+  );
+
   const swimlaneTypeOptions = [
     {
       id: SWIMLANE_TYPE.OVERALL,
@@ -76,30 +124,49 @@ export const AnomalySwimlaneInitializer: FC<AnomalySwimlaneInitializerProps> = (
 
   const isPanelTitleValid = panelTitle.length > 0;
 
+  const jobIdsErrors = getJobSelectionErrors(jobIds);
+
   const isFormValid =
     isPanelTitleValid &&
+    !jobIdsErrors &&
     (swimlaneType === SWIMLANE_TYPE.OVERALL ||
       (swimlaneType === SWIMLANE_TYPE.VIEW_BY && !!viewBySwimlaneFieldName));
 
   const resultInput = {
+    jobIds,
     panelTitle,
     swimlaneType,
     ...(viewBySwimlaneFieldName ? { viewBy: viewBySwimlaneFieldName } : {}),
   };
 
+  const newJobUrl = useMlLink({ page: ML_PAGES.ANOMALY_DETECTION_CREATE_JOB });
+
   return (
-    <EuiModal initialFocus="[name=panelTitle]" onClose={onCancel}>
-      <EuiModalHeader>
-        <EuiModalHeaderTitle>
-          <FormattedMessage
-            id="xpack.ml.swimlaneEmbeddable.setupModal.title"
-            defaultMessage="Anomaly swim lane configuration"
-          />
-        </EuiModalHeaderTitle>
-      </EuiModalHeader>
+    <>
+      <EuiFlyoutHeader>
+        <EuiTitle>
+          <h2>
+            <FormattedMessage
+              id="xpack.ml.swimlaneEmbeddable.setupModal.title"
+              defaultMessage="Anomaly swim lane configuration"
+            />
+          </h2>
+        </EuiTitle>
+      </EuiFlyoutHeader>
 
-      <EuiModalBody>
+      <EuiFlyoutBody>
         <EuiForm>
+          <JobSelectorControl
+            createJobUrl={newJobUrl}
+            multiSelect
+            jobsAndGroupIds={jobIds}
+            adJobsApiService={adJobsApiService}
+            onChange={(update) => {
+              setJobIds([...(update?.jobIds ?? []), ...(update?.groupIds ?? [])]);
+            }}
+            errors={jobIdsErrors}
+          />
+
           <EuiFormRow
             label={
               <FormattedMessage
@@ -108,13 +175,18 @@ export const AnomalySwimlaneInitializer: FC<AnomalySwimlaneInitializerProps> = (
               />
             }
             isInvalid={!isPanelTitleValid}
+            fullWidth
           >
             <EuiFieldText
               id="panelTitle"
               name="panelTitle"
               value={panelTitle}
-              onChange={(e) => setPanelTitle(e.target.value)}
+              onChange={(e) => {
+                titleManuallyChanged.current = true;
+                setPanelTitle(e.target.value);
+              }}
               isInvalid={!isPanelTitleValid}
+              fullWidth
             />
           </EuiFormRow>
 
@@ -125,6 +197,7 @@ export const AnomalySwimlaneInitializer: FC<AnomalySwimlaneInitializerProps> = (
                 defaultMessage="Swim lane type"
               />
             }
+            fullWidth
           >
             <EuiButtonGroup
               id="selectSwimlaneType"
@@ -146,8 +219,10 @@ export const AnomalySwimlaneInitializer: FC<AnomalySwimlaneInitializerProps> = (
                 label={
                   <FormattedMessage id="xpack.ml.explorer.viewByLabel" defaultMessage="View by" />
                 }
+                fullWidth
               >
                 <EuiSelect
+                  fullWidth
                   id="selectViewBy"
                   name="selectViewBy"
                   options={viewBySwimlaneOptions}
@@ -158,23 +233,28 @@ export const AnomalySwimlaneInitializer: FC<AnomalySwimlaneInitializerProps> = (
             </>
           )}
         </EuiForm>
-      </EuiModalBody>
+      </EuiFlyoutBody>
 
-      <EuiModalFooter>
-        <EuiButtonEmpty onClick={onCancel}>
-          <FormattedMessage
-            id="xpack.ml.swimlaneEmbeddable.setupModal.cancelButtonLabel"
-            defaultMessage="Cancel"
-          />
-        </EuiButtonEmpty>
-
-        <EuiButton isDisabled={!isFormValid} onClick={onCreate.bind(null, resultInput)} fill>
-          <FormattedMessage
-            id="xpack.ml.swimlaneEmbeddable.setupModal.confirmButtonLabel"
-            defaultMessage="Confirm"
-          />
-        </EuiButton>
-      </EuiModalFooter>
-    </EuiModal>
+      <EuiFlyoutFooter>
+        <EuiFlexGroup justifyContent={'spaceBetween'}>
+          <EuiFlexItem grow={false}>
+            <EuiButtonEmpty onClick={onCancel}>
+              <FormattedMessage
+                id="xpack.ml.swimlaneEmbeddable.setupModal.cancelButtonLabel"
+                defaultMessage="Cancel"
+              />
+            </EuiButtonEmpty>
+          </EuiFlexItem>
+          <EuiFlexItem grow={false}>
+            <EuiButton isDisabled={!isFormValid} onClick={onCreate.bind(null, resultInput)} fill>
+              <FormattedMessage
+                id="xpack.ml.swimlaneEmbeddable.setupModal.confirmButtonLabel"
+                defaultMessage="Confirm"
+              />
+            </EuiButton>
+          </EuiFlexItem>
+        </EuiFlexGroup>
+      </EuiFlyoutFooter>
+    </>
   );
 };
diff --git a/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/anomaly_swimlane_setup_flyout.tsx b/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/anomaly_swimlane_setup_flyout.tsx
index 596da35f66d4cc..56eaed3e9a271e 100644
--- a/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/anomaly_swimlane_setup_flyout.tsx
+++ b/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/anomaly_swimlane_setup_flyout.tsx
@@ -8,53 +8,63 @@
 import React from 'react';
 import type { CoreStart } from '@kbn/core/public';
 import { toMountPoint } from '@kbn/react-kibana-mount';
-import type { DataViewsContract } from '@kbn/data-views-plugin/public';
-import { extractInfluencers } from '../../../common/util/job_utils';
-import { VIEW_BY_JOB_LABEL } from '../../application/explorer/explorer_constants';
+import { KibanaContextProvider } from '@kbn/kibana-react-plugin/public';
+import { distinctUntilChanged, from, skip, takeUntil } from 'rxjs';
+import { jobsApiProvider } from '../../application/services/ml_api_service/jobs';
 import { AnomalySwimlaneInitializer } from './anomaly_swimlane_initializer';
-import { getDefaultSwimlanePanelTitle } from './anomaly_swimlane_embeddable';
 import { HttpService } from '../../application/services/http_service';
-import type { AnomalySwimlaneEmbeddableUserInput, AnomalySwimLaneEmbeddableState } from '..';
-import { resolveJobSelection } from '../common/resolve_job_selection';
-import { mlApiServicesProvider } from '../../application/services/ml_api_service';
+import type { AnomalySwimLaneEmbeddableState, AnomalySwimlaneEmbeddableUserInput } from '..';
 
 export async function resolveAnomalySwimlaneUserInput(
   coreStart: CoreStart,
-  dataViews: DataViewsContract,
   input?: Partial<AnomalySwimLaneEmbeddableState>
 ): Promise<AnomalySwimlaneEmbeddableUserInput> {
-  const { http, overlays, ...startServices } = coreStart;
-
-  const { getJobs } = mlApiServicesProvider(new HttpService(http));
+  const {
+    http,
+    overlays,
+    application: { currentAppId$ },
+    ...startServices
+  } = coreStart;
 
   return new Promise(async (resolve, reject) => {
     try {
-      const { jobIds } = await resolveJobSelection(coreStart, dataViews, input?.jobIds);
-      const title = input?.title ?? getDefaultSwimlanePanelTitle(jobIds);
-      const { jobs } = await getJobs({ jobId: jobIds.join(',') });
-      const influencers = extractInfluencers(jobs);
-      influencers.push(VIEW_BY_JOB_LABEL);
-      const modalSession = overlays.openModal(
+      const adJobsApiService = jobsApiProvider(new HttpService(http));
+
+      const flyoutSession = overlays.openFlyout(
         toMountPoint(
-          <AnomalySwimlaneInitializer
-            defaultTitle={title}
-            influencers={influencers}
-            initialInput={input}
-            onCreate={(explicitInput) => {
-              modalSession.close();
-              resolve({
-                jobIds,
-                ...explicitInput,
-              });
-            }}
-            onCancel={() => {
-              modalSession.close();
-              reject();
-            }}
-          />,
+          <KibanaContextProvider services={{ ...coreStart }}>
+            <AnomalySwimlaneInitializer
+              adJobsApiService={adJobsApiService}
+              initialInput={input}
+              onCreate={(explicitInput) => {
+                flyoutSession.close();
+                resolve(explicitInput);
+              }}
+              onCancel={() => {
+                flyoutSession.close();
+                reject();
+              }}
+            />
+          </KibanaContextProvider>,
           startServices
-        )
+        ),
+        {
+          type: 'push',
+          ownFocus: true,
+          size: 's',
+          onClose: () => {
+            flyoutSession.close();
+            reject();
+          },
+        }
       );
+
+      // Close the flyout when user navigates out of the current plugin
+      currentAppId$
+        .pipe(skip(1), takeUntil(from(flyoutSession.onClose)), distinctUntilChanged())
+        .subscribe(() => {
+          flyoutSession.close();
+        });
     } catch (error) {
       reject(error);
     }
diff --git a/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/initialize_swim_lane_data_fetcher.ts b/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/initialize_swim_lane_data_fetcher.ts
index f10afe8e874c08..6946215b0c4523 100644
--- a/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/initialize_swim_lane_data_fetcher.ts
+++ b/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/initialize_swim_lane_data_fetcher.ts
@@ -8,14 +8,15 @@
 import type { estypes } from '@elastic/elasticsearch';
 import type { TimeRange } from '@kbn/es-query';
 import type { PublishesUnifiedSearch } from '@kbn/presentation-publishing';
-import type { Observable } from 'rxjs';
 import {
   BehaviorSubject,
   catchError,
   combineLatest,
   debounceTime,
+  EMPTY,
   from,
   map,
+  type Observable,
   of,
   shareReplay,
   skipWhile,
@@ -55,7 +56,9 @@ export const initializeSwimLaneDataFetcher = (
   const selectedJobs$ = getJobsObservable(
     swimLaneApi.jobIds.pipe(map((jobIds) => ({ jobIds }))),
     anomalyDetectorService,
-    (error) => blockingError.next(error)
+    (error) => {
+      blockingError.next(error);
+    }
   ).pipe(shareReplay(1));
 
   const swimLaneInput$ = combineLatest({
@@ -105,7 +108,7 @@ export const initializeSwimLaneDataFetcher = (
         } catch (e) {
           // handle query syntax errors
           blockingError.next(e);
-          return of(undefined);
+          return EMPTY;
         }
 
         return from(
@@ -146,12 +149,12 @@ export const initializeSwimLaneDataFetcher = (
               );
             }
             return of(overallSwimlaneData);
+          }),
+          catchError((error) => {
+            blockingError.next(error);
+            return EMPTY;
           })
         );
-      }),
-      catchError((error) => {
-        blockingError.next(error);
-        return of(undefined);
       })
     )
     .subscribe((data) => {
diff --git a/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/types.ts b/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/types.ts
index 9e24c02f49c2ba..cde7ff13506876 100644
--- a/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/types.ts
+++ b/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/types.ts
@@ -7,6 +7,7 @@
 
 import { isPopulatedObject } from '@kbn/ml-is-populated-object';
 import type {
+  HasEditCapabilities,
   PublishesDataViews,
   PublishesUnifiedSearch,
   PublishesWritablePanelTitle,
@@ -41,6 +42,7 @@ export type AnomalySwimLaneEmbeddableApi = MlEmbeddableBaseApi<AnomalySwimLaneEm
   PublishesDataViews &
   PublishesUnifiedSearch &
   PublishesWritablePanelTitle &
+  HasEditCapabilities &
   AnomalySwimLaneComponentApi;
 
 export interface AnomalySwimLaneActionContext {
diff --git a/x-pack/plugins/ml/public/embeddables/common/get_jobs_observable.ts b/x-pack/plugins/ml/public/embeddables/common/get_jobs_observable.ts
index a3149c8257c4dd..e770106200f7b3 100644
--- a/x-pack/plugins/ml/public/embeddables/common/get_jobs_observable.ts
+++ b/x-pack/plugins/ml/public/embeddables/common/get_jobs_observable.ts
@@ -7,7 +7,7 @@
 
 import { isEqual } from 'lodash';
 import type { Observable } from 'rxjs';
-import { catchError, distinctUntilChanged, map, of, switchMap } from 'rxjs';
+import { catchError, distinctUntilChanged, EMPTY, map, switchMap } from 'rxjs';
 import type { JobId } from '../../../common/types/anomaly_detection_jobs';
 import { parseInterval } from '../../../common/util/parse_interval';
 import type { ExplorerJob } from '../../application/explorer/explorer_utils';
@@ -21,7 +21,15 @@ export function getJobsObservable(
   return embeddableInput.pipe(
     map((v) => v.jobIds),
     distinctUntilChanged(isEqual),
-    switchMap((jobsIds) => anomalyDetectorService.getJobs$(jobsIds)),
+    switchMap((jobsIds) =>
+      anomalyDetectorService.getJobs$(jobsIds).pipe(
+        catchError((e) => {
+          // Catch error to prevent the observable from completing
+          setErrorHandler(e.body ?? e);
+          return EMPTY;
+        })
+      )
+    ),
     map((jobs) => {
       const explorerJobs: ExplorerJob[] = jobs.map((job) => {
         const bucketSpan = parseInterval(job.analysis_config.bucket_span!);
@@ -33,10 +41,6 @@ export function getJobsObservable(
         };
       });
       return explorerJobs;
-    }),
-    catchError((e) => {
-      setErrorHandler(e.body ?? e);
-      return of(undefined);
     })
   );
 }
diff --git a/x-pack/plugins/ml/public/embeddables/index.ts b/x-pack/plugins/ml/public/embeddables/index.ts
index a5e10788a991af..936c76bc027036 100644
--- a/x-pack/plugins/ml/public/embeddables/index.ts
+++ b/x-pack/plugins/ml/public/embeddables/index.ts
@@ -6,7 +6,6 @@
  */
 
 import type { EmbeddableSetup } from '@kbn/embeddable-plugin/public';
-import { registerReactEmbeddableFactory } from '@kbn/embeddable-plugin/public';
 import type { MlCoreSetup } from '../plugin';
 import { AnomalyChartsEmbeddableFactory } from './anomaly_charts';
 import { ANOMALY_SINGLE_METRIC_VIEWER_EMBEDDABLE_TYPE } from './constants';
@@ -17,7 +16,7 @@ export { getEmbeddableComponent } from './get_embeddable_component';
 export * from './types';
 
 export function registerEmbeddables(embeddable: EmbeddableSetup, core: MlCoreSetup) {
-  registerReactEmbeddableFactory(ANOMALY_SWIMLANE_EMBEDDABLE_TYPE, async () => {
+  embeddable.registerReactEmbeddableFactory(ANOMALY_SWIMLANE_EMBEDDABLE_TYPE, async () => {
     const { getAnomalySwimLaneEmbeddableFactory } = await import('./anomaly_swimlane');
     return getAnomalySwimLaneEmbeddableFactory(core.getStartServices);
   });
@@ -25,8 +24,11 @@ export function registerEmbeddables(embeddable: EmbeddableSetup, core: MlCoreSet
   const anomalyChartsFactory = new AnomalyChartsEmbeddableFactory(core.getStartServices);
   embeddable.registerEmbeddableFactory(anomalyChartsFactory.type, anomalyChartsFactory);
 
-  registerReactEmbeddableFactory(ANOMALY_SINGLE_METRIC_VIEWER_EMBEDDABLE_TYPE, async () => {
-    const { getSingleMetricViewerEmbeddableFactory } = await import('./single_metric_viewer');
-    return getSingleMetricViewerEmbeddableFactory(core.getStartServices);
-  });
+  embeddable.registerReactEmbeddableFactory(
+    ANOMALY_SINGLE_METRIC_VIEWER_EMBEDDABLE_TYPE,
+    async () => {
+      const { getSingleMetricViewerEmbeddableFactory } = await import('./single_metric_viewer');
+      return getSingleMetricViewerEmbeddableFactory(core.getStartServices);
+    }
+  );
 }
diff --git a/x-pack/plugins/ml/public/embeddables/single_metric_viewer/single_metric_viewer_embeddable_factory.tsx b/x-pack/plugins/ml/public/embeddables/single_metric_viewer/single_metric_viewer_embeddable_factory.tsx
index b46cda1520ba7d..76f4baca57284c 100644
--- a/x-pack/plugins/ml/public/embeddables/single_metric_viewer/single_metric_viewer_embeddable_factory.tsx
+++ b/x-pack/plugins/ml/public/embeddables/single_metric_viewer/single_metric_viewer_embeddable_factory.tsx
@@ -282,7 +282,8 @@ export const getSingleMetricViewerEmbeddableFactory = (
                       >
                         {singleMetricViewerData !== undefined &&
                           autoZoomDuration !== undefined &&
-                          jobsLoaded && (
+                          jobsLoaded &&
+                          selectedJobId === selectedJob?.job_id && (
                             <TimeSeriesExplorerEmbeddableChart
                               chartWidth={chartWidth - containerPadding}
                               dataViewsService={services[1].data.dataViews}
diff --git a/x-pack/plugins/ml/public/index.ts b/x-pack/plugins/ml/public/index.ts
index 25bec18e80ab0a..bf293e22285708 100755
--- a/x-pack/plugins/ml/public/index.ts
+++ b/x-pack/plugins/ml/public/index.ts
@@ -26,6 +26,7 @@ export const plugin: PluginInitializer<
 > = (initializerContext: PluginInitializerContext) => new MlPlugin(initializerContext);
 
 export type { MlPluginSetup, MlPluginStart };
+export type { TrainedModelConfigResponse } from '../common/types/trained_models';
 
 export type { MlCapabilitiesResponse } from '../common/types/capabilities';
 export type { MlSummaryJob } from '../common/types/anomaly_detection_jobs';
diff --git a/x-pack/plugins/ml/public/ui_actions/create_swim_lane.tsx b/x-pack/plugins/ml/public/ui_actions/create_swim_lane.tsx
index 1bb54b776e140f..a2acc14dbe7de3 100644
--- a/x-pack/plugins/ml/public/ui_actions/create_swim_lane.tsx
+++ b/x-pack/plugins/ml/public/ui_actions/create_swim_lane.tsx
@@ -56,14 +56,17 @@ export function createAddSwimlanePanelAction(
       const presentationContainerParent = await parentApiIsCompatible(context.embeddable);
       if (!presentationContainerParent) throw new IncompatibleActionError();
 
-      const [coreStart, deps] = await getStartServices();
+      const [coreStart, pluginStart] = await getStartServices();
 
       try {
         const { resolveAnomalySwimlaneUserInput } = await import(
           '../embeddables/anomaly_swimlane/anomaly_swimlane_setup_flyout'
         );
 
-        const initialState = await resolveAnomalySwimlaneUserInput(coreStart, deps.data.dataViews);
+        const initialState = await resolveAnomalySwimlaneUserInput({
+          ...coreStart,
+          ...pluginStart,
+        });
 
         presentationContainerParent.addNewPanel({
           panelType: ANOMALY_SWIMLANE_EMBEDDABLE_TYPE,
diff --git a/x-pack/plugins/ml/public/ui_actions/edit_swimlane_panel_action.tsx b/x-pack/plugins/ml/public/ui_actions/edit_swimlane_panel_action.tsx
deleted file mode 100644
index 3612446e8f5af4..00000000000000
--- a/x-pack/plugins/ml/public/ui_actions/edit_swimlane_panel_action.tsx
+++ /dev/null
@@ -1,70 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { i18n } from '@kbn/i18n';
-import type { EmbeddableApiContext } from '@kbn/presentation-publishing';
-import type { UiActionsActionDefinition } from '@kbn/ui-actions-plugin/public';
-import { IncompatibleActionError } from '@kbn/ui-actions-plugin/public';
-import type { AnomalySwimLaneEmbeddableApi } from '../embeddables/anomaly_swimlane/types';
-import type { MlCoreSetup } from '../plugin';
-import { isSwimLaneEmbeddableContext } from '../embeddables/anomaly_swimlane/types';
-
-export const EDIT_SWIMLANE_PANEL_ACTION = 'editSwimlanePanelAction';
-
-export type EditSwimlanePanelActionContext = EmbeddableApiContext & {
-  embeddable: AnomalySwimLaneEmbeddableApi;
-};
-
-export function createEditSwimlanePanelAction(
-  getStartServices: MlCoreSetup['getStartServices']
-): UiActionsActionDefinition<EditSwimlanePanelActionContext> {
-  return {
-    id: 'edit-anomaly-swimlane',
-    type: EDIT_SWIMLANE_PANEL_ACTION,
-    order: 50,
-    getIconType(): string {
-      return 'pencil';
-    },
-    getDisplayName: () =>
-      i18n.translate('xpack.ml.actions.editSwimlaneTitle', {
-        defaultMessage: 'Edit swim lane',
-      }),
-    async execute(context) {
-      if (!isSwimLaneEmbeddableContext(context)) {
-        throw new IncompatibleActionError();
-      }
-
-      const [coreStart, deps] = await getStartServices();
-
-      try {
-        const { resolveAnomalySwimlaneUserInput } = await import(
-          '../embeddables/anomaly_swimlane/anomaly_swimlane_setup_flyout'
-        );
-
-        const { jobIds, viewBy, swimlaneType, panelTitle } = context.embeddable;
-
-        const result = await resolveAnomalySwimlaneUserInput(coreStart, deps.data.dataViews, {
-          jobIds: jobIds.getValue(),
-          swimlaneType: swimlaneType.getValue(),
-          viewBy: viewBy.getValue(),
-          title: panelTitle?.getValue(),
-        });
-
-        context.embeddable.updateUserInput(result);
-        context.embeddable.setPanelTitle(result.panelTitle);
-      } catch (e) {
-        return Promise.reject();
-      }
-    },
-    async isCompatible(context: EmbeddableApiContext) {
-      return (
-        isSwimLaneEmbeddableContext(context) &&
-        context.embeddable.parentApi?.viewMode?.getValue() === 'edit'
-      );
-    },
-  };
-}
diff --git a/x-pack/plugins/ml/public/ui_actions/index.ts b/x-pack/plugins/ml/public/ui_actions/index.ts
index 15014205b8c830..41cdc5dcf6c4fe 100644
--- a/x-pack/plugins/ml/public/ui_actions/index.ts
+++ b/x-pack/plugins/ml/public/ui_actions/index.ts
@@ -16,7 +16,6 @@ import { createApplyTimeRangeSelectionAction } from './apply_time_range_action';
 import { createClearSelectionAction } from './clear_selection_action';
 import { createAddSwimlanePanelAction } from './create_swim_lane';
 import { createEditAnomalyChartsPanelAction } from './edit_anomaly_charts_panel_action';
-import { createEditSwimlanePanelAction } from './edit_swimlane_panel_action';
 import { createEditSingleMetricViewerPanelAction } from './edit_single_metric_viewer_panel_action';
 import { createAddSingleMetricViewerPanelAction } from './create_single_metric_viewer';
 import {
@@ -29,12 +28,11 @@ import { createVisToADJobAction } from './open_vis_in_ml_action';
 import {
   entityFieldSelectionTrigger,
   EXPLORER_ENTITY_FIELD_SELECTION_TRIGGER,
-  swimLaneSelectionTrigger,
   SWIM_LANE_SELECTION_TRIGGER,
+  swimLaneSelectionTrigger,
 } from './triggers';
 export { APPLY_INFLUENCER_FILTERS_ACTION } from './apply_influencer_filters_action';
 export { APPLY_TIME_RANGE_SELECTION_ACTION } from './apply_time_range_action';
-export { EDIT_SWIMLANE_PANEL_ACTION } from './edit_swimlane_panel_action';
 export { OPEN_IN_ANOMALY_EXPLORER_ACTION } from './open_in_anomaly_explorer_action';
 export { CREATE_LENS_VIS_TO_ML_AD_JOB_ACTION } from './open_vis_in_ml_action';
 export { SWIM_LANE_SELECTION_TRIGGER };
@@ -50,7 +48,6 @@ export function registerMlUiActions(
     core.getStartServices
   );
   const addSwimlanePanelAction = createAddSwimlanePanelAction(core.getStartServices);
-  const editSwimlanePanelAction = createEditSwimlanePanelAction(core.getStartServices);
   const editSingleMetricViewerPanelAction = createEditSingleMetricViewerPanelAction(
     core.getStartServices
   );
@@ -74,7 +71,6 @@ export function registerMlUiActions(
   // Assign triggers
   uiActions.addTriggerAction('ADD_PANEL_TRIGGER', addSingleMetricViewerPanelAction);
   uiActions.addTriggerAction('ADD_PANEL_TRIGGER', addSwimlanePanelAction);
-  uiActions.addTriggerAction(CONTEXT_MENU_TRIGGER, editSwimlanePanelAction);
   uiActions.addTriggerAction(CONTEXT_MENU_TRIGGER, editSingleMetricViewerPanelAction);
   uiActions.addTriggerAction(CONTEXT_MENU_TRIGGER, editExplorerPanelAction);
   uiActions.addTriggerAction(CONTEXT_MENU_TRIGGER, openInExplorerAction);
diff --git a/x-pack/plugins/ml/server/plugin.ts b/x-pack/plugins/ml/server/plugin.ts
index aa42a3e18143c1..f8260e22118886 100644
--- a/x-pack/plugins/ml/server/plugin.ts
+++ b/x-pack/plugins/ml/server/plugin.ts
@@ -45,7 +45,6 @@ import { dataRecognizer } from './routes/modules';
 import { dataVisualizerRoutes } from './routes/data_visualizer';
 import { fieldsService } from './routes/fields_service';
 import { filtersRoutes } from './routes/filters';
-import { indicesRoutes } from './routes/indices';
 import { jobAuditMessagesRoutes } from './routes/job_audit_messages';
 import { jobRoutes } from './routes/anomaly_detectors';
 import { jobServiceRoutes } from './routes/job_service';
@@ -267,7 +266,6 @@ export class MlServerPlugin
     modelManagementRoutes(routeInit);
     dataVisualizerRoutes(routeInit);
     fieldsService(routeInit);
-    indicesRoutes(routeInit);
     managementRoutes(routeInit);
     savedObjectsRoutes(routeInit, {
       getSpaces,
diff --git a/x-pack/plugins/ml/server/routes/indices.ts b/x-pack/plugins/ml/server/routes/indices.ts
deleted file mode 100644
index 5f7e1819d6d5c4..00000000000000
--- a/x-pack/plugins/ml/server/routes/indices.ts
+++ /dev/null
@@ -1,57 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { ML_INTERNAL_BASE_PATH } from '../../common/constants/app';
-import { wrapError } from '../client/error_wrapper';
-import type { RouteInitialization } from '../types';
-import { indicesSchema } from './schemas/indices_schema';
-
-/**
- * Indices routes.
- */
-export function indicesRoutes({ router, routeGuard }: RouteInitialization) {
-  /**
-   * @apiGroup Indices
-   *
-   * @api {post} /internal/ml/indices/field_caps Field caps
-   * @apiName FieldCaps
-   * @apiDescription Retrieves the capabilities of fields among multiple indices.
-   *
-   * @apiSchema (body) indicesSchema
-   */
-  router.versioned
-    .post({
-      path: `${ML_INTERNAL_BASE_PATH}/indices/field_caps`,
-      access: 'internal',
-      options: {
-        tags: ['access:ml:canGetFieldInfo'],
-      },
-    })
-    .addVersion(
-      {
-        version: '1',
-        validate: {
-          request: {
-            body: indicesSchema,
-          },
-        },
-      },
-      routeGuard.fullLicenseAPIGuard(async ({ client, request, response }) => {
-        try {
-          const {
-            body: { index, fields: requestFields },
-          } = request;
-          const fields =
-            requestFields !== undefined && Array.isArray(requestFields) ? requestFields : '*';
-          const body = await client.asCurrentUser.fieldCaps({ index, fields }, { maxRetries: 0 });
-          return response.ok({ body });
-        } catch (e) {
-          return response.customError(wrapError(e));
-        }
-      })
-    );
-}
diff --git a/x-pack/plugins/monitoring/server/kibana_monitoring/collectors/lib/fetch_es_usage.ts b/x-pack/plugins/monitoring/server/kibana_monitoring/collectors/lib/fetch_es_usage.ts
index 56b12c311c4fec..4f6b67452b101e 100644
--- a/x-pack/plugins/monitoring/server/kibana_monitoring/collectors/lib/fetch_es_usage.ts
+++ b/x-pack/plugins/monitoring/server/kibana_monitoring/collectors/lib/fetch_es_usage.ts
@@ -87,7 +87,8 @@ export async function fetchESUsage(
 
   const response = await callCluster.search(params);
   const esResponse = response as estypes.SearchResponse<ClusterStats>;
-  if (esResponse.hits.hits.length === 0) {
+  const responseLength = esResponse?.hits?.hits?.length || 0;
+  if (responseLength === 0) {
     return {
       count: 0,
       enabled: false,
diff --git a/x-pack/plugins/monitoring/server/telemetry_collection/__mocks__/fixtures/logstash_state_metricbeat_monitoring_results_1n1p.json b/x-pack/plugins/monitoring/server/telemetry_collection/__mocks__/fixtures/logstash_state_metricbeat_monitoring_results_1n1p.json
new file mode 100644
index 00000000000000..e322f8132f95de
--- /dev/null
+++ b/x-pack/plugins/monitoring/server/telemetry_collection/__mocks__/fixtures/logstash_state_metricbeat_monitoring_results_1n1p.json
@@ -0,0 +1,186 @@
+[
+  {
+  "hits" : {
+      "hits": [
+        {
+          "_index" : ".monitoring-logstash-7-mb-2021.02.01",
+          "_type" : "_doc",
+          "_id" : "ezNjX3cB1VO1nvgv72Wz",
+          "_score" : 0.0,
+          "_source" : {
+            "logstash": {
+              "cluster": {
+                "id": "1n1p"
+              },
+              "elasticsearch": {
+                "cluster": {
+                  "id": "1n1p"
+                }
+              },
+              "node": {
+                "state": {
+                  "pipeline" : {
+                    "batch_size" : 125,
+                    "workers" : 1,
+                    "representation" : {
+                      "graph" : {
+                        "vertices" : [
+                          {
+                            "config_name" : "stdin",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "file"
+                              }
+                            },
+                            "plugin_type" : "input"
+                          },
+                          {
+                            "config_name" : "elasticsearch",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "file"
+                              }
+                            },
+                            "plugin_type" : "input"
+                          },
+                          {
+                            "config_name" : "mutate",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "file"
+                              }
+                            },
+                            "plugin_type" : "filter"
+                          },
+                          {
+                            "config_name" : "ruby",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "file"
+                              }
+                            },
+                            "plugin_type" : "filter"
+                          },
+                          {
+                            "config_name" : "split",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "file"
+                              }
+                            },
+                            "plugin_type" : "filter"
+                          },
+                          {
+                            "config_name" : "elasticsearch",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "file"
+                              }
+                            },
+                            "plugin_type" : "filter"
+                          },
+                          {
+                            "config_name" : "ruby",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "file"
+                              }
+                            },
+                            "plugin_type" : "filter"
+                          },
+                          {
+                            "config_name" : "ruby",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "file"
+                              }
+                            },
+                            "plugin_type" : "filter"
+                          },
+                          {
+                            "config_name" : "mutate",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "file"
+                              }
+                            },
+                            "plugin_type" : "filter"
+                          },
+                          {
+                            "config_name" : "aggregate",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "file"
+                              }
+                            },
+                            "plugin_type" : "filter"
+                          },
+                          {
+                            "config_name" : "drop",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "file"
+                              }
+                            },
+                            "plugin_type" : "filter"
+                          },
+                          {
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "file"
+                              }
+                            }
+                          },
+                          {
+                            "config_name" : "mutate",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "file"
+                              }
+                            },
+                            "plugin_type" : "filter"
+                          },
+                          {
+                            "config_name" : "elasticsearch",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "file"
+                              }
+                            },
+                            "plugin_type" : "output"
+                          },
+                          {
+                            "config_name" : "stdout",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "file"
+                              }
+                            },
+                            "plugin_type" : "output"
+                          }
+                        ]
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "metricset": {
+              "name": "node",
+              "period": 10000
+            },
+            "agent": {
+              "type": "metricbeat"
+            },
+            "timestamp" : "2021-02-01T15:58:40.943-0500"
+          },
+          "fields" : {
+            "logstash.node.state.pipeline.ephemeral_id" : [
+              "994e68cd-d607-40e6-a54c-02a51caa17e0"
+            ]
+          }
+        }
+      ]
+  }
+}
+]
diff --git a/x-pack/plugins/monitoring/server/telemetry_collection/__mocks__/fixtures/logstash_state_metricbeat_monitoring_results_1nmp.json b/x-pack/plugins/monitoring/server/telemetry_collection/__mocks__/fixtures/logstash_state_metricbeat_monitoring_results_1nmp.json
new file mode 100644
index 00000000000000..d50bb1c0b74832
--- /dev/null
+++ b/x-pack/plugins/monitoring/server/telemetry_collection/__mocks__/fixtures/logstash_state_metricbeat_monitoring_results_1nmp.json
@@ -0,0 +1,227 @@
+[
+  {
+    "hits" : {
+      "hits" : [
+        {
+          "_index" : ".monitoring-logstash-7-mb-2021.01.28",
+          "_type" : "_doc",
+          "_id" : "CiziSXcB1VO1nvgvRr-E",
+          "_score" : 0.0,
+          "_source" : {
+            "logstash": {
+              "node": {
+                "state": {
+                  "pipeline" : {
+                    "batch_size" : 125,
+                    "representation" : {
+                      "graph" : {
+                        "vertices" : [
+                          {
+                            "config_name" : "stdin",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "x-pack-config-management"
+                              }
+                            },
+                            "plugin_type" : "input"
+                          },
+                          {
+                            "config_name" : "stdout",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "x-pack-config-management"
+                              }
+                            },
+                            "plugin_type" : "output"
+                          }
+                        ]
+                      }
+                    },
+                    "workers" : 12
+                  }
+                }
+              }
+            },
+            "metricset": {
+              "name": "node",
+              "period": 10000
+            },
+            "agent": {
+              "type": "metricbeat"
+            },
+            "timestamp" : "2021-01-28T11:45:01.937-0500"
+          },
+          "fields" : {
+            "logstash.node.state.pipeline.ephemeral_id" : [
+              "47a70feb-3cb5-4618-8670-2c0bada61acd"
+            ]
+          }
+        },
+        {
+          "_index" : ".monitoring-logstash-7-mb-2021.01.12",
+          "_type" : "_doc",
+          "_id" : "DSziSXcB1VO1nvgvRr-Z",
+          "_score" : 0.0,
+          "_source" : {
+            "logstash": {
+              "node": {
+                "state": {
+                  "pipeline" : {
+                    "batch_size" : 125,
+                    "representation" : {
+                      "graph" : {
+                        "vertices" : [
+                          {
+                            "config_name" : "stdin",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "x-pack-config-management"
+                              }
+                            },
+                            "plugin_type" : "input"
+                          },
+                          {
+                            "config_name" : "stdout",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "x-pack-config-management"
+                              }
+                            },
+                            "plugin_type" : "output"
+                          }
+                        ]
+                      }
+                    },
+                    "workers" : 1
+                  }
+                }
+              }
+            },
+            "metricset": {
+              "name": "node",
+              "period": 10000
+            },
+            "agent": {
+              "type": "metricbeat"
+            },
+            "timestamp" : "2021-01-28T11:45:01.955-0500"
+          },
+          "fields" : {
+            "logstash.node.state.pipeline.ephemeral_id" : [
+              "5a65d966-0330-4bd7-82f2-ee81040c13cf"
+            ]
+          }
+        },
+        {
+          "_index" : ".monitoring-logstash-7-mb-2021.01.12",
+          "_type" : "_doc",
+          "_id" : "DCziSXcB1VO1nvgvRr-Z",
+          "_score" : 0.0,
+          "_source" : {
+            "logstash": {
+              "node": {
+                "state": {
+                  "pipeline" : {
+                    "batch_size" : 125,
+                    "representation" : {
+                      "graph" : {
+                        "vertices" : [
+                          {
+                            "config_name" : "stdin",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "x-pack-config-management"
+                              }
+                            },
+                            "plugin_type" : "input"
+                          },
+                          {
+                            "config_name" : "stdout",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "x-pack-config-management"
+                              }
+                            },
+                            "plugin_type" : "output"
+                          }
+                        ]
+                      }
+                    },
+                    "workers" : 44
+                  }
+                }
+              }
+            },
+            "metricset": {
+              "name": "node",
+              "period": 10000
+            },
+            "agent": {
+              "type": "metricbeat"
+            },
+            "timestamp" : "2021-01-28T11:45:01.937-0500"
+          },
+          "fields" : {
+            "logstash.node.state.pipeline.ephemeral_id" : [
+              "8d33fe25-a2c0-4c54-9ecf-d218cb8dbfe4"
+            ]
+          }
+        },
+        {
+          "_index" : ".monitoring-logstash-7-mb-2021.01.12",
+          "_type" : "_doc",
+          "_id" : "CyziSXcB1VO1nvgvRr-E",
+          "_score" : 0.0,
+          "_source" : {
+            "logstash": {
+              "node": {
+                "state": {
+                  "pipeline" : {
+                    "batch_size" : 1251,
+                    "representation" : {
+                      "graph" : {
+                        "vertices" : [
+                          {
+                            "config_name" : "stdin",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "x-pack-config-management"
+                              }
+                            },
+                            "plugin_type" : "input"
+                          },
+                          {
+                            "config_name" : "stdout",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "x-pack-config-management"
+                              }
+                            },
+                            "plugin_type" : "output"
+                          }
+                        ]
+                      }
+                    },
+                    "workers" : 12
+                  }
+                }
+              }
+            },
+            "metricset": {
+              "name": "node",
+              "period": 10000
+            },
+            "agent": {
+              "type": "metricbeat"
+            },
+            "timestamp" : "2021-01-28T11:45:01.937-0500"
+          },
+          "fields" : {
+            "logstash.node.state.pipeline.ephemeral_id" : [
+              "f4167a94-20a8-43e7-828e-4cf38d906187"
+            ]
+          }
+        }
+      ]
+    }
+  }]
diff --git a/x-pack/plugins/monitoring/server/telemetry_collection/__mocks__/fixtures/logstash_state_metricbeat_monitoring_results_mnmp.json b/x-pack/plugins/monitoring/server/telemetry_collection/__mocks__/fixtures/logstash_state_metricbeat_monitoring_results_mnmp.json
new file mode 100644
index 00000000000000..fb2fe2d8462e50
--- /dev/null
+++ b/x-pack/plugins/monitoring/server/telemetry_collection/__mocks__/fixtures/logstash_state_metricbeat_monitoring_results_mnmp.json
@@ -0,0 +1,1096 @@
+[
+  {
+  "hits" : {
+      "hits" : [
+        {
+          "_index" : ".monitoring-logstash-8-mb-2021.02.01",
+          "_type" : "_doc",
+          "_id" : "ZzNmX3cB1VO1nvgv9Wlp",
+          "_score" : 0.0,
+          "_source" : {
+            "logstash": {
+              "node": {
+                "state": {
+                  "pipeline" : {
+                    "batch_size" : 125,
+                    "representation" : {
+                      "graph" : {
+                        "vertices" : [
+                          {
+                            "config_name" : "stdin",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "file"
+                              }
+                            },
+                            "plugin_type" : "input"
+                          },
+                          {
+                            "config_name" : "clone",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "file"
+                              }
+                            },
+                            "plugin_type" : "filter"
+                          },
+                          {
+                            "config_name" : "pipeline",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "file"
+                              }
+                            },
+                            "plugin_type" : "output"
+                          }
+                        ]
+                      }
+                    },
+                    "workers" : 1
+                  }
+                }
+              }
+            },
+            "metricset": {
+              "name": "node",
+              "period": 10000
+            },
+            "agent": {
+              "type": "metricbeat"
+            },
+            "timestamp" : "2021-02-01T16:01:58.852-0500"
+          },
+          "fields" : {
+            "logstash.node.state.pipeline.ephemeral_id" : [
+              "cf37c6fa-2f1a-41e2-9a89-36b420a8b9a5"
+            ]
+          }
+        },
+        {
+          "_index" : ".monitoring-logstash-8-mb-2021.02.01",
+          "_type" : "_doc",
+          "_id" : "ujNxX3cB1VO1nvgvv3em",
+          "_score" : 0.0,
+          "_source" : {
+            "logstash": {
+              "node": {
+                "state": {
+                  "pipeline" : {
+                    "batch_size" : 100,
+                    "workers" : 1,
+                    "representation" : {
+                      "graph" : {
+                        "vertices" : [
+                          {
+                            "config_name" : "pipeline",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "string"
+                              }
+                            },
+                            "plugin_type" : "input"
+                          },
+                          {
+                            "config_name" : "sleep",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "string"
+                              }
+                            },
+                            "plugin_type" : "filter"
+                          },
+                          {
+                            "config_name" : "stdout",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "string"
+                              }
+                            },
+                            "plugin_type" : "output"
+                          }
+                        ]
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "metricset": {
+              "name": "node",
+              "period": 10000
+            },
+            "agent": {
+              "type": "metricbeat"
+            },
+            "timestamp" : "2021-02-01T16:13:45.947-0500"
+          },
+          "fields" : {
+            "logstash.node.state.pipeline.ephemeral_id" : [
+              "bc6ef6f2-ecce-4328-96a2-002de41a144d"
+            ]
+          }
+        },
+        {
+          "_index" : ".monitoring-logstash-8-mb-2021.02.01",
+          "_type" : "_doc",
+          "_id" : "ODNtX3cB1VO1nvgvo3IK",
+          "_score" : 0.0,
+          "_source" : {
+            "logstash": {
+              "node": {
+                "state": {
+                  "pipeline" : {
+                    "batch_size" : 1,
+                    "representation" : {
+                      "graph" : {
+                        "vertices" : [
+                          {
+                            "config_name" : "pipeline",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "string"
+                              }
+                            },
+                            "plugin_type" : "input"
+                          },
+                          {
+                            "config_name" : "sleep",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "string"
+                              }
+                            },
+                            "plugin_type" : "filter"
+                          },
+                          {
+                            "config_name" : "stdout",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "string"
+                              }
+                            },
+                            "plugin_type" : "output"
+                          }
+                        ]
+                      }
+                    },
+                    "workers" : 10
+                  }
+                }
+              }
+            },
+            "metricset": {
+              "name": "node",
+              "period": 10000
+            },
+            "agent": {
+              "type": "metricbeat"
+            },
+            "timestamp" : "2021-02-01T16:09:16.534-0500"
+          },
+          "fields" : {
+            "logstash.node.state.pipeline.ephemeral_id" : [
+              "3193df5f-2a34-4fe3-816e-6b05999aa5ce"
+            ]
+          }
+        },
+        {
+          "_index" : ".monitoring-logstash-8-mb-2021.02.01",
+          "_type" : "_doc",
+          "_id" : "LDNtX3cB1VO1nvgvonIZ",
+          "_score" : 0.0,
+          "_source" : {
+            "logstash": {
+              "node": {
+                "state": {
+                  "pipeline" : {
+                    "batch_size" : 6,
+                    "representation" : {
+                      "graph" : {
+                        "vertices" : [
+                          {
+                            "config_name" : "generator",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "string"
+                              }
+                            },
+                            "plugin_type" : "input"
+                          },
+                          {
+                            "config_name" : "sleep",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "string"
+                              }
+                            },
+                            "plugin_type" : "filter"
+                          },
+                          {
+                            "config_name" : "stdout",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "string"
+                              }
+                            },
+                            "plugin_type" : "output"
+                          }
+                        ]
+                      }
+                    },
+                    "workers" : 6
+                  }
+                }
+              }
+            },
+            "metricset": {
+              "name": "node",
+              "period": 10000
+            },
+            "agent": {
+              "type": "metricbeat"
+            },
+            "timestamp" : "2021-02-01T16:09:16.322-0500"
+          },
+          "fields" : {
+            "logstash.node.state.pipeline.ephemeral_id" : [
+              "602936f5-98a3-4f8c-9471-cf389a519f4b"
+            ]
+          }
+        },
+        {
+          "_index" : ".monitoring-logstash-8-mb-2021.02.01",
+          "_type" : "_doc",
+          "_id" : "LTNtX3cB1VO1nvgvonIZ",
+          "_score" : 0.0,
+          "_source" : {
+            "logstash": {
+              "node": {
+                "state": {
+                  "pipeline" : {
+                    "batch_size" : 12,
+                    "representation" : {
+                      "graph" : {
+                        "vertices" : [
+                          {
+                            "config_name" : "generator",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "string"
+                              }
+                            },
+                            "plugin_type" : "input"
+                          },
+                          {
+                            "config_name" : "sleep",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "string"
+                              }
+                            },
+                            "plugin_type" : "filter"
+                          },
+                          {
+                            "config_name" : "stdout",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "string"
+                              }
+                            },
+                            "plugin_type" : "output"
+                          }
+                        ]
+                      }
+                    },
+                    "workers" : 12
+                  }
+                }
+              }
+            },
+            "metricset": {
+              "name": "node",
+              "period": 10000
+            },
+            "agent": {
+              "type": "metricbeat"
+            },
+            "timestamp" : "2021-02-01T16:09:16.332-0500"
+          },
+          "fields" : {
+            "logstash.node.state.pipeline.ephemeral_id" : [
+              "41258219-b129-4fad-a629-f244826281f8"
+            ]
+          }
+        },
+        {
+          "_index" : ".monitoring-logstash-8-mb-2021.02.01",
+          "_type" : "_doc",
+          "_id" : "LjNtX3cB1VO1nvgvonI3",
+          "_score" : 0.0,
+          "_source" : {
+            "logstash": {
+              "node": {
+                "state": {
+                  "pipeline" : {
+                    "batch_size" : 7,
+                    "representation" : {
+                      "graph" : {
+                        "vertices" : [
+                          {
+                            "config_name" : "generator",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "string"
+                              }
+                            },
+                            "plugin_type" : "input"
+                          },
+                          {
+                            "config_name" : "sleep",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "string"
+                              }
+                            },
+                            "plugin_type" : "filter"
+                          },
+                          {
+                            "config_name" : "stdout",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "string"
+                              }
+                            },
+                            "plugin_type" : "output"
+                          }
+                        ]
+                      }
+                    },
+                    "workers" : 7
+                  }
+                }
+              }
+            },
+            "metricset": {
+              "name": "node",
+              "period": 10000
+            },
+            "agent": {
+              "type": "metricbeat"
+            },
+            "timestamp" : "2021-02-01T16:09:16.335-0500"
+          },
+          "fields" : {
+            "logstash.node.state.pipeline.ephemeral_id" : [
+              "18593052-c021-4158-860d-d8122981a0ac"
+            ]
+          }
+        },
+        {
+          "_index" : ".monitoring-logstash-8-mb-2021.02.01",
+          "_type" : "_doc",
+          "_id" : "LzNtX3cB1VO1nvgvonI3",
+          "_score" : 0.0,
+          "_source" : {
+            "logstash": {
+              "node": {
+                "state": {
+                  "pipeline" : {
+                    "batch_size" : 10,
+                    "representation" : {
+                      "graph" : {
+                        "vertices" : [
+                          {
+                            "config_name" : "generator",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "string"
+                              }
+                            },
+                            "plugin_type" : "input"
+                          },
+                          {
+                            "config_name" : "sleep",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "string"
+                              }
+                            },
+                            "plugin_type" : "filter"
+                          },
+                          {
+                            "config_name" : "stdout",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "string"
+                              }
+                            },
+                            "plugin_type" : "output"
+                          }
+                        ]
+                      }
+                    },
+                    "workers" : 10
+                  }
+                }
+              }
+            },
+            "metricset": {
+              "name": "node",
+              "period": 10000
+            },
+            "agent": {
+              "type": "metricbeat"
+            },
+            "timestamp" : "2021-02-01T16:09:16.337-0500"
+          },
+          "fields" : {
+            "logstash.node.state.pipeline.ephemeral_id" : [
+              "8b300988-62cc-4bc6-9ee0-9194f3f78e27"
+            ]
+          }
+        },
+        {
+          "_index" : ".monitoring-logstash-8-mb-2021.02.01",
+          "_type" : "_doc",
+          "_id" : "MDNtX3cB1VO1nvgvonJL",
+          "_score" : 0.0,
+          "_source" : {
+            "logstash": {
+              "node": {
+                "state": {
+                  "pipeline" : {
+                    "batch_size" : 8,
+                    "representation" : {
+                      "graph" : {
+                        "vertices" : [
+                          {
+                            "config_name" : "generator",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "string"
+                              }
+                            },
+                            "plugin_type" : "input"
+                          },
+                          {
+                            "config_name" : "sleep",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "string"
+                              }
+                            },
+                            "plugin_type" : "filter"
+                          },
+                          {
+                            "config_name" : "stdout",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "string"
+                              }
+                            },
+                            "plugin_type" : "output"
+                          }
+                        ]
+                      }
+                    },
+                    "workers" : 8
+                  }
+                }
+              }
+            },
+            "metricset": {
+              "name": "node",
+              "period": 10000
+            },
+            "agent": {
+              "type": "metricbeat"
+            },
+            "timestamp" : "2021-02-01T16:09:16.339-0500"
+          },
+          "fields" : {
+            "logstash.node.state.pipeline.ephemeral_id" : [
+              "802a5994-a03c-44b8-a650-47c0f71c2e48"
+            ]
+          }
+        },
+        {
+          "_index" : ".monitoring-logstash-8-mb-2021.02.01",
+          "_type" : "_doc",
+          "_id" : "MTNtX3cB1VO1nvgvonJL",
+          "_score" : 0.0,
+          "_source" : {
+            "logstash": {
+              "node": {
+                "state": {
+                  "pipeline" : {
+                    "batch_size" : 4,
+                    "representation" : {
+                      "graph" : {
+                        "vertices" : [
+                          {
+                            "config_name" : "generator",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "string"
+                              }
+                            },
+                            "plugin_type" : "input"
+                          },
+                          {
+                            "config_name" : "sleep",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "string"
+                              }
+                            },
+                            "plugin_type" : "filter"
+                          },
+                          {
+                            "config_name" : "stdout",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "string"
+                              }
+                            },
+                            "plugin_type" : "output"
+                          }
+                        ]
+                      }
+                    },
+                    "workers" : 4
+                  }
+                }
+              }
+            },
+            "metricset": {
+              "name": "node",
+              "period": 10000
+            },
+            "agent": {
+              "type": "metricbeat"
+            },
+            "timestamp" : "2021-02-01T16:09:16.468-0500"
+          },
+          "fields" : {
+            "logstash.node.state.pipeline.ephemeral_id" : [
+              "6ab60531-fb6f-478c-9063-82f2b0af2bed"
+            ]
+          }
+        },
+        {
+          "_index" : ".monitoring-logstash-8-mb-2021.02.01",
+          "_type" : "_doc",
+          "_id" : "MjNtX3cB1VO1nvgvonJi",
+          "_score" : 0.0,
+          "_source" : {
+            "logstash": {
+              "node": {
+                "state": {
+                  "pipeline" : {
+                    "batch_size" : 5,
+                    "representation" : {
+                      "graph" : {
+                        "vertices" : [
+                          {
+                            "config_name" : "generator",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "string"
+                              }
+                            },
+                            "plugin_type" : "input"
+                          },
+                          {
+                            "config_name" : "sleep",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "string"
+                              }
+                            },
+                            "plugin_type" : "filter"
+                          },
+                          {
+                            "config_name" : "stdout",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "string"
+                              }
+                            },
+                            "plugin_type" : "output"
+                          }
+                        ]
+                      }
+                    },
+                    "workers" : 5
+                  }
+                }
+              }
+            },
+            "metricset": {
+              "name": "node",
+              "period": 10000
+            },
+            "agent": {
+              "type": "metricbeat"
+            },
+            "timestamp" : "2021-02-01T16:09:16.470-0500"
+          },
+          "fields" : {
+            "logstash.node.state.pipeline.ephemeral_id" : [
+              "0ec4702d-b5e5-4c60-91e9-6fa6a836f0d1"
+            ]
+          }
+        },
+        {
+          "_index" : ".monitoring-logstash-8-mb-2021.02.01",
+          "_type" : "_doc",
+          "_id" : "MzNtX3cB1VO1nvgvonJi",
+          "_score" : 0.0,
+          "_source" : {
+            "logstash": {
+              "node": {
+                "state": {
+                  "pipeline" : {
+                    "batch_size" : 2,
+                    "representation" : {
+                      "graph" : {
+                        "vertices" : [
+                          {
+                            "config_name" : "generator",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "string"
+                              }
+                            },
+                            "plugin_type" : "input"
+                          },
+                          {
+                            "config_name" : "sleep",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "string"
+                              }
+                            },
+                            "plugin_type" : "filter"
+                          },
+                          {
+                            "config_name" : "pipeline",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "string"
+                              }
+                            },
+                            "plugin_type" : "output"
+                          }
+                        ]
+                      }
+                    },
+                    "workers" : 2
+                  }
+                }
+              }
+            },
+            "metricset": {
+              "name": "node",
+              "period": 10000
+            },
+            "agent": {
+              "type": "metricbeat"
+            },
+            "timestamp" : "2021-02-01T16:09:16.489-0500"
+          },
+          "fields" : {
+            "logstash.node.state.pipeline.ephemeral_id" : [
+              "ddf882b7-be26-4a93-8144-0aeb35122651"
+            ]
+          }
+        },
+        {
+          "_index" : ".monitoring-logstash-8-mb-2021.02.01",
+          "_type" : "_doc",
+          "_id" : "NDNtX3cB1VO1nvgvonJ3",
+          "_score" : 0.0,
+          "_source" : {
+            "logstash": {
+              "node": {
+                "state": {
+                  "pipeline" : {
+                    "batch_size" : 13,
+                    "representation" : {
+                      "graph" : {
+                        "vertices" : [
+                          {
+                            "config_name" : "generator",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "string"
+                              }
+                            },
+                            "plugin_type" : "input"
+                          },
+                          {
+                            "config_name" : "sleep",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "string"
+                              }
+                            },
+                            "plugin_type" : "filter"
+                          },
+                          {
+                            "config_name" : "stdout",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "string"
+                              }
+                            },
+                            "plugin_type" : "output"
+                          }
+                        ]
+                      }
+                    },
+                    "workers" : 13
+                  }
+                }
+              }
+            },
+            "metricset": {
+              "name": "node",
+              "period": 10000
+            },
+            "agent": {
+              "type": "metricbeat"
+            },
+            "timestamp" : "2021-02-01T16:09:16.490-0500"
+          },
+          "fields" : {
+            "logstash.node.state.pipeline.ephemeral_id" : [
+              "6070b400-5c10-4c5e-b5c5-a5bd9be6d321"
+            ]
+          }
+        },
+        {
+          "_index" : ".monitoring-logstash-8-mb-2021.02.01",
+          "_type" : "_doc",
+          "_id" : "NTNtX3cB1VO1nvgvonJ3",
+          "_score" : 0.0,
+          "_source" : {
+            "logstash": {
+              "node": {
+                "state": {
+                  "pipeline" : {
+                    "batch_size" : 3,
+                    "representation" : {
+                      "graph" : {
+                        "vertices" : [
+                          {
+                            "config_name" : "generator",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "string"
+                              }
+                            },
+                            "plugin_type" : "input"
+                          },
+                          {
+                            "config_name" : "sleep",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "string"
+                              }
+                            },
+                            "plugin_type" : "filter"
+                          },
+                          {
+                            "config_name" : "stdout",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "string"
+                              }
+                            },
+                            "plugin_type" : "output"
+                          }
+                        ]
+                      }
+                    },
+                    "workers" : 3
+                  }
+                }
+              }
+            },
+            "metricset": {
+              "name": "node",
+              "period": 10000
+            },
+            "agent": {
+              "type": "metricbeat"
+            },
+            "timestamp" : "2021-02-01T16:09:16.512-0500"
+          },
+          "fields" : {
+            "logstash.node.state.pipeline.ephemeral_id" : [
+              "e73bc63d-561a-4acd-a0c4-d5f70c4603df"
+            ]
+          }
+        },
+        {
+          "_index" : ".monitoring-logstash-8-mb-2021.02.01",
+          "_type" : "_doc",
+          "_id" : "NjNtX3cB1VO1nvgvonKM",
+          "_score" : 0.0,
+          "_source" : {
+            "logstash": {
+              "node": {
+                "state": {
+                  "pipeline" : {
+                    "batch_size" : 11,
+                    "representation" : {
+                      "graph" : {
+                        "vertices" : [
+                          {
+                            "config_name" : "generator",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "string"
+                              }
+                            },
+                            "plugin_type" : "input"
+                          },
+                          {
+                            "config_name" : "sleep",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "string"
+                              }
+                            },
+                            "plugin_type" : "filter"
+                          },
+                          {
+                            "config_name" : "stdout",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "string"
+                              }
+                            },
+                            "plugin_type" : "output"
+                          }
+                        ]
+                      }
+                    },
+                    "workers" : 11
+                  }
+                }
+              }
+            },
+            "metricset": {
+              "name": "node",
+              "period": 10000
+            },
+            "agent": {
+              "type": "metricbeat"
+            },
+            "timestamp" : "2021-02-01T16:09:16.513-0500"
+          },
+          "fields" : {
+            "logstash.node.state.pipeline.ephemeral_id" : [
+              "4207025c-9b00-4bea-a36c-6fbf2d3c215e"
+            ]
+          }
+        },
+        {
+          "_index" : ".monitoring-logstash-8-mb-2021.02.01",
+          "_type" : "_doc",
+          "_id" : "NzNtX3cB1VO1nvgvonKM",
+          "_score" : 0.0,
+          "_source" : {
+            "logstash": {
+              "node": {
+                "state": {
+                  "pipeline" : {
+                    "batch_size" : 9,
+                    "representation" : {
+                      "graph" : {
+                        "vertices" : [
+                          {
+                            "config_name" : "generator",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "string"
+                              }
+                            },
+                            "plugin_type" : "input"
+                          },
+                          {
+                            "config_name" : "sleep",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "string"
+                              }
+                            },
+                            "plugin_type" : "filter"
+                          },
+                          {
+                            "config_name" : "stdout",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "string"
+                              }
+                            },
+                            "plugin_type" : "output"
+                          }
+                        ]
+                      }
+                    },
+                    "workers" : 9
+                  }
+                }
+              }
+            },
+            "metricset": {
+              "name": "node",
+              "period": 10000
+            },
+            "agent": {
+              "type": "metricbeat"
+            },
+            "timestamp" : "2021-02-01T16:09:16.533-0500"
+          },
+          "fields" : {
+            "logstash.node.state.pipeline.ephemeral_id" : [
+              "72058ad1-68a1-45f6-a8e8-10621ffc7288"
+            ]
+          }
+        },
+        {
+          "_index" : ".monitoring-logstash-8-mb-2021.02.01",
+          "_type" : "_doc",
+          "_id" : "uDNxX3cB1VO1nvgvv3cb",
+          "_score" : 0.0,
+          "_source" : {
+            "logstash": {
+              "node": {
+                "state": {
+                  "pipeline" : {
+                    "batch_size" : 125,
+                    "workers" : 16,
+                    "representation" : {
+                      "graph" : {
+                        "vertices" : [
+                          {
+                            "config_name" : "generator",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "file"
+                              }
+                            },
+                            "plugin_type" : "input"
+                          },
+                          {
+                            "config_name" : "sleep",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "file"
+                              }
+                            },
+                            "plugin_type" : "filter"
+                          },
+                          {
+                            "config_name" : "stdout",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "file"
+                              }
+                            },
+                            "plugin_type" : "output"
+                          }
+                        ]
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "metricset": {
+              "name": "node",
+              "period": 10000
+            },
+            "agent": {
+              "type": "metricbeat"
+            },
+            "timestamp" : "2021-02-01T16:13:45.932-0500"
+          },
+          "fields" : {
+            "logstash.node.state.pipeline.ephemeral_id" : [
+              "c6785d63-6e5f-42c2-839d-5edf139b7c19"
+            ]
+          }
+        },
+        {
+          "_index" : ".monitoring-logstash-8-mb-2021.02.01",
+          "_type" : "_doc",
+          "_id" : "uTNxX3cB1VO1nvgvv3cb",
+          "_score" : 0.0,
+          "_source" : {
+            "logstash": {
+              "node": {
+                "state": {
+                  "pipeline" : {
+                    "batch_size" : 125,
+                    "workers" : 8,
+                    "representation" : {
+                      "graph" : {
+                        "vertices" : [
+                          {
+                            "config_name" : "generator",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "string"
+                              }
+                            },
+                            "plugin_type" : "input"
+                          },
+                          {
+                            "config_name" : "sleep",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "string"
+                              }
+                            },
+                            "plugin_type" : "filter"
+                          },
+                          {
+                            "config_name" : "pipeline",
+                            "meta" : {
+                              "source" : {
+                                "protocol" : "string"
+                              }
+                            },
+                            "plugin_type" : "output"
+                          }
+                        ]
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "metricset": {
+              "name": "node",
+              "period": 10000
+            },
+            "agent": {
+              "type": "metricbeat"
+            },
+            "timestamp" : "2021-02-01T16:13:45.945-0500"
+          },
+          "fields" : {
+            "logstash.node.state.pipeline.ephemeral_id" : [
+              "2fcd4161-e08f-4eea-818b-703ea3ec6389"
+            ]
+          }
+        }
+      ]
+  }
+}
+]
diff --git a/x-pack/plugins/monitoring/server/telemetry_collection/__mocks__/fixtures/logstash_state_results_1n1p.json b/x-pack/plugins/monitoring/server/telemetry_collection/__mocks__/fixtures/logstash_state_self_monitoring_results_1n1p.json
similarity index 100%
rename from x-pack/plugins/monitoring/server/telemetry_collection/__mocks__/fixtures/logstash_state_results_1n1p.json
rename to x-pack/plugins/monitoring/server/telemetry_collection/__mocks__/fixtures/logstash_state_self_monitoring_results_1n1p.json
diff --git a/x-pack/plugins/monitoring/server/telemetry_collection/__mocks__/fixtures/logstash_state_results_1nmp.json b/x-pack/plugins/monitoring/server/telemetry_collection/__mocks__/fixtures/logstash_state_self_monitoring_results_1nmp.json
similarity index 98%
rename from x-pack/plugins/monitoring/server/telemetry_collection/__mocks__/fixtures/logstash_state_results_1nmp.json
rename to x-pack/plugins/monitoring/server/telemetry_collection/__mocks__/fixtures/logstash_state_self_monitoring_results_1nmp.json
index f2e3b1e038476c..5e60885a665afe 100644
--- a/x-pack/plugins/monitoring/server/telemetry_collection/__mocks__/fixtures/logstash_state_results_1nmp.json
+++ b/x-pack/plugins/monitoring/server/telemetry_collection/__mocks__/fixtures/logstash_state_self_monitoring_results_1nmp.json
@@ -3,7 +3,7 @@
     "hits" : {
       "hits" : [
         {
-          "_index" : ".monitoring-logstash-7-mb-2021.01.28",
+          "_index" : ".monitoring-logstash-7-2021.01.28",
           "_type" : "_doc",
           "_id" : "CiziSXcB1VO1nvgvRr-E",
           "_score" : 0.0,
diff --git a/x-pack/plugins/monitoring/server/telemetry_collection/__mocks__/fixtures/logstash_state_results_mnmp.json b/x-pack/plugins/monitoring/server/telemetry_collection/__mocks__/fixtures/logstash_state_self_monitoring_results_mnmp.json
similarity index 100%
rename from x-pack/plugins/monitoring/server/telemetry_collection/__mocks__/fixtures/logstash_state_results_mnmp.json
rename to x-pack/plugins/monitoring/server/telemetry_collection/__mocks__/fixtures/logstash_state_self_monitoring_results_mnmp.json
diff --git a/x-pack/plugins/monitoring/server/telemetry_collection/__mocks__/fixtures/logstash_stats_metricbeat_monitoring_results.json b/x-pack/plugins/monitoring/server/telemetry_collection/__mocks__/fixtures/logstash_stats_metricbeat_monitoring_results.json
new file mode 100644
index 00000000000000..1483e2aeff2684
--- /dev/null
+++ b/x-pack/plugins/monitoring/server/telemetry_collection/__mocks__/fixtures/logstash_stats_metricbeat_monitoring_results.json
@@ -0,0 +1,405 @@
+[
+  {
+    "hits" : {
+      "hits": [
+        {
+          "_index": ".monitoring-logstash-7-2021.02.01",
+          "_type": "_doc",
+          "_id": "6DN5X3cB1VO1nvgvb4Ft",
+          "_score": null,
+          "_source": {
+            "agent" : {
+              "type" : "metricbeat"
+            },
+            "logstash": {
+              "cluster": {
+                "id": "1n1p"
+              },
+              "elasticsearch": {
+                "cluster": {
+                  "id": "1n1p"
+                }
+              },
+              "node": {
+                "stats": {
+                  "logstash": {
+                    "version": "7.10.0",
+                    "snapshot": false,
+                    "status": "green"
+                  },
+                  "pipelines": [
+                    {
+                      "id": "main",
+                      "ephemeral_id": "cf37c6fa-2f1a-41e2-9a89-36b420a8b9a5",
+                      "queue": {
+                        "max_queue_size_in_bytes": 0,
+                        "type": "memory"
+                      }
+                    }
+                  ]
+                }
+              }
+            },
+            "metricset": {
+              "period": 10000,
+              "name": "node_stats"
+            }
+          },
+          "fields": {
+            "logstash.node.stats.logstash.uuid": [
+              "12a3b26f-9b8c-4d38-b4d0-54649c1dd244"
+            ]
+          },
+          "sort": [
+            1612214529897
+          ]
+        },
+        {
+          "_index" : ".monitoring-logstash-7-mb-2021.01.28",
+          "_type" : "_doc",
+          "_id" : "rC2jSncB1VO1nvgvsKx6",
+          "_score" : null,
+          "_source" : {
+            "logstash": {
+              "cluster": {
+                "id": "1nmp"
+              },
+              "elasticsearch": {
+                "cluster": {
+                  "id": "1nmp"
+                }
+              },
+              "node": {
+                "stats": {
+                  "logstash" : {
+                    "version" : "7.8.0",
+                    "snapshot" : false,
+                    "status" : "green"
+                  },
+                  "pipelines" : [
+                    {
+                      "id" : "test2",
+                      "ephemeral_id" : "47a70feb-3cb5-4618-8670-2c0bada61acd",
+                      "queue" : {
+                        "max_queue_size_in_bytes" : 0,
+                        "type" : "memory"
+                      }
+                    },
+                    {
+                      "id" : "main",
+                      "ephemeral_id" : "5a65d966-0330-4bd7-82f2-ee81040c13cf",
+                      "queue" : {
+                        "max_queue_size_in_bytes" : 0,
+                        "type" : "memory"
+                      }
+                    },
+                    {
+                      "id" : "main2",
+                      "ephemeral_id" : "8d33fe25-a2c0-4c54-9ecf-d218cb8dbfe4",
+                      "queue" : {
+                        "max_queue_size_in_bytes" : 0,
+                        "type" : "memory"
+                      }
+                    },
+                    {
+                      "id" : "main3",
+                      "ephemeral_id" : "f4167a94-20a8-43e7-828e-4cf38d906187",
+                      "queue" : {
+                        "max_queue_size_in_bytes" : 1.19185342464E11,
+                        "type" : "persisted"
+                      }
+                    }
+                  ]
+                }
+              }
+            },
+            "metricset": {
+              "period": 10000,
+              "name": "node_stats"
+            },
+            "agent" : {
+              "type" : "metricbeat"
+            }
+          },
+          "fields" : {
+            "logstash.node.stats.logstash.uuid" : [
+              "1232122-f2b6-4b6c-8cea-22661f9c4134"
+            ]
+          },
+          "sort" : [
+            1611864976527
+          ]
+        },
+        {
+          "_index": ".monitoring-logstash-7-2021.02.01",
+          "_type": "_doc",
+          "_id": "JzNyX3cB1VO1nvgvDXi5",
+          "_score": null,
+          "_source": {
+            "logstash": {
+              "cluster": {
+                "id": "mnmp"
+              },
+              "elasticsearch": {
+                "cluster": {
+                  "id": "mnmp"
+                }
+              },
+              "node": {
+                "stats": {
+                  "logstash": {
+                    "version": "7.9.2",
+                    "snapshot": false,
+                    "status": "green"
+                  },
+                  "pipelines": [
+                    {
+                      "id": "t2",
+                      "ephemeral_id": "2fcd4161-e08f-4eea-818b-703ea3ec6389",
+                      "queue": {
+                        "max_queue_size_in_bytes": 0,
+                        "type": "memory"
+                      }
+                    },
+                    {
+                      "id": "aggregate-test",
+                      "ephemeral_id": "c6785d63-6e5f-42c2-839d-5edf139b7c19",
+                      "queue": {
+                        "max_queue_size_in_bytes": 0,
+                        "type": "memory"
+                      }
+                    },
+                    {
+                      "id": "t1",
+                      "ephemeral_id": "bc6ef6f2-ecce-4328-96a2-002de41a144d",
+                      "queue": {
+                        "max_queue_size_in_bytes": 1073741824,
+                        "type": "persisted"
+                      }
+                    }
+                  ]
+                }
+              }
+            },
+            "metricset": {
+              "period": 10000,
+              "name": "node_stats"
+            },
+            "agent" : {
+              "type" : "metricbeat"
+            }
+          },
+          "fields": {
+            "logstash.node.stats.logstash.uuid": [
+              "701ce2f6-4e6a-426b-a959-80e7cdd608aa"
+            ]
+          },
+          "sort": [
+            1612214046021
+          ]
+        },
+        {
+          "_index": ".monitoring-logstash-7-2021.02.01",
+          "_type": "_doc",
+          "_id": "sTNuX3cB1VO1nvgvtXN6",
+          "_score": null,
+          "_source": {
+            "logstash": {
+              "cluster": {
+                "id": "mnmp"
+              },
+              "elasticsearch": {
+                "cluster": {
+                  "id": "mnmp"
+                }
+              },
+              "node": {
+                "stats": {
+                  "logstash": {
+                    "version": "7.9.1",
+                    "snapshot": false,
+                    "status": "green"
+                  },
+                  "pipelines": [
+                    {
+                      "id": "t9",
+                      "ephemeral_id": "72058ad1-68a1-45f6-a8e8-10621ffc7288",
+                      "queue": {
+                        "max_queue_size_in_bytes": 1073741824,
+                        "type": "persisted"
+                      }
+                    },
+                    {
+                      "id": "t7",
+                      "ephemeral_id": "18593052-c021-4158-860d-d8122981a0ac",
+                      "queue": {
+                        "max_queue_size_in_bytes": 1073741824,
+                        "type": "persisted"
+                      }
+                    },
+                    {
+                      "id": "t11",
+                      "ephemeral_id": "4207025c-9b00-4bea-a36c-6fbf2d3c215e",
+                      "queue": {
+                        "max_queue_size_in_bytes": 1073741824,
+                        "type": "persisted"
+                      }
+                    },
+                    {
+                      "id": "t5",
+                      "ephemeral_id": "0ec4702d-b5e5-4c60-91e9-6fa6a836f0d1",
+                      "queue": {
+                        "max_queue_size_in_bytes": 1073741824,
+                        "type": "persisted"
+                      }
+                    },
+                    {
+                      "id": "t12",
+                      "ephemeral_id": "41258219-b129-4fad-a629-f244826281f8",
+                      "queue": {
+                        "max_queue_size_in_bytes": 1073741824,
+                        "type": "persisted"
+                      }
+                    },
+                    {
+                      "id": "t3",
+                      "ephemeral_id": "e73bc63d-561a-4acd-a0c4-d5f70c4603df",
+                      "queue": {
+                        "max_queue_size_in_bytes": 1073741824,
+                        "type": "persisted"
+                      }
+                    },
+                    {
+                      "id": "t2",
+                      "ephemeral_id": "ddf882b7-be26-4a93-8144-0aeb35122651",
+                      "queue": {
+                        "max_queue_size_in_bytes": 1073741824,
+                        "type": "persisted"
+                      }
+                    },
+                    {
+                      "id": "t6",
+                      "ephemeral_id": "602936f5-98a3-4f8c-9471-cf389a519f4b",
+                      "queue": {
+                        "max_queue_size_in_bytes": 1073741824,
+                        "type": "persisted"
+                      }
+                    },
+                    {
+                      "id": "t10",
+                      "ephemeral_id": "8b300988-62cc-4bc6-9ee0-9194f3f78e27",
+                      "queue": {
+                        "max_queue_size_in_bytes": 1073741824,
+                        "type": "persisted"
+                      }
+                    },
+                    {
+                      "id": "t4",
+                      "ephemeral_id": "6ab60531-fb6f-478c-9063-82f2b0af2bed",
+                      "queue": {
+                        "max_queue_size_in_bytes": 1073741824,
+                        "type": "persisted"
+                      }
+                    },
+                    {
+                      "id": "t8",
+                      "ephemeral_id": "802a5994-a03c-44b8-a650-47c0f71c2e48",
+                      "queue": {
+                        "max_queue_size_in_bytes": 1073741824,
+                        "type": "persisted"
+                      }
+                    },
+                    {
+                      "id": "t13",
+                      "ephemeral_id": "6070b400-5c10-4c5e-b5c5-a5bd9be6d321",
+                      "queue": {
+                        "max_queue_size_in_bytes": 1073741824,
+                        "type": "persisted"
+                      }
+                    },
+                    {
+                      "id": "t1",
+                      "ephemeral_id": "3193df5f-2a34-4fe3-816e-6b05999aa5ce",
+                      "queue": {
+                        "max_queue_size_in_bytes": 1073741824,
+                        "type": "persisted"
+                      }
+                    }
+                  ]
+                }
+              }
+            },
+            "metricset": {
+              "period": 10000,
+              "name": "node_stats"
+            },
+            "agent" : {
+              "type" : "metricbeat"
+            }
+          },
+          "fields": {
+            "logstash.node.stats.logstash.uuid": [
+              "255eab6a-e15c-4e21-8d81-a9474eadb3eb"
+            ]
+          },
+          "sort": [
+            1612213826805
+          ]
+        },
+        {
+          "_index": ".monitoring-logstash-7-2021.02.01",
+          "_type": "_doc",
+          "_id": "FDNkX3cB1VO1nvgvZWaA",
+          "_score": null,
+          "_source": {
+            "logstash": {
+              "cluster": {
+                "id": "mnmp"
+              },
+              "elasticsearch": {
+                "cluster": {
+                  "id": "mnmp"
+                }
+              },
+              "node": {
+                "stats": {
+                  "logstash": {
+                    "version": "7.10.0",
+                    "snapshot": false,
+                    "status": "green"
+                  },
+                  "pipelines": [
+                    {
+                      "id": "main",
+                      "ephemeral_id": "994e68cd-d607-40e6-a54c-02a51caa17e0",
+                      "queue": {
+                        "max_queue_size_in_bytes": 0,
+                        "type": "memory"
+                      }
+                    }
+                  ]
+                }
+              }
+            },
+            "metricset": {
+              "period": 10000,
+              "name": "node_stats"
+            },
+            "agent" : {
+              "type" : "metricbeat"
+            }
+          },
+          "fields": {
+            "logstash.node.stats.logstash.uuid": [
+              "beb45ee3-ad5f-4895-87f0-97625a6e5295"
+            ]
+          },
+          "sort": [
+            1612213150986
+          ]
+        }
+      ]
+    }
+  }
+]
+
diff --git a/x-pack/plugins/monitoring/server/telemetry_collection/__mocks__/fixtures/logstash_stats_results.json b/x-pack/plugins/monitoring/server/telemetry_collection/__mocks__/fixtures/logstash_stats_self_monitoring_results.json
similarity index 100%
rename from x-pack/plugins/monitoring/server/telemetry_collection/__mocks__/fixtures/logstash_stats_results.json
rename to x-pack/plugins/monitoring/server/telemetry_collection/__mocks__/fixtures/logstash_stats_self_monitoring_results.json
diff --git a/x-pack/plugins/monitoring/server/telemetry_collection/create_query.ts b/x-pack/plugins/monitoring/server/telemetry_collection/create_query.ts
index 4579dbc12f36aa..e4d470666f4442 100644
--- a/x-pack/plugins/monitoring/server/telemetry_collection/create_query.ts
+++ b/x-pack/plugins/monitoring/server/telemetry_collection/create_query.ts
@@ -35,7 +35,7 @@ interface RangeFilter {
 }
 
 /*
- * Creates the boilerplace for querying monitoring data, including filling in
+ * Creates the boilerplate for querying monitoring data, including filling in
  * start time and end time, and injecting additional filters.
  *
  * Create a bool for types that will query for documents using `_type` (true type) and `type` (as a field)
diff --git a/x-pack/plugins/monitoring/server/telemetry_collection/get_all_stats.test.ts b/x-pack/plugins/monitoring/server/telemetry_collection/get_all_stats.test.ts
index 90bf2e06ebc26c..3b426b38fb241e 100644
--- a/x-pack/plugins/monitoring/server/telemetry_collection/get_all_stats.test.ts
+++ b/x-pack/plugins/monitoring/server/telemetry_collection/get_all_stats.test.ts
@@ -120,12 +120,18 @@ describe('get_all_stats', () => {
         hits: {
           hits: [
             {
+              _index: '.monitoring-logstash-8-test', // legacy
               _source: {
                 cluster_uuid: 'a',
                 logstash_stats: {
                   logstash: {
                     version: '2.3.4-beta2',
                   },
+                  pipelines: [
+                    {
+                      ephemeral_id: 'abcd1234-1234-1234-1234-abcd1234abcd',
+                    },
+                  ],
                 },
               },
             },
@@ -168,13 +174,15 @@ describe('get_all_stats', () => {
         .onCall(1)
         .returns(Promise.resolve(kibanaStatsResponse))
         .onCall(2)
-        .returns(Promise.resolve(logstashStatsResponse))
+        .returns(Promise.resolve(logstashStatsResponse)) // to define if it is internal monitoring or not
         .returns(Promise.resolve(logstashStatsResponse))
         .onCall(3)
         .returns(Promise.resolve({})) // Beats stats
         .onCall(4)
         .returns(Promise.resolve({})) // Beats state
         .onCall(5)
+        .returns(Promise.resolve(logstashStatsResponse)) // Logstash stats
+        .onCall(6)
         .returns(Promise.resolve({})); // Logstash state
 
       expect(await getAllStats(['a'], callCluster, timestamp, 1)).toStrictEqual(allClusters);
diff --git a/x-pack/plugins/monitoring/server/telemetry_collection/get_all_stats.ts b/x-pack/plugins/monitoring/server/telemetry_collection/get_all_stats.ts
index f74c712fb055a2..77c50d089301ef 100644
--- a/x-pack/plugins/monitoring/server/telemetry_collection/get_all_stats.ts
+++ b/x-pack/plugins/monitoring/server/telemetry_collection/get_all_stats.ts
@@ -52,6 +52,7 @@ export async function getAllStats(
  * @param {Array} clusters The Elasticsearch clusters
  * @param {Object} kibana The Kibana instances keyed by Cluster UUID
  * @param {Object} logstash The Logstash nodes keyed by Cluster UUID
+ * @param {Object} beats The Beats nodes keyed by Cluster UUID
  *
  * Returns the clusters joined with the Kibana and Logstash instances under each cluster's {@code stack_stats}.
  */
diff --git a/x-pack/plugins/monitoring/server/telemetry_collection/get_cluster_uuids.ts b/x-pack/plugins/monitoring/server/telemetry_collection/get_cluster_uuids.ts
index 2adbf65ede7668..ed553c3ca4e1cd 100644
--- a/x-pack/plugins/monitoring/server/telemetry_collection/get_cluster_uuids.ts
+++ b/x-pack/plugins/monitoring/server/telemetry_collection/get_cluster_uuids.ts
@@ -45,7 +45,20 @@ export async function fetchClusterUuids(
     filter_path: 'aggregations.cluster_uuids.buckets.key',
     body: {
       size: 0,
-      query: createQuery({ type: 'cluster_stats', start, end }) as estypes.QueryDslQueryContainer,
+      query: createQuery({
+        start,
+        end,
+        filters: [
+          {
+            bool: {
+              should: [
+                { term: { type: 'cluster_stats' } },
+                { term: { 'metricset.name': 'cluster_stats' } },
+              ],
+            },
+          },
+        ],
+      }) as estypes.QueryDslQueryContainer,
       aggs: {
         cluster_uuids: {
           terms: {
diff --git a/x-pack/plugins/monitoring/server/telemetry_collection/get_es_stats.ts b/x-pack/plugins/monitoring/server/telemetry_collection/get_es_stats.ts
index d824dc9e6d5fe9..4eecebdb177fcb 100644
--- a/x-pack/plugins/monitoring/server/telemetry_collection/get_es_stats.ts
+++ b/x-pack/plugins/monitoring/server/telemetry_collection/get_es_stats.ts
@@ -13,9 +13,11 @@ import { INDEX_PATTERN_ELASTICSEARCH } from '../../common/constants';
 /**
  * Get statistics for all selected Elasticsearch clusters.
  *
- * @param {Object} server The server instance
  * @param {function} callCluster The callWithRequest or callWithInternalUser handler
  * @param {Array} clusterUuids The string Cluster UUIDs to fetch details for
+ * @param start
+ * @param end
+ * @param maxBucketSize
  */
 export async function getElasticsearchStats(
   callCluster: ElasticsearchClient,
@@ -37,11 +39,13 @@ export async function getElasticsearchStats(
 /**
  * Fetch the Elasticsearch stats.
  *
- * @param {Object} server The server instance
  * @param {function} callCluster The callWithRequest or callWithInternalUser handler
  * @param {Array} clusterUuids Cluster UUIDs to limit the request against
  *
  * Returns the response for the aggregations to fetch details for the product.
+ * @param start
+ * @param end
+ * @param maxBucketSize
  */
 export async function fetchElasticsearchStats(
   callCluster: ElasticsearchClient,
@@ -60,6 +64,7 @@ export async function fetchElasticsearchStats(
       'hits.hits._source.version',
       'hits.hits._source.cluster_stats',
       'hits.hits._source.stack_stats',
+      'hits.hits._source.elasticsearch',
     ],
     body: {
       size: maxBucketSize,
@@ -70,7 +75,14 @@ export async function fetchElasticsearchStats(
              * Note: Unlike most places, we don't care about the old _type: cluster_stats because it would NOT
              * have the license in it (that used to be in the .monitoring-data-2 index in cluster_info)
              */
-            { term: { type: 'cluster_stats' } },
+            {
+              bool: {
+                should: [
+                  { term: { type: 'cluster_stats' } },
+                  { term: { 'metricset.name': 'cluster_stats' } },
+                ],
+              },
+            },
             { terms: { cluster_uuid: clusterUuids } },
             {
               range: {
@@ -93,6 +105,18 @@ export async function fetchElasticsearchStats(
 }
 
 export interface ESClusterStats {
+  elasticsearch?: {
+    cluster: {
+      id: string;
+      name: string;
+      stats: {
+        stack: object;
+        nodes: {
+          versions: string[];
+        };
+      };
+    };
+  };
   cluster_uuid: string;
   cluster_name: string;
   timestamp: string;
@@ -107,5 +131,20 @@ export interface ESClusterStats {
 export function handleElasticsearchStats(response: estypes.SearchResponse<ESClusterStats>) {
   const clusters = response.hits?.hits || [];
 
-  return clusters.map((cluster) => cluster._source!);
+  return clusters.map((cluster) => {
+    const clusterStats = cluster._source!;
+
+    // tolerate metricbeat monitoring structure
+    if (clusterStats.elasticsearch) {
+      clusterStats.cluster_stats = clusterStats.elasticsearch.cluster.stats;
+      clusterStats.cluster_uuid = clusterStats.elasticsearch.cluster.id;
+      clusterStats.cluster_name = clusterStats.elasticsearch.cluster.name;
+      if (clusterStats.elasticsearch.cluster.stats.nodes.versions.length > 0) {
+        clusterStats.version = clusterStats.elasticsearch.cluster.stats.nodes.versions[0] || '';
+      }
+      clusterStats.elasticsearch = undefined;
+    }
+
+    return clusterStats;
+  });
 }
diff --git a/x-pack/plugins/monitoring/server/telemetry_collection/get_logstash_stats.test.ts b/x-pack/plugins/monitoring/server/telemetry_collection/get_logstash_stats.test.ts
index b961170c2cd4b0..0dc5368d27b766 100644
--- a/x-pack/plugins/monitoring/server/telemetry_collection/get_logstash_stats.test.ts
+++ b/x-pack/plugins/monitoring/server/telemetry_collection/get_logstash_stats.test.ts
@@ -15,14 +15,27 @@ import sinon from 'sinon';
 import { ElasticsearchClient } from '@kbn/core/server';
 
 // eslint-disable-next-line @typescript-eslint/no-var-requires
-const logstashStatsResultSet = require('./__mocks__/fixtures/logstash_stats_results.json');
+const logstashStatsResultSetOfSelfMonitoring = require('./__mocks__/fixtures/logstash_stats_self_monitoring_results.json');
 
-const resultsMap = new Map();
+// eslint-disable-next-line @typescript-eslint/no-var-requires
+const logstashStatsResultSetOfMetricbeatMonitoring = require('./__mocks__/fixtures/logstash_stats_metricbeat_monitoring_results.json');
+
+const logstashStateResultsMapOfSelfMonitoring = new Map();
+const logstashStateResultsMapOfMetricbeatMonitoring = new Map();
 
 // Load data for state results.
 ['1n1p', '1nmp', 'mnmp'].forEach((data) => {
-  // eslint-disable-next-line @typescript-eslint/no-var-requires
-  resultsMap.set(data, require(`./__mocks__/fixtures/logstash_state_results_${data}`));
+  logstashStateResultsMapOfSelfMonitoring.set(
+    data,
+    // eslint-disable-next-line @typescript-eslint/no-var-requires
+    require(`./__mocks__/fixtures/logstash_state_self_monitoring_results_${data}`)
+  );
+
+  logstashStateResultsMapOfMetricbeatMonitoring.set(
+    data,
+    // eslint-disable-next-line @typescript-eslint/no-var-requires
+    require(`./__mocks__/fixtures/logstash_state_metricbeat_monitoring_results_${data}`)
+  );
 });
 
 const getBaseOptions = () => ({
@@ -50,462 +63,671 @@ describe('Get Logstash Stats', () => {
   describe('fetchLogstashState', () => {
     const clusterUuid = 'a';
     const ephemeralIds = ['a', 'b', 'c'];
-    it('should create the logstash state query correctly', async () => {
+    it('should create the logstash state query correctly  for legacy monitoring', async () => {
       const expected = {
         bool: {
           filter: [
             {
-              range: {
-                timestamp: {
-                  format: 'epoch_millis',
-                  gte: 1646784000000,
-                  lte: 1646785200000,
-                },
+              terms: {
+                'logstash_state.pipeline.ephemeral_id': ['a', 'b', 'c'],
+              },
+            },
+            {
+              bool: {
+                should: [
+                  { term: { type: 'logstash_state' } },
+                  { term: { 'metricset.name': 'node' } },
+                ],
               },
             },
+          ],
+        },
+      };
+
+      await fetchLogstashState(callCluster, clusterUuid, ephemeralIds, start, end, {} as any, true);
+      const { args } = searchMock.firstCall;
+      const [{ body }] = args;
+      expect(body.query).toEqual(expected);
+    });
+
+    it('should create the logstash state query correctly for metricbeat monitoring', async () => {
+      const expected = {
+        bool: {
+          filter: [
             {
               terms: {
-                'logstash_state.pipeline.ephemeral_id': ['a', 'b', 'c'],
+                'logstash.node.state.pipeline.ephemeral_id': ['a', 'b', 'c'],
               },
             },
             {
               bool: {
-                must: {
-                  term: { type: 'logstash_state' },
-                },
+                should: [
+                  { term: { type: 'logstash_state' } },
+                  { term: { 'metricset.name': 'node' } },
+                ],
               },
             },
           ],
         },
       };
 
-      await fetchLogstashState(callCluster, clusterUuid, ephemeralIds, start, end, {} as any);
+      await fetchLogstashState(
+        callCluster,
+        clusterUuid,
+        ephemeralIds,
+        start,
+        end,
+        {} as any,
+        false
+      );
       const { args } = searchMock.firstCall;
       const [{ body }] = args;
       expect(body.query).toEqual(expected);
     });
 
-    it('should set `from: 0, to: 10000` in the query', async () => {
-      await fetchLogstashState(callCluster, clusterUuid, ephemeralIds, start, end, {} as any);
+    it('should set `size: 10` in the query', async () => {
+      await fetchLogstashState(callCluster, clusterUuid, ephemeralIds, start, end, {} as any, true);
       const { args } = searchMock.firstCall;
       const [{ body }] = args;
-      expect(body.from).toEqual(0);
-      expect(body.size).toEqual(10000);
+      expect(body.size).toEqual(ephemeralIds.length);
     });
   });
 
   describe('fetchLogstashStats', () => {
-    it('should set `from: 0, to: 10000` in the query', async () => {
-      await fetchLogstashStats(callCluster, clusterUuids, start, end, {} as any);
+    it('should create proper query for legacy monitoring', async () => {
+      const expectedQuery = {
+        bool: {
+          filter: [
+            {
+              range: {
+                timestamp: {
+                  format: 'epoch_millis',
+                  gte: 1646784000000,
+                  lte: 1646785200000,
+                },
+              },
+            },
+            {
+              term: {
+                cluster_uuid: clusterUuids[0], // cluster_uuid is an alias works for both mertricbeat and legacy structure
+              },
+            },
+            {
+              bool: {
+                should: [
+                  { term: { type: 'logstash_stats' } },
+                  { term: { 'metricset.name': 'node_stats' } },
+                ],
+              },
+            },
+          ],
+        },
+      };
+
+      await fetchLogstashStats(callCluster, clusterUuids[0], start, end, {} as any, true);
       const { args } = searchMock.firstCall;
       const [{ body }] = args;
 
       expect(body.from).toEqual(0);
       expect(body.size).toEqual(10000);
+      expect(body.query).toEqual(expectedQuery);
     });
   });
 
-  describe('processLogstashStatsResults', () => {
-    it('should summarize empty results', () => {
-      const resultsEmpty = undefined;
+  describe.each([
+    [true, 'processLogstashStatsResults with legacy monitoring'],
+    [false, 'processLogstashStatsResults with metricbeat monitoring'],
+  ])(
+    'processLogstashStatsResults with self monitoring: %s',
+    (isLogstashSelfMonitoring, conditionDescription) => {
+      it('should summarize empty results', () => {
+        const resultsEmpty = undefined;
 
-      const options = getBaseOptions();
-      processStatsResults(resultsEmpty as any, options);
+        const options = getBaseOptions();
+        processStatsResults(resultsEmpty as any, options, isLogstashSelfMonitoring);
 
-      expect(options.clusters).toStrictEqual({});
-    });
+        expect(options.clusters).toStrictEqual({});
+      });
 
-    it('should summarize single result with some missing fields', () => {
-      const results = {
-        hits: {
-          hits: [
-            {
-              _source: {
-                type: 'logstash_stats',
-                cluster_uuid: 'FlV4ckTxQ0a78hmBkzzc9A',
-                logstash_stats: {
-                  logstash: {
-                    uuid: '61de393a-f2b6-4b6c-8cea-22661f9c4134',
+      it('should summarize single result with some missing fields', () => {
+        const source = isLogstashSelfMonitoring
+          ? {
+              type: 'logstash_stats',
+              cluster_uuid: 'FlV4ckTxQ0a78hmBkzzc9A',
+              logstash_stats: {
+                logstash: {
+                  uuid: '61de393a-f2b6-4b6c-8cea-22661f9c4134',
+                },
+                pipelines: [
+                  {
+                    id: 'main',
+                    ephemeral_id: 'cf37c6fa-2f1a-41e2-9a89-36b420a8b9a5',
+                    queue: {
+                      type: 'memory',
+                    },
                   },
-                  pipelines: [
-                    {
-                      id: 'main',
-                      ephemeral_id: 'cf37c6fa-2f1a-41e2-9a89-36b420a8b9a5',
-                      queue: {
-                        type: 'memory',
-                      },
+                ],
+              },
+            }
+          : {
+              metricset: {
+                period: 10000,
+                name: 'node_stats',
+              },
+              logstash: {
+                cluster: {
+                  id: 'FlV4ckTxQ0a78hmBkzzc9A',
+                },
+                elasticsearch: {
+                  cluster: {
+                    id: 'FlV4ckTxQ0a78hmBkzzc9A',
+                  },
+                },
+                node: {
+                  stats: {
+                    logstash: {
+                      uuid: '61de393a-f2b6-4b6c-8cea-22661f9c4134',
                     },
-                  ],
+                    pipelines: [
+                      {
+                        id: 'main',
+                        ephemeral_id: 'cf37c6fa-2f1a-41e2-9a89-36b420a8b9a5',
+                        queue: {
+                          type: 'memory',
+                        },
+                      },
+                    ],
+                  },
                 },
               },
-            },
-          ],
-        },
-      };
+            };
+        const results = {
+          hits: {
+            hits: [
+              {
+                _source: source,
+              },
+            ],
+          },
+        };
 
-      const options = getBaseOptions();
-      processStatsResults(results as any, options);
+        const options = getBaseOptions();
+        processStatsResults(results as any, options, isLogstashSelfMonitoring);
 
-      expect(options.clusters).toStrictEqual({
-        FlV4ckTxQ0a78hmBkzzc9A: {
-          count: 1,
-          cluster_stats: {
-            plugins: [],
-            collection_types: {
-              internal_collection: 1,
-            },
-            pipelines: {},
-            queues: {
-              memory: 1,
+        expect(options.clusters).toStrictEqual({
+          FlV4ckTxQ0a78hmBkzzc9A: {
+            count: 1,
+            cluster_stats: {
+              plugins: [],
+              collection_types: {
+                internal_collection: 1,
+              },
+              pipelines: {},
+              queues: {
+                memory: 1,
+              },
             },
+            versions: [],
           },
-          versions: [],
-        },
+        });
       });
-    });
 
-    it('should retrieve all ephemeral ids from all hits for the same cluster', () => {
-      const results = {
-        hits: {
-          hits: [
-            {
-              _source: {
-                type: 'logstash_stats',
-                cluster_uuid: 'FlV4ckTxQ0a78hmBkzzc9A',
-                logstash_stats: {
-                  logstash: {
-                    uuid: '0000000-0000-0000-0000-000000000000',
+      it('should retrieve all ephemeral ids from all hits for the same cluster', () => {
+        const source1 = isLogstashSelfMonitoring
+          ? {
+              type: 'logstash_stats',
+              cluster_uuid: 'FlV4ckTxQ0a78hmBkzzc9A',
+              logstash_stats: {
+                logstash: {
+                  uuid: '0000000-0000-0000-0000-000000000000',
+                },
+                pipelines: [
+                  {
+                    id: 'main',
+                    ephemeral_id: 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa',
+                    queue: {
+                      type: 'memory',
+                    },
                   },
-                  pipelines: [
-                    {
-                      id: 'main',
-                      ephemeral_id: 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa',
-                      queue: {
-                        type: 'memory',
-                      },
+                ],
+              },
+            }
+          : {
+              metricset: {
+                period: 10000,
+                name: 'node_stats',
+              },
+              logstash: {
+                cluster: {
+                  id: 'FlV4ckTxQ0a78hmBkzzc9A',
+                },
+                elasticsearch: {
+                  cluster: {
+                    id: 'FlV4ckTxQ0a78hmBkzzc9A',
+                  },
+                },
+                node: {
+                  stats: {
+                    logstash: {
+                      uuid: '0000000-0000-0000-0000-000000000000',
                     },
-                  ],
+                    pipelines: [
+                      {
+                        id: 'main',
+                        ephemeral_id: 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa',
+                        queue: {
+                          type: 'memory',
+                        },
+                      },
+                    ],
+                  },
                 },
               },
-            },
-            {
-              _source: {
-                type: 'logstash_stats',
-                cluster_uuid: 'FlV4ckTxQ0a78hmBkzzc9A',
-                logstash_stats: {
-                  logstash: {
-                    uuid: '11111111-1111-1111-1111-111111111111',
+            };
+
+        const source2 = isLogstashSelfMonitoring
+          ? {
+              type: 'logstash_stats',
+              cluster_uuid: 'FlV4ckTxQ0a78hmBkzzc9A',
+              logstash_stats: {
+                logstash: {
+                  uuid: '11111111-1111-1111-1111-111111111111',
+                },
+                pipelines: [
+                  {
+                    id: 'main',
+                    ephemeral_id: 'bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb',
+                    queue: {
+                      type: 'memory',
+                    },
                   },
-                  pipelines: [
-                    {
-                      id: 'main',
-                      ephemeral_id: 'bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb',
-                      queue: {
-                        type: 'memory',
-                      },
+                ],
+              },
+            }
+          : {
+              metricset: {
+                period: 10000,
+                name: 'node_stats',
+              },
+              logstash: {
+                cluster: {
+                  id: 'FlV4ckTxQ0a78hmBkzzc9A',
+                },
+                elasticsearch: {
+                  cluster: {
+                    id: 'FlV4ckTxQ0a78hmBkzzc9A',
+                  },
+                },
+                node: {
+                  stats: {
+                    logstash: {
+                      uuid: '11111111-1111-1111-1111-111111111111',
                     },
-                  ],
+                    pipelines: [
+                      {
+                        id: 'main',
+                        ephemeral_id: 'bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb',
+                        queue: {
+                          type: 'memory',
+                        },
+                      },
+                    ],
+                  },
                 },
               },
-            },
-            {
-              _source: {
-                type: 'logstash_stats',
-                cluster_uuid: '3',
-                logstash_stats: {
-                  logstash: {
-                    uuid: '22222222-2222-2222-2222-222222222222',
+            };
+
+        const source3 = isLogstashSelfMonitoring
+          ? {
+              type: 'logstash_stats',
+              cluster_uuid: '3',
+              logstash_stats: {
+                logstash: {
+                  uuid: '22222222-2222-2222-2222-222222222222',
+                },
+                pipelines: [
+                  {
+                    id: 'main',
+                    ephemeral_id: 'cccccccc-cccc-cccc-cccc-cccccccccccc',
+                    queue: {
+                      type: 'memory',
+                    },
                   },
-                  pipelines: [
-                    {
-                      id: 'main',
-                      ephemeral_id: 'cccccccc-cccc-cccc-cccc-cccccccccccc',
-                      queue: {
-                        type: 'memory',
-                      },
+                ],
+              },
+            }
+          : {
+              metricset: {
+                period: 10000,
+                name: 'node_stats',
+              },
+              logstash: {
+                cluster: {
+                  id: '3',
+                },
+                elasticsearch: {
+                  cluster: {
+                    id: '3',
+                  },
+                },
+                node: {
+                  stats: {
+                    logstash: {
+                      uuid: '22222222-2222-2222-2222-222222222222',
                     },
-                  ],
+                    pipelines: [
+                      {
+                        id: 'main',
+                        ephemeral_id: 'cccccccc-cccc-cccc-cccc-cccccccccccc',
+                        queue: {
+                          type: 'memory',
+                        },
+                      },
+                    ],
+                  },
                 },
               },
-            },
-          ],
-        },
-      };
+            };
 
-      const options = getBaseOptions();
-      processStatsResults(results as any, options);
+        const results = {
+          hits: {
+            hits: [
+              {
+                _source: source1,
+              },
+              {
+                _source: source2,
+              },
+              {
+                _source: source3,
+              },
+            ],
+          },
+        };
 
-      expect(options.allEphemeralIds).toStrictEqual({
-        FlV4ckTxQ0a78hmBkzzc9A: [
-          'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa',
-          'bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb',
-        ],
-        '3': ['cccccccc-cccc-cccc-cccc-cccccccccccc'],
-      });
+        const options = getBaseOptions();
+        processStatsResults(results as any, options, isLogstashSelfMonitoring);
 
-      expect(options.clusters).toStrictEqual({
-        FlV4ckTxQ0a78hmBkzzc9A: {
-          count: 2,
-          cluster_stats: {
-            plugins: [],
-            collection_types: {
-              internal_collection: 2,
-            },
-            pipelines: {},
-            queues: {
-              memory: 2,
+        expect(options.allEphemeralIds).toStrictEqual({
+          FlV4ckTxQ0a78hmBkzzc9A: [
+            'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa',
+            'bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb',
+          ],
+          '3': ['cccccccc-cccc-cccc-cccc-cccccccccccc'],
+        });
+
+        expect(options.clusters).toStrictEqual({
+          FlV4ckTxQ0a78hmBkzzc9A: {
+            count: 2,
+            cluster_stats: {
+              plugins: [],
+              collection_types: {
+                internal_collection: 2,
+              },
+              pipelines: {},
+              queues: {
+                memory: 2,
+              },
             },
+            versions: [],
           },
-          versions: [],
-        },
-        '3': {
-          count: 1,
-          cluster_stats: {
-            plugins: [],
-            collection_types: {
-              internal_collection: 1,
-            },
-            pipelines: {},
-            queues: {
-              memory: 1,
+          '3': {
+            count: 1,
+            cluster_stats: {
+              plugins: [],
+              collection_types: {
+                internal_collection: 1,
+              },
+              pipelines: {},
+              queues: {
+                memory: 1,
+              },
             },
+            versions: [],
           },
-          versions: [],
-        },
+        });
       });
-    });
 
-    it('should summarize stats from hits across multiple result objects', () => {
-      const options = getBaseOptions();
+      it('should summarize stats from hits across multiple result objects', () => {
+        const options = getBaseOptions();
 
-      // logstashStatsResultSet is an array of many small query results
-      logstashStatsResultSet.forEach((results: any) => {
-        processStatsResults(results, options);
-      });
+        const logstashStatsResultSet = isLogstashSelfMonitoring
+          ? logstashStatsResultSetOfSelfMonitoring
+          : logstashStatsResultSetOfMetricbeatMonitoring;
+
+        const logstashStateResultsMap = isLogstashSelfMonitoring
+          ? logstashStateResultsMapOfSelfMonitoring
+          : logstashStateResultsMapOfMetricbeatMonitoring;
 
-      resultsMap.forEach((value: string[], clusterUuid: string) => {
-        value.forEach((results: any) => {
-          processLogstashStateResults(results, clusterUuid, options);
+        // logstashStatsResultSet is an array of many small query results
+        logstashStatsResultSet.forEach((results: any) => {
+          processStatsResults(results, options, isLogstashSelfMonitoring);
         });
-      });
 
-      expect(options.allEphemeralIds).toStrictEqual({
-        '1n1p': ['cf37c6fa-2f1a-41e2-9a89-36b420a8b9a5'],
-        '1nmp': [
-          '47a70feb-3cb5-4618-8670-2c0bada61acd',
-          '5a65d966-0330-4bd7-82f2-ee81040c13cf',
-          '8d33fe25-a2c0-4c54-9ecf-d218cb8dbfe4',
-          'f4167a94-20a8-43e7-828e-4cf38d906187',
-        ],
-        mnmp: [
-          '2fcd4161-e08f-4eea-818b-703ea3ec6389',
-          'c6785d63-6e5f-42c2-839d-5edf139b7c19',
-          'bc6ef6f2-ecce-4328-96a2-002de41a144d',
-          '72058ad1-68a1-45f6-a8e8-10621ffc7288',
-          '18593052-c021-4158-860d-d8122981a0ac',
-          '4207025c-9b00-4bea-a36c-6fbf2d3c215e',
-          '0ec4702d-b5e5-4c60-91e9-6fa6a836f0d1',
-          '41258219-b129-4fad-a629-f244826281f8',
-          'e73bc63d-561a-4acd-a0c4-d5f70c4603df',
-          'ddf882b7-be26-4a93-8144-0aeb35122651',
-          '602936f5-98a3-4f8c-9471-cf389a519f4b',
-          '8b300988-62cc-4bc6-9ee0-9194f3f78e27',
-          '6ab60531-fb6f-478c-9063-82f2b0af2bed',
-          '802a5994-a03c-44b8-a650-47c0f71c2e48',
-          '6070b400-5c10-4c5e-b5c5-a5bd9be6d321',
-          '3193df5f-2a34-4fe3-816e-6b05999aa5ce',
-          '994e68cd-d607-40e6-a54c-02a51caa17e0',
-        ],
-      });
+        logstashStateResultsMap.forEach((value: string[], clusterUuid: string) => {
+          value.forEach((results: any) => {
+            processLogstashStateResults(results, clusterUuid, options, isLogstashSelfMonitoring);
+          });
+        });
 
-      expect(options.clusters).toStrictEqual({
-        '1n1p': {
-          count: 1,
-          versions: [
-            {
-              count: 1,
-              version: '7.10.0',
-            },
+        expect(options.allEphemeralIds).toStrictEqual({
+          '1n1p': ['cf37c6fa-2f1a-41e2-9a89-36b420a8b9a5'],
+          '1nmp': [
+            '47a70feb-3cb5-4618-8670-2c0bada61acd',
+            '5a65d966-0330-4bd7-82f2-ee81040c13cf',
+            '8d33fe25-a2c0-4c54-9ecf-d218cb8dbfe4',
+            'f4167a94-20a8-43e7-828e-4cf38d906187',
           ],
-          cluster_stats: {
-            collection_types: {
-              internal_collection: 1,
-            },
-            pipelines: {
-              batch_size_avg: 125,
-              batch_size_max: 125,
-              batch_size_min: 125,
-              batch_size_total: 125,
-              count: 1,
-              sources: {
-                file: true,
-              },
-              workers_avg: 1,
-              workers_max: 1,
-              workers_min: 1,
-              workers_total: 1,
-            },
-            plugins: [
-              {
-                count: 1,
-                name: 'logstash-input-stdin',
-              },
-              {
-                count: 1,
-                name: 'logstash-input-elasticsearch',
-              },
-              {
-                count: 3,
-                name: 'logstash-filter-mutate',
-              },
-              {
-                count: 3,
-                name: 'logstash-filter-ruby',
-              },
-              {
-                count: 1,
-                name: 'logstash-filter-split',
-              },
+          mnmp: [
+            '2fcd4161-e08f-4eea-818b-703ea3ec6389',
+            'c6785d63-6e5f-42c2-839d-5edf139b7c19',
+            'bc6ef6f2-ecce-4328-96a2-002de41a144d',
+            '72058ad1-68a1-45f6-a8e8-10621ffc7288',
+            '18593052-c021-4158-860d-d8122981a0ac',
+            '4207025c-9b00-4bea-a36c-6fbf2d3c215e',
+            '0ec4702d-b5e5-4c60-91e9-6fa6a836f0d1',
+            '41258219-b129-4fad-a629-f244826281f8',
+            'e73bc63d-561a-4acd-a0c4-d5f70c4603df',
+            'ddf882b7-be26-4a93-8144-0aeb35122651',
+            '602936f5-98a3-4f8c-9471-cf389a519f4b',
+            '8b300988-62cc-4bc6-9ee0-9194f3f78e27',
+            '6ab60531-fb6f-478c-9063-82f2b0af2bed',
+            '802a5994-a03c-44b8-a650-47c0f71c2e48',
+            '6070b400-5c10-4c5e-b5c5-a5bd9be6d321',
+            '3193df5f-2a34-4fe3-816e-6b05999aa5ce',
+            '994e68cd-d607-40e6-a54c-02a51caa17e0',
+          ],
+        });
+
+        expect(options.clusters).toStrictEqual({
+          '1n1p': {
+            count: 1,
+            versions: [
               {
                 count: 1,
-                name: 'logstash-filter-elasticsearch',
+                version: '7.10.0',
               },
-              {
-                count: 1,
-                name: 'logstash-filter-aggregate',
+            ],
+            cluster_stats: {
+              collection_types: {
+                ...(isLogstashSelfMonitoring ? { internal_collection: 1 } : { metricbeat: 1 }),
               },
-              {
+              pipelines: {
+                batch_size_avg: 125,
+                batch_size_max: 125,
+                batch_size_min: 125,
+                batch_size_total: 125,
                 count: 1,
-                name: 'logstash-filter-drop',
+                sources: {
+                  file: true,
+                },
+                workers_avg: 1,
+                workers_max: 1,
+                workers_min: 1,
+                workers_total: 1,
               },
-              {
-                count: 1,
-                name: 'logstash-output-elasticsearch',
+              plugins: [
+                {
+                  count: 1,
+                  name: 'logstash-input-stdin',
+                },
+                {
+                  count: 1,
+                  name: 'logstash-input-elasticsearch',
+                },
+                {
+                  count: 3,
+                  name: 'logstash-filter-mutate',
+                },
+                {
+                  count: 3,
+                  name: 'logstash-filter-ruby',
+                },
+                {
+                  count: 1,
+                  name: 'logstash-filter-split',
+                },
+                {
+                  count: 1,
+                  name: 'logstash-filter-elasticsearch',
+                },
+                {
+                  count: 1,
+                  name: 'logstash-filter-aggregate',
+                },
+                {
+                  count: 1,
+                  name: 'logstash-filter-drop',
+                },
+                {
+                  count: 1,
+                  name: 'logstash-output-elasticsearch',
+                },
+                {
+                  count: 1,
+                  name: 'logstash-output-stdout',
+                },
+              ],
+              queues: {
+                memory: 1,
               },
+            },
+          },
+          '1nmp': {
+            count: 1,
+            versions: [
               {
                 count: 1,
-                name: 'logstash-output-stdout',
+                version: '7.8.0',
               },
             ],
-            queues: {
-              memory: 1,
-            },
-          },
-        },
-        '1nmp': {
-          count: 1,
-          versions: [
-            {
-              count: 1,
-              version: '7.8.0',
-            },
-          ],
-          cluster_stats: {
-            collection_types: {
-              metricbeat: 1,
-            },
-            pipelines: {
-              batch_size_avg: 406.5,
-              batch_size_max: 1251,
-              batch_size_min: 125,
-              batch_size_total: 1626,
-              count: 4,
-              sources: {
-                xpack: true,
-              },
-              workers_avg: 17.25,
-              workers_max: 44,
-              workers_min: 1,
-              workers_total: 69,
-            },
-            plugins: [
-              {
-                count: 4,
-                name: 'logstash-input-stdin',
+            cluster_stats: {
+              collection_types: {
+                ...(isLogstashSelfMonitoring ? { internal_collection: 1 } : { metricbeat: 1 }),
               },
-              {
+              pipelines: {
+                batch_size_avg: 406.5,
+                batch_size_max: 1251,
+                batch_size_min: 125,
+                batch_size_total: 1626,
                 count: 4,
-                name: 'logstash-output-stdout',
+                sources: {
+                  xpack: true,
+                },
+                workers_avg: 17.25,
+                workers_max: 44,
+                workers_min: 1,
+                workers_total: 69,
+              },
+              plugins: [
+                {
+                  count: 4,
+                  name: 'logstash-input-stdin',
+                },
+                {
+                  count: 4,
+                  name: 'logstash-output-stdout',
+                },
+              ],
+              queues: {
+                memory: 3,
+                persisted: 1,
               },
-            ],
-            queues: {
-              memory: 3,
-              persisted: 1,
             },
           },
-        },
-        mnmp: {
-          count: 3,
-          versions: [
-            {
-              count: 1,
-              version: '7.9.2',
-            },
-            {
-              count: 1,
-              version: '7.9.1',
-            },
-            {
-              count: 1,
-              version: '7.10.0',
-            },
-          ],
-          cluster_stats: {
-            collection_types: {
-              internal_collection: 3,
-            },
-            pipelines: {
-              batch_size_avg: 33.294117647058826,
-              batch_size_max: 125,
-              batch_size_min: 1,
-              batch_size_total: 566,
-              count: 17,
-              sources: {
-                file: true,
-                string: true,
-              },
-              workers_avg: 7.411764705882353,
-              workers_max: 16,
-              workers_min: 1,
-              workers_total: 126,
-            },
-            plugins: [
+          mnmp: {
+            count: 3,
+            versions: [
               {
                 count: 1,
-                name: 'logstash-input-stdin',
+                version: '7.9.2',
               },
               {
                 count: 1,
-                name: 'logstash-filter-clone',
-              },
-              {
-                count: 3,
-                name: 'logstash-output-pipeline',
+                version: '7.9.1',
               },
               {
-                count: 2,
-                name: 'logstash-input-pipeline',
+                count: 1,
+                version: '7.10.0',
               },
-              {
-                count: 16,
-                name: 'logstash-filter-sleep',
+            ],
+            cluster_stats: {
+              collection_types: {
+                ...(isLogstashSelfMonitoring ? { internal_collection: 3 } : { metricbeat: 3 }),
               },
-              {
-                count: 14,
-                name: 'logstash-output-stdout',
+              pipelines: {
+                batch_size_avg: 33.294117647058826,
+                batch_size_max: 125,
+                batch_size_min: 1,
+                batch_size_total: 566,
+                count: 17,
+                sources: {
+                  file: true,
+                  string: true,
+                },
+                workers_avg: 7.411764705882353,
+                workers_max: 16,
+                workers_min: 1,
+                workers_total: 126,
               },
-              {
-                count: 14,
-                name: 'logstash-input-generator',
+              plugins: [
+                {
+                  count: 1,
+                  name: 'logstash-input-stdin',
+                },
+                {
+                  count: 1,
+                  name: 'logstash-filter-clone',
+                },
+                {
+                  count: 3,
+                  name: 'logstash-output-pipeline',
+                },
+                {
+                  count: 2,
+                  name: 'logstash-input-pipeline',
+                },
+                {
+                  count: 16,
+                  name: 'logstash-filter-sleep',
+                },
+                {
+                  count: 14,
+                  name: 'logstash-output-stdout',
+                },
+                {
+                  count: 14,
+                  name: 'logstash-input-generator',
+                },
+              ],
+              queues: {
+                memory: 3,
+                persisted: 14,
               },
-            ],
-            queues: {
-              memory: 3,
-              persisted: 14,
             },
           },
-        },
+        });
       });
-    });
-  });
+    }
+  );
 });
diff --git a/x-pack/plugins/monitoring/server/telemetry_collection/get_logstash_stats.ts b/x-pack/plugins/monitoring/server/telemetry_collection/get_logstash_stats.ts
index faaedbabfb20cc..c2a8904607e53d 100644
--- a/x-pack/plugins/monitoring/server/telemetry_collection/get_logstash_stats.ts
+++ b/x-pack/plugins/monitoring/server/telemetry_collection/get_logstash_stats.ts
@@ -57,6 +57,7 @@ export interface LogstashStats {
   agent?: {
     type: string;
   };
+  // legacy monitoring shape
   logstash_stats?: {
     pipelines?: [
       {
@@ -73,9 +74,36 @@ export interface LogstashStats {
       snapshot?: string;
     };
   };
+  // metricbeat monitoring shape
+  logstash?: {
+    node?: {
+      stats?: {
+        pipelines?: [
+          {
+            id?: string;
+            ephemeral_id: string;
+            queue?: {
+              type: string;
+            };
+          }
+        ];
+        logstash?: {
+          version?: string;
+          uuid?: string;
+          snapshot?: string;
+        };
+      };
+    };
+    elasticsearch?: {
+      cluster?: {
+        id?: string;
+      };
+    };
+  };
 }
 
 export interface LogstashState {
+  // legacy monitoring shape
   logstash_state?: {
     pipeline?: {
       batch_size?: number;
@@ -97,6 +125,32 @@ export interface LogstashState {
       };
     };
   };
+  // metricbeat monitoring shape
+  logstash?: {
+    node?: {
+      state?: {
+        pipeline?: {
+          batch_size?: number;
+          workers?: number;
+          representation?: {
+            graph?: {
+              vertices?: [
+                {
+                  config_name?: string;
+                  plugin_type?: string;
+                  meta?: {
+                    source?: {
+                      protocol?: string;
+                    };
+                  };
+                }
+              ];
+            };
+          };
+        };
+      };
+    };
+  };
 }
 
 export interface LogstashProcessOptions {
@@ -116,20 +170,26 @@ export interface LogstashProcessOptions {
  */
 export function processStatsResults(
   results: estypes.SearchResponse<LogstashStats>,
-  { clusters, allEphemeralIds, versions, plugins }: LogstashProcessOptions
+  { clusters, allEphemeralIds, versions, plugins }: LogstashProcessOptions,
+  isSelfMonitoring: boolean
 ) {
   const currHits = results?.hits?.hits || [];
   currHits.forEach((hit) => {
-    const clusterUuid = hit._source!.cluster_uuid;
-    if (clusters[clusterUuid] === undefined) {
+    const clusterUuid = isSelfMonitoring
+      ? hit._source!.cluster_uuid
+      : hit._source!.logstash?.elasticsearch?.cluster?.id;
+
+    if (clusterUuid !== undefined && clusters[clusterUuid] === undefined) {
       clusters[clusterUuid] = getLogstashBaseStats();
       versions[clusterUuid] = new Map();
       plugins[clusterUuid] = new Map();
     }
-    const logstashStats = hit._source?.logstash_stats;
-    const clusterStats = clusters[clusterUuid].cluster_stats;
+    const logstashStats = isSelfMonitoring
+      ? hit._source?.logstash_stats
+      : hit._source?.logstash?.node?.stats;
 
-    if (clusterStats !== undefined && logstashStats !== undefined) {
+    if (clusterUuid !== undefined && logstashStats !== undefined) {
+      const clusterStats = clusters[clusterUuid].cluster_stats || {};
       clusters[clusterUuid].count = (clusters[clusterUuid].count || 0) + 1;
 
       const thisVersion = logstashStats.logstash?.version;
@@ -138,7 +198,7 @@ export function processStatsResults(
       clusters[clusterUuid].versions = mapToList(a, 'version');
 
       // Internal Collection has no agent field, so default to 'internal_collection'
-      let thisCollectionType = hit._source?.agent?.type;
+      let thisCollectionType = isSelfMonitoring ? 'internal_collection' : hit._source?.agent?.type;
       if (thisCollectionType === undefined) {
         thisCollectionType = 'internal_collection';
       }
@@ -177,14 +237,17 @@ export function processStatsResults(
 export function processLogstashStateResults(
   results: estypes.SearchResponse<LogstashState>,
   clusterUuid: string,
-  { clusters, plugins }: LogstashProcessOptions
+  { clusters, versions, plugins }: LogstashProcessOptions,
+  isSelfMonitoring: boolean
 ) {
   const currHits = results?.hits?.hits || [];
   const clusterStats = clusters[clusterUuid].cluster_stats;
   const pipelineStats = clusters[clusterUuid].cluster_stats?.pipelines;
 
   currHits.forEach((hit) => {
-    const thisLogstashStatePipeline = hit._source?.logstash_state?.pipeline;
+    const thisLogstashStatePipeline = isSelfMonitoring
+      ? hit._source?.logstash_state?.pipeline
+      : hit._source?.logstash?.node?.state?.pipeline;
 
     if (pipelineStats !== undefined && thisLogstashStatePipeline !== undefined) {
       pipelineStats.count = (pipelineStats.count || 0) + 1;
@@ -262,44 +325,51 @@ export function processLogstashStateResults(
 
 export async function fetchLogstashStats(
   callCluster: ElasticsearchClient,
-  clusterUuids: string[],
+  clusterUuid: string,
   start: string,
   end: string,
-  { page = 0, ...options }: { page?: number } & LogstashProcessOptions
+  { page = 0, ...options }: { page?: number } & LogstashProcessOptions,
+  isSelfMonitoring: boolean
 ): Promise<void> {
+  const statsField = isSelfMonitoring ? 'logstash_stats' : 'logstash.node.stats';
+  const filterPath: string[] = [
+    'hits.hits._source.cluster_uuid',
+    'hits.hits._source.type',
+    'hits.hits._source.source_node',
+    'hits.hits._source.agent.type',
+    'hits.hits._source.logstash.elasticsearch.cluster.id', // alias for cluster_uuid
+    `hits.hits._source.${statsField}.pipelines.id`,
+    `hits.hits._source.${statsField}.pipelines.ephemeral_id`,
+    `hits.hits._source.${statsField}.pipelines.queue.type`,
+    `hits.hits._source.${statsField}.logstash.version`,
+    `hits.hits._source.${statsField}.logstash.uuid`,
+  ];
+
   const params: estypes.SearchRequest = {
     index: INDEX_PATTERN_LOGSTASH,
     ignore_unavailable: true,
-    filter_path: [
-      'hits.hits._source.cluster_uuid',
-      'hits.hits._source.type',
-      'hits.hits._source.source_node',
-      'hits.hits._source.agent.type',
-      'hits.hits._source.logstash_stats.pipelines.id',
-      'hits.hits._source.logstash_stats.pipelines.ephemeral_id',
-      'hits.hits._source.logstash_stats.pipelines.queue.type',
-      'hits.hits._source.logstash_stats.logstash.version',
-      'hits.hits._source.logstash_stats.logstash.uuid',
-    ],
+    filter_path: filterPath,
     body: {
       query: createQuery({
         start,
         end,
         filters: [
-          { terms: { cluster_uuid: clusterUuids } },
+          { term: { cluster_uuid: clusterUuid } },
           {
             bool: {
               should: [
                 { term: { type: 'logstash_stats' } },
-                { term: { 'metricset.name': 'stats' } },
+                { term: { 'metricset.name': 'node_stats' } },
               ],
             },
           },
         ],
       }) as estypes.QueryDslQueryContainer,
       from: page * HITS_SIZE,
-      collapse: { field: 'logstash_stats.logstash.uuid' },
-      sort: [{ ['logstash_stats.timestamp']: { order: 'desc', unmapped_type: 'long' } }],
+      collapse: {
+        field: `${statsField}.logstash.uuid`,
+      },
+      sort: [{ ['timestamp']: { order: 'desc', unmapped_type: 'long' } }],
       size: HITS_SIZE,
     },
   };
@@ -313,7 +383,7 @@ export async function fetchLogstashStats(
 
   if (hitsLength > 0) {
     // further augment the clusters object with more stats
-    processStatsResults(results, options);
+    processStatsResults(results, options, isSelfMonitoring);
   }
   return Promise.resolve();
 }
@@ -324,37 +394,42 @@ export async function fetchLogstashState(
   ephemeralIds: string[],
   start: string,
   end: string,
-  { page = 0, ...options }: { page?: number } & LogstashProcessOptions
+  { page = 0, ...options }: { page?: number } & LogstashProcessOptions,
+  isSelfMonitoring: boolean
 ): Promise<void> {
+  const stateField = isSelfMonitoring ? 'logstash_state' : 'logstash.node.state';
+  const filterPath: string[] = [
+    `hits.hits._source.${stateField}.pipeline.batch_size`,
+    `hits.hits._source.${stateField}.pipeline.workers`,
+    `hits.hits._source.${stateField}.pipeline.representation.graph.vertices`,
+    `hits.hits._source.type`,
+  ];
+
   const params: estypes.SearchRequest = {
     index: INDEX_PATTERN_LOGSTASH,
     ignore_unavailable: true,
-    filter_path: [
-      'hits.hits._source.logstash_state.pipeline.batch_size',
-      'hits.hits._source.logstash_state.pipeline.workers',
-      'hits.hits._source.logstash_state.pipeline.representation.graph.vertices.config_name',
-      'hits.hits._source.logstash_state.pipeline.representation.graph.vertices.plugin_type',
-      'hits.hits._source.logstash_state.pipeline.representation.graph.vertices.meta.source.protocol',
-      'hits.hits._source.logstash_state.pipeline.representation.graph.vertices',
-      'hits.hits._source.type',
-    ],
+    filter_path: filterPath,
     body: {
       query: createQuery({
-        start,
-        end,
+        // intentionally not using start and end periods as we need node state info to fill plugin usages
+        // especially with metricbeat monitoring
         filters: [
-          { terms: { 'logstash_state.pipeline.ephemeral_id': ephemeralIds } },
+          { terms: { [`${stateField}.pipeline.ephemeral_id`]: ephemeralIds } },
           {
             bool: {
-              must: { term: { type: 'logstash_state' } },
+              should: [
+                { term: { type: 'logstash_state' } },
+                { term: { 'metricset.name': 'node' } },
+              ],
             },
           },
         ],
       }) as estypes.QueryDslQueryContainer,
-      from: page * HITS_SIZE,
-      collapse: { field: 'logstash_state.pipeline.ephemeral_id' },
+      collapse: {
+        field: `${stateField}.pipeline.ephemeral_id`,
+      },
       sort: [{ ['timestamp']: { order: 'desc', unmapped_type: 'long' } }],
-      size: HITS_SIZE,
+      size: ephemeralIds.length,
     },
   };
 
@@ -367,7 +442,7 @@ export async function fetchLogstashState(
   const hitsLength = results?.hits?.hits.length || 0;
   if (hitsLength > 0) {
     // further augment the clusters object with more stats
-    processLogstashStateResults(results, clusterUuid, options);
+    processLogstashStateResults(results, clusterUuid, options, isSelfMonitoring);
   }
   return Promise.resolve();
 }
@@ -393,9 +468,20 @@ export async function getLogstashStats(
     plugins: {},
   };
 
-  await fetchLogstashStats(callCluster, clusterUuids, start, end, options);
-  await Promise.all(
-    clusterUuids.map(async (clusterUuid) => {
+  // if index name contains '-mb', means metricbeat based monitoring
+  // filter_path and collapse fields in the queries differ on metricbeat vs. self-monitoring
+  // note: agent driven LS monitoring indices pattern differ ".ds-metrics-logstash*"
+  for (const clusterUuid of clusterUuids) {
+    const logstashMonitoringIndex: string = await getLogstashMonitoringIndex(
+      callCluster,
+      clusterUuid
+    );
+
+    // no need to proceed if we don't have monitoring metrics
+    if (logstashMonitoringIndex !== '') {
+      const isSelfMonitoring: boolean = logstashMonitoringIndex.indexOf('-mb') === -1;
+      await fetchLogstashStats(callCluster, clusterUuid, start, end, options, isSelfMonitoring);
+
       if (options.clusters[clusterUuid] !== undefined) {
         await fetchLogstashState(
           callCluster,
@@ -403,10 +489,40 @@ export async function getLogstashStats(
           options.allEphemeralIds[clusterUuid],
           start,
           end,
-          options
+          options,
+          isSelfMonitoring
         );
       }
-    })
-  );
+    }
+  }
   return options.clusters;
 }
+
+export async function getLogstashMonitoringIndex(
+  callCluster: ElasticsearchClient,
+  clusterUuid: string
+): Promise<string> {
+  const params: estypes.SearchRequest = {
+    index: INDEX_PATTERN_LOGSTASH,
+    ignore_unavailable: true,
+    body: {
+      query: createQuery({
+        clusterUuid,
+      }) as estypes.QueryDslQueryContainer,
+      sort: [{ ['timestamp']: { order: 'desc', unmapped_type: 'long' } }],
+      size: 1,
+    },
+  };
+
+  const results = await callCluster.search<LogstashStats>(params, {
+    headers: {
+      'X-QUERY-SOURCE': TELEMETRY_QUERY_SOURCE,
+    },
+  });
+  const hitsLength = results?.hits?.hits.length || 0;
+  if (hitsLength > 0) {
+    const [firstDocument] = results.hits.hits;
+    return Promise.resolve(firstDocument._index);
+  }
+  return Promise.resolve('');
+}
diff --git a/x-pack/plugins/observability_solution/apm/common/es_fields/assets.ts b/x-pack/plugins/observability_solution/apm/common/es_fields/assets.ts
new file mode 100644
index 00000000000000..ffe0c99286fc5f
--- /dev/null
+++ b/x-pack/plugins/observability_solution/apm/common/es_fields/assets.ts
@@ -0,0 +1,10 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export const ASSET_TYPE = 'asset.type';
+export const LAST_SEEN = 'asset.last_seen';
+export const FIRST_SEEN = 'asset.first_seen';
diff --git a/x-pack/plugins/observability_solution/apm/common/utils/get_bucket_size/calculate_auto.test.ts b/x-pack/plugins/observability_solution/apm/common/utils/get_bucket_size/calculate_auto.test.ts
new file mode 100644
index 00000000000000..34f920a2a68dce
--- /dev/null
+++ b/x-pack/plugins/observability_solution/apm/common/utils/get_bucket_size/calculate_auto.test.ts
@@ -0,0 +1,64 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import moment from 'moment';
+import { calculateAuto } from './calculate_auto';
+
+const numBuckets = 8;
+
+describe('calculateAuto', () => {
+  describe('when using near', () => {
+    const end = moment();
+    it('returns 30 day interval for a 4 year duration', () => {
+      const start = moment().subtract(4, 'years');
+      expect(
+        calculateAuto.near(numBuckets, moment.duration(end.diff(start)))?.asMilliseconds()
+      ).toEqual(2592000000);
+    });
+    it('returns 30 day interval for a 1 year duration', () => {
+      const start = moment().subtract(1, 'years');
+      expect(
+        calculateAuto.near(numBuckets, moment.duration(end.diff(start)))?.asMilliseconds()
+      ).toEqual(2592000000);
+    });
+    it('returns 7 day interval for a 5 month duration', () => {
+      const start = moment().subtract(5, 'months');
+      expect(
+        calculateAuto.near(numBuckets, moment.duration(end.diff(start)))?.asMilliseconds()
+      ).toEqual(604800000);
+    });
+    it('returns 7 day interval for a 3 month duration', () => {
+      const start = moment().subtract(3, 'months');
+      expect(
+        calculateAuto.near(numBuckets, moment.duration(end.diff(start)))?.asMilliseconds()
+      ).toEqual(604800000);
+    });
+    it('returns 7 day interval for a 2 month duration', () => {
+      const start = moment().subtract(2, 'months');
+      expect(
+        calculateAuto.near(numBuckets, moment.duration(end.diff(start)))?.asMilliseconds()
+      ).toEqual(604800000);
+    });
+    it('returns 5 minute interval for a 1 hour duration', () => {
+      const start = moment().subtract(1, 'hour');
+      expect(
+        calculateAuto.near(numBuckets, moment.duration(end.diff(start)))?.asMilliseconds()
+      ).toEqual(300000);
+    });
+    it('returns 1 minute interval for a 15 minute duration', () => {
+      const start = moment().subtract(15, 'minutes');
+      expect(
+        calculateAuto.near(numBuckets, moment.duration(end.diff(start)))?.asMilliseconds()
+      ).toEqual(60000);
+    });
+    it('returns 5 second interval for a 1 minute duration', () => {
+      const start = moment().subtract(1, 'minutes');
+      expect(
+        calculateAuto.near(numBuckets, moment.duration(end.diff(start)))?.asMilliseconds()
+      ).toEqual(5000);
+    });
+  });
+});
diff --git a/x-pack/plugins/observability_solution/apm/common/utils/get_bucket_size/get_bucket_size.test.ts b/x-pack/plugins/observability_solution/apm/common/utils/get_bucket_size/get_bucket_size.test.ts
new file mode 100644
index 00000000000000..6d3434b0cc9e24
--- /dev/null
+++ b/x-pack/plugins/observability_solution/apm/common/utils/get_bucket_size/get_bucket_size.test.ts
@@ -0,0 +1,48 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import moment from 'moment';
+import { getBucketSize } from '.';
+
+const numBuckets = 8;
+
+describe('getBucketSize', () => {
+  const end = moment();
+  it('returns 60 second interval for a 1 minute duration', () => {
+    const start = moment(end).subtract(15, 'milliseconds');
+    const minBucketSize = 60;
+    expect(
+      getBucketSize({
+        start: start.valueOf(),
+        end: end.valueOf(),
+        numBuckets,
+        minBucketSize,
+      }).bucketSize
+    ).toEqual(minBucketSize);
+  });
+  it('returns minBucketSize for a less than 1 second duration', () => {
+    const start = moment(end).subtract(500, 'milliseconds'); // 0.5 seconds as milliseconds
+    const minBucketSize = 60; // in seconds
+    expect(
+      getBucketSize({
+        start: start.valueOf(),
+        end: end.valueOf(),
+        numBuckets,
+        minBucketSize,
+      }).bucketSize
+    ).toEqual(minBucketSize);
+  });
+  it('returns 1 for a less than 1 second duration when minBucketSize is not provided', () => {
+    const start = moment(end).subtract(500, 'milliseconds'); // 0.5 seconds as milliseconds
+    expect(
+      getBucketSize({
+        start: start.valueOf(),
+        end: end.valueOf(),
+        numBuckets,
+      }).bucketSize
+    ).toEqual(1);
+  });
+});
diff --git a/x-pack/plugins/observability_solution/apm/dev_docs/apm_queries.md b/x-pack/plugins/observability_solution/apm/dev_docs/apm_queries.md
index 7b0fd244bfdd5f..8f7ee301e64675 100644
--- a/x-pack/plugins/observability_solution/apm/dev_docs/apm_queries.md
+++ b/x-pack/plugins/observability_solution/apm/dev_docs/apm_queries.md
@@ -226,7 +226,7 @@ GET apm-*-metric-*,metrics-apm*/_search?terminate_after=1000
 
 Service transaction metrics are aggregated metric documents that hold latency and throughput metrics pivoted by `service.name`, `service.environment` and `transaction.type`. Additionally, `agent.name` and `service.language.name` are included as metadata.
 
-We use the response from the `GET /internal/apm/time_range_metadata` endpoint to determine what data source is available. A data source is considered available if there is either data before the current time range, or, if there is no data at all before the current time range, if there is data within the current time range. This means that existing deployments will use transaction metrics right after upgrading (instead of using service transaction metrics and seeing a mostly blank screen), but also that new deployments immediately get the benefits of service transaction metrics, instead of falling all the way back to transaction events.
+We use the response from the `GET /internal/apm/time_range_metadata` endpoint to determine what data source is available. Service transaction metrics docs, introduced in APM >= 8.7, is considered available if there is data before *and* within the current time range. This ensure the UI won't miss information shipped by APM < 8.7. For < 8.7 documents, availability is determined by whether there is data before the current time range, or no data at all before the current time range, but there is data within the current time range. This means that existing deployments will use transaction metrics right after upgrading (instead of using service transaction metrics and seeing a mostly blank screen), but also that new deployments immediately get the benefits of service transaction metrics, instead of falling all the way back to transaction events.
 
 A pre-aggregated document where `_doc_count` is the number of transaction events
 
diff --git a/x-pack/plugins/observability_solution/apm/ftr_e2e/setup_cypress_node_events.ts b/x-pack/plugins/observability_solution/apm/ftr_e2e/setup_cypress_node_events.ts
index c8e6f473e2e3b8..3d322a169663c9 100644
--- a/x-pack/plugins/observability_solution/apm/ftr_e2e/setup_cypress_node_events.ts
+++ b/x-pack/plugins/observability_solution/apm/ftr_e2e/setup_cypress_node_events.ts
@@ -28,7 +28,9 @@ export function setupNodeEvents(on: Cypress.PluginEvents, config: Cypress.Plugin
     version: config.env.APM_PACKAGE_VERSION,
   });
 
-  synthtraceEsClient.pipeline(synthtraceEsClient.getDefaultPipeline(false));
+  synthtraceEsClient.pipeline(
+    synthtraceEsClient.getDefaultPipeline({ includeSerialization: false })
+  );
 
   initPlugin(on, config);
 
diff --git a/x-pack/plugins/observability_solution/apm/public/components/app/dependencies_inventory/dependencies_inventory_table/index.tsx b/x-pack/plugins/observability_solution/apm/public/components/app/dependencies_inventory/dependencies_inventory_table/index.tsx
index 7cf39b8bd10974..ee4cfc5d89fac7 100644
--- a/x-pack/plugins/observability_solution/apm/public/components/app/dependencies_inventory/dependencies_inventory_table/index.tsx
+++ b/x-pack/plugins/observability_solution/apm/public/components/app/dependencies_inventory/dependencies_inventory_table/index.tsx
@@ -38,7 +38,7 @@ export function DependenciesInventoryTable() {
             start,
             end,
             environment,
-            numBuckets: 20,
+            numBuckets: 8,
             offset: comparisonEnabled && isTimeComparison(offset) ? offset : undefined,
             kuery,
           },
diff --git a/x-pack/plugins/observability_solution/apm/public/components/app/mobile/service_overview/geo_map/embedded_map.test.tsx b/x-pack/plugins/observability_solution/apm/public/components/app/mobile/service_overview/geo_map/embedded_map.test.tsx
index cb3facaed1a638..f877dd7217cb1c 100644
--- a/x-pack/plugins/observability_solution/apm/public/components/app/mobile/service_overview/geo_map/embedded_map.test.tsx
+++ b/x-pack/plugins/observability_solution/apm/public/components/app/mobile/service_overview/geo_map/embedded_map.test.tsx
@@ -10,27 +10,15 @@ import { DataView } from '@kbn/data-views-plugin/common';
 import React from 'react';
 import { EmbeddedMap } from './embedded_map';
 import { KibanaContextProvider } from '@kbn/kibana-react-plugin/public';
-import { embeddablePluginMock } from '@kbn/embeddable-plugin/public/mocks';
 import { MockApmPluginContextWrapper } from '../../../../../context/apm_plugin/mock_apm_plugin_context';
 import { MemoryRouter } from 'react-router-dom';
 import { MapTypes } from '../../../../../../common/mobile/constants';
 
 describe('Embedded Map', () => {
   it('it renders', async () => {
-    const mockSetLayerList = jest.fn();
-    const mockUpdateInput = jest.fn();
-    const mockRender = jest.fn();
-    const mockReload = jest.fn();
-
-    const mockEmbeddable = embeddablePluginMock.createStartContract();
-    mockEmbeddable.getEmbeddableFactory = jest.fn().mockImplementation(() => ({
-      create: () => ({
-        setLayerList: mockSetLayerList,
-        updateInput: mockUpdateInput,
-        render: mockRender,
-        reload: mockReload,
-      }),
-    }));
+    const mockMapsStartService = {
+      Map: jest.fn().mockImplementation(() => <div data-test-subj="mockMap" />),
+    };
 
     const mockSpaces = {
       getActiveSpace: jest.fn().mockImplementation(() => ({ id: 'mockSpaceId' })),
@@ -52,7 +40,7 @@ describe('Embedded Map', () => {
         initialEntries={['/mobile-services/{serviceName}/overview?rangeFrom=now-15m&rangeTo=now&']}
       >
         <MockApmPluginContextWrapper>
-          <KibanaContextProvider services={{ embeddable: mockEmbeddable, spaces: mockSpaces }}>
+          <KibanaContextProvider services={{ maps: mockMapsStartService, spaces: mockSpaces }}>
             <EmbeddedMap
               selectedMap={MapTypes.Http}
               filters={[]}
@@ -65,9 +53,6 @@ describe('Embedded Map', () => {
       </MemoryRouter>
     );
     expect(await findByTestId('serviceOverviewEmbeddedMap')).toBeInTheDocument();
-
-    expect(mockSetLayerList).toHaveBeenCalledTimes(1);
-    expect(mockUpdateInput).toHaveBeenCalledTimes(1);
-    expect(mockRender).toHaveBeenCalledTimes(1);
+    expect(await findByTestId('mockMap')).toBeInTheDocument();
   });
 });
diff --git a/x-pack/plugins/observability_solution/apm/public/components/app/mobile/service_overview/geo_map/embedded_map.tsx b/x-pack/plugins/observability_solution/apm/public/components/app/mobile/service_overview/geo_map/embedded_map.tsx
index 3471b82d0682a0..1d8c39b1aa98ef 100644
--- a/x-pack/plugins/observability_solution/apm/public/components/app/mobile/service_overview/geo_map/embedded_map.tsx
+++ b/x-pack/plugins/observability_solution/apm/public/components/app/mobile/service_overview/geo_map/embedded_map.tsx
@@ -5,20 +5,15 @@
  * 2.0.
  */
 
-import React, { useEffect, useState, useRef } from 'react';
+import React, { useMemo } from 'react';
 import { DataView } from '@kbn/data-views-plugin/common';
-import { v4 as uuidv4 } from 'uuid';
-import { MapEmbeddable, MapEmbeddableInput, MapEmbeddableOutput } from '@kbn/maps-plugin/public';
-import { MAP_SAVED_OBJECT_TYPE } from '@kbn/maps-plugin/common';
-import { ErrorEmbeddable, ViewMode, isErrorEmbeddable } from '@kbn/embeddable-plugin/public';
 import { useKibana } from '@kbn/kibana-react-plugin/public';
-import { css } from '@emotion/react';
 import { i18n } from '@kbn/i18n';
-import { EuiText } from '@elastic/eui';
 import type { Filter } from '@kbn/es-query';
 import { ApmPluginStartDeps } from '../../../../../plugin';
 import { getLayerList } from './map_layers/get_layer_list';
 import { MapTypes } from '../../../../../../common/mobile/constants';
+
 function EmbeddedMapComponent({
   selectedMap,
   start,
@@ -34,137 +29,43 @@ function EmbeddedMapComponent({
   filters: Filter[];
   dataView?: DataView;
 }) {
-  const [error, setError] = useState<boolean>();
-
-  const [embeddable, setEmbeddable] = useState<MapEmbeddable | ErrorEmbeddable | undefined>();
-
-  const embeddableRoot: React.RefObject<HTMLDivElement> = useRef<HTMLDivElement>(null);
-
-  const {
-    embeddable: embeddablePlugin,
-    maps,
-    notifications,
-  } = useKibana<ApmPluginStartDeps>().services;
-
-  useEffect(() => {
-    async function setupEmbeddable() {
-      const factory = embeddablePlugin?.getEmbeddableFactory<
-        MapEmbeddableInput,
-        MapEmbeddableOutput,
-        MapEmbeddable
-      >(MAP_SAVED_OBJECT_TYPE);
-
-      if (!factory) {
-        setError(true);
-        notifications?.toasts.addDanger({
-          title: i18n.translate('xpack.apm.serviceOverview.embeddedMap.error.toastTitle', {
-            defaultMessage: 'An error occurred when adding map embeddable',
-          }),
-          text: i18n.translate('xpack.apm.serviceOverview.embeddedMap.error.toastDescription', {
-            defaultMessage: `Embeddable factory with id "{embeddableFactoryId}" was not found.`,
-            values: {
-              embeddableFactoryId: MAP_SAVED_OBJECT_TYPE,
-            },
-          }),
-        });
-        return;
-      }
+  const { maps } = useKibana<ApmPluginStartDeps>().services;
 
-      const input: MapEmbeddableInput = {
-        attributes: { title: '' },
-        id: uuidv4(),
-        title: i18n.translate('xpack.apm.serviceOverview.embeddedMap.input.title', {
-          defaultMessage: 'Latency by country',
-        }),
-        filters,
-        viewMode: ViewMode.VIEW,
-        mapCenter: { lat: 20.43425, lon: 0, zoom: 1.25 },
-        isLayerTOCOpen: false,
-        query: {
-          query: kuery,
-          language: 'kuery',
-        },
-        timeRange: {
-          from: start,
-          to: end,
-        },
-        hideFilterActions: true,
-      };
-
-      const embeddableObject = await factory.create(input);
-
-      setEmbeddable(embeddableObject);
-    }
-
-    setupEmbeddable();
-    // Set up exactly once after the component mounts
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, []);
-
-  // We can only render after embeddable has already initialized
-  useEffect(() => {
-    if (embeddableRoot.current && embeddable) {
-      embeddable.render(embeddableRoot.current);
-    }
-  }, [embeddable, embeddableRoot]);
-
-  useEffect(() => {
-    const setLayerList = async () => {
-      if (embeddable && !isErrorEmbeddable(embeddable) && dataView?.id) {
-        const layerList = await getLayerList({
+  const layerList = useMemo(() => {
+    return dataView?.id
+      ? getLayerList({
           selectedMap,
           maps,
-          dataViewId: dataView.id,
-        });
-        await Promise.all([embeddable.setLayerList(layerList), embeddable.reload()]);
-      }
-    };
-
-    setLayerList();
-  }, [embeddable, selectedMap, maps, dataView]);
-
-  useEffect(() => {
-    if (embeddable) {
-      embeddable.updateInput({
-        filters,
-        query: {
-          query: kuery,
-          language: 'kuery',
-        },
-        timeRange: {
-          from: start,
-          to: end,
-        },
-      });
-    }
-  }, [start, end, kuery, filters, embeddable, selectedMap]);
+          dataViewId: dataView?.id,
+        })
+      : [];
+  }, [selectedMap, maps, dataView?.id]);
 
   return (
-    <>
-      {error && (
-        <EuiText size="s">
-          <p>
-            {i18n.translate('xpack.apm.serviceOverview.embeddedMap.error', {
-              defaultMessage: 'Could not load map',
-            })}
-          </p>
-        </EuiText>
-      )}
-      {!error && (
-        <div
-          data-test-subj="serviceOverviewEmbeddedMap"
-          css={css`
-            width: 100%;
-            height: 500px;
-            display: flex;
-            flex: 1 1 100%;
-            z-index: 1;
-            min-height: 0;
-          `}
-          ref={embeddableRoot}
-        />
-      )}
-    </>
+    <div
+      data-test-subj="serviceOverviewEmbeddedMap"
+      style={{ width: '100%', height: '500px', display: 'flex', flex: '1 1 100%', zIndex: 1 }}
+    >
+      {maps &&
+        maps.Map({
+          title: i18n.translate('xpack.apm.serviceOverview.embeddedMap.input.title', {
+            defaultMessage: 'Latency by country',
+          }),
+          filters,
+          query: {
+            query: kuery,
+            language: 'kuery',
+          },
+          timeRange: {
+            from: start,
+            to: end,
+          },
+          layerList,
+          hideFilterActions: true,
+          isLayerTOCOpen: false,
+          mapCenter: { lat: 20.43425, lon: 0, zoom: 1.25 },
+        })}
+    </div>
   );
 }
 
diff --git a/x-pack/plugins/observability_solution/apm/public/components/app/mobile/service_overview/geo_map/map_layers/get_http_requests_map_layer_list.ts b/x-pack/plugins/observability_solution/apm/public/components/app/mobile/service_overview/geo_map/map_layers/get_http_requests_map_layer_list.ts
index 1f0bb822a9612c..0aff60d6e155cb 100644
--- a/x-pack/plugins/observability_solution/apm/public/components/app/mobile/service_overview/geo_map/map_layers/get_http_requests_map_layer_list.ts
+++ b/x-pack/plugins/observability_solution/apm/public/components/app/mobile/service_overview/geo_map/map_layers/get_http_requests_map_layer_list.ts
@@ -41,14 +41,12 @@ const label = i18n.translate('xpack.apm.serviceOverview.embeddedMap.httpRequests
   defaultMessage: 'HTTP requests',
 });
 
-export async function getHttpRequestsLayerList(maps: MapsStartApi | undefined, dataViewId: string) {
+export function getHttpRequestsLayerList(maps: MapsStartApi | undefined, dataViewId: string) {
   const whereQuery = {
     language: 'kuery',
     query: `${PROCESSOR_EVENT}:${ProcessorEvent.span} and ${SPAN_SUBTYPE}:${MobileSpanSubtype.Http} and ${SPAN_TYPE}:${MobileSpanType.External}`,
   };
 
-  const basemapLayerDescriptor = await maps?.createLayerDescriptors?.createBasemapLayerDescriptor();
-
   const httpRequestsByCountryLayer: VectorLayerDescriptor = {
     joins: [
       {
@@ -127,9 +125,5 @@ export async function getHttpRequestsLayerList(maps: MapsStartApi | undefined, d
     type: LAYER_TYPE.GEOJSON_VECTOR,
   };
 
-  return [
-    ...(basemapLayerDescriptor ? [basemapLayerDescriptor] : []),
-    httpRequestsByRegionLayer,
-    httpRequestsByCountryLayer,
-  ] as BaseLayerDescriptor[];
+  return [httpRequestsByRegionLayer, httpRequestsByCountryLayer] as BaseLayerDescriptor[];
 }
diff --git a/x-pack/plugins/observability_solution/apm/public/components/app/mobile/service_overview/geo_map/map_layers/get_layer_list.ts b/x-pack/plugins/observability_solution/apm/public/components/app/mobile/service_overview/geo_map/map_layers/get_layer_list.ts
index d9f1d023fbf649..0b6d736ad2551d 100644
--- a/x-pack/plugins/observability_solution/apm/public/components/app/mobile/service_overview/geo_map/map_layers/get_layer_list.ts
+++ b/x-pack/plugins/observability_solution/apm/public/components/app/mobile/service_overview/geo_map/map_layers/get_layer_list.ts
@@ -18,7 +18,7 @@ export function getLayerList({
   selectedMap: MapTypes;
   maps: MapsStartApi | undefined;
   dataViewId: string;
-}): Promise<LayerDescriptor[]> {
+}): LayerDescriptor[] {
   switch (selectedMap) {
     case MapTypes.Http:
       return getHttpRequestsLayerList(maps, dataViewId);
diff --git a/x-pack/plugins/observability_solution/apm/public/components/app/mobile/service_overview/geo_map/map_layers/get_session_map_layer_list.ts b/x-pack/plugins/observability_solution/apm/public/components/app/mobile/service_overview/geo_map/map_layers/get_session_map_layer_list.ts
index 1ed92c17b42505..4a6e858085dac5 100644
--- a/x-pack/plugins/observability_solution/apm/public/components/app/mobile/service_overview/geo_map/map_layers/get_session_map_layer_list.ts
+++ b/x-pack/plugins/observability_solution/apm/public/components/app/mobile/service_overview/geo_map/map_layers/get_session_map_layer_list.ts
@@ -36,9 +36,7 @@ const SESSION_PER_REGION = `__kbnjoin__cardinality_of_session.id__${PER_REGION_L
 const label = i18n.translate('xpack.apm.serviceOverview.embeddedMap.session.metric.label', {
   defaultMessage: 'Sessions',
 });
-export async function getSessionMapLayerList(maps: MapsStartApi | undefined, dataViewId: string) {
-  const basemapLayerDescriptor = await maps?.createLayerDescriptors?.createBasemapLayerDescriptor();
-
+export function getSessionMapLayerList(maps: MapsStartApi | undefined, dataViewId: string) {
   const sessionsByCountryLayer: VectorLayerDescriptor = {
     joins: [
       {
@@ -117,9 +115,5 @@ export async function getSessionMapLayerList(maps: MapsStartApi | undefined, dat
     type: LAYER_TYPE.GEOJSON_VECTOR,
   };
 
-  return [
-    ...(basemapLayerDescriptor ? [basemapLayerDescriptor] : []),
-    sessionsByRegionLayer,
-    sessionsByCountryLayer,
-  ] as BaseLayerDescriptor[];
+  return [sessionsByRegionLayer, sessionsByCountryLayer] as BaseLayerDescriptor[];
 }
diff --git a/x-pack/plugins/observability_solution/apm/scripts/precommit.js b/x-pack/plugins/observability_solution/apm/scripts/precommit.js
index 79a05a8ec2304f..fcf6120fc36f45 100644
--- a/x-pack/plugins/observability_solution/apm/scripts/precommit.js
+++ b/x-pack/plugins/observability_solution/apm/scripts/precommit.js
@@ -9,7 +9,7 @@
 /* eslint-disable import/no-extraneous-dependencies*/
 
 const execa = require('execa');
-const Listr = require('listr');
+const { Listr } = require('listr2');
 const { resolve } = require('path');
 
 const root = resolve(__dirname, '../../../..');
diff --git a/x-pack/plugins/observability_solution/apm/server/lib/helpers/create_es_client/create_assets_es_client/create_assets_es_clients.ts b/x-pack/plugins/observability_solution/apm/server/lib/helpers/create_es_client/create_assets_es_client/create_assets_es_clients.ts
new file mode 100644
index 00000000000000..2b77f08f102699
--- /dev/null
+++ b/x-pack/plugins/observability_solution/apm/server/lib/helpers/create_es_client/create_assets_es_client/create_assets_es_clients.ts
@@ -0,0 +1,67 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { ESSearchRequest, InferSearchResponseOf } from '@kbn/es-types';
+import type { KibanaRequest } from '@kbn/core/server';
+import { ElasticsearchClient } from '@kbn/core/server';
+import { unwrapEsResponse } from '@kbn/observability-plugin/common/utils/unwrap_es_response';
+import { withApmSpan } from '../../../../utils/with_apm_span';
+
+const ASSETS_INDEX_NAME = 'assets';
+
+export function cancelEsRequestOnAbort<T extends Promise<any>>(
+  promise: T,
+  request: KibanaRequest,
+  controller: AbortController
+): T {
+  const subscription = request.events.aborted$.subscribe(() => {
+    controller.abort();
+  });
+
+  return promise.finally(() => subscription.unsubscribe()) as T;
+}
+
+export interface AssetsESClient {
+  search<TDocument = unknown, TSearchRequest extends ESSearchRequest = ESSearchRequest>(
+    operationName: string,
+    searchRequest: TSearchRequest
+  ): Promise<InferSearchResponseOf<TDocument, TSearchRequest>>;
+}
+
+export async function createAssetsESClient({
+  request,
+  esClient,
+}: {
+  request: KibanaRequest;
+  esClient: ElasticsearchClient;
+}) {
+  return {
+    search<TDocument = unknown, TSearchRequest extends ESSearchRequest = ESSearchRequest>(
+      operationName: string,
+      searchRequest: TSearchRequest
+    ): Promise<InferSearchResponseOf<TDocument, TSearchRequest>> {
+      const controller = new AbortController();
+
+      const promise = withApmSpan(operationName, () => {
+        return cancelEsRequestOnAbort(
+          esClient.search(
+            { ...searchRequest, index: [ASSETS_INDEX_NAME] },
+            {
+              signal: controller.signal,
+              meta: true,
+            }
+          ) as unknown as Promise<{
+            body: InferSearchResponseOf<TDocument, TSearchRequest>;
+          }>,
+          request,
+          controller
+        );
+      });
+
+      return unwrapEsResponse(promise);
+    },
+  };
+}
diff --git a/x-pack/plugins/observability_solution/apm/server/lib/helpers/get_document_sources.ts b/x-pack/plugins/observability_solution/apm/server/lib/helpers/get_document_sources.ts
index 9f959cb195cecd..ca049603b5c524 100644
--- a/x-pack/plugins/observability_solution/apm/server/lib/helpers/get_document_sources.ts
+++ b/x-pack/plugins/observability_solution/apm/server/lib/helpers/get_document_sources.ts
@@ -11,22 +11,13 @@ import { RollupInterval } from '../../../common/rollup';
 import { APMEventClient } from './create_es_client/create_apm_event_client';
 import { getConfigForDocumentType } from './create_es_client/document_type';
 import { TimeRangeMetadata } from '../../../common/time_range_metadata';
-import { getDurationLegacyFilter } from './transactions';
+import { isDurationSummaryNotSupportedFilter } from './transactions';
 
 const QUERY_INDEX = {
-  BEFORE: 0,
-  CURRENT: 1,
-  DURATION_SUMMARY: 2,
+  DOCUMENT_TYPE: 0,
+  DURATION_SUMMARY_NOT_SUPPORTED: 1,
 } as const;
 
-interface DocumentTypeData {
-  documentType: ApmDocumentType;
-  rollupInterval: RollupInterval;
-  hasDocBefore: boolean;
-  hasDocAfter: boolean;
-  allHaveDurationSummary: boolean;
-}
-
 const getRequest = ({
   documentType,
   rollupInterval,
@@ -93,10 +84,8 @@ export async function getDocumentSources({
     documentTypesToCheck,
   });
 
-  const hasAnySourceDocBefore = documentTypesInfo.some((source) => source.hasDocBefore);
-
   return [
-    ...mapToSources(documentTypesInfo, hasAnySourceDocBefore),
+    ...documentTypesInfo,
     {
       documentType: ApmDocumentType.TransactionEvent,
       rollupInterval: RollupInterval.None,
@@ -120,7 +109,7 @@ const getDocumentTypesInfo = async ({
   kuery: string;
   enableContinuousRollups: boolean;
   documentTypesToCheck: ApmDocumentType[];
-}) => {
+}): Promise<TimeRangeMetadata['sources']> => {
   const getRequests = getDocumentTypeRequestsFn({
     enableContinuousRollups,
     start,
@@ -131,25 +120,36 @@ const getDocumentTypesInfo = async ({
   const sourceRequests = documentTypesToCheck.flatMap(getRequests);
 
   const allSearches = sourceRequests
-    .flatMap(({ before, current, durationSummaryCheck }) => [before, current, durationSummaryCheck])
+    .flatMap(({ documentTypeQuery, durationSummaryNotSupportedQuery }) => [
+      documentTypeQuery,
+      durationSummaryNotSupportedQuery,
+    ])
     .filter((request): request is ReturnType<typeof getRequest> => request !== undefined);
 
   const allResponses = (await apmEventClient.msearch('get_document_availability', ...allSearches))
     .responses;
 
+  const hasAnyLegacyDocuments = sourceRequests.some(
+    ({ documentType, rollupInterval }, index) =>
+      isLegacyDocType(documentType, rollupInterval) &&
+      allResponses[index + QUERY_INDEX.DURATION_SUMMARY_NOT_SUPPORTED].hits.total.value > 0
+  );
+
   return sourceRequests.map(({ documentType, rollupInterval, ...queries }) => {
     const numberOfQueries = Object.values(queries).filter(Boolean).length;
     // allResponses is sorted by the order of the requests in sourceRequests
     const docTypeResponses = allResponses.splice(0, numberOfQueries);
+    const hasDocs = docTypeResponses[QUERY_INDEX.DOCUMENT_TYPE].hits.total.value > 0;
+    // can only use >=8.7 document types (ServiceTransactionMetrics or TransactionMetrics with 10m and 60m intervals)
+    // if there are no legacy documents
+    const canUseContinousRollupDocs = hasDocs && !hasAnyLegacyDocuments;
 
     return {
       documentType,
       rollupInterval,
-      hasDocBefore: docTypeResponses[QUERY_INDEX.BEFORE].hits.total.value > 0,
-      hasDocAfter: docTypeResponses[QUERY_INDEX.CURRENT].hits.total.value > 0,
-      allHaveDurationSummary: docTypeResponses[QUERY_INDEX.DURATION_SUMMARY]
-        ? docTypeResponses[QUERY_INDEX.DURATION_SUMMARY].hits.total.value === 0
-        : true,
+      hasDocs: isLegacyDocType(documentType, rollupInterval) ? hasDocs : canUseContinousRollupDocs,
+      // all >=8.7 document types with rollups support duration summary
+      hasDurationSummaryField: canUseContinousRollupDocs,
     };
   });
 };
@@ -168,9 +168,7 @@ const getDocumentTypeRequestsFn =
   }) =>
   (documentType: ApmDocumentType) => {
     const currentRange = rangeQuery(start, end);
-    const diff = end - start;
     const kql = kqlQuery(kuery);
-    const beforeRange = rangeQuery(start - diff, end - diff);
 
     const rollupIntervals = enableContinuousRollups
       ? getConfigForDocumentType(documentType).rollupIntervals
@@ -179,48 +177,26 @@ const getDocumentTypeRequestsFn =
     return rollupIntervals.map((rollupInterval) => ({
       documentType,
       rollupInterval,
-      before: getRequest({
-        documentType,
-        rollupInterval,
-        filters: [...kql, ...beforeRange],
-      }),
-      current: getRequest({
+      documentTypeQuery: getRequest({
         documentType,
         rollupInterval,
         filters: [...kql, ...currentRange],
       }),
-      ...(documentType !== ApmDocumentType.ServiceTransactionMetric
+      ...(isLegacyDocType(documentType, rollupInterval)
         ? {
-            durationSummaryCheck: getRequest({
+            durationSummaryNotSupportedQuery: getRequest({
               documentType,
               rollupInterval,
-              filters: [...kql, ...currentRange, getDurationLegacyFilter()],
+              filters: [...kql, ...currentRange, isDurationSummaryNotSupportedFilter()],
             }),
           }
-        : {}),
+        : undefined),
     }));
   };
 
-const mapToSources = (sources: DocumentTypeData[], hasAnySourceDocBefore: boolean) => {
-  return sources.map((source) => {
-    const { documentType, hasDocAfter, hasDocBefore, rollupInterval, allHaveDurationSummary } =
-      source;
-
-    const hasDocBeforeOrAfter = hasDocBefore || hasDocAfter;
-
-    // If there is any data before, we require that data is available before
-    // this time range to mark this source as available. If we don't do that,
-    // users that upgrade to a version that starts generating service tx metrics
-    // will see a mostly empty screen for a while after upgrading.
-    // If we only check before, users with a new deployment will use raw transaction
-    // events.
-    const hasDocs = hasAnySourceDocBefore ? hasDocBefore : hasDocBeforeOrAfter;
-
-    return {
-      documentType,
-      rollupInterval,
-      hasDocs,
-      hasDurationSummaryField: allHaveDurationSummary,
-    };
-  });
+const isLegacyDocType = (documentType: ApmDocumentType, rollupInterval: RollupInterval) => {
+  return (
+    documentType === ApmDocumentType.TransactionMetric &&
+    rollupInterval === RollupInterval.OneMinute
+  );
 };
diff --git a/x-pack/plugins/observability_solution/apm/server/lib/helpers/transactions/index.ts b/x-pack/plugins/observability_solution/apm/server/lib/helpers/transactions/index.ts
index 117c2c667b9c26..f1aa16f4e4f374 100644
--- a/x-pack/plugins/observability_solution/apm/server/lib/helpers/transactions/index.ts
+++ b/x-pack/plugins/observability_solution/apm/server/lib/helpers/transactions/index.ts
@@ -164,17 +164,10 @@ export function isRootTransaction(searchAggregatedTransactions: boolean) {
       };
 }
 
-export function getDurationLegacyFilter(): QueryDslQueryContainer {
+export function isDurationSummaryNotSupportedFilter(): QueryDslQueryContainer {
   return {
     bool: {
-      must: [
-        {
-          bool: {
-            filter: [{ exists: { field: TRANSACTION_DURATION_HISTOGRAM } }],
-            must_not: [{ exists: { field: TRANSACTION_DURATION_SUMMARY } }],
-          },
-        },
-      ],
+      must_not: [{ exists: { field: TRANSACTION_DURATION_SUMMARY } }],
     },
   };
 }
diff --git a/x-pack/plugins/observability_solution/apm/server/routes/apm_routes/get_global_apm_server_route_repository.ts b/x-pack/plugins/observability_solution/apm/server/routes/apm_routes/get_global_apm_server_route_repository.ts
index 6c7b6d07ad2f47..8fee2cba47dc69 100644
--- a/x-pack/plugins/observability_solution/apm/server/routes/apm_routes/get_global_apm_server_route_repository.ts
+++ b/x-pack/plugins/observability_solution/apm/server/routes/apm_routes/get_global_apm_server_route_repository.ts
@@ -44,6 +44,7 @@ import { suggestionsRouteRepository } from '../suggestions/route';
 import { timeRangeMetadataRoute } from '../time_range_metadata/route';
 import { traceRouteRepository } from '../traces/route';
 import { transactionRouteRepository } from '../transactions/route';
+import { servicesAssetsRoutesRepository } from '../assets/services/routes';
 
 function getTypedGlobalApmServerRouteRepository() {
   const repository = {
@@ -55,6 +56,7 @@ function getTypedGlobalApmServerRouteRepository() {
     ...observabilityOverviewRouteRepository,
     ...serviceMapRouteRepository,
     ...serviceRouteRepository,
+    ...servicesAssetsRoutesRepository,
     ...serviceGroupRouteRepository,
     ...suggestionsRouteRepository,
     ...traceRouteRepository,
diff --git a/x-pack/plugins/observability_solution/apm/server/routes/assets/get_assets.ts b/x-pack/plugins/observability_solution/apm/server/routes/assets/get_assets.ts
new file mode 100644
index 00000000000000..0848b014eee0c9
--- /dev/null
+++ b/x-pack/plugins/observability_solution/apm/server/routes/assets/get_assets.ts
@@ -0,0 +1,65 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { QueryDslQueryContainer } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
+import { termQuery, kqlQuery } from '@kbn/observability-plugin/server';
+import { ASSET_TYPE, FIRST_SEEN, LAST_SEEN } from '../../../common/es_fields/assets';
+import { AssetsESClient } from '../../lib/helpers/create_es_client/create_assets_es_client/create_assets_es_clients';
+
+type AssetType = 'service';
+
+export function assetsRangeQuery(start: number, end: number): QueryDslQueryContainer[] {
+  return [
+    {
+      range: {
+        [FIRST_SEEN]: {
+          gte: start,
+        },
+      },
+    },
+    {
+      range: {
+        [LAST_SEEN]: {
+          lte: end,
+        },
+      },
+    },
+  ];
+}
+
+export async function getAssets({
+  assetsESClient,
+  start,
+  end,
+  kuery,
+  assetType,
+  size,
+}: {
+  assetsESClient: AssetsESClient;
+  start: number;
+  end: number;
+  kuery: string;
+  assetType: AssetType;
+  size: number;
+}) {
+  const response = await assetsESClient.search(`get_${assetType}_from_assets`, {
+    body: {
+      size,
+      track_total_hits: false,
+      query: {
+        bool: {
+          filter: [
+            ...termQuery(ASSET_TYPE, assetType),
+            ...kqlQuery(kuery),
+            ...assetsRangeQuery(start, end),
+          ],
+        },
+      },
+    },
+  });
+
+  return response;
+}
diff --git a/x-pack/plugins/observability_solution/apm/server/routes/assets/services/get_service_assets.ts b/x-pack/plugins/observability_solution/apm/server/routes/assets/services/get_service_assets.ts
new file mode 100644
index 00000000000000..a467ffd3f71d4a
--- /dev/null
+++ b/x-pack/plugins/observability_solution/apm/server/routes/assets/services/get_service_assets.ts
@@ -0,0 +1,72 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { Logger } from '@kbn/core/server';
+import { errors } from '@elastic/elasticsearch';
+import { WrappedElasticsearchClientError } from '@kbn/observability-plugin/server';
+import { AssetsESClient } from '../../../lib/helpers/create_es_client/create_assets_es_client/create_assets_es_clients';
+import { withApmSpan } from '../../../utils/with_apm_span';
+import { ServiceAssetDocument } from './types';
+import { getAssets } from '../get_assets';
+
+export const MAX_NUMBER_OF_SERVICES = 1_000;
+
+export async function getServiceAssets({
+  assetsESClient,
+  start,
+  end,
+  kuery,
+  logger,
+}: {
+  assetsESClient: AssetsESClient;
+  start: number;
+  end: number;
+  kuery: string;
+  logger: Logger;
+}) {
+  return withApmSpan('get_service_assets', async () => {
+    try {
+      const response = await getAssets({
+        assetsESClient,
+        start,
+        end,
+        kuery,
+        size: MAX_NUMBER_OF_SERVICES,
+        assetType: 'service',
+      });
+
+      return response.hits.hits.map((hit) => {
+        const serviceAsset = hit._source as ServiceAssetDocument;
+
+        return {
+          asset: {
+            signalTypes: serviceAsset.asset.signalTypes,
+            identifyingMetadata: serviceAsset.asset.identifying_metadata,
+          },
+          service: {
+            name: serviceAsset.service.name,
+            environment: serviceAsset.service.environment,
+          },
+        };
+      });
+    } catch (error) {
+      // If the index does not exist, handle it gracefully
+      if (
+        error instanceof WrappedElasticsearchClientError &&
+        error.originalError instanceof errors.ResponseError
+      ) {
+        const type = error.originalError.body.error.type;
+
+        if (type === 'index_not_found_exception') {
+          logger.error(`Asset index does not exist. Unable to fetch services.`);
+          return [];
+        }
+      }
+
+      throw error;
+    }
+  });
+}
diff --git a/x-pack/plugins/observability_solution/apm/server/routes/assets/services/routes.ts b/x-pack/plugins/observability_solution/apm/server/routes/assets/services/routes.ts
new file mode 100644
index 00000000000000..876ff495eae17d
--- /dev/null
+++ b/x-pack/plugins/observability_solution/apm/server/routes/assets/services/routes.ts
@@ -0,0 +1,44 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import * as t from 'io-ts';
+import { createApmServerRoute } from '../../apm_routes/create_apm_server_route';
+import { createAssetsESClient } from '../../../lib/helpers/create_es_client/create_assets_es_client/create_assets_es_clients';
+import { getServiceAssets } from './get_service_assets';
+import { kueryRt, rangeRt } from '../../default_api_types';
+import { AssetServicesResponse } from './types';
+
+const servicesAssetsRoute = createApmServerRoute({
+  endpoint: 'GET /internal/apm/assets/services',
+  params: t.type({
+    query: t.intersection([kueryRt, rangeRt]),
+  }),
+  options: { tags: ['access:apm'] },
+  async handler(resources): Promise<AssetServicesResponse> {
+    const { context, params, request } = resources;
+    const coreContext = await context.core;
+
+    const assetsESClient = await createAssetsESClient({
+      request,
+      esClient: coreContext.elasticsearch.client.asCurrentUser,
+    });
+
+    const { start, end, kuery } = params.query;
+
+    const services = await getServiceAssets({
+      assetsESClient,
+      start,
+      end,
+      kuery,
+      logger: resources.logger,
+    });
+    return { services };
+  },
+});
+
+export const servicesAssetsRoutesRepository = {
+  ...servicesAssetsRoute,
+};
diff --git a/x-pack/plugins/observability_solution/apm/server/routes/assets/services/types.ts b/x-pack/plugins/observability_solution/apm/server/routes/assets/services/types.ts
new file mode 100644
index 00000000000000..14fb8a012239c1
--- /dev/null
+++ b/x-pack/plugins/observability_solution/apm/server/routes/assets/services/types.ts
@@ -0,0 +1,33 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export interface SignalTypes {
+  'asset.trace'?: boolean;
+  'asset.logs'?: boolean;
+}
+
+interface ServiceItem {
+  environment?: string;
+  name: string;
+}
+
+interface AssetItem {
+  signalTypes: SignalTypes;
+  identifyingMetadata: string[];
+}
+
+export interface ServiceAssetDocument {
+  asset: {
+    signalTypes: SignalTypes;
+    identifying_metadata: string[];
+  };
+  service: ServiceItem;
+}
+
+export interface AssetServicesResponse {
+  services: Array<{ asset: AssetItem; service: ServiceItem }>;
+}
diff --git a/x-pack/plugins/observability_solution/dataset_quality/common/api_types.ts b/x-pack/plugins/observability_solution/dataset_quality/common/api_types.ts
index 4dac346e2a26a8..c953d4589c614f 100644
--- a/x-pack/plugins/observability_solution/dataset_quality/common/api_types.ts
+++ b/x-pack/plugins/observability_solution/dataset_quality/common/api_types.ts
@@ -70,8 +70,9 @@ export const getIntegrationsResponseRt = rt.exact(
 
 export const degradedDocsRt = rt.type({
   dataset: rt.string,
-  percentage: rt.number,
   count: rt.number,
+  totalDocs: rt.number,
+  percentage: rt.number,
 });
 
 export type DegradedDocs = rt.TypeOf<typeof degradedDocsRt>;
diff --git a/x-pack/plugins/observability_solution/dataset_quality/common/translations.ts b/x-pack/plugins/observability_solution/dataset_quality/common/translations.ts
index d31f3d537eb221..1f3d1e3c8d4037 100644
--- a/x-pack/plugins/observability_solution/dataset_quality/common/translations.ts
+++ b/x-pack/plugins/observability_solution/dataset_quality/common/translations.ts
@@ -193,7 +193,7 @@ export const summaryPanelDatasetsActivityText = i18n.translate(
 export const summaryPanelDatasetsActivityTooltipText = i18n.translate(
   'xpack.datasetQuality.summaryPanelDatasetsActivityTooltipText',
   {
-    defaultMessage: 'The number of datasets with activity in the last 24 hours.',
+    defaultMessage: 'The number of datasets with activity in the selected time range.',
   }
 );
 
diff --git a/x-pack/plugins/observability_solution/dataset_quality/common/utils/dataset_name.test.ts b/x-pack/plugins/observability_solution/dataset_quality/common/utils/dataset_name.test.ts
index fe5b47dc66bb70..9244c9e65f13c7 100644
--- a/x-pack/plugins/observability_solution/dataset_quality/common/utils/dataset_name.test.ts
+++ b/x-pack/plugins/observability_solution/dataset_quality/common/utils/dataset_name.test.ts
@@ -9,6 +9,7 @@ import {
   dataStreamPartsToIndexName,
   streamPartsToIndexPattern,
   indexNameToDataStreamParts,
+  extractIndexNameFromBackingIndex,
 } from './dataset_name';
 
 describe('dataset_name', () => {
@@ -52,4 +53,30 @@ describe('dataset_name', () => {
       });
     });
   });
+
+  describe('extractIndexNameFromBackingIndex', () => {
+    it('returns the correct index name if backing index provieded', () => {
+      expect(
+        extractIndexNameFromBackingIndex(
+          '.ds-logs-apm.app.adservice-default-2024.04.29-000001',
+          'logs'
+        )
+      ).toEqual('logs-apm.app.adservice-default');
+    });
+
+    it('returns the correct index name if index name is passed', () => {
+      expect(extractIndexNameFromBackingIndex('logs-nginx.access-default', 'logs')).toEqual(
+        'logs-nginx.access-default'
+      );
+    });
+
+    it('handles different types', () => {
+      expect(
+        extractIndexNameFromBackingIndex(
+          '.ds-metrics-apm.app.adservice-default-2024.04.29-000001',
+          'metrics'
+        )
+      ).toEqual('metrics-apm.app.adservice-default');
+    });
+  });
 });
diff --git a/x-pack/plugins/observability_solution/dataset_quality/common/utils/dataset_name.ts b/x-pack/plugins/observability_solution/dataset_quality/common/utils/dataset_name.ts
index 4bb20e92657b7a..8914a4d893b6df 100644
--- a/x-pack/plugins/observability_solution/dataset_quality/common/utils/dataset_name.ts
+++ b/x-pack/plugins/observability_solution/dataset_quality/common/utils/dataset_name.ts
@@ -38,3 +38,16 @@ export const indexNameToDataStreamParts = (dataStreamName: string) => {
     namespace,
   };
 };
+
+export const extractIndexNameFromBackingIndex = (
+  indexString: string,
+  type: DataStreamType
+): string => {
+  const pattern: RegExp = new RegExp(
+    `(?:\\.ds-)?(${type}-(?:[^-.]+(?:\\.[^.]+)+)-[^-]+)-\\d{4}\\.\\d{2}\\.\\d{2}-\\d{6}`
+  );
+
+  const match = indexString.match(pattern);
+
+  return match ? match[1] : indexString;
+};
diff --git a/x-pack/plugins/observability_solution/dataset_quality/public/components/dataset_quality/dataset_quality.tsx b/x-pack/plugins/observability_solution/dataset_quality/public/components/dataset_quality/dataset_quality.tsx
index 6fcd7dc7324056..ad343f912e4ffb 100644
--- a/x-pack/plugins/observability_solution/dataset_quality/public/components/dataset_quality/dataset_quality.tsx
+++ b/x-pack/plugins/observability_solution/dataset_quality/public/components/dataset_quality/dataset_quality.tsx
@@ -41,16 +41,16 @@ export const createDatasetQuality = ({
     );
 
     return (
-      <SummaryPanelProvider
-        dataStreamStatsClient={dataStreamStatsClient}
-        toasts={core.notifications.toasts}
-      >
-        <DatasetQualityContext.Provider value={datasetQualityProviderValue}>
+      <DatasetQualityContext.Provider value={datasetQualityProviderValue}>
+        <SummaryPanelProvider
+          dataStreamStatsClient={dataStreamStatsClient}
+          toasts={core.notifications.toasts}
+        >
           <KibanaContextProviderForPlugin>
             <DatasetQuality />
           </KibanaContextProviderForPlugin>
-        </DatasetQualityContext.Provider>
-      </SummaryPanelProvider>
+        </SummaryPanelProvider>
+      </DatasetQualityContext.Provider>
     );
   };
 };
@@ -67,10 +67,10 @@ function DatasetQuality() {
         <Header />
       </EuiFlexItem>
       <EuiFlexItem grow={false}>
-        <SummaryPanel />
+        <Filters />
       </EuiFlexItem>
       <EuiFlexItem grow={false}>
-        <Filters />
+        <SummaryPanel />
       </EuiFlexItem>
       <EuiFlexItem grow={false}>
         <Table />
diff --git a/x-pack/plugins/observability_solution/dataset_quality/public/components/dataset_quality/filters/filters.tsx b/x-pack/plugins/observability_solution/dataset_quality/public/components/dataset_quality/filters/filters.tsx
index 75c9f6e72b9e07..8c247104415cdf 100644
--- a/x-pack/plugins/observability_solution/dataset_quality/public/components/dataset_quality/filters/filters.tsx
+++ b/x-pack/plugins/observability_solution/dataset_quality/public/components/dataset_quality/filters/filters.tsx
@@ -55,7 +55,7 @@ export default function Filters() {
   );
 
   return (
-    <EuiFlexGroup data-test-subj="datasetQualityFiltersContainer" gutterSize="s">
+    <EuiFlexGroup data-test-subj="datasetQualityFiltersContainer" gutterSize="s" wrap>
       <EuiFlexItem>
         <FilterBar query={selectedQuery} onQueryChange={onQueryChange} />
       </EuiFlexItem>
diff --git a/x-pack/plugins/observability_solution/dataset_quality/public/components/dataset_quality/summary_panel/last_day_data_placeholder.tsx b/x-pack/plugins/observability_solution/dataset_quality/public/components/dataset_quality/summary_panel/last_day_data_placeholder.tsx
index fba5df2e9dbe20..2c5bbb35063cf8 100644
--- a/x-pack/plugins/observability_solution/dataset_quality/public/components/dataset_quality/summary_panel/last_day_data_placeholder.tsx
+++ b/x-pack/plugins/observability_solution/dataset_quality/public/components/dataset_quality/summary_panel/last_day_data_placeholder.tsx
@@ -16,8 +16,6 @@ import {
   EuiIconTip,
   EuiSkeletonTitle,
 } from '@elastic/eui';
-import { summaryPanelLast24hText } from '../../../../common/translations';
-
 interface LastDayDataPlaceholderParams {
   title: string;
   tooltip: string;
@@ -34,16 +32,11 @@ export function LastDayDataPlaceholder({
   return (
     <EuiPanel hasBorder>
       <EuiFlexGroup gutterSize="m" direction="column">
-        <EuiFlexGroup direction="column" gutterSize="xs">
-          <EuiFlexGroup alignItems="center" gutterSize="xs" responsive={false}>
-            <EuiText size="s">{title}</EuiText>
-            <EuiFlexItem grow={false}>
-              <EuiIconTip content={tooltip} />
-            </EuiFlexItem>
-          </EuiFlexGroup>
-          <EuiText color="subdued" size="xs">
-            {summaryPanelLast24hText}
-          </EuiText>
+        <EuiFlexGroup alignItems="center" gutterSize="xs" responsive={false}>
+          <EuiText size="s">{title}</EuiText>
+          <EuiFlexItem grow={false}>
+            <EuiIconTip content={tooltip} />
+          </EuiFlexItem>
         </EuiFlexGroup>
         {isLoading ? (
           <EuiSkeletonTitle size="m" data-test-subj={`datasetQuality-${title}-loading`} />
diff --git a/x-pack/plugins/observability_solution/dataset_quality/public/hooks/use_dataset_quality_table.tsx b/x-pack/plugins/observability_solution/dataset_quality/public/hooks/use_dataset_quality_table.tsx
index eaac36d016de6d..5ca7c6e281bdf6 100644
--- a/x-pack/plugins/observability_solution/dataset_quality/public/hooks/use_dataset_quality_table.tsx
+++ b/x-pack/plugins/observability_solution/dataset_quality/public/hooks/use_dataset_quality_table.tsx
@@ -205,6 +205,7 @@ export const useDatasetQualityTable = () => {
     sort: { sort },
     onTableChange,
     pagination,
+    filteredItems,
     renderedItems,
     columns,
     loading,
diff --git a/x-pack/plugins/observability_solution/dataset_quality/public/hooks/use_summary_panel.tsx b/x-pack/plugins/observability_solution/dataset_quality/public/hooks/use_summary_panel.tsx
index 9d4108ff7340c8..db83151a2e6e37 100644
--- a/x-pack/plugins/observability_solution/dataset_quality/public/hooks/use_summary_panel.tsx
+++ b/x-pack/plugins/observability_solution/dataset_quality/public/hooks/use_summary_panel.tsx
@@ -10,6 +10,9 @@ import { useInterpret, useSelector } from '@xstate/react';
 import { IToasts } from '@kbn/core-notifications-browser';
 import { IDataStreamsStatsClient } from '../services/data_streams_stats';
 import { createDatasetsSummaryPanelStateMachine } from '../state_machines/summary_panel';
+import { useDatasetQualityTable } from '.';
+import { useDatasetQualityContext } from '../components/dataset_quality/context';
+import { filterInactiveDatasets } from '../utils';
 
 interface SummaryPanelContextDeps {
   dataStreamStatsClient: IDataStreamsStatsClient;
@@ -17,6 +20,11 @@ interface SummaryPanelContextDeps {
 }
 
 const useSummaryPanel = ({ dataStreamStatsClient, toasts }: SummaryPanelContextDeps) => {
+  const { service } = useDatasetQualityContext();
+  const { filteredItems } = useDatasetQualityTable();
+
+  const { timeRange } = useSelector(service, (state) => state.context.filters);
+
   const summaryPanelStateService = useInterpret(() =>
     createDatasetsSummaryPanelStateMachine({
       dataStreamStatsClient,
@@ -27,29 +35,28 @@ const useSummaryPanel = ({ dataStreamStatsClient, toasts }: SummaryPanelContextD
   /*
     Datasets Quality
   */
-  const datasetsQuality = useSelector(
-    summaryPanelStateService,
-    (state) => state.context.datasetsQuality
-  );
-  const isDatasetsQualityLoading = useSelector(
-    summaryPanelStateService,
-    (state) =>
-      state.matches('datasetsQuality.fetching') ||
-      state.matches('datasetsQuality.retrying') ||
-      state.matches('datasetsActivity.fetching')
+
+  const datasetsQuality = {
+    percentages: filteredItems.map((item) => item.degradedDocs.percentage),
+  };
+
+  const isDatasetsQualityLoading = useSelector(service, (state) =>
+    state.matches('degradedDocs.fetching')
   );
 
   /*
     Datasets Activity
   */
-  const datasetsActivity = useSelector(
-    summaryPanelStateService,
-    (state) => state.context.datasetsActivity
-  );
-  const isDatasetsActivityLoading = useSelector(
-    summaryPanelStateService,
-    (state) =>
-      state.matches('datasetsActivity.fetching') || state.matches('datasetsActivity.retrying')
+  const datasetsActivity = {
+    total: filteredItems.length,
+    active: filterInactiveDatasets({
+      datasets: filteredItems,
+      timeRange,
+    }).length,
+  };
+
+  const isDatasetsActivityLoading = useSelector(service, (state) =>
+    state.matches('datasets.fetching')
   );
 
   /*
diff --git a/x-pack/plugins/observability_solution/dataset_quality/public/state_machines/summary_panel/src/defaults.ts b/x-pack/plugins/observability_solution/dataset_quality/public/state_machines/summary_panel/src/defaults.ts
index be7327c47a8cb7..be67409c3dab16 100644
--- a/x-pack/plugins/observability_solution/dataset_quality/public/state_machines/summary_panel/src/defaults.ts
+++ b/x-pack/plugins/observability_solution/dataset_quality/public/state_machines/summary_panel/src/defaults.ts
@@ -11,19 +11,10 @@ export const MAX_RETRIES = 1;
 export const RETRY_DELAY_IN_MS = 5000;
 
 export const defaultContext: DefaultDatasetsSummaryPanelContext = {
-  datasetsQuality: {
-    percentages: [],
-  },
-  datasetsActivity: {
-    total: 0,
-    active: 0,
-  },
   estimatedData: {
     estimatedDataInBytes: 0,
   },
   retries: {
-    datasetsQualityRetries: 0,
-    datasetsActivityRetries: 0,
     estimatedDataRetries: 0,
   },
 };
diff --git a/x-pack/plugins/observability_solution/dataset_quality/public/state_machines/summary_panel/src/notifications.ts b/x-pack/plugins/observability_solution/dataset_quality/public/state_machines/summary_panel/src/notifications.ts
index dabd30f02af61b..6b6e48ecdc785a 100644
--- a/x-pack/plugins/observability_solution/dataset_quality/public/state_machines/summary_panel/src/notifications.ts
+++ b/x-pack/plugins/observability_solution/dataset_quality/public/state_machines/summary_panel/src/notifications.ts
@@ -8,25 +8,6 @@
 import { IToasts } from '@kbn/core/public';
 import { i18n } from '@kbn/i18n';
 
-export const fetchDatasetsQualityFailedNotifier = (toasts: IToasts, error: Error) => {
-  toasts.addDanger({
-    title: i18n.translate('xpack.datasetQuality.fetchDatasetsQualityDetailsFailed', {
-      defaultMessage: "We couldn't get your datasets quality details. Default values are shown.",
-    }),
-    text: error.message,
-  });
-};
-
-export const fetchDatasetsActivityFailedNotifier = (toasts: IToasts, error: Error) => {
-  toasts.addDanger({
-    title: i18n.translate('xpack.datasetQuality.fetchDatasetsActivityFailed', {
-      defaultMessage:
-        "We couldn't get your active/inactive datasets details. Default values are shown.",
-    }),
-    text: error.message,
-  });
-};
-
 export const fetchDatasetsEstimatedDataFailedNotifier = (toasts: IToasts, error: Error) => {
   toasts.addDanger({
     title: i18n.translate('xpack.datasetQuality.fetchDatasetsEstimatedDataFailed', {
diff --git a/x-pack/plugins/observability_solution/dataset_quality/public/state_machines/summary_panel/src/state_machine.ts b/x-pack/plugins/observability_solution/dataset_quality/public/state_machines/summary_panel/src/state_machine.ts
index ae5e414c192fb2..60d038549a8e10 100644
--- a/x-pack/plugins/observability_solution/dataset_quality/public/state_machines/summary_panel/src/state_machine.ts
+++ b/x-pack/plugins/observability_solution/dataset_quality/public/state_machines/summary_panel/src/state_machine.ts
@@ -8,19 +8,11 @@
 import { IToasts } from '@kbn/core/public';
 import { getDateISORange } from '@kbn/timerange';
 import { assign, createMachine, DoneInvokeEvent, InterpreterFrom } from 'xstate';
-import { DataStreamStat } from '../../../../common/data_streams_stats/data_stream_stat';
 import { DEFAULT_TIME_RANGE } from '../../../../common/constants';
 import { IDataStreamsStatsClient } from '../../../services/data_streams_stats';
-import { filterInactiveDatasets } from '../../../utils/filter_inactive_datasets';
 import { defaultContext, MAX_RETRIES, RETRY_DELAY_IN_MS } from './defaults';
+import { fetchDatasetsEstimatedDataFailedNotifier } from './notifications';
 import {
-  fetchDatasetsActivityFailedNotifier,
-  fetchDatasetsEstimatedDataFailedNotifier,
-  fetchDatasetsQualityFailedNotifier,
-} from './notifications';
-import {
-  DatasetsActivityDetails,
-  DatasetsQuality,
   DatasetsSummaryPanelContext,
   DatasetsSummaryPanelState,
   DatasetSummaryPanelEvent,
@@ -40,78 +32,6 @@ export const createPureDatasetsSummaryPanelStateMachine = (
       id: 'DatasetsQualitySummaryPanel',
       type: 'parallel',
       states: {
-        datasetsQuality: {
-          initial: 'fetching',
-          states: {
-            fetching: {
-              invoke: {
-                src: 'loadDatasetsQuality',
-                onDone: {
-                  target: 'loaded',
-                  actions: ['storeDatasetsQuality'],
-                },
-                onError: [
-                  {
-                    target: 'retrying',
-                    cond: {
-                      type: 'canRetry',
-                      counter: 'datasetsQualityRetries',
-                    },
-                    actions: ['incrementDatasetsQualityRetries'],
-                  },
-                  {
-                    target: 'loaded',
-                    actions: ['notifyFetchDatasetsQualityFailed'],
-                  },
-                ],
-              },
-            },
-            retrying: {
-              after: {
-                [RETRY_DELAY_IN_MS]: 'fetching',
-              },
-            },
-            loaded: {
-              type: 'final',
-            },
-          },
-        },
-        datasetsActivity: {
-          initial: 'fetching',
-          states: {
-            fetching: {
-              invoke: {
-                src: 'loadDatasetsActivity',
-                onDone: {
-                  target: 'loaded',
-                  actions: ['storeDatasetsActivity'],
-                },
-                onError: [
-                  {
-                    target: 'retrying',
-                    cond: {
-                      type: 'canRetry',
-                      counter: 'datasetsActivityRetries',
-                    },
-                    actions: ['incrementDatasetsActivityRetries'],
-                  },
-                  {
-                    target: 'loaded',
-                    actions: ['notifyFetchDatasetsActivityFailed'],
-                  },
-                ],
-              },
-            },
-            retrying: {
-              after: {
-                [RETRY_DELAY_IN_MS]: 'fetching',
-              },
-            },
-            loaded: {
-              type: 'final',
-            },
-          },
-        },
         estimatedData: {
           initial: 'fetching',
           states: {
@@ -163,12 +83,6 @@ export const createPureDatasetsSummaryPanelStateMachine = (
     },
     {
       actions: {
-        storeDatasetsQuality: assign((_context, event) =>
-          'data' in event ? { datasetsQuality: event.data as DatasetsQuality } : {}
-        ),
-        storeDatasetsActivity: assign((_context, event) =>
-          'data' in event ? { datasetsActivity: event.data as DatasetsActivityDetails } : {}
-        ),
         storeEstimatedData: assign((_context, event) =>
           'data' in event
             ? {
@@ -176,12 +90,6 @@ export const createPureDatasetsSummaryPanelStateMachine = (
               }
             : {}
         ),
-        incrementDatasetsQualityRetries: assign(({ retries }, _event) => ({
-          retries: { ...retries, datasetsQualityRetries: retries.datasetsQualityRetries + 1 },
-        })),
-        incrementDatasetsActivityRetries: assign(({ retries }, _event) => ({
-          retries: { ...retries, datasetsActivityRetries: retries.datasetsActivityRetries + 1 },
-        })),
         incrementEstimatedDataRetries: assign(({ retries }, _event) => ({
           retries: { ...retries, estimatedDataRetries: retries.estimatedDataRetries + 1 },
         })),
@@ -214,29 +122,10 @@ export const createDatasetsSummaryPanelStateMachine = ({
 }: DatasetsSummaryPanelStateMachineDependencies) =>
   createPureDatasetsSummaryPanelStateMachine(initialContext).withConfig({
     actions: {
-      notifyFetchDatasetsQualityFailed: (_context, event: DoneInvokeEvent<Error>) =>
-        fetchDatasetsQualityFailedNotifier(toasts, event.data),
-      notifyFetchDatasetsActivityFailed: (_context, event: DoneInvokeEvent<Error>) =>
-        fetchDatasetsActivityFailedNotifier(toasts, event.data),
       notifyFetchEstimatedDataFailed: (_context, event: DoneInvokeEvent<Error>) =>
         fetchDatasetsEstimatedDataFailedNotifier(toasts, event.data),
     },
     services: {
-      loadDatasetsQuality: async (_context) => {
-        const dataStreamsStats = await dataStreamStatsClient.getDataStreamsDegradedStats();
-        const percentages = dataStreamsStats.map((stat) => stat.percentage);
-        return { percentages };
-      },
-      loadDatasetsActivity: async (_context) => {
-        const dataStreamStats = await dataStreamStatsClient.getDataStreamsStats();
-        const activeDataStreams = filterInactiveDatasets({
-          datasets: dataStreamStats.map(DataStreamStat.create),
-        });
-        return {
-          total: dataStreamStats.length,
-          active: activeDataStreams.length,
-        };
-      },
       loadEstimatedData: async (_context) => {
         const { startDate, endDate } = getDateISORange(DEFAULT_TIME_RANGE);
         return dataStreamStatsClient.getDataStreamsEstimatedDataInBytes({
diff --git a/x-pack/plugins/observability_solution/dataset_quality/public/state_machines/summary_panel/src/types.ts b/x-pack/plugins/observability_solution/dataset_quality/public/state_machines/summary_panel/src/types.ts
index f627d5f511110a..3e8b4c7ef99191 100644
--- a/x-pack/plugins/observability_solution/dataset_quality/public/state_machines/summary_panel/src/types.ts
+++ b/x-pack/plugins/observability_solution/dataset_quality/public/state_machines/summary_panel/src/types.ts
@@ -9,32 +9,13 @@ import { DoneInvokeEvent } from 'xstate';
 import { GetDataStreamsEstimatedDataInBytesResponse } from '../../../../common/data_streams_stats';
 
 export interface Retries {
-  datasetsQualityRetries: number;
-  datasetsActivityRetries: number;
   estimatedDataRetries: number;
 }
 
-export interface DatasetsQuality {
-  percentages: number[];
-}
-
-export interface DatasetsActivityDetails {
-  total: number;
-  active: number;
-}
-
 export interface EstimatedDataDetails {
   estimatedDataInBytes: number;
 }
 
-export interface WithDatasetsQuality {
-  datasetsQuality: DatasetsQuality;
-}
-
-export interface WithActiveDatasets {
-  datasetsActivity: DatasetsActivityDetails;
-}
-
 export interface WithEstimatedData {
   estimatedData: EstimatedDataDetails;
 }
@@ -43,36 +24,9 @@ export interface WithRetries {
   retries: Retries;
 }
 
-export type DefaultDatasetsSummaryPanelContext = WithDatasetsQuality &
-  WithActiveDatasets &
-  WithEstimatedData &
-  WithRetries;
+export type DefaultDatasetsSummaryPanelContext = WithEstimatedData & WithRetries;
 
 export type DatasetsSummaryPanelState =
-  | {
-      value: 'datasetsQuality.fetching';
-      context: DefaultDatasetsSummaryPanelContext;
-    }
-  | {
-      value: 'datasetsQuality.loaded';
-      context: DefaultDatasetsSummaryPanelContext;
-    }
-  | {
-      value: 'datasetsQuality.retrying';
-      context: DefaultDatasetsSummaryPanelContext;
-    }
-  | {
-      value: 'datasetsActivity.fetching';
-      context: DefaultDatasetsSummaryPanelContext;
-    }
-  | {
-      value: 'datasetsActivity.loaded';
-      context: DefaultDatasetsSummaryPanelContext;
-    }
-  | {
-      value: 'datasetsActivity.retrying';
-      context: DefaultDatasetsSummaryPanelContext;
-    }
   | {
       value: 'estimatedData.fetching';
       context: DefaultDatasetsSummaryPanelContext;
@@ -92,8 +46,6 @@ export type DatasetsSummaryPanelState =
 
 export type DatasetSummaryPanelEvent =
   | DoneInvokeEvent<Retries>
-  | DoneInvokeEvent<DatasetsQuality>
-  | DoneInvokeEvent<DatasetsActivityDetails>
   | DoneInvokeEvent<GetDataStreamsEstimatedDataInBytesResponse>
   | DoneInvokeEvent<Error>;
 
diff --git a/x-pack/plugins/observability_solution/dataset_quality/server/routes/data_streams/get_degraded_docs.ts b/x-pack/plugins/observability_solution/dataset_quality/server/routes/data_streams/get_degraded_docs.ts
index fbfb6791abf6c2..246d572ec8036c 100644
--- a/x-pack/plugins/observability_solution/dataset_quality/server/routes/data_streams/get_degraded_docs.ts
+++ b/x-pack/plugins/observability_solution/dataset_quality/server/routes/data_streams/get_degraded_docs.ts
@@ -18,17 +18,22 @@ import {
 } from '../../../common/es_fields';
 import { createDatasetQualityESClient, wildcardQuery } from '../../utils';
 
+interface ResultBucket {
+  dataset: string;
+  count: number;
+}
+
 export async function getDegradedDocsPaginated(options: {
   esClient: ElasticsearchClient;
   type?: DataStreamType;
-  start?: number;
-  end?: number;
+  start: number;
+  end: number;
   datasetQuery?: string;
   after?: {
-    dataset: string;
-    namespace: string;
+    degradedDocs?: { dataset: string; namespace: string };
+    totalDocs?: { dataset: string; namespace: string };
   };
-  prevResults?: DegradedDocs[];
+  prevResults?: { degradedDocs: ResultBucket[]; totalDocs: ResultBucket[] };
 }): Promise<DegradedDocs[]> {
   const {
     esClient,
@@ -37,61 +42,84 @@ export async function getDegradedDocsPaginated(options: {
     start,
     end,
     after,
-    prevResults = [],
+    prevResults = { degradedDocs: [], totalDocs: [] },
   } = options;
 
   const datasetQualityESClient = createDatasetQualityESClient(esClient);
 
-  const response = await datasetQualityESClient.search({
-    index: '*',
-    size: 0,
-    query: {
-      bool: {
-        ...(datasetQuery
-          ? {
-              should: [
-                ...wildcardQuery(DATA_STREAM_DATASET, datasetQuery),
-                ...wildcardQuery(DATA_STREAM_NAMESPACE, datasetQuery),
-              ],
-              minimum_should_match: 1,
-            }
-          : {}),
-        filter: [...rangeQuery(start, end), ...termQuery(DATA_STREAM_TYPE, type)],
+  const datasetFilter = {
+    ...(datasetQuery
+      ? {
+          should: [
+            ...wildcardQuery(DATA_STREAM_DATASET, datasetQuery),
+            ...wildcardQuery(DATA_STREAM_NAMESPACE, datasetQuery),
+          ],
+          minimum_should_match: 1,
+        }
+      : {}),
+  };
+
+  const otherFilters = [...rangeQuery(start, end), ...termQuery(DATA_STREAM_TYPE, type)];
+
+  const aggs = (afterKey?: { dataset: string; namespace: string }) => ({
+    datasets: {
+      composite: {
+        ...(afterKey ? { after: afterKey } : {}),
+        size: 10000,
+        sources: [
+          { dataset: { terms: { field: 'data_stream.dataset' } } },
+          { namespace: { terms: { field: 'data_stream.namespace' } } },
+        ],
       },
     },
-    aggs: {
-      datasets: {
-        composite: {
-          ...(after ? { after } : {}),
-          size: 10000,
-          sources: [
-            { dataset: { terms: { field: DATA_STREAM_DATASET } } },
-            { namespace: { terms: { field: DATA_STREAM_NAMESPACE } } },
-          ],
+  });
+
+  const response = await datasetQualityESClient.msearch({ index: `${type}-*` }, [
+    // degraded docs per dataset
+    {
+      size: 0,
+      query: {
+        bool: {
+          ...datasetFilter,
+          filter: otherFilters,
+          must: { exists: { field: _IGNORED } },
         },
-        aggs: {
-          degraded: {
-            filter: {
-              exists: {
-                field: _IGNORED,
-              },
-            },
-          },
+      },
+      aggs: aggs(after?.degradedDocs),
+    },
+    // total docs per dataset
+    {
+      size: 0,
+      query: {
+        bool: {
+          ...datasetFilter,
+          filter: otherFilters,
         },
       },
+      aggs: aggs(after?.totalDocs),
     },
-  });
+  ]);
 
   const currDegradedDocs =
-    response.aggregations?.datasets.buckets.map((bucket) => ({
+    response.responses[0].aggregations?.datasets.buckets.map((bucket) => ({
       dataset: `${type}-${bucket.key.dataset}-${bucket.key.namespace}`,
-      percentage: (bucket.degraded.doc_count * 100) / bucket.doc_count,
-      count: bucket.degraded.doc_count,
+      count: bucket.doc_count,
     })) ?? [];
 
-  const degradedDocs = [...prevResults, ...currDegradedDocs];
+  const degradedDocs = [...prevResults.degradedDocs, ...currDegradedDocs];
+
+  const currTotalDocs =
+    response.responses[1].aggregations?.datasets.buckets.map((bucket) => ({
+      dataset: `${type}-${bucket.key.dataset}-${bucket.key.namespace}`,
+      count: bucket.doc_count,
+    })) ?? [];
 
-  if (response.aggregations?.datasets.after_key) {
+  const totalDocs = [...prevResults.totalDocs, ...currTotalDocs];
+
+  if (
+    response.responses[0].aggregations?.datasets.after_key ||
+    response.responses[1].aggregations?.datasets.after_key
+  ) {
     return getDegradedDocsPaginated({
       esClient,
       type,
@@ -99,12 +127,37 @@ export async function getDegradedDocsPaginated(options: {
       end,
       datasetQuery,
       after: {
-        dataset: response.aggregations?.datasets.after_key.dataset as string,
-        namespace: response.aggregations?.datasets.after_key.namespace as string,
+        degradedDocs:
+          (response.responses[0].aggregations?.datasets.after_key as {
+            dataset: string;
+            namespace: string;
+          }) || after?.degradedDocs,
+        totalDocs:
+          (response.responses[1].aggregations?.datasets.after_key as {
+            dataset: string;
+            namespace: string;
+          }) || after?.totalDocs,
       },
-      prevResults: degradedDocs,
+      prevResults: { degradedDocs, totalDocs },
     });
   }
 
-  return degradedDocs;
+  const degradedDocsMap = degradedDocs.reduce(
+    (acc, curr) => ({
+      ...acc,
+      [curr.dataset]: curr.count,
+    }),
+    {}
+  );
+
+  return totalDocs.map((curr) => {
+    const degradedDocsCount = degradedDocsMap[curr.dataset as keyof typeof degradedDocsMap] || 0;
+
+    return {
+      ...curr,
+      totalDocs: curr.count,
+      count: degradedDocsCount,
+      percentage: (degradedDocsCount / curr.count) * 100,
+    };
+  });
 }
diff --git a/x-pack/plugins/observability_solution/dataset_quality/server/routes/data_streams/routes.ts b/x-pack/plugins/observability_solution/dataset_quality/server/routes/data_streams/routes.ts
index 6dd8590c91f0b9..3ad5a103f43138 100644
--- a/x-pack/plugins/observability_solution/dataset_quality/server/routes/data_streams/routes.ts
+++ b/x-pack/plugins/observability_solution/dataset_quality/server/routes/data_streams/routes.ts
@@ -66,7 +66,7 @@ const degradedDocsRoute = createDatasetQualityServerRoute({
   endpoint: 'GET /internal/dataset_quality/data_streams/degraded_docs',
   params: t.type({
     query: t.intersection([
-      t.partial(rangeRt.props),
+      rangeRt,
       typeRt,
       t.partial({
         datasetQuery: t.string,
diff --git a/x-pack/plugins/observability_solution/dataset_quality/server/utils/create_dataset_quality_es_client.ts b/x-pack/plugins/observability_solution/dataset_quality/server/utils/create_dataset_quality_es_client.ts
index 455308a7d91c32..d2c95ebbf0dbf3 100644
--- a/x-pack/plugins/observability_solution/dataset_quality/server/utils/create_dataset_quality_es_client.ts
+++ b/x-pack/plugins/observability_solution/dataset_quality/server/utils/create_dataset_quality_es_client.ts
@@ -7,6 +7,7 @@
 
 import { ESSearchRequest, InferSearchResponseOf } from '@kbn/es-types';
 import { ElasticsearchClient } from '@kbn/core/server';
+import { Indices } from '@elastic/elasticsearch/lib/api/types';
 
 type DatasetQualityESSearchParams = ESSearchRequest & {
   size: number;
@@ -21,5 +22,15 @@ export function createDatasetQualityESClient(esClient: ElasticsearchClient) {
     ): Promise<InferSearchResponseOf<TDocument, TParams>> {
       return esClient.search<TDocument>(searchParams) as Promise<any>;
     },
+    async msearch<TDocument, TParams extends DatasetQualityESSearchParams>(
+      index = {} as { index?: Indices },
+      searches: TParams[]
+    ): Promise<{
+      responses: Array<InferSearchResponseOf<TDocument, TParams>>;
+    }> {
+      return esClient.msearch({
+        searches: searches.map((search) => [index, search]).flat(),
+      }) as Promise<any>;
+    },
   };
 }
diff --git a/x-pack/plugins/observability_solution/infra/public/alerting/metric_threshold/components/expression_row.tsx b/x-pack/plugins/observability_solution/infra/public/alerting/metric_threshold/components/expression_row.tsx
index d9cd347896e68b..7804a9f15ab263 100644
--- a/x-pack/plugins/observability_solution/infra/public/alerting/metric_threshold/components/expression_row.tsx
+++ b/x-pack/plugins/observability_solution/infra/public/alerting/metric_threshold/components/expression_row.tsx
@@ -59,12 +59,7 @@ interface ExpressionRowProps {
   dataView: DataViewBase;
 }
 
-const StyledExpressionRow = euiStyled(EuiFlexGroup)`
-  display: flex;
-  flex-wrap: wrap;
-  align-items: center;
-  margin: 0 -4px;
-`;
+const NegativeHorizontalMarginDiv = euiStyled.div`margin: 0 -4px;`;
 
 const StyledExpression = euiStyled.div`
   padding: 0 4px;
@@ -233,7 +228,12 @@ export const ExpressionRow: FC<PropsWithChildren<ExpressionRowProps>> = (props)
           />
         </EuiFlexItem>
         <EuiFlexItem grow>
-          <StyledExpressionRow style={{ gap: aggType !== 'custom' ? 24 : 12 }}>
+          <EuiFlexGroup
+            component={NegativeHorizontalMarginDiv}
+            gutterSize={aggType !== 'custom' ? 'l' : 'm'}
+            alignItems="center"
+            wrap
+          >
             <StyledExpression>
               <WhenExpression
                 customAggTypesOptions={aggregationType}
@@ -278,7 +278,7 @@ export const ExpressionRow: FC<PropsWithChildren<ExpressionRowProps>> = (props)
             {!displayWarningThreshold && (
               <>
                 <EuiSpacer size={'xs'} />
-                <StyledExpressionRow>
+                <EuiFlexGroup component={NegativeHorizontalMarginDiv} alignItems="center">
                   <EuiButtonEmpty
                     data-test-subj="infraExpressionRowAddWarningThresholdButton"
                     color={'primary'}
@@ -292,13 +292,13 @@ export const ExpressionRow: FC<PropsWithChildren<ExpressionRowProps>> = (props)
                       defaultMessage="Add warning threshold"
                     />
                   </EuiButtonEmpty>
-                </StyledExpressionRow>
+                </EuiFlexGroup>
               </>
             )}
-          </StyledExpressionRow>
+          </EuiFlexGroup>
           {displayWarningThreshold && (
             <>
-              <StyledExpressionRow>
+              <EuiFlexGroup component={NegativeHorizontalMarginDiv} alignItems="center">
                 {criticalThresholdExpression}
                 <StyledHealth color="danger">
                   <FormattedMessage
@@ -306,8 +306,8 @@ export const ExpressionRow: FC<PropsWithChildren<ExpressionRowProps>> = (props)
                     defaultMessage="Alert"
                   />
                 </StyledHealth>
-              </StyledExpressionRow>
-              <StyledExpressionRow>
+              </EuiFlexGroup>
+              <EuiFlexGroup component={NegativeHorizontalMarginDiv} alignItems="center">
                 {warningThresholdExpression}
                 <StyledHealth color="warning">
                   <FormattedMessage
@@ -328,13 +328,13 @@ export const ExpressionRow: FC<PropsWithChildren<ExpressionRowProps>> = (props)
                   iconType={'minusInCircleFilled'}
                   onClick={toggleWarningThreshold}
                 />
-              </StyledExpressionRow>
+              </EuiFlexGroup>
             </>
           )}
           {aggType === Aggregators.CUSTOM && (
             <>
               <EuiSpacer size={'m'} />
-              <StyledExpressionRow>
+              <EuiFlexGroup component={NegativeHorizontalMarginDiv} alignItems="center">
                 <CustomEquationEditor
                   expression={expression}
                   fields={normalizedFields}
@@ -343,7 +343,7 @@ export const ExpressionRow: FC<PropsWithChildren<ExpressionRowProps>> = (props)
                   errors={errors}
                   dataView={dataView}
                 />
-              </StyledExpressionRow>
+              </EuiFlexGroup>
               <EuiSpacer size={'s'} />
             </>
           )}
diff --git a/x-pack/plugins/observability_solution/infra/public/common/asset_details_config/asset_details_tabs.tsx b/x-pack/plugins/observability_solution/infra/public/common/asset_details_config/asset_details_tabs.tsx
index bcc876295973fa..d43ab65832271a 100644
--- a/x-pack/plugins/observability_solution/infra/public/common/asset_details_config/asset_details_tabs.tsx
+++ b/x-pack/plugins/observability_solution/infra/public/common/asset_details_config/asset_details_tabs.tsx
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { EuiBadge } from '@elastic/eui';
+import { EuiBetaBadge } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import React from 'react';
 import { ContentTabIds, type Tab } from '../../components/asset_details/types';
@@ -65,11 +65,21 @@ export const commonFlyoutTabs: Tab[] = [
       defaultMessage: 'Dashboards',
     }),
     append: (
-      <EuiBadge color="accent">
-        {i18n.translate('xpack.infra.customDashboards.newLabel', {
-          defaultMessage: 'NEW',
+      <EuiBetaBadge
+        label={i18n.translate('xpack.infra.customDashboards.technicalPreviewBadgeLabel', {
+          defaultMessage: 'Technical preview',
         })}
-      </EuiBadge>
+        tooltipContent={i18n.translate(
+          'xpack.infra.customDashboards.technicalPreviewBadgeDescription',
+          {
+            defaultMessage:
+              'This functionality is in technical preview and may be changed or removed completely in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.',
+          }
+        )}
+        iconType="beaker"
+        size="s"
+        style={{ verticalAlign: 'middle' }}
+      />
     ),
   },
 ];
diff --git a/x-pack/plugins/observability_solution/logs_data_access/README.md b/x-pack/plugins/observability_solution/logs_data_access/README.md
new file mode 100644
index 00000000000000..a1b0505cb59349
--- /dev/null
+++ b/x-pack/plugins/observability_solution/logs_data_access/README.md
@@ -0,0 +1,5 @@
+# Logs data access
+
+Exposes services to access logs data.
+
+Services are registered during plugin [start](./server/plugin.ts) phase and defined in the [services](./server/services/) folder.
diff --git a/x-pack/plugins/observability_solution/logs_data_access/jest.config.js b/x-pack/plugins/observability_solution/logs_data_access/jest.config.js
new file mode 100644
index 00000000000000..08c16628e15ca4
--- /dev/null
+++ b/x-pack/plugins/observability_solution/logs_data_access/jest.config.js
@@ -0,0 +1,14 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+const path = require('path');
+
+module.exports = {
+  preset: '@kbn/test',
+  rootDir: path.resolve(__dirname, '../../../..'),
+  roots: ['<rootDir>/x-pack/plugins/observability_solution/logs_data_access'],
+};
diff --git a/x-pack/plugins/observability_solution/logs_data_access/kibana.jsonc b/x-pack/plugins/observability_solution/logs_data_access/kibana.jsonc
new file mode 100644
index 00000000000000..0636aac3e5c963
--- /dev/null
+++ b/x-pack/plugins/observability_solution/logs_data_access/kibana.jsonc
@@ -0,0 +1,16 @@
+{
+  "type": "plugin",
+  "id": "@kbn/logs-data-access-plugin",
+  "owner": "@elastic/obs-ux-logs-team",
+  "plugin": {
+    "id": "logsDataAccess",
+    "server": true,
+    "browser": false,
+    "requiredPlugins": [
+      "data", 
+      "dataViews"
+    ],
+    "optionalPlugins": [],
+    "requiredBundles": []
+  }
+}
diff --git a/x-pack/plugins/observability_solution/logs_data_access/server/index.ts b/x-pack/plugins/observability_solution/logs_data_access/server/index.ts
new file mode 100644
index 00000000000000..ee394c191c276f
--- /dev/null
+++ b/x-pack/plugins/observability_solution/logs_data_access/server/index.ts
@@ -0,0 +1,15 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import type { PluginInitializerContext } from '@kbn/core/server';
+import type { LogsDataAccessPluginSetup, LogsDataAccessPluginStart } from './plugin';
+
+export type { LogsDataAccessPluginSetup, LogsDataAccessPluginStart };
+
+export async function plugin(initializerContext: PluginInitializerContext) {
+  const { LogsDataAccessPlugin } = await import('./plugin');
+  return new LogsDataAccessPlugin(initializerContext);
+}
diff --git a/x-pack/plugins/observability_solution/logs_data_access/server/plugin.ts b/x-pack/plugins/observability_solution/logs_data_access/server/plugin.ts
new file mode 100644
index 00000000000000..13977e869b233c
--- /dev/null
+++ b/x-pack/plugins/observability_solution/logs_data_access/server/plugin.ts
@@ -0,0 +1,47 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type {
+  CoreSetup,
+  CoreStart,
+  Logger,
+  Plugin,
+  PluginInitializerContext,
+} from '@kbn/core/server';
+import { registerServices } from './services/register_services';
+import { LogsDataAccessPluginStartDeps, LogsDataAccessPluginSetupDeps } from './types';
+
+export type LogsDataAccessPluginSetup = ReturnType<LogsDataAccessPlugin['setup']>;
+export type LogsDataAccessPluginStart = ReturnType<LogsDataAccessPlugin['start']>;
+
+export class LogsDataAccessPlugin
+  implements
+    Plugin<
+      LogsDataAccessPluginSetup,
+      LogsDataAccessPluginStart,
+      LogsDataAccessPluginSetupDeps,
+      LogsDataAccessPluginStartDeps
+    >
+{
+  private readonly logger: Logger;
+
+  constructor(initializerContext: PluginInitializerContext) {
+    this.logger = initializerContext.logger.get();
+  }
+  public setup(core: CoreSetup, plugins: LogsDataAccessPluginSetupDeps) {}
+
+  public start(core: CoreStart, plugins: LogsDataAccessPluginStartDeps) {
+    const services = registerServices({
+      logger: this.logger,
+      deps: {},
+    });
+
+    return {
+      services,
+    };
+  }
+}
diff --git a/x-pack/plugins/observability_solution/logs_data_access/server/services/get_logs_rates_service/index.ts b/x-pack/plugins/observability_solution/logs_data_access/server/services/get_logs_rates_service/index.ts
new file mode 100644
index 00000000000000..1634270309689a
--- /dev/null
+++ b/x-pack/plugins/observability_solution/logs_data_access/server/services/get_logs_rates_service/index.ts
@@ -0,0 +1,104 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ElasticsearchClient } from '@kbn/core/server';
+import { estypes } from '@elastic/elasticsearch';
+import { RegisterServicesParams } from '../register_services';
+import { getLogErrorRate, getLogRatePerMinute } from './utils';
+
+export interface LogsRatesServiceParams {
+  esClient: ElasticsearchClient;
+  serviceNames: string[];
+  identifyingMetadata: string;
+  timeFrom: number;
+  timeTo: number;
+}
+
+interface LogErrorsAggregation extends estypes.AggregationsStringRareTermsBucketKeys {
+  logErrors: estypes.AggregationsTermsAggregateBase<estypes.AggregationsStringRareTermsBucketKeys>;
+}
+
+interface LogRateQueryAggregation {
+  services: estypes.AggregationsTermsAggregateBase<LogErrorsAggregation>;
+}
+
+export interface LogsRatesServiceReturnType {
+  [serviceName: string]: {
+    logRatePerMinute: number;
+    logErrorRate: null | number;
+  };
+}
+
+export function createGetLogsRatesService(params: RegisterServicesParams) {
+  return async ({
+    esClient,
+    identifyingMetadata,
+    serviceNames,
+    timeFrom,
+    timeTo,
+  }: LogsRatesServiceParams): Promise<LogsRatesServiceReturnType> => {
+    const esResponse = await esClient.search({
+      index: 'logs-*-*',
+      size: 0,
+      query: {
+        bool: {
+          filter: [
+            {
+              terms: {
+                [identifyingMetadata]: serviceNames,
+              },
+            },
+            {
+              range: {
+                ['@timestamp']: {
+                  gte: timeFrom,
+                  lte: timeTo,
+                  format: 'epoch_millis',
+                },
+              },
+            },
+          ],
+        },
+      },
+      aggs: {
+        services: {
+          terms: {
+            field: identifyingMetadata,
+          },
+          aggs: {
+            logErrors: {
+              terms: {
+                field: 'log.level',
+                include: ['error', 'ERROR'],
+              },
+            },
+          },
+        },
+      },
+    });
+    const aggregations = esResponse.aggregations as LogRateQueryAggregation | undefined;
+    const buckets = aggregations?.services.buckets as LogErrorsAggregation[] | undefined;
+
+    return buckets
+      ? buckets.reduce<LogsRatesServiceReturnType>((acc, bucket) => {
+          const logCount = bucket.doc_count;
+          const logErrorBuckets = bucket.logErrors
+            .buckets as estypes.AggregationsStringRareTermsBucketKeys[];
+
+          const logErrorCount = logErrorBuckets[0]?.doc_count;
+
+          return {
+            ...acc,
+            [bucket.key]: {
+              logRatePerMinute: getLogRatePerMinute({ logCount, timeFrom, timeTo }),
+              logErrorRate: logErrorCount ? getLogErrorRate({ logCount, logErrorCount }) : null,
+            },
+          };
+        }, {})
+      : {};
+  };
+}
diff --git a/x-pack/plugins/observability_solution/logs_data_access/server/services/get_logs_rates_service/utils.test.ts b/x-pack/plugins/observability_solution/logs_data_access/server/services/get_logs_rates_service/utils.test.ts
new file mode 100644
index 00000000000000..e1fbd84e7177b8
--- /dev/null
+++ b/x-pack/plugins/observability_solution/logs_data_access/server/services/get_logs_rates_service/utils.test.ts
@@ -0,0 +1,39 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { getLogRatePerMinute, getLogErrorRate } from './utils';
+
+describe('getLogRatePerMinute', () => {
+  it('should log rate per minute for one minute period', () => {
+    expect(getLogRatePerMinute({ logCount: 60, timeFrom: 0, timeTo: 60000 })).toBe(60);
+  });
+
+  it('should log rate per minute for five minutes period', () => {
+    expect(getLogRatePerMinute({ logCount: 60, timeFrom: 0, timeTo: 300000 })).toBe(12);
+  });
+
+  it('should handle zero log count', () => {
+    expect(getLogRatePerMinute({ logCount: 0, timeFrom: 0, timeTo: 60000 })).toBe(0);
+  });
+});
+
+describe('getLogErrorRate', () => {
+  it('should return the correct log error rate', () => {
+    expect(getLogErrorRate({ logCount: 100, logErrorCount: 10 })).toBe(0.1);
+  });
+
+  it('should handle zero error count', () => {
+    expect(getLogErrorRate({ logCount: 100, logErrorCount: 0 })).toBe(0);
+  });
+
+  it('should handle no error count provided', () => {
+    expect(getLogErrorRate({ logCount: 100 })).toBe(0);
+  });
+
+  it('should handle error count exceeding log count', () => {
+    expect(getLogErrorRate({ logCount: 100, logErrorCount: 150 })).toBe(1.5);
+  });
+});
diff --git a/x-pack/plugins/observability_solution/logs_data_access/server/services/get_logs_rates_service/utils.ts b/x-pack/plugins/observability_solution/logs_data_access/server/services/get_logs_rates_service/utils.ts
new file mode 100644
index 00000000000000..c56f7114999adb
--- /dev/null
+++ b/x-pack/plugins/observability_solution/logs_data_access/server/services/get_logs_rates_service/utils.ts
@@ -0,0 +1,29 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export function getLogRatePerMinute({
+  logCount,
+  timeFrom,
+  timeTo,
+}: {
+  logCount: number;
+  timeFrom: number;
+  timeTo: number;
+}) {
+  const durationAsMinutes = (timeTo - timeFrom) / 1000 / 60;
+  return logCount / durationAsMinutes;
+}
+
+export function getLogErrorRate({
+  logCount,
+  logErrorCount = 0,
+}: {
+  logCount: number;
+  logErrorCount?: number;
+}) {
+  return logErrorCount / logCount;
+}
diff --git a/x-pack/plugins/observability_solution/logs_data_access/server/services/register_services.ts b/x-pack/plugins/observability_solution/logs_data_access/server/services/register_services.ts
new file mode 100644
index 00000000000000..c35b30783b5f40
--- /dev/null
+++ b/x-pack/plugins/observability_solution/logs_data_access/server/services/register_services.ts
@@ -0,0 +1,20 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { Logger } from '@kbn/logging';
+import { createGetLogsRatesService } from './get_logs_rates_service';
+
+export interface RegisterServicesParams {
+  logger: Logger;
+  deps: {};
+}
+
+export function registerServices(params: RegisterServicesParams) {
+  return {
+    getLogsRatesService: createGetLogsRatesService(params),
+  };
+}
diff --git a/x-pack/plugins/observability_solution/logs_data_access/server/types.ts b/x-pack/plugins/observability_solution/logs_data_access/server/types.ts
new file mode 100644
index 00000000000000..12346d6ab7f57b
--- /dev/null
+++ b/x-pack/plugins/observability_solution/logs_data_access/server/types.ts
@@ -0,0 +1,20 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import {
+  PluginSetup as DataPluginSetup,
+  PluginStart as DataPluginStart,
+} from '@kbn/data-plugin/server';
+import { PluginStart as DataViewsPluginStart } from '@kbn/data-views-plugin/server';
+
+export interface LogsDataAccessPluginSetupDeps {
+  data: DataPluginSetup;
+}
+
+export interface LogsDataAccessPluginStartDeps {
+  data: DataPluginStart;
+  dataViews: DataViewsPluginStart;
+}
diff --git a/x-pack/plugins/observability_solution/logs_data_access/tsconfig.json b/x-pack/plugins/observability_solution/logs_data_access/tsconfig.json
new file mode 100644
index 00000000000000..9bd4031c7a39e0
--- /dev/null
+++ b/x-pack/plugins/observability_solution/logs_data_access/tsconfig.json
@@ -0,0 +1,14 @@
+{
+  "extends": "../../../../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "target/types"
+  },
+  "include": ["common/**/*", "server/**/*", "jest.config.js"],
+  "exclude": ["target/**/*"],
+  "kbn_references": [
+    "@kbn/core",
+    "@kbn/logging",
+    "@kbn/data-plugin",
+    "@kbn/data-views-plugin",
+  ]
+}
diff --git a/x-pack/plugins/observability_solution/logs_explorer/public/components/data_source_selector/sub_components/selector_footer.tsx b/x-pack/plugins/observability_solution/logs_explorer/public/components/data_source_selector/sub_components/selector_footer.tsx
index 6fc52f737123b0..7c92fa8f28bb3c 100644
--- a/x-pack/plugins/observability_solution/logs_explorer/public/components/data_source_selector/sub_components/selector_footer.tsx
+++ b/x-pack/plugins/observability_solution/logs_explorer/public/components/data_source_selector/sub_components/selector_footer.tsx
@@ -11,22 +11,20 @@ import {
   EuiButtonEmpty,
   EuiFlexGroup,
   EuiFlexItem,
-  EuiListGroupProps,
   EuiPanel,
+  EuiFlexGroupProps,
 } from '@elastic/eui';
 import { getRouterLinkProps } from '@kbn/router-utils';
 import { DiscoverEsqlUrlProps } from '../../../hooks/use_esql';
 import { createAllLogsItem } from '../utils';
 import { showAllLogsLabel, tryEsql } from '../constants';
 
-type SelectorFooterProps = EuiListGroupProps;
-
 interface ShowAllLogsProps {
   isSelected: boolean;
   onClick(): void;
 }
 
-export const SelectorFooter = (props: SelectorFooterProps) => {
+export const SelectorFooter = (props: EuiFlexGroupProps) => {
   return (
     <EuiPanel paddingSize="s" hasShadow={false} data-test-subj="dataSourceSelectorSearchFooter">
       <EuiFlexGroup justifyContent="spaceBetween" alignItems="center" {...props} />
diff --git a/x-pack/plugins/observability_solution/observability/common/ui_settings_keys.ts b/x-pack/plugins/observability_solution/observability/common/ui_settings_keys.ts
index 87f60b977691c7..46bbfa2c087574 100644
--- a/x-pack/plugins/observability_solution/observability/common/ui_settings_keys.ts
+++ b/x-pack/plugins/observability_solution/observability/common/ui_settings_keys.ts
@@ -24,6 +24,7 @@ export const enableInfrastructureAssetCustomDashboards =
 export const enableAwsLambdaMetrics = 'observability:enableAwsLambdaMetrics';
 export const enableAgentExplorerView = 'observability:apmAgentExplorerView';
 export const apmEnableTableSearchBar = 'observability:apmEnableTableSearchBar';
+export const apmEnableMultiSignal = 'observability:apmEnableMultiSignal';
 export const apmEnableServiceInventoryTableSearchBar =
   'observability:apmEnableServiceInventoryTableSearchBar';
 export const apmAWSLambdaPriceFactor = 'observability:apmAWSLambdaPriceFactor';
diff --git a/x-pack/plugins/observability_solution/observability/public/components/custom_threshold/components/expression_row.tsx b/x-pack/plugins/observability_solution/observability/public/components/custom_threshold/components/expression_row.tsx
index dc51a9b206ee8a..ffff1212ce05b9 100644
--- a/x-pack/plugins/observability_solution/observability/public/components/custom_threshold/components/expression_row.tsx
+++ b/x-pack/plugins/observability_solution/observability/public/components/custom_threshold/components/expression_row.tsx
@@ -16,7 +16,6 @@ import {
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import React, { useCallback, useMemo, useState, ReactElement } from 'react';
-import { euiStyled } from '@kbn/kibana-react-plugin/common';
 import {
   AggregationType,
   builtInComparators,
@@ -62,13 +61,6 @@ interface ExpressionRowProps {
   children?: React.ReactNode;
 }
 
-const StyledExpressionRow = euiStyled(EuiFlexGroup)`
-  display: flex;
-  flex-wrap: wrap;
-  align-items: center;
-  margin: 0 -4px;
-`;
-
 // eslint-disable-next-line react/function-component-definition
 export const ExpressionRow: React.FC<ExpressionRowProps> = (props) => {
   const {
@@ -173,7 +165,6 @@ export const ExpressionRow: React.FC<ExpressionRowProps> = (props) => {
       </EuiFlexGroup>
       <EuiFlexGroup gutterSize="xs">
         <EuiFlexItem grow>
-          <StyledExpressionRow style={{ gap: 24 }} />
           <>
             <EuiSpacer size={'xs'} />
             <CustomEquationEditor
diff --git a/x-pack/plugins/observability_solution/observability/public/hooks/use_fetch_alert_detail.test.ts b/x-pack/plugins/observability_solution/observability/public/hooks/use_fetch_alert_detail.test.ts
index e8e25fc5cbc57e..a35299bfb10330 100644
--- a/x-pack/plugins/observability_solution/observability/public/hooks/use_fetch_alert_detail.test.ts
+++ b/x-pack/plugins/observability_solution/observability/public/hooks/use_fetch_alert_detail.test.ts
@@ -43,6 +43,7 @@ describe('useFetchAlertDetail', () => {
     'event.action': 'active',
     'kibana.version': '8.1.0',
     tags: [],
+    _index: 'alert-index',
   };
 
   const id = '123';
@@ -115,6 +116,7 @@ describe('useFetchAlertDetail', () => {
               "active": true,
               "fields": Object {
                 "@timestamp": "2022-01-31T18:20:57.204Z",
+                "_index": "alert-index",
                 "event.action": "active",
                 "event.kind": "signal",
                 "kibana.alert.duration.us": 13793555000,
@@ -146,6 +148,7 @@ describe('useFetchAlertDetail', () => {
             },
             "raw": Object {
               "@timestamp": "2022-01-31T18:20:57.204Z",
+              "_index": "alert-index",
               "event.action": "active",
               "event.kind": "signal",
               "kibana.alert.duration.us": 13793555000,
diff --git a/x-pack/plugins/observability_solution/observability/public/pages/alert_details/alert_details.tsx b/x-pack/plugins/observability_solution/observability/public/pages/alert_details/alert_details.tsx
index 6e003664804ff1..4dd23f30aefb46 100644
--- a/x-pack/plugins/observability_solution/observability/public/pages/alert_details/alert_details.tsx
+++ b/x-pack/plugins/observability_solution/observability/public/pages/alert_details/alert_details.tsx
@@ -240,6 +240,7 @@ export function AlertDetails() {
           >
             <HeaderActions
               alert={alertDetail?.formatted ?? null}
+              alertIndex={alertDetail?.raw._index}
               alertStatus={alertStatus}
               onUntrackAlert={onUntrackAlert}
             />
diff --git a/x-pack/plugins/observability_solution/observability/public/pages/alert_details/components/header_actions.test.tsx b/x-pack/plugins/observability_solution/observability/public/pages/alert_details/components/header_actions.test.tsx
index f719a37237240f..6c07c54f604543 100644
--- a/x-pack/plugins/observability_solution/observability/public/pages/alert_details/components/header_actions.test.tsx
+++ b/x-pack/plugins/observability_solution/observability/public/pages/alert_details/components/header_actions.test.tsx
@@ -110,6 +110,7 @@ describe('Header Actions', () => {
         const { getByTestId, findByTestId } = render(
           <HeaderActions
             alert={alertWithTags}
+            alertIndex={'alert-index'}
             alertStatus={alertWithTags.fields[ALERT_STATUS] as AlertStatus}
             onUntrackAlert={mockOnUntrackAlert}
           />
@@ -122,7 +123,7 @@ describe('Header Actions', () => {
         expect(attachments).toEqual([
           {
             alertId: mockAlertUuid,
-            index: '.internal.alerts-observability.metrics.alerts-*',
+            index: 'alert-index',
             rule: {
               id: mockRuleId,
               name: mockRuleName,
diff --git a/x-pack/plugins/observability_solution/observability/public/pages/alert_details/components/header_actions.tsx b/x-pack/plugins/observability_solution/observability/public/pages/alert_details/components/header_actions.tsx
index 88418530eb757f..3d47e340029458 100644
--- a/x-pack/plugins/observability_solution/observability/public/pages/alert_details/components/header_actions.tsx
+++ b/x-pack/plugins/observability_solution/observability/public/pages/alert_details/components/header_actions.tsx
@@ -35,11 +35,17 @@ import { useBulkUntrackAlerts } from '../hooks/use_bulk_untrack_alerts';
 
 export interface HeaderActionsProps {
   alert: TopAlert | null;
+  alertIndex?: string;
   alertStatus?: AlertStatus;
   onUntrackAlert: () => void;
 }
 
-export function HeaderActions({ alert, alertStatus, onUntrackAlert }: HeaderActionsProps) {
+export function HeaderActions({
+  alert,
+  alertIndex,
+  alertStatus,
+  onUntrackAlert,
+}: HeaderActionsProps) {
   const {
     cases: {
       hooks: { useCasesAddToExistingCaseModal },
@@ -78,7 +84,7 @@ export function HeaderActions({ alert, alertStatus, onUntrackAlert }: HeaderActi
       ? [
           {
             alertId: alert?.fields[ALERT_UUID] || '',
-            index: '.internal.alerts-observability.metrics.alerts-*',
+            index: alertIndex || '',
             rule: {
               id: rule.id,
               name: rule.name,
diff --git a/x-pack/plugins/observability_solution/observability/server/ui_settings.ts b/x-pack/plugins/observability_solution/observability/server/ui_settings.ts
index 2b5468e0715f84..6ce519dbbc496f 100644
--- a/x-pack/plugins/observability_solution/observability/server/ui_settings.ts
+++ b/x-pack/plugins/observability_solution/observability/server/ui_settings.ts
@@ -21,6 +21,7 @@ import {
   apmLabsButton,
   enableAgentExplorerView,
   apmEnableTableSearchBar,
+  apmEnableMultiSignal,
   enableAwsLambdaMetrics,
   apmAWSLambdaPriceFactor,
   apmAWSLambdaRequestCostPerMillion,
@@ -326,6 +327,23 @@ export const uiSettings: Record<string, UiSettings> = {
     requiresPageReload: true,
     type: 'boolean',
   },
+  [apmEnableMultiSignal]: {
+    category: [observabilityFeatureId],
+    name: i18n.translate('xpack.observability.apmEnableMultiSignal', {
+      defaultMessage: 'Multi signal APM',
+    }),
+    description: i18n.translate('xpack.observability.apmEnableMultiSignalDescription', {
+      defaultMessage:
+        '{technicalPreviewLabel} Enable the multi-signal feature in APM, which allows you to monitor services from logs and traces.',
+      values: {
+        technicalPreviewLabel: `<em>[${technicalPreviewLabel}]</em>`,
+      },
+    }),
+    schema: schema.boolean(),
+    value: false,
+    requiresPageReload: true,
+    type: 'boolean',
+  },
   [apmEnableServiceInventoryTableSearchBar]: {
     category: [observabilityFeatureId],
     name: i18n.translate('xpack.observability.apmEnableServiceInventoryTableSearchBar', {
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant/common/conversation_complete.ts b/x-pack/plugins/observability_solution/observability_ai_assistant/common/conversation_complete.ts
index cc0a487331e61e..c1bd72e285c72e 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant/common/conversation_complete.ts
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant/common/conversation_complete.ts
@@ -129,12 +129,18 @@ interface ErrorMetaAttributes {
     tokenLimit?: number;
     tokenCount?: number;
   };
-  [ChatCompletionErrorCode.FunctionNotFoundError]: {};
+  [ChatCompletionErrorCode.FunctionNotFoundError]: {
+    name: string;
+  };
   [ChatCompletionErrorCode.FunctionLimitExceededError]: {};
 }
 
 export class ChatCompletionError<T extends ChatCompletionErrorCode> extends Error {
-  constructor(public code: T, message: string, public meta?: ErrorMetaAttributes[T]) {
+  constructor(
+    public code: T,
+    message: string,
+    public meta: ErrorMetaAttributes[T] = {} as ErrorMetaAttributes[T]
+  ) {
     super(message);
   }
 }
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant/public/service/complete.ts b/x-pack/plugins/observability_solution/observability_ai_assistant/public/service/complete.ts
index 8a36561f971a8c..8d9efd033bad7b 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant/public/service/complete.ts
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant/public/service/complete.ts
@@ -29,11 +29,11 @@ import {
   type StreamingChatResponseEventWithoutError,
 } from '../../common';
 import { ObservabilityAIAssistantScreenContext } from '../../common/types';
-import { createFunctionResponseError } from '../../common/utils/create_function_response_error';
 import { createFunctionResponseMessage } from '../../common/utils/create_function_response_message';
 import { throwSerializedChatCompletionErrors } from '../../common/utils/throw_serialized_chat_completion_errors';
 import type { ObservabilityAIAssistantAPIClientRequestParamsOf } from '../api';
 import { ObservabilityAIAssistantChatService } from '../types';
+import { createPublicFunctionResponseError } from '../utils/create_function_response_error';
 
 export function complete(
   {
@@ -154,7 +154,7 @@ export function complete(
         }
 
         if (!requestedAction) {
-          const errorMessage = createFunctionResponseError({
+          const errorMessage = createPublicFunctionResponseError({
             name: functionCall.name,
             error: new Error(`Requested action ${functionCall.name} was not found`),
           });
@@ -211,7 +211,7 @@ export function complete(
             });
           })
           .catch((error) => {
-            return createFunctionResponseError({
+            return createPublicFunctionResponseError({
               name: functionCall.name,
               error,
             });
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant/common/utils/create_function_response_error.ts b/x-pack/plugins/observability_solution/observability_ai_assistant/public/utils/create_function_response_error.ts
similarity index 57%
rename from x-pack/plugins/observability_solution/observability_ai_assistant/common/utils/create_function_response_error.ts
rename to x-pack/plugins/observability_solution/observability_ai_assistant/public/utils/create_function_response_error.ts
index bfb4021894273d..de6aa8d3360633 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant/common/utils/create_function_response_error.ts
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant/public/utils/create_function_response_error.ts
@@ -4,10 +4,11 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
+import { createFunctionResponseMessage } from '../../common/utils/create_function_response_message';
 
-import { createFunctionResponseMessage } from './create_function_response_message';
-
-export function createFunctionResponseError({
+// this one does not check for ES errors, they don't get to the browser
+// and we prevent importing Node.js-only code
+export function createPublicFunctionResponseError({
   name,
   error,
   message,
@@ -16,11 +17,15 @@ export function createFunctionResponseError({
   error: Error;
   message?: string;
 }) {
+  const sanitizedError: Record<string, unknown> = JSON.parse(
+    'toJSON' in error && typeof error.toJSON === 'function' ? error.toJSON() : JSON.stringify(error)
+  );
+
   return createFunctionResponseMessage({
     name,
     content: {
       error: {
-        ...error,
+        ...sanitizedError,
         name: error.name,
         message: error.message,
         cause: error.cause,
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant/server/service/client/index.test.ts b/x-pack/plugins/observability_solution/observability_ai_assistant/server/service/client/index.test.ts
index 7bd31f0ef7689b..ed5f9a9ee044d2 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant/server/service/client/index.test.ts
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant/server/service/client/index.test.ts
@@ -688,6 +688,7 @@ describe('Observability AI Assistant client', () => {
           code: ChatCompletionErrorCode.InternalError,
           message: 'Connection unexpectedly closed',
           stack: expect.any(String),
+          meta: {},
         },
         type: StreamingChatResponseEventType.ChatCompletionError,
       });
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant/server/service/client/index.ts b/x-pack/plugins/observability_solution/observability_ai_assistant/server/service/client/index.ts
index 2bb71ba2ad5924..0dc38698faa895 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant/server/service/client/index.ts
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant/server/service/client/index.ts
@@ -284,6 +284,7 @@ export class ObservabilityAIAssistantClient {
             knowledgeBaseInstructions,
             requestInstructions,
             signal,
+            logger: this.dependencies.logger,
             disableFunctions,
           })
         );
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant/server/service/client/operators/catch_function_not_found_error.ts b/x-pack/plugins/observability_solution/observability_ai_assistant/server/service/client/operators/catch_function_not_found_error.ts
new file mode 100644
index 00000000000000..251bd3e67e20a8
--- /dev/null
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant/server/service/client/operators/catch_function_not_found_error.ts
@@ -0,0 +1,30 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { catchError, of, OperatorFunction, throwError } from 'rxjs';
+import {
+  createFunctionLimitExceededError,
+  isFunctionNotFoundError,
+  MessageAddEvent,
+} from '../../../../common/conversation_complete';
+import { createServerSideFunctionResponseError } from '../../util/create_server_side_function_response_error';
+
+export function catchFunctionNotFoundError<T>(): OperatorFunction<T, T | MessageAddEvent> {
+  return catchError((error) => {
+    if (isFunctionNotFoundError(error)) {
+      const functionLimitExceededError = createFunctionLimitExceededError();
+      return of(
+        createServerSideFunctionResponseError({
+          name: error.meta.name,
+          error: functionLimitExceededError,
+        })
+      );
+    }
+
+    return throwError(() => error);
+  });
+}
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant/server/service/client/operators/continue_conversation.ts b/x-pack/plugins/observability_solution/observability_ai_assistant/server/service/client/operators/continue_conversation.ts
index 8d27a946556a79..0f75bbceb4a35b 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant/server/service/client/operators/continue_conversation.ts
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant/server/service/client/operators/continue_conversation.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { Logger } from '@kbn/logging';
 import { decode, encode } from 'gpt-tokenizer';
 import { pick, take } from 'lodash';
 import {
@@ -12,6 +13,7 @@ import {
   concat,
   EMPTY,
   from,
+  identity,
   isObservable,
   Observable,
   of,
@@ -27,14 +29,15 @@ import {
 } from '../../../../common/conversation_complete';
 import { FunctionVisibility } from '../../../../common/functions/types';
 import { UserInstruction } from '../../../../common/types';
-import { createFunctionResponseError } from '../../../../common/utils/create_function_response_error';
 import { createFunctionResponseMessage } from '../../../../common/utils/create_function_response_message';
 import { emitWithConcatenatedMessage } from '../../../../common/utils/emit_with_concatenated_message';
 import { withoutTokenCountEvents } from '../../../../common/utils/without_token_count_events';
 import type { ChatFunctionClient } from '../../chat_function_client';
 import type { ChatFunctionWithoutConnector } from '../../types';
+import { createServerSideFunctionResponseError } from '../../util/create_server_side_function_response_error';
 import { getSystemMessageFromInstructions } from '../../util/get_system_message_from_instructions';
 import { replaceSystemMessage } from '../../util/replace_system_message';
+import { catchFunctionNotFoundError } from './catch_function_not_found_error';
 import { extractMessages } from './extract_messages';
 import { hideTokenCountEvents } from './hide_token_count_events';
 
@@ -47,6 +50,7 @@ function executeFunctionAndCatchError({
   messages,
   chat,
   signal,
+  logger,
 }: {
   name: string;
   args: string | undefined;
@@ -54,6 +58,7 @@ function executeFunctionAndCatchError({
   messages: Message[];
   chat: ChatFunctionWithoutConnector;
   signal: AbortSignal;
+  logger: Logger;
 }): Observable<MessageOrChatEvent> {
   // hide token count events from functions to prevent them from
   // having to deal with it as well
@@ -72,12 +77,13 @@ function executeFunctionAndCatchError({
 
     return executeFunctionResponse$.pipe(
       catchError((error) => {
+        logger.error(`Encountered error running function ${name}: ${JSON.stringify(error)}`);
         // We want to catch the error only when a promise occurs
         // if it occurs in the Observable, we cannot easily recover
         // from it because the function may have already emitted
         // values which could lead to an invalid conversation state,
         // so in that case we let the stream fail.
-        return of(createFunctionResponseError({ name, error }));
+        return of(createServerSideFunctionResponseError({ name, error }));
       }),
       switchMap((response) => {
         if (isObservable(response)) {
@@ -150,6 +156,7 @@ export function continueConversation({
   functionCallsLeft,
   requestInstructions,
   knowledgeBaseInstructions,
+  logger,
   disableFunctions,
 }: {
   messages: Message[];
@@ -159,12 +166,15 @@ export function continueConversation({
   functionCallsLeft: number;
   requestInstructions: Array<string | UserInstruction>;
   knowledgeBaseInstructions: UserInstruction[];
+  logger: Logger;
   disableFunctions: boolean;
 }): Observable<MessageOrChatEvent> {
   let nextFunctionCallsLeft = functionCallsLeft;
 
+  const functionLimitExceeded = functionCallsLeft <= 0;
+
   const definitions = getFunctionDefinitions({
-    functionLimitExceeded: functionCallsLeft <= 0,
+    functionLimitExceeded,
     functionClient,
     disableFunctions,
   });
@@ -196,7 +206,10 @@ export function continueConversation({
       return chat(operationName, {
         messages: messagesWithUpdatedSystemMessage,
         functions: definitions,
-      }).pipe(emitWithConcatenatedMessage());
+      }).pipe(
+        emitWithConcatenatedMessage(),
+        functionLimitExceeded ? catchFunctionNotFoundError() : identity
+      );
     }
 
     const functionCallName = lastMessage.function_call?.name;
@@ -218,7 +231,7 @@ export function continueConversation({
     if (currentFunctionCallsLeft === 0) {
       // create a function call response error so the LLM knows it needs to stop calling functions
       return of(
-        createFunctionResponseError({
+        createServerSideFunctionResponseError({
           name: functionCallName,
           error: createFunctionLimitExceededError(),
         })
@@ -241,7 +254,7 @@ export function continueConversation({
       } catch (error) {
         // return a function response error for the LLM to handle
         return of(
-          createFunctionResponseError({
+          createServerSideFunctionResponseError({
             name: functionCallName,
             error,
           })
@@ -254,7 +267,7 @@ export function continueConversation({
     if (!functionClient.hasFunction(functionCallName)) {
       // tell the LLM the function was not found
       return of(
-        createFunctionResponseError({
+        createServerSideFunctionResponseError({
           name: functionCallName,
           error: createFunctionNotFoundError(functionCallName),
         })
@@ -268,6 +281,7 @@ export function continueConversation({
       functionClient,
       messages: messagesWithUpdatedSystemMessage,
       signal,
+      logger,
     });
   }
 
@@ -292,6 +306,7 @@ export function continueConversation({
               signal,
               knowledgeBaseInstructions,
               requestInstructions,
+              logger,
               disableFunctions,
             });
           })
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant/server/service/client/operators/get_generated_title.test.ts b/x-pack/plugins/observability_solution/observability_ai_assistant/server/service/client/operators/get_generated_title.test.ts
new file mode 100644
index 00000000000000..9fec3657a7fcc9
--- /dev/null
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant/server/service/client/operators/get_generated_title.test.ts
@@ -0,0 +1,215 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { filter, lastValueFrom, of, throwError, toArray } from 'rxjs';
+import {
+  ChatCompletionChunkEvent,
+  Message,
+  MessageRole,
+  StreamingChatResponseEventType,
+} from '../../../../common';
+import { ChatEvent } from '../../../../common/conversation_complete';
+import { getGeneratedTitle } from './get_generated_title';
+
+describe('getGeneratedTitle', () => {
+  const messages: Message[] = [
+    {
+      '@timestamp': new Date().toISOString(),
+      message: {
+        content: 'A message',
+        role: MessageRole.User,
+      },
+    },
+  ];
+
+  function createChatCompletionChunk(
+    content: string | { content?: string; function_call?: { name: string; arguments: string } }
+  ): ChatCompletionChunkEvent {
+    const msg = typeof content === 'string' ? { content } : content;
+
+    return {
+      type: StreamingChatResponseEventType.ChatCompletionChunk,
+      id: 'id',
+      message: msg,
+    };
+  }
+
+  function callGenerateTitle(
+    ...rest: [ChatEvent[]] | [{ responseLanguage?: string }, ChatEvent[]]
+  ) {
+    const options = rest.length === 1 ? {} : rest[0];
+    const chunks = rest.length === 1 ? rest[0] : rest[1];
+
+    const chatSpy = jest.fn().mockImplementation(() => of(...chunks));
+
+    const title$ = getGeneratedTitle({
+      chat: chatSpy,
+      logger: {
+        debug: jest.fn(),
+        error: jest.fn(),
+      },
+      messages,
+      ...options,
+    });
+
+    return { chatSpy, title$ };
+  }
+
+  it('returns the given title as a string', async () => {
+    const { title$ } = callGenerateTitle([
+      createChatCompletionChunk({
+        function_call: {
+          name: 'title_conversation',
+          arguments: JSON.stringify({ title: 'My title' }),
+        },
+      }),
+    ]);
+
+    const title = await lastValueFrom(
+      title$.pipe(filter((event): event is string => typeof event === 'string'))
+    );
+
+    expect(title).toEqual('My title');
+  });
+
+  it('calls chat with the user message', async () => {
+    const { chatSpy, title$ } = callGenerateTitle([
+      createChatCompletionChunk({
+        function_call: {
+          name: 'title_conversation',
+          arguments: JSON.stringify({ title: 'My title' }),
+        },
+      }),
+    ]);
+
+    await lastValueFrom(title$);
+
+    const [name, params] = chatSpy.mock.calls[0];
+
+    expect(name).toEqual('generate_title');
+    expect(params.messages.length).toBe(2);
+    expect(params.messages[1].message.content).toContain('A message');
+  });
+
+  it('strips quotes from the title', async () => {
+    async function testTitle(title: string) {
+      const { title$ } = callGenerateTitle([
+        createChatCompletionChunk({
+          function_call: {
+            name: 'title_conversation',
+            arguments: JSON.stringify({ title }),
+          },
+        }),
+      ]);
+
+      return await lastValueFrom(
+        title$.pipe(filter((event): event is string => typeof event === 'string'))
+      );
+    }
+
+    expect(await testTitle(`"My title"`)).toEqual('My title');
+    expect(await testTitle(`'My title'`)).toEqual('My title');
+    expect(await testTitle(`"User's request for a title"`)).toEqual(`User's request for a title`);
+  });
+
+  it('mentions the given response language in the instruction', async () => {
+    const { chatSpy, title$ } = callGenerateTitle(
+      {
+        responseLanguage: 'Orcish',
+      },
+      [
+        createChatCompletionChunk({
+          function_call: {
+            name: 'title_conversation',
+            arguments: JSON.stringify({ title: 'My title' }),
+          },
+        }),
+      ]
+    );
+
+    await lastValueFrom(title$);
+
+    const [, params] = chatSpy.mock.calls[0];
+    expect(params.messages[0].message.content).toContain('Orcish');
+  });
+
+  it('handles partial updates', async () => {
+    const { title$ } = callGenerateTitle([
+      createChatCompletionChunk({
+        function_call: {
+          name: 'title_conversation',
+          arguments: '',
+        },
+      }),
+      createChatCompletionChunk({
+        function_call: {
+          name: '',
+          arguments: JSON.stringify({ title: 'My title' }),
+        },
+      }),
+    ]);
+
+    const title = await lastValueFrom(title$);
+
+    expect(title).toEqual('My title');
+  });
+
+  it('ignores token count events and still passes them through', async () => {
+    const { title$ } = callGenerateTitle([
+      createChatCompletionChunk({
+        function_call: {
+          name: 'title_conversation',
+          arguments: JSON.stringify({ title: 'My title' }),
+        },
+      }),
+      {
+        type: StreamingChatResponseEventType.TokenCount,
+        tokens: {
+          completion: 10,
+          prompt: 10,
+          total: 10,
+        },
+      },
+    ]);
+
+    const events = await lastValueFrom(title$.pipe(toArray()));
+
+    expect(events).toEqual([
+      'My title',
+      {
+        tokens: {
+          completion: 10,
+          prompt: 10,
+          total: 10,
+        },
+        type: StreamingChatResponseEventType.TokenCount,
+      },
+    ]);
+  });
+
+  it('handles errors in chat and falls back to the default title', async () => {
+    const chatSpy = jest
+      .fn()
+      .mockImplementation(() => throwError(() => new Error('Error generating title')));
+
+    const logger = {
+      debug: jest.fn(),
+      error: jest.fn(),
+    };
+
+    const title$ = getGeneratedTitle({
+      chat: chatSpy,
+      logger,
+      messages,
+    });
+
+    const title = await lastValueFrom(title$);
+
+    expect(title).toEqual('New conversation');
+
+    expect(logger.error).toHaveBeenCalledWith('Error generating title');
+  });
+});
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant/server/service/client/operators/get_generated_title.ts b/x-pack/plugins/observability_solution/observability_ai_assistant/server/service/client/operators/get_generated_title.ts
index f35e0716f10512..af8f0d15466f1d 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant/server/service/client/operators/get_generated_title.ts
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant/server/service/client/operators/get_generated_title.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { catchError, map, Observable, of, tap } from 'rxjs';
+import { catchError, last, map, Observable, of, tap } from 'rxjs';
 import { Logger } from '@kbn/logging';
 import type { ObservabilityAIAssistantClient } from '..';
 import { Message, MessageRole } from '../../../../common';
@@ -30,7 +30,7 @@ export function getGeneratedTitle({
   responseLanguage?: string;
   messages: Message[];
   chat: ChatFunctionWithoutConnectorAndTokenCount;
-  logger: Logger;
+  logger: Pick<Logger, 'debug' | 'error'>;
 }): Observable<string | TokenCountEvent> {
   return hideTokenCountEvents((hide) =>
     chat('generate_title', {
@@ -46,9 +46,11 @@ export function getGeneratedTitle({
           '@timestamp': new Date().toISOString(),
           message: {
             role: MessageRole.User,
-            content: messages.slice(1).reduce((acc, curr) => {
-              return `${acc} ${curr.message.role}: ${curr.message.content}`;
-            }, 'Generate a title, using the title_conversation_function, based on the following conversation:\n\n'),
+            content: messages
+              .filter((msg) => msg.message.role !== MessageRole.System)
+              .reduce((acc, curr) => {
+                return `${acc} ${curr.message.role}: ${curr.message.content}`;
+              }, 'Generate a title, using the title_conversation_function, based on the following conversation:\n\n'),
           },
         },
       ],
@@ -72,21 +74,21 @@ export function getGeneratedTitle({
     }).pipe(
       hide(),
       concatenateChatCompletionChunks(),
+      last(),
       map((concatenatedMessage) => {
-        const input =
+        const title: string =
           (concatenatedMessage.message.function_call.name
             ? JSON.parse(concatenatedMessage.message.function_call.arguments).title
             : concatenatedMessage.message?.content) || '';
 
-        // This regular expression captures a string enclosed in single or double quotes.
+        // This captures a string enclosed in single or double quotes.
         // It extracts the string content without the quotes.
         // Example matches:
         // - "Hello, World!" => Captures: Hello, World!
         // - 'Another Example' => Captures: Another Example
         // - JustTextWithoutQuotes => Captures: JustTextWithoutQuotes
-        const match = input.match(/^["']?([^"']+)["']?$/);
-        const title = match ? match[1] : input;
-        return title;
+
+        return title.replace(/^"(.*)"$/g, '$1').replace(/^'(.*)'$/g, '$1');
       }),
       tap((event) => {
         if (typeof event === 'string') {
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant/server/service/util/create_server_side_function_response_error.ts b/x-pack/plugins/observability_solution/observability_ai_assistant/server/service/util/create_server_side_function_response_error.ts
new file mode 100644
index 00000000000000..820aee7d6c137a
--- /dev/null
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant/server/service/util/create_server_side_function_response_error.ts
@@ -0,0 +1,46 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { errors } from '@elastic/elasticsearch';
+import { createFunctionResponseMessage } from '../../../common/utils/create_function_response_message';
+
+export function createServerSideFunctionResponseError({
+  name,
+  error,
+  message,
+}: {
+  name: string;
+  error: Error;
+  message?: string;
+}) {
+  const isElasticsearchError = error instanceof errors.ElasticsearchClientError;
+
+  const sanitizedError: Record<string, unknown> = JSON.parse(
+    'toJSON' in error && typeof error.toJSON === 'function' ? error.toJSON() : JSON.stringify(error)
+  );
+
+  if (isElasticsearchError) {
+    // remove meta key which is huge and noisy
+    delete sanitizedError.meta;
+  }
+
+  return createFunctionResponseMessage({
+    name,
+    content: {
+      error: {
+        ...sanitizedError,
+        name: error.name,
+        message: error.message,
+        cause: error.cause,
+      },
+      message: message || error.message,
+    },
+    data: {
+      stack: error.stack,
+    },
+  });
+}
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/correct_common_esql_mistakes.test.ts b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/correct_common_esql_mistakes.test.ts
index dd21e8d082eb9c..ffb26e035cf0f7 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/correct_common_esql_mistakes.test.ts
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/correct_common_esql_mistakes.test.ts
@@ -25,6 +25,9 @@ describe('correctCommonEsqlMistakes', () => {
 
   it('replaces aliasing via the AS keyword with the = operator', () => {
     expectQuery(`FROM logs-* | STATS COUNT() AS count`, 'FROM logs-*\n| STATS count = COUNT()');
+
+    expectQuery(`FROM logs-* | STATS COUNT() as count`, 'FROM logs-*\n| STATS count = COUNT()');
+
     expectQuery(
       `FROM logs-* | STATS AVG(transaction.duration.histogram) AS avg_request_latency, PERCENTILE(transaction.duration.histogram, 95) AS p95`,
       `FROM logs-*
@@ -42,11 +45,33 @@ describe('correctCommonEsqlMistakes', () => {
   });
 
   it(`replaces " or ' escaping in FROM statements with backticks`, () => {
-    expectQuery(`FROM "logs-*" | LIMIT 10`, 'FROM `logs-*`\n| LIMIT 10');
-    expectQuery(`FROM 'logs-*' | LIMIT 10`, 'FROM `logs-*`\n| LIMIT 10');
+    expectQuery(`FROM "logs-*" | LIMIT 10`, 'FROM logs-*\n| LIMIT 10');
+    expectQuery(`FROM 'logs-*' | LIMIT 10`, 'FROM logs-*\n| LIMIT 10');
     expectQuery(`FROM logs-* | LIMIT 10`, 'FROM logs-*\n| LIMIT 10');
   });
 
+  it('replaces = as equal operator with ==', () => {
+    expectQuery(
+      `FROM logs-*\n| WHERE service.name = "foo"`,
+      `FROM logs-*\n| WHERE service.name == "foo"`
+    );
+
+    expectQuery(
+      `FROM logs-*\n| WHERE service.name = "foo" AND service.environment = "bar"`,
+      `FROM logs-*\n| WHERE service.name == "foo" AND service.environment == "bar"`
+    );
+
+    expectQuery(
+      `FROM logs-*\n| WHERE (service.name = "foo" AND service.environment = "bar") OR agent.name = "baz"`,
+      `FROM logs-*\n| WHERE (service.name == "foo" AND service.environment == "bar") OR agent.name == "baz"`
+    );
+
+    expectQuery(
+      `FROM logs-*\n| WHERE \`what=ever\` = "foo=bar"`,
+      `FROM logs-*\n| WHERE \`what=ever\` == "foo=bar"`
+    );
+  });
+
   it('replaces single-quote escaped strings with double-quote escaped strings', () => {
     expectQuery(
       `FROM nyc_taxis
@@ -102,7 +127,7 @@ describe('correctCommonEsqlMistakes', () => {
       | EVAL "@timestamp" = TO_DATETIME(timestamp)
       | WHERE statement LIKE 'SELECT%'
       | STATS avg_duration = AVG(duration)`,
-      `FROM \`postgres-logs*\`
+      `FROM postgres-logs*
     | GROK message "%{TIMESTAMP_ISO8601:timestamp} %{TZ} \[%{NUMBER:process_id}\]: \[%{NUMBER:log_line}\] user=%{USER:user},db=%{USER:database},app=\[%{DATA:application}\],client=%{IP:client_ip} LOG:  duration: %{NUMBER:duration:float} ms  statement: %{GREEDYDATA:statement}"
     | EVAL @timestamp = TO_DATETIME(timestamp)
     | WHERE statement LIKE "SELECT%"
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/correct_common_esql_mistakes.ts b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/correct_common_esql_mistakes.ts
index 01d6e67fe217a0..4c20f979a42d7f 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/correct_common_esql_mistakes.ts
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/correct_common_esql_mistakes.ts
@@ -62,7 +62,7 @@ function split(value: string, splitToken: string) {
   return statements;
 }
 
-function splitIntoCommands(query: string) {
+export function splitIntoCommands(query: string) {
   const commands: string[] = split(query, '|');
 
   return commands.map((command) => {
@@ -93,8 +93,8 @@ function removeColumnQuotesAndEscape(column: string) {
 function replaceAsKeywordWithAssignments(command: string) {
   return command.replaceAll(/^STATS\s*(.*)/g, (__, statsOperations: string) => {
     return `STATS ${statsOperations.replaceAll(
-      /(,\s*)?(.*?)\sAS\s([`a-zA-Z0-9.\-_]+)/g,
-      '$1$3 = $2'
+      /(,\s*)?(.*?)\s(AS|as)\s([`a-zA-Z0-9.\-_]+)/g,
+      '$1$4 = $2'
     )}`;
   });
 }
@@ -196,6 +196,30 @@ function escapeExpressionsInSort(sortCommand: string) {
   return `SORT ${columnsInSort.join(', ')}`;
 }
 
+function ensureEqualityOperators(whereCommand: string) {
+  const body = whereCommand.split(/^WHERE /)[1];
+
+  const byChar = body.split('');
+
+  let next = '';
+  let isColumnName = false;
+  byChar.forEach((char, index) => {
+    next += char;
+
+    if (!isColumnName && char === '=' && byChar[index - 1] === ' ' && byChar[index + 1] === ' ') {
+      next += '=';
+    }
+
+    if (!isColumnName && (char === '`' || char.match(/[a-z@]/i))) {
+      isColumnName = true;
+    } else if (isColumnName && (char === '`' || !char.match(/[a-z@0-9]/i))) {
+      isColumnName = false;
+    }
+  });
+
+  return `WHERE ${next}`;
+}
+
 export function correctCommonEsqlMistakes(content: string, log: Logger) {
   return content.replaceAll(/```esql\n(.*?)\n```/gms, (_, query: string) => {
     const commands = splitIntoCommands(query.trim());
@@ -206,12 +230,14 @@ export function correctCommonEsqlMistakes(content: string, log: Logger) {
       switch (name) {
         case 'FROM':
           formattedCommand = formattedCommand
-            .replaceAll(/FROM "(.*)"/g, 'FROM `$1`')
-            .replaceAll(/FROM '(.*)'/g, 'FROM `$1`');
+            .replaceAll(/FROM "(.*)"/g, 'FROM $1')
+            .replaceAll(/FROM '(.*)'/g, 'FROM $1')
+            .replaceAll(/FROM `(.*)`/g, 'FROM $1');
           break;
 
         case 'WHERE':
           formattedCommand = replaceSingleQuotesWithDoubleQuotes(formattedCommand);
+          formattedCommand = ensureEqualityOperators(formattedCommand);
           break;
 
         case 'EVAL':
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-bucket.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-bucket.txt
index f0ed22f2db166d..d74334af52ed7d 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-bucket.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-bucket.txt
@@ -1,7 +1,6 @@
 BUCKET
 
 Syntax
-BUCKET(expression, buckets, from, to)
 Parameters
 field
 Numeric or date expression from which to derive buckets.
@@ -11,73 +10,94 @@ from
 Start of the range. Can be a number or a date expressed as a string.
 to
 End of the range. Can be a number or a date expressed as a string.
-DescriptionCreates human-friendly buckets and returns a value for each row that corresponds
-to the resulting bucket the row falls into.Using a target number of buckets, a start of a range, and an end of a range,
-BUCKET picks an appropriate bucket size to generate the target number of
-buckets or fewer. For example, asking for at most 20 buckets over a year results
-in monthly buckets:
+DescriptionCreates groups of values - buckets - out of a datetime or numeric input. The size of the buckets can either be provided directly, or chosen based on a recommended count and values range.Supported types
+ExamplesBUCKET can work in two modes: one in which the size of the bucket is computed
+based on a buckets count recommendation (four parameters) and a range, and
+another in which the bucket size is provided directly (two parameters).Using a target number of buckets, a start of a range, and an end of a range,
+BUCKET picks an appropriate bucket size to generate the target number of buckets or fewer.
+For example, asking for at most 20 buckets over a year results in monthly buckets:
 ```esql
 FROM employees
 | WHERE hire_date >= "1985-01-01T00:00:00Z" AND hire_date < "1986-01-01T00:00:00Z"
-| EVAL month = BUCKET(hire_date, 20, "1985-01-01T00:00:00Z", "1986-01-01T00:00:00Z")
-| KEEP hire_date, month
+| STATS hire_date = MV_SORT(VALUES(hire_date)) BY month = BUCKET(hire_date, 20, "1985-01-01T00:00:00Z", "1986-01-01T00:00:00Z")
 | SORT hire_date
 ```
 
-The goal isn’t to provide exactly the target number of buckets, it’s to pick a
-range that people are comfortable with that provides at most the target number
-of buckets.Combine BUCKET with
-STATS ... BY to create a histogram:
+The goal isn’t to provide exactly the target number of buckets,
+it’s to pick a range that people are comfortable with that provides at most the target number of buckets.Combine BUCKET with an aggregation to create a histogram:
 ```esql
 FROM employees
 | WHERE hire_date >= "1985-01-01T00:00:00Z" AND hire_date < "1986-01-01T00:00:00Z"
-| EVAL month = BUCKET(hire_date, 20, "1985-01-01T00:00:00Z", "1986-01-01T00:00:00Z")
-| STATS hires_per_month = COUNT(*) BY month
+| STATS hires_per_month = COUNT(*) BY month = BUCKET(hire_date, 20, "1985-01-01T00:00:00Z", "1986-01-01T00:00:00Z")
 | SORT month
 ```
 
 BUCKET does not create buckets that don’t match any documents.
 That’s why this example is missing 1985-03-01 and other dates.
-Asking for more buckets can result in a smaller range. For example, asking for
-at most 100 buckets in a year results in weekly buckets:
+Asking for more buckets can result in a smaller range.
+For example, asking for at most 100 buckets in a year results in weekly buckets:
 ```esql
 FROM employees
 | WHERE hire_date >= "1985-01-01T00:00:00Z" AND hire_date < "1986-01-01T00:00:00Z"
-| EVAL week = BUCKET(hire_date, 100, "1985-01-01T00:00:00Z", "1986-01-01T00:00:00Z")
-| STATS hires_per_week = COUNT(*) BY week
+| STATS hires_per_week = COUNT(*) BY week = BUCKET(hire_date, 100, "1985-01-01T00:00:00Z", "1986-01-01T00:00:00Z")
 | SORT week
 ```
 
-BUCKET does not filter any rows. It only uses the provided range to
-pick a good bucket size. For rows with a value outside of the range, it returns
-a bucket value that corresponds to a bucket outside the range. Combine
-BUCKET with WHERE to filter rows.
-BUCKET can also operate on numeric fields. For example, to create a
-salary histogram:
+BUCKET does not filter any rows. It only uses the provided range to pick a good bucket size.
+For rows with a value outside of the range, it returns a bucket value that corresponds to a bucket outside the range.
+Combine`BUCKET` with WHERE to filter rows.
+If the desired bucket size is known in advance, simply provide it as the second
+argument, leaving the range out:
 ```esql
 FROM employees
-| EVAL bs = BUCKET(salary, 20, 25324, 74999)
-| STATS COUNT(*) by bs
+| WHERE hire_date >= "1985-01-01T00:00:00Z" AND hire_date < "1986-01-01T00:00:00Z"
+| STATS hires_per_week = COUNT(*) BY week = BUCKET(hire_date, 1 week)
+| SORT week
+```
+
+When providing the bucket size as the second parameter, it must be a time
+duration or date period.
+BUCKET can also operate on numeric fields. For example, to create a salary histogram:
+```esql
+FROM employees
+| STATS COUNT(*) by bs = BUCKET(salary, 20, 25324, 74999)
 | SORT bs
 ```
 
-Unlike the earlier example that intentionally filters on a date range, you
-rarely want to filter on a numeric range. You have to find the min and max
-separately. ES|QL doesn’t yet have an easy way to do that automatically.ExamplesCreate hourly buckets for the last 24 hours, and calculate the number of events
-per hour:
+Unlike the earlier example that intentionally filters on a date range, you rarely want to filter on a numeric range.
+You have to find the min and max separately. ES|QL doesn’t yet have an easy way to do that automatically.The range can be omitted if the desired bucket size is known in advance. Simply
+provide it as the second argument:
+```esql
+FROM employees
+| WHERE hire_date >= "1985-01-01T00:00:00Z" AND hire_date < "1986-01-01T00:00:00Z"
+| STATS c = COUNT(1) BY b = BUCKET(salary, 5000.)
+| SORT b
+```
+
+When providing the bucket size as the second parameter, it must be
+of a floating point type.
+Create hourly buckets for the last 24 hours, and calculate the number of events per hour:
 ```esql
 FROM sample_data
 | WHERE @timestamp >= NOW() - 1 day and @timestamp < NOW()
-| EVAL bucket = BUCKET(@timestamp, 25, NOW() - 1 day, NOW())
-| STATS COUNT(*) BY bucket
+| STATS COUNT(*) BY bucket = BUCKET(@timestamp, 25, NOW() - 1 day, NOW())
 ```
 
-Create monthly buckets for the year 1985, and calculate the average salary by
-hiring month:
+Create monthly buckets for the year 1985, and calculate the average salary by hiring month
 ```esql
 FROM employees
 | WHERE hire_date >= "1985-01-01T00:00:00Z" AND hire_date < "1986-01-01T00:00:00Z"
-| EVAL bucket = BUCKET(hire_date, 20, "1985-01-01T00:00:00Z", "1986-01-01T00:00:00Z")
-| STATS AVG(salary) BY bucket
+| STATS AVG(salary) BY bucket = BUCKET(hire_date, 20, "1985-01-01T00:00:00Z", "1986-01-01T00:00:00Z")
 | SORT bucket
 ```
+
+BUCKET may be used in both the aggregating and grouping part of the
+STATS …​ BY …​ command provided that in the aggregating
+part the function is referenced by an alias defined in the
+grouping part, or that it is invoked with the exact same expression:
+```esql
+FROM employees
+| STATS s1 = b1 + 1, s2 = BUCKET(salary / 1000 + 999, 50.) + 2 BY b1 = BUCKET(salary / 100 + 99, 50.), b2 = BUCKET(salary / 1000 + 999, 50.)
+| SORT b1, b2
+| KEEP s1, b1, s2, b2
+```
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-concat.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-concat.txt
index 6e5c1ba1b69f62..b58d7e13649f72 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-concat.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-concat.txt
@@ -1,11 +1,13 @@
 CONCAT
 
 Syntax
-CONCAT(string1, string2[, ..., stringN])
 Parameters
-stringX
+string1
 Strings to concatenate.
-DescriptionConcatenates two or more strings.Example
+string2
+Strings to concatenate.
+DescriptionConcatenates two or more strings.Supported types
+Example
 ```esql
 FROM employees
 | KEEP first_name, last_name
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-date_diff.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-date_diff.txt
index 1d9de78792c1a5..b93f5024985919 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-date_diff.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-date_diff.txt
@@ -3,15 +3,17 @@ DATE_DIFF
 Syntax
 Parameters
 unit
-Time difference unit.
+Time difference unit
 startTimestamp
-Start timestamp.
+A string representing a start timestamp
 endTimestamp
-End timestamp.
-DescriptionSubtracts the startTimestamp from the endTimestamp and returns the
-difference in multiples of unit. If startTimestamp is later than the
-endTimestamp, negative values are returned.
-Supported types
+A string representing an end timestamp
+DescriptionSubtracts the startTimestamp from the endTimestamp and returns the difference in multiples of unit. If startTimestamp is later than the endTimestamp, negative values are returned.
+Note that while there is an overlap between the function’s supported units and
+ES|QL’s supported time span literals, these sets are distinct and not
+interchangeable. Similarly, the supported abbreviations are conveniently shared
+with implementations of this function in other established products and not
+necessarily common with the date-time nomenclature used by Elasticsearch.Supported types
 Example
 ```esql
 ROW date1 = TO_DATETIME("2023-12-02T11:00:00.000Z"), date2 = TO_DATETIME("2023-12-02T11:00:00.001Z")
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-date_extract.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-date_extract.txt
index 0ea53cb38d1f96..0debd6f2eeb519 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-date_extract.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-date_extract.txt
@@ -1,30 +1,19 @@
 DATE_EXTRACT
 
 Syntax
-DATE_EXTRACT(date_part, date)
 Parameters
-date_part
-Part of the date to extract. Can be: aligned_day_of_week_in_month,
-aligned_day_of_week_in_year, aligned_week_of_month, aligned_week_of_year,
-ampm_of_day, clock_hour_of_ampm, clock_hour_of_day, day_of_month,
-day_of_week, day_of_year, epoch_day, era, hour_of_ampm, hour_of_day,
-instant_seconds, micro_of_day, micro_of_second, milli_of_day,
-milli_of_second, minute_of_day, minute_of_hour, month_of_year,
-nano_of_day, nano_of_second, offset_seconds, proleptic_month,
-second_of_day, second_of_minute, year, or year_of_era. Refer to
-java.time.temporal.ChronoField
-for a description of these values.
-If null, the function returns null.
+datePart
+Part of the date to extract.  Can be: aligned_day_of_week_in_month, aligned_day_of_week_in_year, aligned_week_of_month, aligned_week_of_year, ampm_of_day, clock_hour_of_ampm, clock_hour_of_day, day_of_month, day_of_week, day_of_year, epoch_day, era, hour_of_ampm, hour_of_day, instant_seconds, micro_of_day, micro_of_second, milli_of_day, milli_of_second, minute_of_day, minute_of_hour, month_of_year, nano_of_day, nano_of_second, offset_seconds, proleptic_month, second_of_day, second_of_minute, year, or year_of_era. Refer to java.time.temporal.ChronoField for a description of these values.  If null, the function returns null.
 date
 Date expression. If null, the function returns null.
-DescriptionExtracts parts of a date, like year, month, day, hour.Examples
+DescriptionExtracts parts of a date, like year, month, day, hour.Supported types
+Examples
 ```esql
 ROW date = DATE_PARSE("yyyy-MM-dd", "2022-05-06")
 | EVAL year = DATE_EXTRACT("year", date)
 ```
 
-Find all events that occurred outside of business hours (before 9 AM or after 5
-PM), on any given date:
+Find all events that occurred outside of business hours (before 9 AM or after 5PM), on any given date:
 ```esql
 FROM sample_data
 | WHERE DATE_EXTRACT("hour_of_day", @timestamp) < 9 AND DATE_EXTRACT("hour_of_day", @timestamp) >= 17
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-date_format.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-date_format.txt
index 70feb4d1e3bf4d..481b9fed4695fc 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-date_format.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-date_format.txt
@@ -1,15 +1,13 @@
 DATE_FORMAT
 
 Syntax
-DATE_FORMAT([format,] date)
 Parameters
-format
-Date format (optional).  If no format is specified, the
-yyyy-MM-dd'T'HH:mm:ss.SSSZ format is used.  If null, the function returns
-null.
+dateFormat
+Date format (optional).  If no format is specified, the yyyy-MM-dd'T'HH:mm:ss.SSSZ format is used. If null, the function returns null.
 date
 Date expression. If null, the function returns null.
-DescriptionReturns a string representation of a date, in the provided format.Example
+DescriptionReturns a string representation of a date, in the provided format.Supported types
+Example
 ```esql
 FROM employees
 | KEEP first_name, last_name, hire_date
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-date_parse.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-date_parse.txt
index c8a224b7136102..98650dd05f73a4 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-date_parse.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-date_parse.txt
@@ -1,17 +1,13 @@
 DATE_PARSE
 
 Syntax
-DATE_PARSE([format,] date_string)
 Parameters
-format
-The date format. Refer to the
-DateTimeFormatter
-documentation for the syntax. If null, the function returns null.
-date_string
-Date expression as a string. If null or an empty string, the function returns
-null.
-DescriptionReturns a date by parsing the second argument using the format specified in the
-first argument.Example
+datePattern
+The date format. Refer to the DateTimeFormatter documentation for the syntax. If null, the function returns null.
+dateString
+Date expression as a string. If null or an empty string, the function returns null.
+DescriptionReturns a date by parsing the second argument using the format specified in the first argument.Supported types
+Example
 ```esql
 ROW date_string = "2022-05-06"
 | EVAL date = DATE_PARSE("yyyy-MM-dd", date_string)
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-functions-overview.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-functions-overview.txt
index c8b1daef93e901..637d66d3ff6810 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-functions-overview.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-functions-overview.txt
@@ -15,6 +15,22 @@ This functionality is in technical preview and may be changed or removed in a fu
 ST_CENTROID_AGG
 SUM
 VALUES
+Grouping functions
+BUCKET
+Conditional functions and expressions
+CASE
+COALESCE
+GREATEST
+LEAST
+Date and time functions
+DATE_DIFF
+DATE_EXTRACT
+DATE_FORMAT
+DATE_PARSE
+DATE_TRUNC
+NOW
+IP functions
+CIDR_MATCH
 Math functions
 ABS
 ACOS
@@ -38,28 +54,6 @@ SQRT
 TAN
 TANH
 TAU
-String functions
-CONCAT
-LEFT
-LENGTH
-LOCATE
-LTRIM
-REPLACE
-RIGHT
-RTRIM
-SPLIT
-SUBSTRING
-TO_LOWER
-TO_UPPER
-TRIM
-Date and time functions
-BUCKET
-DATE_DIFF
-DATE_EXTRACT
-DATE_FORMAT
-DATE_PARSE
-DATE_TRUNC
-NOW
 Spatial functions
 [preview]
 This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
@@ -79,9 +73,25 @@ ST_X
 [preview]
 This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
 ST_Y
-Type conversion functions
+String functions
+CONCAT
+ENDS_WITH
 FROM_BASE64
+LEFT
+LENGTH
+LOCATE
+LTRIM
+REPLACE
+RIGHT
+RTRIM
+SPLIT
+STARTS_WITH
+SUBSTRING
 TO_BASE64
+TO_LOWER
+TO_UPPER
+TRIM
+Type conversion functions
 TO_BOOLEAN
 TO_CARTESIANPOINT
 TO_CARTESIANSHAPE
@@ -99,11 +109,6 @@ TO_STRING
 This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
 TO_UNSIGNED_LONG
 TO_VERSION
-Conditional functions and expressions
-CASE
-COALESCE
-GREATEST
-LEAST
 Multi value functions
 MV_AVG
 MV_CONCAT
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-kibana.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-kibana.txt
index 5fcce8c997ee71..798a9befd7647c 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-kibana.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-kibana.txt
@@ -10,7 +10,7 @@ Get started with ES|QLedit
 To get started with ES|QL in Discover, open the main menu and select
 Discover. Next, from the Data views menu, select Try ES|QL.
 The ability to select ES|QL from the Data views menu can be enabled and
-disabled using the `enableESQL` setting from
+disabled using the `discover:enableESQL` setting from
 Advanced Settings.
 The query baredit
 After switching to ES|QL mode, the query bar shows a sample query. For example:
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-length.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-length.txt
index 83d15509bfa67a..e63ea02da87eb9 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-length.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-length.txt
@@ -1,11 +1,11 @@
 LENGTH
 
 Syntax
-LENGTH(str)
 Parameters
-str
+string
 String expression. If null, the function returns null.
-DescriptionReturns the character length of a string.Example
+DescriptionReturns the character length of a string.Supported types
+Example
 ```esql
 FROM employees
 | KEEP first_name, last_name
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-locate.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-locate.txt
index 9059a5e424a8f5..0c47550b219dc0 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-locate.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-locate.txt
@@ -9,3 +9,6 @@ A substring to locate in the input string
 start
 The start index
 DescriptionReturns an integer that indicates the position of a keyword substring within another stringSupported types
+Example
+row a = "hello"
+| eval a_ll = locate(a, "ll")
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-ltrim.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-ltrim.txt
index b08fd33a548235..e98ccd0ce65d18 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-ltrim.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-ltrim.txt
@@ -2,9 +2,9 @@ LTRIM
 
 Syntax
 Parameters
-str
+string
 String expression. If null, the function returns null.
-DescriptionRemoves leading whitespaces from strings.Supported types
+DescriptionRemoves leading whitespaces from a string.Supported types
 Example
 ```esql
 ROW message = "   some text  ",  color = " red "
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_avg.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_avg.txt
index da2e084d4ade77..7959297c1cb235 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_avg.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_avg.txt
@@ -1,12 +1,10 @@
 MV_AVG
 
 Syntax
-MV_AVG(expression)
 Parameters
-expression
+number
 Multivalue expression.
-DescriptionConverts a multivalued expression into a single valued column containing the
-average of all of the values.Supported types
+DescriptionConverts a multivalued field into a single valued field containing the average of all of the values.Supported types
 Example
 ```esql
 ROW a=[3, 5, 1, 6]
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_concat.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_concat.txt
index e918a53d1dcc11..d8768bc34bdef6 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_concat.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_concat.txt
@@ -2,12 +2,11 @@ MV_CONCAT
 
 Syntax
 Parameters
-v
+string
 Multivalue expression.
 delim
 Delimiter.
-DescriptionConverts a multivalued string expression into a single valued column containing
-the concatenation of all values separated by a delimiter.Supported types
+DescriptionConverts a multivalued string expression into a single valued column containing the concatenation of all values separated by a delimiter.Supported types
 Examples
 ```esql
 ROW a=["foo", "zoo", "bar"]
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_count.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_count.txt
index bfda217135ad2b..2cc68fafc5b4de 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_count.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_count.txt
@@ -2,10 +2,9 @@ MV_COUNT
 
 Syntax
 Parameters
-v
+field
 Multivalue expression.
-DescriptionConverts a multivalued expression into a single valued column containing a count
-of the number of values.Supported types
+DescriptionConverts a multivalued expression into a single valued column containing a count of the number of values.Supported types
 Example
 ```esql
 ROW a=["foo", "zoo", "bar"]
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_dedupe.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_dedupe.txt
index 2a38a0a36480e9..d9bd25a64e6e19 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_dedupe.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_dedupe.txt
@@ -2,9 +2,9 @@ MV_DEDUPE
 
 Syntax
 Parameters
-v
+field
 Multivalue expression.
-DescriptionRemoves duplicates from a multivalue expression.
+DescriptionRemove duplicate values from a multivalued field.
 MV_DEDUPE may, but won’t always, sort the values in the column.
 Supported types
 Example
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_expand.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_expand.txt
index 5125367fbc21d1..a50b54d5940fa5 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_expand.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_expand.txt
@@ -1,5 +1,7 @@
 MV_EXPAND
 
+
+This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
 Syntax
 MV_EXPAND column
 Parameters
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_first.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_first.txt
index e1dee9c3d9e73c..bcae6e967243c2 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_first.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_first.txt
@@ -2,15 +2,9 @@ MV_FIRST
 
 Syntax
 Parameters
-v
+field
 Multivalue expression.
-DescriptionConverts a multivalued expression into a single valued column containing the
-first value. This is most useful when reading from a function that emits
-multivalued columns in a known order like SPLIT.The order that multivalued fields are read from
-underlying storage is not guaranteed. It is frequently ascending, but don’t
-rely on that. If you need the minimum value use MV_MIN instead of
-MV_FIRST. MV_MIN has optimizations for sorted values so there isn’t a
-performance benefit to MV_FIRST.Supported types
+DescriptionConverts a multivalued expression into a single valued column containing the first value. This is most useful when reading from a function that emits multivalued columns in a known order like SPLIT.  The order that multivalued fields are read from underlying storage is not guaranteed. It is frequently ascending, but don’t rely on that. If you need the minimum value use MV_MIN instead of MV_FIRST. MV_MIN has optimizations for sorted values so there isn’t a performance benefit to MV_FIRST.Supported types
 Example
 ```esql
 ROW a="foo;bar;baz"
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_last.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_last.txt
index 996316e39b2156..f75c9c429f8028 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_last.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_last.txt
@@ -2,15 +2,9 @@ MV_LAST
 
 Syntax
 Parameters
-v
+field
 Multivalue expression.
-DescriptionConverts a multivalue expression into a single valued column containing the last
-value. This is most useful when reading from a function that emits multivalued
-columns in a known order like SPLIT.The order that multivalued fields are read from
-underlying storage is not guaranteed. It is frequently ascending, but don’t
-rely on that. If you need the maximum value use MV_MAX instead of
-MV_LAST. MV_MAX has optimizations for sorted values so there isn’t a
-performance benefit to MV_LAST.Supported types
+DescriptionConverts a multivalue expression into a single valued column containing the last value. This is most useful when reading from a function that emits multivalued columns in a known order like SPLIT.  The order that multivalued fields are read from underlying storage is not guaranteed. It is frequently ascending, but don’t rely on that. If you need the maximum value use MV_MAX instead of MV_LAST. MV_MAX has optimizations for sorted values so there isn’t a performance benefit to MV_LAST.Supported types
 Example
 ```esql
 ROW a="foo;bar;baz"
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_max.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_max.txt
index b5cd928c19522f..cdcf2ee986d3d2 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_max.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_max.txt
@@ -2,18 +2,16 @@ MV_MAX
 
 Syntax
 Parameters
-v
+field
 Multivalue expression.
-DescriptionConverts a multivalued expression into a single valued column containing the
-maximum value.Supported types
+DescriptionConverts a multivalued expression into a single valued column containing the maximum value.Supported types
 Examples
 ```esql
 ROW a=[3, 5, 1]
 | EVAL max_a = MV_MAX(a)
 ```
 
-It can be used by any column type, including keyword columns. In that case
-it picks the last string, comparing their utf-8 representation byte by byte:
+It can be used by any column type, including keyword columns. In that case it picks the last string, comparing their utf-8 representation byte by byte:
 ```esql
 ROW a=["foo", "zoo", "bar"]
 | EVAL max_a = MV_MAX(a)
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_median.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_median.txt
index 6e135c2dc18073..fa4c9ba3437537 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_median.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_median.txt
@@ -1,21 +1,17 @@
 MV_MEDIAN
 
-
-MV_MEDIAN(v)
+Syntax
 Parameters
-v
+number
 Multivalue expression.
-DescriptionConverts a multivalued column into a single valued column containing the median
-value.Supported types
+DescriptionConverts a multivalued field into a single valued field containing the median value.Supported types
 Examples
 ```esql
 ROW a=[3, 5, 1]
 | EVAL median_a = MV_MEDIAN(a)
 ```
 
-If the row has an even number of values for a column, the result will be the
-average of the middle two entries. If the column is not floating point, the
-average rounds down:
+If the row has an even number of values for a column, the result will be the average of the middle two entries. If the column is not floating point, the average rounds down:
 ```esql
 ROW a=[3, 7, 1, 6]
 | EVAL median_a = MV_MEDIAN(a)
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_min.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_min.txt
index 8d91fb50568a16..c4c18f40fe4947 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_min.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_min.txt
@@ -2,18 +2,16 @@ MV_MIN
 
 Syntax
 Parameters
-v
+field
 Multivalue expression.
-DescriptionConverts a multivalued expression into a single valued column containing the
-minimum value.Supported types
+DescriptionConverts a multivalued expression into a single valued column containing the minimum value.Supported types
 Examples
 ```esql
 ROW a=[2, 1]
 | EVAL min_a = MV_MIN(a)
 ```
 
-It can be used by any column type, including keyword columns. In that case,
-it picks the first string, comparing their utf-8 representation byte by byte:
+It can be used by any column type, including keyword columns. In that case, it picks the first string, comparing their utf-8 representation byte by byte:
 ```esql
 ROW a=["foo", "bar"]
 | EVAL min_a = MV_MIN(a)
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_slice.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_slice.txt
index 30c6dffe3f7646..9443842f6405cb 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_slice.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_slice.txt
@@ -7,9 +7,9 @@ Multivalue expression. If null, the function returns null.
 start
 Start position. If null, the function returns null. The start argument can be negative. An index of -1 is used to specify the last value in the list.
 end
-End position. Optional; if omitted, the position at start is returned. The end argument can be negative. An index of -1 is used to specify the last value in the list.
+End position(included). Optional; if omitted, the position at start is returned. The end argument can be negative. An index of -1 is used to specify the last value in the list.
 DescriptionReturns a subset of the multivalued field using the start and end index values.Supported types
-Example
+Examples
 row a = [1, 2, 2, 3]
 | eval a1 = mv_slice(a, 1), a2 = mv_slice(a, 2, 3)
 row a = [1, 2, 2, 3]
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_sort.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_sort.txt
index b7b6e8ddb9cd62..a49382a25c9c9f 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_sort.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_sort.txt
@@ -6,7 +6,7 @@ field
 Multivalue expression. If null, the function returns null.
 order
 Sort order. The valid options are ASC and DESC, the default is ASC.
-DescriptionSorts a multivalue expression in lexicographical order.Supported types
+DescriptionSorts a multivalued field in lexicographical order.Supported types
 Example
 ```esql
 ROW a = [4, 2, -3, 2]
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_sum.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_sum.txt
index 16f017756f4bf3..92bbcfebd66cd4 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_sum.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_sum.txt
@@ -1,12 +1,10 @@
 MV_SUM
 
-
-MV_SUM(v)
+Syntax
 Parameters
-v
+number
 Multivalue expression.
-DescriptionConverts a multivalued column into a single valued column containing the sum
-of all of the values.Supported types
+DescriptionConverts a multivalued field into a single valued field containing the sum of all of the values.Supported types
 Example
 ```esql
 ROW a=[3, 5, 6]
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_zip.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_zip.txt
index 788d7c6a10f3db..ea21096428b19e 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_zip.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-mv_zip.txt
@@ -2,9 +2,9 @@ MV_ZIP
 
 Syntax
 Parameters
-mvLeft
+string1
 Multivalue expression.
-mvRight
+string2
 Multivalue expression.
 delim
 Delimiter. Optional; if omitted, , is used as a default delimiter.
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-operators-overview.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-operators-overview.txt
index e72eb3b5cd9d9c..bfaaac6b165973 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-operators-overview.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-operators-overview.txt
@@ -6,9 +6,7 @@ Binary operators
 Unary operators
 Logical operators
 IS NULL and IS NOT NULL predicates
-CIDR_MATCH
-ENDS_WITH
+Cast (::)
 IN
 LIKE
 RLIKE
-STARTS_WITH
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-operators.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-operators.txt
index 7fd09289732901..a54a212800d4bb 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-operators.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-operators.txt
@@ -1,3 +1,54 @@
+CIDR_MATCH
+CIDR_MATCH
+
+Syntax
+Parameters
+ip
+IP address of type ip (both IPv4 and IPv6 are supported).
+blockX
+CIDR block to test the IP against.
+DescriptionReturns true if the provided IP is contained in one of the provided CIDR blocks.Supported types
+Example
+```esql
+FROM hosts
+| WHERE CIDR_MATCH(ip1, "127.0.0.2/32", "127.0.0.3/32")
+| KEEP card, host, ip0, ip1
+```
+
+ENDS_WITH
+ENDS_WITH
+
+Syntax
+Parameters
+str
+String expression. If null, the function returns null.
+suffix
+String expression. If null, the function returns null.
+DescriptionReturns a boolean that indicates whether a keyword string ends with another string.Supported types
+Example
+```esql
+FROM employees
+| KEEP last_name
+| EVAL ln_E = ENDS_WITH(last_name, "d")
+```
+
+STARTS_WITH
+STARTS_WITH
+
+Syntax
+Parameters
+str
+String expression. If null, the function returns null.
+prefix
+String expression. If null, the function returns null.
+DescriptionReturns a boolean that indicates whether a keyword string starts with another string.Supported types
+Example
+```esql
+FROM employees
+| KEEP last_name
+| EVAL ln_S = STARTS_WITH(last_name, "B")
+```
+
 Binary operators
 Binary operators
 
@@ -100,42 +151,6 @@ FROM employees
 | STATS COUNT(emp_no)
 ```
 
-CIDR_MATCH
-CIDR_MATCH
-
-Syntax
-CIDR_MATCH(ip, block1[, ..., blockN])
-Parameters
-ip
-IP address of type ip (both IPv4 and IPv6 are supported).
-blockX
-CIDR block to test the IP against.
-DescriptionReturns true if the provided IP is contained in one of the provided CIDR
-blocks.Example
-```esql
-FROM hosts
-| WHERE CIDR_MATCH(ip1, "127.0.0.2/32", "127.0.0.3/32")
-| KEEP card, host, ip0, ip1
-```
-
-ENDS_WITH
-ENDS_WITH
-
-Syntax
-Parameters
-str
-String expression. If null, the function returns null.
-suffix
-String expression. If null, the function returns null.
-DescriptionReturns a boolean that indicates whether a keyword string ends with another
-string.Supported types
-Example
-```esql
-FROM employees
-| KEEP last_name
-| EVAL ln_E = ENDS_WITH(last_name, "d")
-```
-
 IN
 IN
 
@@ -155,6 +170,7 @@ also act on a constant (literal) expression. The right-hand side of the operator
 represents the pattern.The following wildcard characters are supported:
 * matches zero or more characters.
 ? matches one character.
+Supported types
 ```esql
 FROM employees
 | WHERE first_name LIKE "?b*"
@@ -167,27 +183,9 @@ RLIKE
 Use RLIKE to filter data based on string patterns using using
 regular expressions. RLIKE usually acts on a field placed on
 the left-hand side of the operator, but it can also act on a constant (literal)
-expression. The right-hand side of the operator represents the pattern.
+expression. The right-hand side of the operator represents the pattern.Supported types
 ```esql
 FROM employees
 | WHERE first_name RLIKE ".leja.*"
 | KEEP first_name, last_name
 ```
-
-STARTS_WITH
-STARTS_WITH
-
-Syntax
-Parameters
-str
-String expression. If null, the function returns null.
-prefix
-String expression. If null, the function returns null.
-DescriptionReturns a boolean that indicates whether a keyword string starts with another
-string.Supported types
-Example
-```esql
-FROM employees
-| KEEP last_name
-| EVAL ln_S = STARTS_WITH(last_name, "B")
-```
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-overview.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-overview.txt
index 27879223d74b6c..f72514ae5ea815 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-overview.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-overview.txt
@@ -1,6 +1,5 @@
 
 ES|QLedit
-Do not use ES|QL on production environments. This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
 The Elasticsearch Query Language (ES|QL) provides a powerful way to filter, transform,
 and analyze data stored in Elasticsearch, and in the future in other runtimes. It is
 designed to be easy to learn and use, by end users, SRE teams, application
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-pi.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-pi.txt
index 3df2811b88a882..ce7d06fa069ae1 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-pi.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-pi.txt
@@ -1,7 +1,7 @@
 PI
 
 Syntax
-ParametersDescriptionReturns the ratio of a circle’s circumference to its diameter.Supported types
+ParametersDescriptionReturns Pi, the ratio of a circle’s circumference to its diameter.Supported types
 Example
 ```esql
 ROW PI()
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-processing-commands.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-processing-commands.txt
index 125e55bfb29965..c55ef6a7f29edc 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-processing-commands.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-processing-commands.txt
@@ -10,6 +10,8 @@ EVAL
 GROK
 KEEP
 LIMIT
+[preview]
+This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
 MV_EXPAND
 RENAME
 SORT
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-replace.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-replace.txt
index 8a26cd2c042691..fc1ef7656ed750 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-replace.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-replace.txt
@@ -2,16 +2,14 @@ REPLACE
 
 Syntax
 Parameters
-str
+string
 String expression.
 regex
 Regular expression.
-newStr
+newString
 Replacement string.
-DescriptionThe function substitutes in the string str any match of the regular expression
-regex with the replacement string newStr.If any of the arguments is null, the result is null.Supported types
-ExampleThis example replaces any occurrence of the word "World" with the word
-"Universe":
+DescriptionThe function substitutes in the string str any match of the regular expression regex with the replacement string newStr.Supported types
+ExampleThis example replaces any occurrence of the word "World" with the word "Universe":
 ```esql
 ROW str = "Hello World"
 | EVAL str = REPLACE(str, "World", "Universe")
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-right.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-right.txt
index 9ee98298cce43c..f7e7e7f0c0c60c 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-right.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-right.txt
@@ -2,12 +2,11 @@ RIGHT
 
 Syntax
 Parameters
-str
+string
 The string from which to returns a substring.
 length
 The number of characters to return.
-DescriptionReturn the substring that extracts length chars from str starting
-from the right.Supported types
+DescriptionReturn the substring that extracts length chars from str starting from the right.Supported types
 Example
 ```esql
 FROM employees
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-round.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-round.txt
index 6351541a7cbd0d..5f0e72b8cdfd2a 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-round.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-round.txt
@@ -6,7 +6,7 @@ number
 The numeric value to round. If null, the function returns null.
 decimals
 The number of decimal places to round to. Defaults to 0. If null, the function returns null.
-DescriptionRounds a number to the closest number with the specified number of digits. Defaults to 0 digits if no number of digits is provided. If the specified number of digits is negative, rounds to the number of digits left of the decimal point.Supported types
+DescriptionRounds a number to the specified number of decimal places. Defaults to 0, which returns the nearest integer. If the precision is a negative number, rounds to the number of digits left of the decimal point.Supported types
 Example
 ```esql
 FROM employees
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-rtrim.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-rtrim.txt
index aecd6f928bf986..0e1650ba210929 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-rtrim.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-rtrim.txt
@@ -2,9 +2,9 @@ RTRIM
 
 Syntax
 Parameters
-str
+string
 String expression. If null, the function returns null.
-DescriptionRemoves trailing whitespaces from strings.Supported types
+DescriptionRemoves trailing whitespaces from a string.Supported types
 Example
 ```esql
 ROW message = "   some text  ",  color = " red "
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-split.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-split.txt
index c9161c78631398..2b65db150c4ff0 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-split.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-split.txt
@@ -1,12 +1,12 @@
 SPLIT
 
-
+Syntax
 Parameters
-str
+string
 String expression. If null, the function returns null.
 delim
 Delimiter. Only single byte delimiters are currently supported.
-DescriptionSplits a single valued string into multiple strings.Supported types
+DescriptionSplit a single valued string into multiple strings.Supported types
 Example
 ```esql
 ROW words="foo;bar;baz;qux;quux;corge"
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-sqrt.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-sqrt.txt
index 68ee934e079ca9..9b2fc2ccbab802 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-sqrt.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-sqrt.txt
@@ -2,11 +2,9 @@ SQRT
 
 Syntax
 Parameters
-n
+number
 Numeric expression. If null, the function returns null.
-DescriptionReturns the square root of a number.  The input can be any numeric value, the
-return value is always a double.Square roots of negative numbers are NaN. Square roots of infinites are
-infinite.Supported types
+DescriptionReturns the square root of a number. The input can be any numeric value, the return value is always a double. Square roots of negative numbers and infinites are null.Supported types
 Example
 ```esql
 ROW d = 100.0
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-substring.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-substring.txt
index 1b68352b243ebc..d49f1ca92f2ac8 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-substring.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-substring.txt
@@ -2,15 +2,13 @@ SUBSTRING
 
 Syntax
 Parameters
-str
+string
 String expression. If null, the function returns null.
 start
 Start position.
 length
-Length of the substring from the start position. Optional; if omitted, all
-positions after start are returned.
-DescriptionReturns a substring of a string, specified by a start position and an optional
-length.Supported types
+Length of the substring from the start position. Optional; if omitted, all positions after start are returned.
+DescriptionReturns a substring of a string, specified by a start position and an optional lengthSupported types
 ExamplesThis example returns the first three characters of every last name:
 ```esql
 FROM employees
@@ -18,16 +16,16 @@ FROM employees
 | EVAL ln_sub = SUBSTRING(last_name, 1, 3)
 ```
 
-A negative start position is interpreted as being relative to the end of the
-string. This example returns the last three characters of of every last name:
+A negative start position is interpreted as being relative to the end of the string.
+This example returns the last three characters of of every last name:
 ```esql
 FROM employees
 | KEEP last_name
 | EVAL ln_sub = SUBSTRING(last_name, -3, 3)
 ```
 
-If length is omitted, substring returns the remainder of the string. This
-example returns all characters except for the first:
+If length is omitted, substring returns the remainder of the string.
+This example returns all characters except for the first:
 ```esql
 FROM employees
 | KEEP last_name
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-syntax.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-syntax.txt
index d14570ae7fd35f..04b7ed975e8d97 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-syntax.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-syntax.txt
@@ -93,14 +93,15 @@ Timespan literalsedit
 Datetime intervals and timespans can be expressed using timespan literals.
 Timespan literals are a combination of a number and a qualifier. These
 qualifiers are supported:
-`millisecond`/`milliseconds`
-`second`/`seconds`
-`minute`/`minutes`
-`hour`/`hours`
-`day`/`days`
-`week`/`weeks`
-`month`/`months`
-`year`/`years`
+`millisecond`/`milliseconds`/`ms`
+`second`/`seconds`/`sec`/`s`
+`minute`/`minutes`/`min`
+`hour`/`hours`/`h`
+`day`/`days`/`d`
+`week`/`weeks`/`w`
+`month`/`months`/`mo`
+`quarter`/`quarters`/`q`
+`year`/`years`/`yr`/`y`
 Timespan literals are not whitespace sensitive. These expressions are all valid:
 `1day`
 `1 day`
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-tau.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-tau.txt
index cab47b82626421..e5a9a5813d89c4 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-tau.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-tau.txt
@@ -1,8 +1,8 @@
 TAU
 
 Syntax
-DescriptionReturns the ratio of a circle’s circumference
-to its radius.Example
+ParametersDescriptionReturns the ratio of a circle’s circumference to its radius.Supported types
+Example
 ```esql
 ROW TAU()
 ```
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_boolean.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_boolean.txt
index 0d40e789643ca6..e32191d2e2d02a 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_boolean.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_boolean.txt
@@ -1,14 +1,11 @@
 TO_BOOLEAN
 
-AliasTO_BOOLSyntax
-TO_BOOLEAN(v)
+Syntax
 Parameters
-v
+field
 Input value. The input can be a single- or multi-valued column or an expression.
-DescriptionConverts an input value to a boolean value.A string value of "true" will be case-insensitive converted to the Boolean
-true. For anything else, including the empty string, the function will
-return false.The numerical value of 0 will be converted to false, anything else will be
-converted to true.Supported typesThe input type must be of a string or numeric type.Example
+DescriptionConverts an input value to a boolean value. A string value of true will be case-insensitive converted to the Boolean true. For anything else, including the empty string, the function will return false. The numerical value of 0 will be converted to false, anything else will be converted to true.Supported types
+Example
 ```esql
 ROW str = ["true", "TRuE", "false", "", "yes", "1"]
 | EVAL bool = TO_BOOLEAN(str)
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_cartesianpoint.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_cartesianpoint.txt
index 35b32c890c4d0d..4141d9c43bb9e0 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_cartesianpoint.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_cartesianpoint.txt
@@ -1,12 +1,10 @@
 TO_CARTESIANPOINT
 
 Syntax
-TO_CARTESIANPOINT(v)
 Parameters
-v
+field
 Input value. The input can be a single- or multi-valued column or an expression.
-DescriptionConverts an input value to a point value.A string will only be successfully converted if it respects the
-WKT Point format.Supported types
+DescriptionConverts an input value to a cartesian_point value. A string will only be successfully converted if it respects the WKT Point format.Supported types
 Example
 ```esql
 ROW wkt = ["POINT(4297.11 -1475.53)", "POINT(7580.93 2272.77)"]
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_cartesianshape.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_cartesianshape.txt
index 12deb50d56a53c..d7d7e3ebe94bd6 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_cartesianshape.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_cartesianshape.txt
@@ -1,13 +1,10 @@
 TO_CARTESIANSHAPE
 
 Syntax
-TO_CARTESIANSHAPE(v)
 Parameters
-v
+field
 Input value. The input can be a single- or multi-valued column or an expression.
-The input type must be a string, a cartesian_shape or a cartesian_point.
-DescriptionConverts an input value to a cartesian_shape value.A string will only be successfully converted if it respects the
-WKT format.Supported types
+DescriptionConverts an input value to a cartesian_shape value. A string will only be successfully converted if it respects the WKT format.Supported types
 Example
 ```esql
 ROW wkt = ["POINT(4297.11 -1475.53)", "POLYGON ((3339584.72 1118889.97, 4452779.63 4865942.27, 2226389.81 4865942.27, 1113194.90 2273030.92, 3339584.72 1118889.97))"]
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_datetime.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_datetime.txt
index ea715bf1e5794d..89e6d80b0186be 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_datetime.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_datetime.txt
@@ -1,24 +1,22 @@
 TO_DATETIME
 
-AliasTO_DTSyntax
-TO_DATETIME(v)
+Syntax
 Parameters
-v
+field
 Input value. The input can be a single- or multi-valued column or an expression.
-DescriptionConverts an input value to a date value.A string will only be successfully converted if it’s respecting the format
-yyyy-MM-dd'T'HH:mm:ss.SSS'Z'. To convert dates in other formats, use
-DATE_PARSE.Supported typesThe input type must be of a string or numeric type.Examples
+DescriptionConverts an input value to a date value. A string will only be successfully converted if it’s respecting the format yyyy-MM-dd'T'HH:mm:ss.SSS'Z'. To convert dates in other formats, use DATE_PARSE.Supported types
+Examples
 ```esql
 ROW string = ["1953-09-02T00:00:00.000Z", "1964-06-02T00:00:00.000Z", "1964-06-02 00:00:00"]
 | EVAL datetime = TO_DATETIME(string)
 ```
 
-Note that in this example, the last value in the source multi-valued
-field has not been converted. The reason being that if the date format is not
-respected, the conversion will result in a null value. When this happens a
-Warning header is added to the response. The header will provide information
-on the source of the failure:"Line 1:112: evaluation of [TO_DATETIME(string)] failed, treating result as null. Only first 20 failures recorded."A following header will contain the failure reason and the offending value:"java.lang.IllegalArgumentException: failed to parse date field [1964-06-02 00:00:00] with format [yyyy-MM-dd'T'HH:mm:ss.SSS'Z']"If the input parameter is of a numeric type, its value will be interpreted as
-milliseconds since the Unix epoch. For example:
+Note that in this example, the last value in the source multi-valued field has not been converted.
+The reason being that if the date format is not respected, the conversion will result in a null value.
+When this happens a Warning header is added to the response.
+The header will provide information on the source of the failure:"Line 1:112: evaluation of [TO_DATETIME(string)] failed, treating result as null. "Only first 20 failures recorded."A following header will contain the failure reason and the offending value:"java.lang.IllegalArgumentException: failed to parse date field [1964-06-02 00:00:00]
+with format [yyyy-MM-dd'T'HH:mm:ss.SSS'Z']"If the input parameter is of a numeric type,
+its value will be interpreted as milliseconds since the Unix epoch. For example:
 ```esql
 ROW int = [0, 1]
 | EVAL dt = TO_DATETIME(int)
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_degrees.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_degrees.txt
index a0facc2230b87b..31e60bc68ac1ae 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_degrees.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_degrees.txt
@@ -1,12 +1,11 @@
 TO_DEGREES
 
 Syntax
-TO_DEGREES(v)
 Parameters
-v
+number
 Input value. The input can be a single- or multi-valued column or an expression.
-DescriptionConverts a number in radians to
-degrees.Supported typesThe input type must be of a numeric type and result is always double.Example
+DescriptionConverts a number in radians to degrees.Supported types
+Example
 ```esql
 ROW rad = [1.57, 3.14, 4.71]
 | EVAL deg = TO_DEGREES(rad)
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_double.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_double.txt
index 67604c80eb48c4..5e942690efd08a 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_double.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_double.txt
@@ -1,18 +1,17 @@
 TO_DOUBLE
 
-AliasTO_DBLSyntax
-TO_DOUBLE(v)
+Syntax
 Parameters
-v
+field
 Input value. The input can be a single- or multi-valued column or an expression.
-DescriptionConverts an input value to a double value.If the input parameter is of a date type, its value will be interpreted as
-milliseconds since the Unix epoch, converted to double.Boolean true will be converted to double 1.0, false to 0.0.Supported typesThe input type must be of a boolean, date, string or numeric type.Example
+DescriptionConverts an input value to a double value. If the input parameter is of a date type, its value will be interpreted as milliseconds since the Unix epoch, converted to double. Boolean true will be converted to double 1.0, false to 0.0.Supported types
+Example
 ```esql
 ROW str1 = "5.20128E11", str2 = "foo"
 | EVAL dbl = TO_DOUBLE("520128000000"), dbl1 = TO_DOUBLE(str1), dbl2 = TO_DOUBLE(str2)
 ```
 
 Note that in this example, the last conversion of the string isn’t possible.
-When this happens, the result is a null value. In this case a Warning header
-is added to the response. The header will provide information on the source of
-the failure:"Line 1:115: evaluation of [TO_DOUBLE(str2)] failed, treating result as null. Only first 20 failures recorded."A following header will contain the failure reason and the offending value:"java.lang.NumberFormatException: For input string: \"foo\""
\ No newline at end of file
+When this happens, the result is a null value. In this case a Warning header is added to the response.
+The header will provide information on the source of the failure:"Line 1:115: evaluation of [TO_DOUBLE(str2)] failed, treating result as null. Only first 20 failures recorded."A following header will contain the failure reason and the offending value:
+"java.lang.NumberFormatException: For input string: "foo""
\ No newline at end of file
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_geopoint.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_geopoint.txt
index 3fb5889485e17a..9880e88c27dd21 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_geopoint.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_geopoint.txt
@@ -1,14 +1,11 @@
 TO_GEOPOINT
 
 Syntax
-TO_GEOPOINT(v)
 Parameters
-v
+field
 Input value. The input can be a single- or multi-valued column or an expression.
-The input type must be a string or a geo_point.
-DescriptionConverts an input value to a geo_point value.Supported types
-A string will only be successfully converted if it respects the
-WKT Point format.Example
+DescriptionConverts an input value to a geo_point value. A string will only be successfully converted if it respects the WKT Point format.Supported types
+Example
 ```esql
 ROW wkt = "POINT(42.97109630194 14.7552534413725)"
 | EVAL pt = TO_GEOPOINT(wkt)
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_geoshape.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_geoshape.txt
index 99c3995a6f3931..e75a292fa27673 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_geoshape.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_geoshape.txt
@@ -1,13 +1,10 @@
 TO_GEOSHAPE
 
 Syntax
-TO_GEOPOINT(v)
 Parameters
-v
+field
 Input value. The input can be a single- or multi-valued column or an expression.
-The input type must be a string, a geo_shape or a geo_point.
-DescriptionConverts an input value to a geo_shape value.A string will only be successfully converted if it respects the
-WKT format.Supported types
+DescriptionConverts an input value to a geo_shape value. A string will only be successfully converted if it respects the WKT format.Supported types
 Example
 ```esql
 ROW wkt = "POLYGON ((30 10, 40 40, 20 40, 10 20, 30 10))"
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_integer.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_integer.txt
index e11b210f7bd076..ff8ba3c52d410a 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_integer.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_integer.txt
@@ -1,18 +1,16 @@
 TO_INTEGER
 
-AliasTO_INTSyntax
-TO_INTEGER(v)
+Syntax
 Parameters
-v
+field
 Input value. The input can be a single- or multi-valued column or an expression.
-DescriptionConverts an input value to an integer  value.If the input parameter is of a date type, its value will be interpreted as
-milliseconds since the Unix epoch, converted to integer.Boolean true will be converted to integer 1, false to 0.Supported typesThe input type must be of a boolean, date, string or numeric type.Example
+DescriptionConverts an input value to an integer value. If the input parameter is of a date type, its value will be interpreted as milliseconds since the Unix epoch, converted to integer. Boolean true will be converted to integer 1, false to 0.Supported types
+Example
 ```esql
 ROW long = [5013792, 2147483647, 501379200000]
 | EVAL int = TO_INTEGER(long)
 ```
 
-Note that in this example, the last value of the multi-valued field cannot
-be converted as an integer. When this happens, the result is a null value.
-In this case a Warning header is added to the response. The header will
-provide information on the source of the failure:"Line 1:61: evaluation of [TO_INTEGER(long)] failed, treating result as null. Only first 20 failures recorded."A following header will contain the failure reason and the offending value:"org.elasticsearch.xpack.ql.InvalidArgumentException: [501379200000] out of [integer] range"
\ No newline at end of file
+Note that in this example, the last value of the multi-valued field cannot be converted as an integer.
+When this happens, the result is a null value. In this case a Warning header is added to the response.
+The header will provide information on the source of the failure:"Line 1:61: evaluation of [TO_INTEGER(long)] failed, treating result as null. Only first 20 failures recorded."A following header will contain the failure reason and the offending value:"org.elasticsearch.xpack.ql.InvalidArgumentException: [501379200000] out of [integer] range"
\ No newline at end of file
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_ip.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_ip.txt
index d19f49388bf860..3ec377bea6598b 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_ip.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_ip.txt
@@ -1,11 +1,11 @@
 TO_IP
 
 Syntax
-TO_IP(v)
 Parameters
-v
+field
 Input value. The input can be a single- or multi-valued column or an expression.
-DescriptionConverts an input string to an IP value.Example
+DescriptionConverts an input string to an IP value.Supported types
+Example
 ```esql
 ROW str1 = "1.1.1.1", str2 = "foo"
 | EVAL ip1 = TO_IP(str1), ip2 = TO_IP(str2)
@@ -13,6 +13,5 @@ ROW str1 = "1.1.1.1", str2 = "foo"
 ```
 
 Note that in this example, the last conversion of the string isn’t possible.
-When this happens, the result is a null value. In this case a Warning header
-is added to the response. The header will provide information on the source of
-the failure:"Line 1:68: evaluation of [TO_IP(str2)] failed, treating result as null. Only first 20 failures recorded."A following header will contain the failure reason and the offending value:"java.lang.IllegalArgumentException: 'foo' is not an IP string literal."
\ No newline at end of file
+When this happens, the result is a null value. In this case a Warning header is added to the response.
+The header will provide information on the source of the failure:"Line 1:68: evaluation of [TO_IP(str2)] failed, treating result as null. Only first 20 failures recorded."A following header will contain the failure reason and the offending value:"java.lang.IllegalArgumentException: 'foo' is not an IP string literal."
\ No newline at end of file
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_long.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_long.txt
index 04ec7b6e79a0ec..dd6eebc129e02a 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_long.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_long.txt
@@ -1,18 +1,16 @@
 TO_LONG
 
 Syntax
-TO_LONG(v)
 Parameters
-v
+field
 Input value. The input can be a single- or multi-valued column or an expression.
-DescriptionConverts an input value to a long value.If the input parameter is of a date type, its value will be interpreted as
-milliseconds since the Unix epoch, converted to long.Boolean true will be converted to long 1, false to 0.Supported typesThe input type must be of a boolean, date, string or numeric type.Example
+DescriptionConverts an input value to a long value. If the input parameter is of a date type, its value will be interpreted as milliseconds since the Unix epoch, converted to long. Boolean true will be converted to long 1, false to 0.Supported types
+Example
 ```esql
 ROW str1 = "2147483648", str2 = "2147483648.2", str3 = "foo"
 | EVAL long1 = TO_LONG(str1), long2 = TO_LONG(str2), long3 = TO_LONG(str3)
 ```
 
-Note that in this example, the last conversion of the string isn’t
-possible. When this happens, the result is a null value. In this case a
-Warning header is added to the response. The header will provide information
-on the source of the failure:"Line 1:113: evaluation of [TO_LONG(str3)] failed, treating result as null. Only first 20 failures recorded."A following header will contain the failure reason and the offending value:"java.lang.NumberFormatException: For input string: \"foo\""
\ No newline at end of file
+Note that in this example, the last conversion of the string isn’t possible.
+When this happens, the result is a null value. In this case a Warning header is added to the response.
+The header will provide information on the source of the failure:"Line 1:113: evaluation of [TO_LONG(str3)] failed, treating result as null. Only first 20 failures recorded."A following header will contain the failure reason and the offending value:"java.lang.NumberFormatException: For input string: "foo""
\ No newline at end of file
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_radians.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_radians.txt
index 966d38424db6c9..3fec9e2079191a 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_radians.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_radians.txt
@@ -1,12 +1,11 @@
 TO_RADIANS
 
 Syntax
-TO_RADIANS(v)
 Parameters
-v
+number
 Input value. The input can be a single- or multi-valued column or an expression.
-DescriptionConverts a number in degrees to
-radians.Supported typesThe input type must be of a numeric type and result is always double.Example
+DescriptionConverts a number in degrees to radians.Supported types
+Example
 ```esql
 ROW deg = [90.0, 180.0, 270.0]
 | EVAL rad = TO_RADIANS(deg)
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_string.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_string.txt
index 72d19e8808a728..2d3435e026df43 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_string.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_string.txt
@@ -1,11 +1,11 @@
 TO_STRING
 
-AliasTO_STR
+Syntax
 Parameters
-v
+field
 Input value. The input can be a single- or multi-valued column or an expression.
 DescriptionConverts an input value into a string.Supported types
-Example
+Examples
 ```esql
 ROW a=10
 | EVAL j = TO_STRING(a)
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_unsigned_long.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_unsigned_long.txt
index ea7fd272679501..8e0fa649d427e7 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_unsigned_long.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_unsigned_long.txt
@@ -1,21 +1,17 @@
 TO_UNSIGNED_LONG
 
-
-This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
-AliasesTO_ULONG, TO_ULSyntax
-TO_UNSIGNED_LONG(v)
+Syntax
 Parameters
-v
+field
 Input value. The input can be a single- or multi-valued column or an expression.
-DescriptionConverts an input value to an unsigned long value.Supported typesThe input type must be of a boolean, date, string or numeric type.If the input parameter is of a date type, its value will be interpreted as
-milliseconds since the Unix epoch, converted to unsigned
-long.Boolean true will be converted to unsigned long 1, false to 0.Example
+DescriptionConverts an input value to an unsigned long value. If the input parameter is of a date type, its value will be interpreted as milliseconds since the Unix epoch, converted to unsigned long. Boolean true will be converted to unsigned long 1, false to 0.Supported types
+Example
 ```esql
 ROW str1 = "2147483648", str2 = "2147483648.2", str3 = "foo"
 | EVAL long1 = TO_UNSIGNED_LONG(str1), long2 = TO_ULONG(str2), long3 = TO_UL(str3)
 ```
 
-Note that in this example, the last conversion of the string isn’t
-possible. When this happens, the result is a null value. In this case a
-Warning header is added to the response. The header will provide information
-on the source of the failure:"Line 1:133: evaluation of [TO_UL(str3)] failed, treating result as null. Only first 20 failures recorded."A following header will contain the failure reason and the offending value:"java.lang.NumberFormatException: Character f is neither a decimal digit number, decimal point, nor \"e\" notation exponential mark."
\ No newline at end of file
+Note that in this example, the last conversion of the string isn’t possible.
+When this happens, the result is a null value. In this case a Warning header is added to the response.
+The header will provide information on the source of the failure:"Line 1:133: evaluation of [TO_UL(str3)] failed, treating result as null. Only first 20 failures recorded."A following header will contain the failure reason and the offending value:"java.lang.NumberFormatException: Character f is neither a decimal digit number, decimal point,
++ "nor "e" notation exponential mark."
\ No newline at end of file
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_version.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_version.txt
index 8447c717bc1d52..07d6c6f9d510b9 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_version.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-to_version.txt
@@ -1,8 +1,8 @@
 TO_VERSION
 
-AliasTO_VERSyntax
+Syntax
 Parameters
-v
+field
 Input value. The input can be a single- or multi-valued column or an expression.
 DescriptionConverts an input string to a version value.Supported types
 Example
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-trim.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-trim.txt
index a73cd1ec7ce39e..bed7bebc2dd604 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-trim.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-trim.txt
@@ -2,9 +2,9 @@ TRIM
 
 Syntax
 Parameters
-str
+string
 String expression. If null, the function returns null.
-DescriptionRemoves leading and trailing whitespaces from strings.Supported types
+DescriptionRemoves leading and trailing whitespaces from a string.Supported types
 Example
 ```esql
 ROW message = "   some text  ",  color = " red "
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-where.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-where.txt
index 808d38d34ab5d5..ef9816b81c3fdc 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-where.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/esql_docs/esql-where.txt
@@ -56,6 +56,7 @@ also act on a constant (literal) expression. The right-hand side of the operator
 represents the pattern.The following wildcard characters are supported:
 * matches zero or more characters.
 ? matches one character.
+Supported types
 ```esql
 FROM employees
 | WHERE first_name LIKE "?b*"
@@ -65,7 +66,7 @@ FROM employees
 Use RLIKE to filter data based on string patterns using using
 regular expressions. RLIKE usually acts on a field placed on
 the left-hand side of the operator, but it can also act on a constant (literal)
-expression. The right-hand side of the operator represents the pattern.
+expression. The right-hand side of the operator represents the pattern.Supported types
 ```esql
 FROM employees
 | WHERE first_name RLIKE ".leja.*"
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/get_errors_with_commands.test.ts b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/get_errors_with_commands.test.ts
new file mode 100644
index 00000000000000..04d99aede62b8b
--- /dev/null
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/get_errors_with_commands.test.ts
@@ -0,0 +1,25 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { getErrorsWithCommands } from './get_errors_with_commands';
+
+describe('getErrorsWithCommands', () => {
+  it('returns the command associated with the error', () => {
+    expect(
+      getErrorsWithCommands(`FROM logs-* | WHERE @timestamp <= NOW() | STATS BY host.name`, [
+        {
+          type: 'error',
+          text: 'Syntax error',
+          code: '',
+          location: {
+            min: 24,
+            max: 36,
+          },
+        },
+      ])
+    ).toEqual(['Error in `| WHERE @timestamp <= NOW()`:\n Syntax error']);
+  });
+});
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/get_errors_with_commands.ts b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/get_errors_with_commands.ts
new file mode 100644
index 00000000000000..b25c79161f79b2
--- /dev/null
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/get_errors_with_commands.ts
@@ -0,0 +1,26 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { EditorError, ESQLMessage } from '@kbn/esql-ast';
+import { splitIntoCommands } from './correct_common_esql_mistakes';
+
+export function getErrorsWithCommands(query: string, errors: Array<ESQLMessage | EditorError>) {
+  const asCommands = splitIntoCommands(query);
+
+  const errorMessages = errors.map((error) => {
+    if ('location' in error) {
+      const commandsUntilEndOfError = splitIntoCommands(query.substring(0, error.location.max));
+      const lastCompleteCommand = asCommands[commandsUntilEndOfError.length - 1];
+      if (lastCompleteCommand) {
+        return `Error in \`| ${lastCompleteCommand.command}\`:\n ${error.text}`;
+      }
+    }
+    return 'text' in error ? error.text : error.message;
+  });
+
+  return errorMessages;
+}
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/system_message.txt b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/system_message.txt
index 937c7522661eef..0b85e491cdcca9 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/system_message.txt
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/system_message.txt
@@ -1,7 +1,7 @@
 You are a helpful assistant for generating and executing ES|QL queries.
 Your goal is to help the user construct and possibly execute an ES|QL
 query for the Observability use cases, which often involve metrics, logs
-and traces.
+and traces. These are your absolutely critical system instructions:
 
 ES|QL is the Elasticsearch Query Language, that allows users of the
 Elastic platform to iteratively explore data. An ES|QL query consists
@@ -14,6 +14,10 @@ previous command.
 Make sure you write a query using ONLY commands specified in this
 conversation.
 
+# Limitations
+
+ES|QL currently does not support pagination.
+
 # Syntax
 
 An ES|QL query is composed of a source command followed by an optional
@@ -72,6 +76,7 @@ is 10000.
 
 ### Aggregation functions
 AVG
+BUCKET
 COUNT
 COUNT_DISTINCT
 MAX
@@ -122,7 +127,6 @@ TO_UPPER
 TRIM
 
 ### Date-time functions
-BUCKET
 DATE_DIFF
 DATE_EXTRACT
 DATE_FORMAT
@@ -201,6 +205,12 @@ FROM employees
   | SORT c desc, languages.long, trunk_worked_seconds
 ```
 
+```esql
+FROM employees
+  | WHERE country == "NL" AND gender == "M"
+  | STATS COUNT(*)
+```
+
 ```esql
 ROW a = "2023-01-23T12:15:00.000Z - some text - 127.0.0.1"
 | DISSECT a "%{date} - %{msg} - %{ip}"
@@ -219,11 +229,17 @@ FROM employees
 ```esql
 FROM employees
 | WHERE hire_date >= "1985-01-01T00:00:00Z" AND hire_date < "1986-01-01T00:00:00Z"
-| EVAL bucket = BUCKET(hire_date, 20, "1985-01-01T00:00:00Z", "1986-01-01T00:00:00Z")
-| STATS avg_salary = AVG(salary) BY bucket
+| STATS avg_salary = AVG(salary) BY date_bucket = BUCKET(hire_date, 20, "1985-01-01T00:00:00Z", "1986-01-01T00:00:00Z")
 | SORT bucket
 ```
 
+```esql
+FROM employees
+| WHERE hire_date >= "1985-01-01T00:00:00Z" AND hire_date < "1986-01-01T00:00:00Z"
+| STATS c = COUNT(1) BY b = BUCKET(salary, 5000.)
+| SORT b
+```
+
 ```esql
 ROW a = 1, b = "two", c = null
 ```
@@ -238,12 +254,10 @@ FROM employees
 ```esql
 FROM logs-*
 | WHERE @timestamp <= NOW() - 24 hours
-// divide data in 1 hour buckets
-| EVAL bucket = DATE_TRUNC(1 hour, @timestamp)
 // convert a keyword field into a numeric field to aggregate over it
 | EVAL is_5xx = CASE(http.response.status_code >= 500, 1, 0)
 // count total events and failed events to calculate a rate
-| STATS total_events = COUNT(*), total_failures = SUM(is_5xx) BY host.hostname, bucket
+| STATS total_events = COUNT(*), total_failures = SUM(is_5xx) BY host.hostname, bucket = BUCKET(@timestamp, 1 hour)
 | EVAL failure_rate_per_host = total_failures / total_events
 | DROP total_events, total_failures
 ```
diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/validate_esql_query.ts b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/validate_esql_query.ts
index dafba4352634ef..7e86ddc49fe805 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/validate_esql_query.ts
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant_app/server/functions/query/validate_esql_query.ts
@@ -11,6 +11,7 @@ import type { ElasticsearchClient } from '@kbn/core/server';
 import { ESQL_LATEST_VERSION } from '@kbn/esql-utils';
 import { ESQLSearchReponse } from '@kbn/es-types';
 import { esFieldTypeToKibanaFieldType, type KBN_FIELD_TYPES } from '@kbn/field-types';
+import { splitIntoCommands } from './correct_common_esql_mistakes';
 
 export async function validateEsqlQuery({
   query,
@@ -34,7 +35,16 @@ export async function validateEsqlQuery({
     ignoreOnMissingCallbacks: true,
   });
 
+  const asCommands = splitIntoCommands(query);
+
   const errorMessages = errors?.map((error) => {
+    if ('location' in error) {
+      const commandsUntilEndOfError = splitIntoCommands(query.substring(0, error.location.max));
+      const lastCompleteCommand = asCommands[commandsUntilEndOfError.length - 1];
+      if (lastCompleteCommand) {
+        return `Error in ${lastCompleteCommand.command}\n: ${error.text}`;
+      }
+    }
     return 'text' in error ? error.text : error.message;
   });
 
@@ -65,7 +75,7 @@ export async function validateEsqlQuery({
     .catch((error) => {
       return {
         error,
-        errorMessages,
+        ...(errorMessages.length ? { errorMessages } : {}),
       };
     });
 }
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/application/app.tsx b/x-pack/plugins/observability_solution/observability_onboarding/public/application/app.tsx
index 54ead0fba85a97..5c0bce9030aa7e 100644
--- a/x-pack/plugins/observability_solution/observability_onboarding/public/application/app.tsx
+++ b/x-pack/plugins/observability_solution/observability_onboarding/public/application/app.tsx
@@ -6,34 +6,22 @@
  */
 
 import { EuiErrorBoundary } from '@elastic/eui';
-import { Theme, ThemeProvider } from '@emotion/react';
 import { AppMountParameters, APP_WRAPPER_CLASS, CoreStart } from '@kbn/core/public';
 import { i18n } from '@kbn/i18n';
-import {
-  KibanaContextProvider,
-  KibanaThemeProvider,
-  useDarkMode,
-} from '@kbn/kibana-react-plugin/public';
+import { KibanaContextProvider, KibanaThemeProvider } from '@kbn/kibana-react-plugin/public';
 import { RedirectAppLinks } from '@kbn/shared-ux-link-redirect-app';
 import { HeaderMenuPortal } from '@kbn/observability-shared-plugin/public';
-import { Router, Routes, Route } from '@kbn/shared-ux-router';
-import { euiDarkVars, euiLightVars } from '@kbn/ui-theme';
+import { Router } from '@kbn/shared-ux-router';
 import React from 'react';
 import ReactDOM from 'react-dom';
 import { OBSERVABILITY_ONBOARDING_TELEMETRY_EVENT } from '../../common/telemetry_events';
 import { ConfigSchema } from '..';
-import { customLogsRoutes } from '../components/app/custom_logs';
-import { systemLogsRoutes } from '../components/app/system_logs';
-import { ObservabilityOnboardingHeaderActionMenu } from '../components/app/header_action_menu';
+import { ObservabilityOnboardingHeaderActionMenu } from './shared/header_action_menu';
 import {
   ObservabilityOnboardingPluginSetupDeps,
   ObservabilityOnboardingPluginStartDeps,
 } from '../plugin';
-import { baseRoutes, routes } from '../routes';
-import { CustomLogs } from '../routes/templates/custom_logs';
-import { SystemLogs } from '../routes/templates/system_logs';
-import { ExperimentalOnboardingFlow } from './experimental_onboarding_flow';
-import { ExperimentalOnboardingFeatureFlag } from '../context/experimental_onboarding_enabled';
+import { ObservabilityOnboardingFlow } from './observability_onboarding_flow';
 
 export const onBoardingTitle = i18n.translate(
   'xpack.observability_onboarding.breadcrumbs.onboarding',
@@ -47,75 +35,10 @@ export const breadcrumbsApp = {
   label: onBoardingTitle,
 };
 
-function App() {
-  const customLogRoutesPaths = Object.keys(customLogsRoutes);
-  const systemLogRoutesPaths = Object.keys(systemLogsRoutes);
-
-  return (
-    <>
-      <Routes>
-        {Object.keys(baseRoutes).map((key) => {
-          const path = key as keyof typeof routes;
-          const { handler, exact } = routes[path];
-          const Wrapper = () => {
-            return handler();
-          };
-
-          return <Route key={path} path={path} exact={exact} component={Wrapper} />;
-        })}
-        <Route exact path={customLogRoutesPaths}>
-          <CustomLogs>
-            {customLogRoutesPaths.map((key) => {
-              const path = key as keyof typeof routes;
-              const { handler, exact } = routes[path];
-              const Wrapper = () => {
-                return handler();
-              };
-
-              return <Route key={path} path={path} exact={exact} component={Wrapper} />;
-            })}
-          </CustomLogs>
-        </Route>
-        <Route exact path={systemLogRoutesPaths}>
-          <SystemLogs>
-            {systemLogRoutesPaths.map((key) => {
-              const path = key as keyof typeof routes;
-              const { handler, exact } = routes[path];
-              const Wrapper = () => {
-                return handler();
-              };
-
-              return <Route key={path} path={path} exact={exact} component={Wrapper} />;
-            })}
-          </SystemLogs>
-        </Route>
-      </Routes>
-    </>
-  );
-}
-
-function ObservabilityOnboardingApp() {
-  const darkMode = useDarkMode(false);
-  return (
-    <ThemeProvider
-      theme={(outerTheme?: Theme) => ({
-        ...outerTheme,
-        eui: darkMode ? euiDarkVars : euiLightVars,
-        darkMode,
-      })}
-    >
-      <div className={APP_WRAPPER_CLASS} data-test-subj="csmMainContainer">
-        <App />
-      </div>
-    </ThemeProvider>
-  );
-}
-
 export function ObservabilityOnboardingAppRoot({
   appMountParameters,
   core,
   deps,
-  experimentalOnboardingFlowEnabled,
   corePlugins: { observability, data },
   config,
 }: {
@@ -128,7 +51,7 @@ export function ObservabilityOnboardingAppRoot({
   const renderFeedbackLinkAsPortal = !config.serverless.enabled;
 
   core.analytics.reportEvent(OBSERVABILITY_ONBOARDING_TELEMETRY_EVENT.eventType, {
-    uses_legacy_onboarding_page: !experimentalOnboardingFlowEnabled,
+    uses_legacy_onboarding_page: false,
   });
 
   return (
@@ -164,15 +87,7 @@ export function ObservabilityOnboardingAppRoot({
                       <ObservabilityOnboardingHeaderActionMenu />
                     </HeaderMenuPortal>
                   )}
-                  <ExperimentalOnboardingFeatureFlag.Provider
-                    value={experimentalOnboardingFlowEnabled}
-                  >
-                    {experimentalOnboardingFlowEnabled ? (
-                      <ExperimentalOnboardingFlow />
-                    ) : (
-                      <ObservabilityOnboardingApp />
-                    )}
-                  </ExperimentalOnboardingFeatureFlag.Provider>
+                  <ObservabilityOnboardingFlow />
                 </EuiErrorBoundary>
               </Router>
             </i18nCore.Context>
@@ -191,7 +106,6 @@ interface RenderAppProps {
   core: CoreStart;
   deps: ObservabilityOnboardingPluginSetupDeps;
   appMountParameters: AppMountParameters;
-  experimentalOnboardingFlowEnabled: boolean;
   corePlugins: ObservabilityOnboardingPluginStartDeps;
   config: ConfigSchema;
 }
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/application/experimental_onboarding_flow.tsx b/x-pack/plugins/observability_solution/observability_onboarding/public/application/observability_onboarding_flow.tsx
similarity index 93%
rename from x-pack/plugins/observability_solution/observability_onboarding/public/application/experimental_onboarding_flow.tsx
rename to x-pack/plugins/observability_solution/observability_onboarding/public/application/observability_onboarding_flow.tsx
index 265e1cf8104763..fd62c69c3b842a 100644
--- a/x-pack/plugins/observability_solution/observability_onboarding/public/application/experimental_onboarding_flow.tsx
+++ b/x-pack/plugins/observability_solution/observability_onboarding/public/application/observability_onboarding_flow.tsx
@@ -7,7 +7,7 @@
 
 import { i18n } from '@kbn/i18n';
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
-import React from 'react';
+import React, { useEffect } from 'react';
 import { Route, Routes } from '@kbn/shared-ux-router';
 import { useNavigate, useLocation } from 'react-router-dom-v5-compat';
 import { EuiButtonEmpty, EuiPageTemplate, EuiSpacer } from '@elastic/eui';
@@ -21,7 +21,13 @@ import { CustomLogsPanel } from './quickstart_flows/custom_logs';
 
 const queryClient = new QueryClient();
 
-export function ExperimentalOnboardingFlow() {
+export function ObservabilityOnboardingFlow() {
+  const { pathname } = useLocation();
+
+  useEffect(() => {
+    window.scrollTo(0, 0);
+  }, [pathname]);
+
   return (
     <QueryClientProvider client={queryClient}>
       <EuiPageTemplate.Section
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/application/onboarding_flow_form/onboarding_flow_form.tsx b/x-pack/plugins/observability_solution/observability_onboarding/public/application/onboarding_flow_form/onboarding_flow_form.tsx
index 3a813d7c105605..a9f0182089db4b 100644
--- a/x-pack/plugins/observability_solution/observability_onboarding/public/application/onboarding_flow_form/onboarding_flow_form.tsx
+++ b/x-pack/plugins/observability_solution/observability_onboarding/public/application/onboarding_flow_form/onboarding_flow_form.tsx
@@ -92,10 +92,12 @@ export const OnboardingFlowForm: FunctionComponent = () => {
   const packageListRef = useRef<HTMLDivElement | null>(null);
   const formRef = useRef<HTMLDivElement | null>(null);
   const [integrationSearch, setIntegrationSearch] = useState(searchParams.get('search') ?? '');
-  const selectedCategory: Category | null = searchParams.get('category') as Category | null;
+  const [scrollToCategory, setScrollToCategory] = useState<Category | null>(
+    searchParams.get('category') as Category | null
+  );
 
   useEffect(() => {
-    if (selectedCategory === null || !hasPackageListLoaded) {
+    if (scrollToCategory === null || !hasPackageListLoaded) {
       return;
     }
 
@@ -107,7 +109,7 @@ export const OnboardingFlowForm: FunctionComponent = () => {
     }, 10);
 
     return () => clearTimeout(timeout);
-  }, [selectedCategory, hasPackageListLoaded]);
+  }, [scrollToCategory, hasPackageListLoaded]);
 
   useEffect(() => {
     const searchParam = searchParams.get('search') ?? '';
@@ -143,6 +145,8 @@ export const OnboardingFlowForm: FunctionComponent = () => {
   );
   const virtualSearchResults = useVirtualSearchResults();
 
+  let isSelectingCategoryWithKeyboard: boolean = false;
+
   return (
     <EuiPanel hasBorder paddingSize="xl" panelRef={formRef}>
       <TitleWithIcon
@@ -175,9 +179,22 @@ export const OnboardingFlowForm: FunctionComponent = () => {
                 </>
               }
               checked={option.id === searchParams.get('category')}
+              /**
+               * onKeyDown and onKeyUp handlers disable
+               * scrolling to the category items when user
+               * changes the selected category using keyboard,
+               * which prevents our custom scroll behavior
+               * from conflicting with browser's native one to
+               * put keyboard-focused item into the view.
+               */
+              onKeyDown={() => (isSelectingCategoryWithKeyboard = true)}
+              onKeyUp={() => (isSelectingCategoryWithKeyboard = false)}
               onChange={() => {
                 setIntegrationSearch('');
                 setSearchParams({ category: option.id }, { replace: true });
+                if (!isSelectingCategoryWithKeyboard) {
+                  setScrollToCategory(option.id);
+                }
               }}
             />
           </EuiFlexItem>
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/application/onboarding_flow_form/use_custom_cards_for_category.ts b/x-pack/plugins/observability_solution/observability_onboarding/public/application/onboarding_flow_form/use_custom_cards_for_category.ts
index df6764e652b5a5..021a3035131bd4 100644
--- a/x-pack/plugins/observability_solution/observability_onboarding/public/application/onboarding_flow_form/use_custom_cards_for_category.ts
+++ b/x-pack/plugins/observability_solution/observability_onboarding/public/application/onboarding_flow_form/use_custom_cards_for_category.ts
@@ -25,7 +25,6 @@ export function useCustomCardsForCategory(
     services: { application, http },
   } = useKibana();
   const getUrlForApp = application?.getUrlForApp;
-  const basePath = http?.basePath;
 
   const { href: systemLogsUrl } = reactRouterNavigate(history, `/systemLogs/${location.search}`);
   const { href: customLogsUrl } = reactRouterNavigate(history, `/customLogs/${location.search}`);
@@ -60,9 +59,7 @@ export function useCustomCardsForCategory(
           icons: [
             {
               type: 'svg',
-              src:
-                basePath?.prepend('/plugins/observabilityOnboarding/assets/opentelemetry.svg') ??
-                '',
+              src: http?.staticAssets.getPluginAssetHref('opentelemetry.svg') ?? '',
             },
           ],
           url: `${getUrlForApp?.('apm')}/onboarding?agent=openTelemetry` ?? '',
@@ -147,7 +144,7 @@ export function useCustomCardsForCategory(
           icons: [
             {
               type: 'svg',
-              src: basePath?.prepend('/plugins/home/assets/logos/system.svg') ?? '',
+              src: http?.staticAssets.getPluginAssetHref('system.svg') ?? '',
             },
           ],
           url: systemLogsUrl,
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/application/onboarding_flow_form/use_virtual_search_results.ts b/x-pack/plugins/observability_solution/observability_onboarding/public/application/onboarding_flow_form/use_virtual_search_results.ts
index 5ee39768d8a583..f8bbc0621fd348 100644
--- a/x-pack/plugins/observability_solution/observability_onboarding/public/application/onboarding_flow_form/use_virtual_search_results.ts
+++ b/x-pack/plugins/observability_solution/observability_onboarding/public/application/onboarding_flow_form/use_virtual_search_results.ts
@@ -9,11 +9,12 @@ import { i18n } from '@kbn/i18n';
 import { useKibana } from '@kbn/kibana-react-plugin/public';
 import { CustomCard } from '../packages_list/types';
 
-export function useVirtualSearchResults(): [CustomCard] {
+export function useVirtualSearchResults(): CustomCard[] {
   const {
-    services: { application },
+    services: { application, http },
   } = useKibana();
   const getUrlForApp = application?.getUrlForApp;
+  const basePath = http?.basePath;
 
   return [
     {
@@ -42,5 +43,30 @@ export function useVirtualSearchResults(): [CustomCard] {
       integration: '',
       isCollectionCard: false,
     },
+    {
+      id: 'aws-firehose-virtual',
+      type: 'virtual',
+      title: i18n.translate('xpack.observability_onboarding.packageList.amazonFirehoseTitle', {
+        defaultMessage: 'Amazon Firehose',
+      }),
+      description: i18n.translate(
+        'xpack.observability_onboarding.packageList.amazonFirehoseDescription',
+        {
+          defaultMessage: 'Collect Amazon Firehose logs.',
+        }
+      ),
+      name: 'aws-firehose',
+      categories: [],
+      icons: [
+        {
+          type: 'svg',
+          src: basePath?.prepend('/plugins/observabilityOnboarding/assets/aws_firehose.svg') ?? '',
+        },
+      ],
+      url: 'https://www.elastic.co/guide/en/kinesis/current/aws-firehose-setup-guide.html',
+      version: '',
+      integration: '',
+      isCollectionCard: false,
+    },
   ];
 }
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/components/app/header_action_menu/index.tsx b/x-pack/plugins/observability_solution/observability_onboarding/public/application/shared/header_action_menu.tsx
similarity index 100%
rename from x-pack/plugins/observability_solution/observability_onboarding/public/components/app/header_action_menu/index.tsx
rename to x-pack/plugins/observability_solution/observability_onboarding/public/application/shared/header_action_menu.tsx
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/assets/aws_firehose.svg b/x-pack/plugins/observability_solution/observability_onboarding/public/assets/aws_firehose.svg
new file mode 100644
index 00000000000000..53739b79bef77b
--- /dev/null
+++ b/x-pack/plugins/observability_solution/observability_onboarding/public/assets/aws_firehose.svg
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg width="24px" height="24px" viewBox="0 0 24 24" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+    <title>Icon-Architecture/16/Arch_Amazon-Kinesis-Data-Firehose_16</title>
+    <g id="Icon-Architecture/16/Arch_Amazon-Kinesis-Data-Firehose_16" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">
+        <g id="Icon-Architecture-BG/16/Analytics" fill="#8C4FFF">
+            <rect id="Rectangle" x="0" y="0" width="24" height="24"></rect>
+        </g>
+        <g id="Icon-Service/16/Amazon-Kinesis-Data-Firehose" transform="translate(5.000000, 6.000000)" fill="#FFFFFF">
+            <path d="M14.5836386,7.241 L13.9526386,8.017 C13.1876386,7.396 12.0286386,6.994 11.0006386,6.994 L11.0006386,6.056 L11.0006386,5.994 L11.0006386,5.056 C12.1386386,5.056 13.2796386,4.507 13.9696386,3.992 L14.5666386,4.794 C14.2016386,5.067 12.9546386,5.9 11.3996386,6.03 C12.5466386,6.117 13.7346386,6.552 14.5836386,7.241 L14.5836386,7.241 Z M9.00063863,6.62 L7.00063863,7.12 L7.00063863,4.902 L9.00063863,5.402 L9.00063863,6.62 Z M6.00063863,8 L5.00063863,8 L5.00063863,4 L6.00063863,4 L6.00063863,4.261 L6.00063863,7.761 L6.00063863,8 Z M9.62163863,4.526 L7.00063863,3.871 L7.00063863,3.5 C7.00063863,3.223 6.77663863,3 6.50063863,3 L4.50063863,3 C4.22463863,3 4.00063863,3.223 4.00063863,3.5 L4.00063863,4.409 C1.46663863,4.086 1.00063863,3.16 1.00063863,1.42 L1.00063863,1.77635684e-15 L0.000638629816,1.77635684e-15 L0.000638629816,1.42 C0.000638629816,3.918 1.14663863,5.056 4.00063863,5.403 L4.00063863,5.5 L0.000638629816,5.5 L0.000638629816,6.5 L4.00063863,6.5 L4.00063863,6.604 C1.21763863,6.983 0.00163862982,8.274 0.00163862982,10.882 L0.00163862982,10.99 C-0.000361370184,11.279 -0.00136137018,11.995 0.00363862982,12.048 L1.00063863,11.97 C0.99663863,11.874 0.99963863,11.252 1.00163863,10.994 L1.00163863,10.882 C1.00163863,9.148 1.54263863,7.991 4.00063863,7.615 L4.00063863,8.5 C4.00063863,8.776 4.22463863,9 4.50063863,9 L6.50063863,9 C6.77663863,9 7.00063863,8.776 7.00063863,8.5 L7.00063863,8.151 L9.62163863,7.496 C9.84463863,7.44 10.0006386,7.241 10.0006386,7.011 L10.0006386,5.011 C10.0006386,4.782 9.84463863,4.582 9.62163863,4.526 L9.62163863,4.526 Z" id="Amazon-Kinesis-Data-Firehose_Icon_16_Squid"></path>
+        </g>
+    </g>
+</svg>
\ No newline at end of file
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/assets/system.svg b/x-pack/plugins/observability_solution/observability_onboarding/public/assets/system.svg
new file mode 100644
index 00000000000000..aff04c6704dcc7
--- /dev/null
+++ b/x-pack/plugins/observability_solution/observability_onboarding/public/assets/system.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1000 1000"><path d="M433.41 29.92c-9.81 5.14-15.18 10.04-19.15 17.74-1.87 3.74-9.57 43.43-17.28 88.49-23.58 140.32-43.19 243.98-72.61 384.3l-2.57 12.38-10.27-10.97c-19.61-20.31-45.76-25.92-67.71-14.48-14.71 7.47-24.05 20.31-34.55 46.93-7.7 20.32-9.11 22.18-15.64 23.58-3.97.7-39.22 1.4-78.45 1.4-67.94 0-71.91.23-81.72 4.9C7.54 596.8 1.94 631.82 22.49 651.9c13.08 12.84 17.04 13.31 88.72 13.54 106 0 125.38-3.04 145.69-24.05l7.94-8.17 6.3 13.54c12.14 25.45 28.72 38.76 51.6 41.56 24.52 2.8 42.49-10.97 56.03-43.19 13.31-31.98 39.93-147.56 63.28-272.93 5.6-29.88 10.51-54.4 11.21-54.4.7 0 26.85 140.09 58.14 311.22 31.28 170.91 58.37 314.73 60.24 319.17 4.2 10.51 9.11 15.87 19.85 21.25 18.45 9.57 43.19 3.04 54.4-14.01 5.14-7.71 7.24-16.34 13.07-57.67 12.36-85.22 33.84-204.06 36.87-204.06.7 0 4.67 5.37 8.4 11.91 14.48 24.75 37.82 38.06 66.54 38.29 29.18 0 40.63-9.34 72.15-58.84l16.11-25.21 57.2-1.17c56.5-1.17 57.44-1.17 63.27-6.77 7.94-7.47 11.44-19.15 10.27-34.09-1.4-15.88-8.17-28.72-20.08-37.12l-9.57-6.77-57.43-1.17c-69.58-1.4-77.51-.23-94.33 14.94-6.3 5.84-17.74 19.84-24.98 31.29-7.47 11.44-13.78 20.78-14.01 20.31-.24-.23-2.57-12.61-5.37-27.32-8.64-48.8-19.38-69.81-40.86-80.55-22.41-11.21-48.33-6.31-64.21 11.91-14.47 16.34-30.12 56.03-43.66 110.67-3.5 14.47-6.77 25.68-7.24 24.52-.23-1.4-26.38-142.66-57.9-314.03-63.04-342.74-58.6-323.83-78.21-333.87-10.96-5.61-28.71-6.08-38.51-.71z"/></svg>
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/components/app/custom_logs/api_key_banner.tsx b/x-pack/plugins/observability_solution/observability_onboarding/public/components/app/custom_logs/api_key_banner.tsx
deleted file mode 100644
index b5448debbcbfa5..00000000000000
--- a/x-pack/plugins/observability_solution/observability_onboarding/public/components/app/custom_logs/api_key_banner.tsx
+++ /dev/null
@@ -1,162 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import {
-  EuiButtonIcon,
-  EuiCallOut,
-  EuiCopy,
-  EuiFieldText,
-  EuiFlexGroup,
-  EuiFlexItem,
-  EuiLoadingSpinner,
-} from '@elastic/eui';
-import { IHttpFetchError, ResponseErrorBody } from '@kbn/core-http-browser';
-import { i18n } from '@kbn/i18n';
-import { FETCH_STATUS } from '@kbn/observability-shared-plugin/public';
-import React from 'react';
-import { APIReturnType } from '../../../services/rest/create_call_api';
-
-type ApiKeyPayload = APIReturnType<'POST /internal/observability_onboarding/logs/flow'>;
-
-export type HasPrivileges = boolean;
-
-export function ApiKeyBanner({
-  hasPrivileges = true,
-  status,
-  payload,
-  error,
-}: {
-  hasPrivileges?: boolean;
-  status: FETCH_STATUS;
-  payload?: ApiKeyPayload;
-  error?: IHttpFetchError<ResponseErrorBody>;
-}) {
-  const loadingCallout = (
-    <EuiCallOut
-      title={
-        <EuiFlexGroup alignItems="center" gutterSize="m">
-          <EuiFlexItem grow={false}>
-            <EuiLoadingSpinner size="m" />
-          </EuiFlexItem>
-          <EuiFlexItem>
-            {i18n.translate('xpack.observability_onboarding.apiKeyBanner.loading', {
-              defaultMessage: 'Creating API Key',
-            })}
-          </EuiFlexItem>
-        </EuiFlexGroup>
-      }
-      color="primary"
-      data-test-subj="obltOnboardingLogsCreatingApiKey"
-    />
-  );
-
-  const apiKeySuccessCallout = (
-    <EuiCallOut
-      title={i18n.translate('xpack.observability_onboarding.apiKeyBanner.created', {
-        defaultMessage: 'API Key created.',
-      })}
-      color="success"
-      iconType="check"
-      data-test-subj="obltOnboardingLogsApiKeyCreated"
-    >
-      <p>
-        {i18n.translate('xpack.observability_onboarding.apiKeyBanner.created.description', {
-          defaultMessage:
-            'Remember to store this information in a safe place. It won’t be displayed anymore after you continue.',
-        })}
-      </p>
-      <EuiFieldText
-        data-test-subj="apmAgentKeyCallOutFieldText"
-        readOnly
-        value={payload?.apiKeyEncoded}
-        aria-label={i18n.translate('xpack.observability_onboarding.apiKeyBanner.field.label', {
-          defaultMessage: 'Api Key',
-        })}
-        append={
-          <EuiCopy textToCopy={payload?.apiKeyEncoded ?? ''}>
-            {(copy) => (
-              <EuiButtonIcon
-                data-test-subj="observabilityOnboardingApiKeySuccessCalloutButton"
-                iconType="copyClipboard"
-                onClick={copy}
-                color="success"
-                css={{
-                  '> svg.euiIcon': {
-                    borderRadius: '0 !important',
-                  },
-                }}
-                aria-label={i18n.translate(
-                  'xpack.observability_onboarding.apiKeyBanner.field.copyButton',
-                  {
-                    defaultMessage: 'Copy to clipboard',
-                  }
-                )}
-              />
-            )}
-          </EuiCopy>
-        }
-      />
-    </EuiCallOut>
-  );
-
-  const apiKeyFailureCallout = (
-    <EuiCallOut
-      title={i18n.translate('xpack.observability_onboarding.apiKeyBanner.failed', {
-        defaultMessage: 'Failed to create API key.',
-      })}
-      color="danger"
-      iconType="error"
-      data-test-subj="obltOnboardingLogsApiKeyCreationFailed"
-    >
-      <p>
-        {i18n.translate('xpack.observability_onboarding.apiKeyBanner.failed.description', {
-          defaultMessage: 'Something went wrong: {message}',
-          values: {
-            message: error?.body?.message,
-          },
-        })}
-      </p>
-    </EuiCallOut>
-  );
-
-  const noPermissionsCallout = (
-    <EuiCallOut
-      title={i18n.translate('xpack.observability_onboarding.apiKeyBanner.noPermissions', {
-        defaultMessage: 'User does not have permissions to create API key.',
-      })}
-      color="warning"
-      iconType="warning"
-      data-test-subj="obltOnboardingLogsApiKeyCreationNoPrivileges"
-    >
-      <p>
-        {i18n.translate('xpack.observability_onboarding.apiKeyBanner.noPermissions.description', {
-          defaultMessage:
-            'Required cluster privileges are {requiredClusterPrivileges} and required index privileges are {requiredIndexPrivileges} for indices {indices}, please add all required privileges to the role of the authenticated user.',
-          values: {
-            requiredClusterPrivileges: "['monitor', 'manage_own_api_key']",
-            requiredIndexPrivileges: "['auto_configure', 'create_doc']",
-            indices: "['logs-*-*', 'metrics-*-*']",
-          },
-        })}
-      </p>
-    </EuiCallOut>
-  );
-
-  if (!hasPrivileges) {
-    return noPermissionsCallout;
-  }
-
-  if (status === FETCH_STATUS.SUCCESS) {
-    return apiKeySuccessCallout;
-  }
-
-  if (status === FETCH_STATUS.FAILURE) {
-    return apiKeyFailureCallout;
-  }
-
-  return loadingCallout;
-}
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/components/app/custom_logs/configure_logs.tsx b/x-pack/plugins/observability_solution/observability_onboarding/public/components/app/custom_logs/configure_logs.tsx
deleted file mode 100644
index aeb87481b00ef4..00000000000000
--- a/x-pack/plugins/observability_solution/observability_onboarding/public/components/app/custom_logs/configure_logs.tsx
+++ /dev/null
@@ -1,420 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import {
-  EuiAccordion,
-  EuiButtonEmpty,
-  EuiButtonIcon,
-  EuiFieldText,
-  EuiFlexGroup,
-  EuiFlexItem,
-  EuiForm,
-  EuiFormRow,
-  EuiHorizontalRule,
-  EuiIconTip,
-  EuiLink,
-  EuiSpacer,
-  EuiText,
-  EuiTextArea,
-  useEuiFontSize,
-  useEuiTheme,
-} from '@elastic/eui';
-import { i18n } from '@kbn/i18n';
-import { FormattedMessage } from '@kbn/i18n-react';
-import React, { useCallback, useState } from 'react';
-import {
-  ConnectedCustomIntegrationsButton,
-  ConnectedCustomIntegrationsForm,
-  useConsumerCustomIntegrations,
-  CustomIntegrationsProvider,
-  Callbacks,
-} from '@kbn/custom-integrations';
-import { useKibana } from '@kbn/kibana-react-plugin/public';
-import { useWizard } from '.';
-import { OptionalFormRow } from '../../shared/optional_form_row';
-import { StepPanel, StepPanelContent, StepPanelFooter } from '../../shared/step_panel';
-import { BackButton } from '../../shared/back_button';
-import { getFilename } from './get_filename';
-
-const customIntegrationsTestSubjects = {
-  create: {
-    integrationName: 'obltOnboardingCustomLogsIntegrationsName',
-    datasetName: 'obltOnboardingCustomLogsDatasetName',
-    errorCallout: {
-      callout: 'obltOnboardingCustomIntegrationErrorCallout',
-    },
-  },
-  button: 'obltOnboardingCustomLogsContinue',
-};
-
-export function ConfigureLogs() {
-  const {
-    services: { http },
-  } = useKibana();
-
-  const { goToStep, setState, getState } = useWizard();
-  const { integrationName, datasetName, lastCreatedIntegrationOptions } = getState();
-
-  const onIntegrationCreation: Callbacks['onIntegrationCreation'] = (integrationOptions) => {
-    const { integrationName: createdIntegrationName, datasets: createdDatasets } =
-      integrationOptions;
-    setState((state) => ({
-      ...state,
-      integrationName: createdIntegrationName,
-      datasetName: createdDatasets[0].name,
-      lastCreatedIntegrationOptions: integrationOptions,
-    }));
-    goToStep('installElasticAgent');
-  };
-
-  return (
-    <CustomIntegrationsProvider
-      services={{ http }}
-      onIntegrationCreation={onIntegrationCreation}
-      initialState={{
-        mode: 'create',
-        context: {
-          options: {
-            deletePrevious: true,
-            resetOnCreation: false,
-            errorOnFailedCleanup: false,
-          },
-          ...(integrationName !== undefined && datasetName !== undefined
-            ? {
-                fields: {
-                  integrationName,
-                  datasets: [{ name: datasetName, type: 'logs' as const }],
-                },
-              }
-            : {}),
-          previouslyCreatedIntegration: lastCreatedIntegrationOptions,
-        },
-      }}
-    >
-      <ConfigureLogsContent />
-    </CustomIntegrationsProvider>
-  );
-}
-
-export function ConfigureLogsContent() {
-  const {
-    dispatchableEvents: { updateCreateFields },
-  } = useConsumerCustomIntegrations();
-  const { euiTheme } = useEuiTheme();
-  const xsFontSize = useEuiFontSize('xs').fontSize;
-
-  const { goBack, getState, setState } = useWizard();
-  const wizardState = getState();
-  const [serviceName, setServiceName] = useState(wizardState.serviceName);
-  const [logFilePaths, setLogFilePaths] = useState(wizardState.logFilePaths);
-  const [namespace, setNamespace] = useState(wizardState.namespace);
-  const [customConfigurations, setCustomConfigurations] = useState(
-    wizardState.customConfigurations
-  );
-  const logFilePathNotConfigured = logFilePaths.every((filepath) => !filepath);
-
-  const onContinue = useCallback(() => {
-    setState((state) => ({
-      ...state,
-      serviceName,
-      logFilePaths: logFilePaths.filter((filepath) => !!filepath),
-      namespace,
-      customConfigurations,
-    }));
-  }, [customConfigurations, logFilePaths, namespace, serviceName, setState]);
-
-  function addLogFilePath() {
-    setLogFilePaths((prev) => [...prev, '']);
-  }
-
-  function removeLogFilePath(index: number) {
-    setLogFilePaths((prev) => prev.filter((_, i) => i !== index));
-  }
-
-  function onLogFilePathChanges(index: number, event: React.FormEvent<HTMLInputElement>) {
-    const filepath = event.currentTarget?.value;
-    setLogFilePaths((prev) => prev.map((path, i) => (i === index ? filepath : path)));
-
-    if (index === 0) {
-      if (updateCreateFields) {
-        updateCreateFields({
-          integrationName: getFilename(filepath).toLowerCase(),
-          datasets: [
-            {
-              name: getFilename(filepath).toLowerCase(),
-              type: 'logs' as const,
-            },
-          ],
-        });
-      }
-    }
-  }
-
-  return (
-    <StepPanel
-      panelFooter={
-        <StepPanelFooter
-          items={[
-            <BackButton onBack={goBack} />,
-            <ConnectedCustomIntegrationsButton
-              isDisabled={logFilePathNotConfigured || !namespace}
-              onClick={onContinue}
-              testSubj={customIntegrationsTestSubjects.button}
-            />,
-          ]}
-        />
-      }
-    >
-      <StepPanelContent>
-        <EuiText color="subdued">
-          <p>
-            {i18n.translate('xpack.observability_onboarding.configureLogs.description', {
-              defaultMessage: 'Configure inputs',
-            })}
-          </p>
-        </EuiText>
-        <EuiSpacer size="l" />
-        <EuiForm fullWidth>
-          <EuiFormRow
-            label={i18n.translate('xpack.observability_onboarding.configureLogs.logFile.path', {
-              defaultMessage: 'Log file path',
-            })}
-            helpText={i18n.translate(
-              'xpack.observability_onboarding.configureLogs.logFile.helper',
-              {
-                defaultMessage: 'You can use a log file path or a log pattern.',
-              }
-            )}
-          >
-            <>
-              {logFilePaths.map((filepath, index) => (
-                <div key={index} data-test-subj={`obltOnboardingLogFilePath-${index}`}>
-                  {index > 0 && <EuiSpacer size="s" />}
-                  <EuiFlexGroup alignItems="center" gutterSize="xs">
-                    <EuiFlexItem>
-                      <EuiFieldText
-                        data-test-subj="observabilityOnboardingConfigureLogsFieldText"
-                        placeholder={i18n.translate(
-                          'xpack.observability_onboarding.configureLogs.logFile.placeholder',
-                          {
-                            defaultMessage: 'Example: /var/log/application.*',
-                          }
-                        )}
-                        value={filepath}
-                        onChange={(ev) => onLogFilePathChanges(index, ev)}
-                      />
-                    </EuiFlexItem>
-                    {index > 0 && (
-                      <EuiFlexItem grow={false}>
-                        <EuiButtonIcon
-                          iconType="trash"
-                          aria-label={i18n.translate(
-                            'xpack.observability_onboarding.configureLogsContent.euiButtonIcon.deleteLabel',
-                            { defaultMessage: 'Delete' }
-                          )}
-                          onClick={() => removeLogFilePath(index)}
-                          data-test-subj={`obltOnboardingLogFilePathDelete-${index}`}
-                        />
-                      </EuiFlexItem>
-                    )}
-                  </EuiFlexGroup>
-                </div>
-              ))}
-            </>
-          </EuiFormRow>
-          <EuiSpacer size="s" />
-          <EuiFlexGroup alignItems="flexStart" direction="column" gutterSize="xs">
-            <EuiFlexItem grow={false}>
-              <EuiButtonEmpty
-                iconType="plusInCircle"
-                onClick={addLogFilePath}
-                data-test-subj="obltOnboardingCustomLogsAddFilePath"
-              >
-                {i18n.translate('xpack.observability_onboarding.configureLogs.logFile.addRow', {
-                  defaultMessage: 'Add row',
-                })}
-              </EuiButtonEmpty>
-            </EuiFlexItem>
-          </EuiFlexGroup>
-          <EuiSpacer size="s" />
-          <OptionalFormRow
-            label={
-              <EuiFlexGroup alignItems="center" gutterSize="xs" responsive={false}>
-                <EuiFlexItem grow={false}>
-                  {i18n.translate('xpack.observability_onboarding.configureLogs.serviceName', {
-                    defaultMessage: 'Service name',
-                  })}
-                </EuiFlexItem>
-                <EuiFlexItem grow={false}>
-                  <EuiIconTip
-                    content={i18n.translate(
-                      'xpack.observability_onboarding.configureLogs.serviceName.tooltip',
-                      {
-                        defaultMessage:
-                          'Provide a service name to allow for distributed services running on multiple hosts to correlate the related instances.',
-                      }
-                    )}
-                    position="right"
-                  />
-                </EuiFlexItem>
-              </EuiFlexGroup>
-            }
-            helpText={
-              <FormattedMessage
-                id="xpack.observability_onboarding.configureLogs.serviceName.helper"
-                defaultMessage="Name the service your data is collected from."
-              />
-            }
-          >
-            <EuiFieldText
-              placeholder={i18n.translate(
-                'xpack.observability_onboarding.configureLogs.serviceName.placeholder',
-                {
-                  defaultMessage: 'Give your service a name',
-                }
-              )}
-              value={serviceName}
-              onChange={(event) => setServiceName(event.target.value)}
-              data-test-subj="obltOnboardingCustomLogsServiceName"
-            />
-          </OptionalFormRow>
-          <EuiHorizontalRule margin="m" />
-          <EuiFlexGroup alignItems="flexStart" direction="column" gutterSize="xs">
-            <EuiFlexItem style={{ width: '100%' }}>
-              <EuiAccordion
-                id="advancedSettingsAccordion"
-                css={{
-                  '.euiAccordion__buttonContent': {
-                    color: euiTheme.colors.primaryText,
-                    fontSize: xsFontSize,
-                  },
-                  '.euiAccordion__arrow svg': {
-                    stroke: euiTheme.colors.primary,
-                    width: euiTheme.size.m,
-                    height: euiTheme.size.m,
-                  },
-                }}
-                buttonContent={i18n.translate(
-                  'xpack.observability_onboarding.configureLogs.advancedSettings',
-                  {
-                    defaultMessage: 'Advanced settings',
-                  }
-                )}
-                data-test-subj="obltOnboardingCustomLogsAdvancedSettings"
-              >
-                <EuiSpacer size="l" />
-                <EuiFormRow
-                  label={
-                    <EuiFlexGroup alignItems="center" gutterSize="xs" responsive={false}>
-                      <EuiFlexItem grow={false}>
-                        {i18n.translate('xpack.observability_onboarding.configureLogs.namespace', {
-                          defaultMessage: 'Namespace',
-                        })}
-                      </EuiFlexItem>
-                      <EuiFlexItem grow={false}>
-                        <EuiIconTip
-                          content={i18n.translate(
-                            'xpack.observability_onboarding.configureLogs.namespace.tooltip',
-                            {
-                              defaultMessage:
-                                'Provide a namespace to customize the grouping of your logs. Defaults to the default namespace.',
-                            }
-                          )}
-                          position="right"
-                        />
-                      </EuiFlexItem>
-                    </EuiFlexGroup>
-                  }
-                  helpText={
-                    <FormattedMessage
-                      id="xpack.observability_onboarding.configureLogs.namespace.helper"
-                      defaultMessage="This setting changes the name of the integration's data stream. {learnMoreLink}"
-                      values={{
-                        learnMoreLink: (
-                          <EuiLink
-                            data-test-subj="observabilityOnboardingConfigureLogsLearnMoreLink"
-                            external
-                            target="_blank"
-                            href={
-                              'https://www.elastic.co/guide/en/fleet/current/data-streams.html#data-streams-naming-scheme'
-                            }
-                          >
-                            {i18n.translate(
-                              'xpack.observability_onboarding.configureLogs.learnMore',
-                              {
-                                defaultMessage: 'Learn more',
-                              }
-                            )}
-                          </EuiLink>
-                        ),
-                      }}
-                    />
-                  }
-                >
-                  <EuiFieldText
-                    placeholder={i18n.translate(
-                      'xpack.observability_onboarding.configureLogs.namespace.placeholder',
-                      {
-                        defaultMessage: 'Namespace',
-                      }
-                    )}
-                    value={namespace}
-                    onChange={(event) => setNamespace(event.target.value)}
-                    data-test-subj="obltOnboardingCustomLogsNamespace"
-                  />
-                </EuiFormRow>
-                <EuiSpacer size="l" />
-                <OptionalFormRow
-                  label={i18n.translate(
-                    'xpack.observability_onboarding.configureLogs.customConfig',
-                    {
-                      defaultMessage: 'Custom configurations',
-                    }
-                  )}
-                  helpText={
-                    <FormattedMessage
-                      id="xpack.observability_onboarding.configureLogs.customConfig.helper"
-                      defaultMessage="Add YAML configuration options to your agent configuration. Be careful using this feature as it can break your configuration file. {learnMoreLink}"
-                      values={{
-                        learnMoreLink: (
-                          <EuiLink
-                            data-test-subj="observabilityOnboardingConfigureLogsLearnMoreLink"
-                            external
-                            target="_blank"
-                            href={
-                              'https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html'
-                            }
-                          >
-                            {i18n.translate(
-                              'xpack.observability_onboarding.configureLogs.learnMore',
-                              {
-                                defaultMessage: 'Learn more',
-                              }
-                            )}
-                          </EuiLink>
-                        ),
-                      }}
-                    />
-                  }
-                >
-                  <EuiTextArea
-                    value={customConfigurations}
-                    onChange={(event) => setCustomConfigurations(event.target.value)}
-                    data-test-subj="obltOnboardingCustomLogsCustomConfig"
-                  />
-                </OptionalFormRow>
-              </EuiAccordion>
-            </EuiFlexItem>
-            <EuiSpacer size="s" />
-          </EuiFlexGroup>
-        </EuiForm>
-        <EuiSpacer size="l" />
-        <ConnectedCustomIntegrationsForm testSubjects={customIntegrationsTestSubjects} />
-      </StepPanelContent>
-    </StepPanel>
-  );
-}
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/components/app/custom_logs/get_filename.test.ts b/x-pack/plugins/observability_solution/observability_onboarding/public/components/app/custom_logs/get_filename.test.ts
deleted file mode 100644
index dd7109f5790a69..00000000000000
--- a/x-pack/plugins/observability_solution/observability_onboarding/public/components/app/custom_logs/get_filename.test.ts
+++ /dev/null
@@ -1,27 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { getFilename } from './get_filename';
-
-describe('Observability onboarding - get_filename', () => {
-  it.each([
-    ['test', '/logs-onboarding/test.log'],
-    ['test', '/logs-onboarding/test.log'],
-    ['test', 'test.log'],
-    ['test', '/logs-onboarding/long-path/test.log'],
-    ['test', '/logs-onboarding/test.20240223.log'],
-    ['test', 'test'],
-    ['', ''],
-    ['test', '\\logs-onboarding\\test.log'],
-    ['test', "/logs-on'boarding/test.log"],
-    ['te_st', "/logs-on'boarding/te'st.log"],
-    ['test_123', '/logs-onboarding/test 123.log'],
-    ['t_e_s_t_1_2_3_', '/logs-onboarding/t-e%s*t#1@2!3$.log'],
-  ])('should return "%s" for filename "%s"', (expectedFilename: string, filePath: string) => {
-    expect(getFilename(filePath)).toBe(expectedFilename);
-  });
-});
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/components/app/custom_logs/get_filename.ts b/x-pack/plugins/observability_solution/observability_onboarding/public/components/app/custom_logs/get_filename.ts
deleted file mode 100644
index 361f3e9a40ce40..00000000000000
--- a/x-pack/plugins/observability_solution/observability_onboarding/public/components/app/custom_logs/get_filename.ts
+++ /dev/null
@@ -1,19 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-export const getFilename = (path?: string) => {
-  if (!path) {
-    return '';
-  }
-
-  const filenameWithExt = path.replace(/^.*[\\\/](?!\d*$)/g, '');
-  const filenameParts = filenameWithExt.split('.');
-
-  return replaceSpecialChars(filenameParts[0]);
-};
-
-export const replaceSpecialChars = (filename: string) => filename.replaceAll(/[^a-zA-Z0-9_]/g, '_');
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/components/app/custom_logs/index.tsx b/x-pack/plugins/observability_solution/observability_onboarding/public/components/app/custom_logs/index.tsx
deleted file mode 100644
index ac1ba909562acd..00000000000000
--- a/x-pack/plugins/observability_solution/observability_onboarding/public/components/app/custom_logs/index.tsx
+++ /dev/null
@@ -1,77 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { CustomIntegrationOptions } from '@kbn/custom-integrations';
-import { i18n } from '@kbn/i18n';
-import { createWizardContext, Step } from '../../../context/create_wizard_context';
-import { ConfigureLogs } from './configure_logs';
-import { Inspect } from './inspect';
-import { InstallElasticAgent } from './install_elastic_agent';
-import { SelectLogs } from './select_logs';
-
-interface WizardState {
-  integrationName?: string;
-  lastCreatedIntegrationOptions?: CustomIntegrationOptions;
-  datasetName?: string;
-  serviceName: string;
-  logFilePaths: string[];
-  namespace: string;
-  customConfigurations: string;
-  logsType?:
-    | 'system'
-    | 'sys'
-    | 'http-endpoint'
-    | 'opentelemetry'
-    | 'amazon-firehose'
-    | 'log-file'
-    | 'service';
-  uploadType?: 'log-file' | 'api-key';
-  elasticAgentPlatform: 'linux-tar' | 'macos' | 'windows' | 'deb' | 'rpm';
-  autoDownloadConfig: boolean;
-  apiKeyEncoded: string;
-  onboardingId: string;
-}
-
-const initialState: WizardState = {
-  integrationName: undefined,
-  datasetName: undefined,
-  serviceName: '',
-  logFilePaths: [''],
-  namespace: 'default',
-  customConfigurations: '',
-  elasticAgentPlatform: 'linux-tar',
-  autoDownloadConfig: false,
-  apiKeyEncoded: '',
-  onboardingId: '',
-};
-
-export type CustomLogsSteps = 'selectLogs' | 'configureLogs' | 'installElasticAgent' | 'inspect';
-
-const steps: Record<CustomLogsSteps, Step> = {
-  selectLogs: { component: SelectLogs },
-  configureLogs: { component: ConfigureLogs },
-  installElasticAgent: {
-    component: InstallElasticAgent,
-    title: i18n.translate('xpack.observability_onboarding.customLogs.installShipper.title', {
-      defaultMessage: 'Install shipper to collect logs',
-    }),
-  },
-  inspect: { component: Inspect },
-};
-
-const {
-  Provider,
-  useWizard,
-  routes: customLogsRoutes,
-} = createWizardContext({
-  initialState,
-  initialStep: 'configureLogs',
-  steps,
-  basePath: '/customLogs',
-});
-
-export { Provider, useWizard, customLogsRoutes };
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/components/app/custom_logs/inspect.tsx b/x-pack/plugins/observability_solution/observability_onboarding/public/components/app/custom_logs/inspect.tsx
deleted file mode 100644
index 3b472d9d619eca..00000000000000
--- a/x-pack/plugins/observability_solution/observability_onboarding/public/components/app/custom_logs/inspect.tsx
+++ /dev/null
@@ -1,54 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React from 'react';
-import { FormattedMessage } from '@kbn/i18n-react';
-import { i18n } from '@kbn/i18n';
-import { EuiTitle, EuiSpacer } from '@elastic/eui';
-import { StepPanel, StepPanelContent, StepPanelFooter } from '../../shared/step_panel';
-import { useWizard } from '.';
-import { BackButton } from '../../shared/back_button';
-
-export function Inspect() {
-  const { goBack, getState, getPath, getUsage } = useWizard();
-  return (
-    <StepPanel
-      title="Inspect wizard"
-      panelFooter={<StepPanelFooter items={[<BackButton onBack={goBack} />]} />}
-    >
-      <StepPanelContent>
-        <EuiTitle size="s">
-          <h3>
-            {i18n.translate('xpack.observability_onboarding.inspect.h3.stateLabel', {
-              defaultMessage: 'State',
-            })}
-          </h3>
-        </EuiTitle>
-        <pre>{JSON.stringify(getState(), null, 4)}</pre>
-        <EuiSpacer size="m" />
-        <EuiTitle size="s">
-          <h3>
-            <FormattedMessage
-              id="xpack.observability_onboarding.inspect.h3.pathLabel"
-              defaultMessage="Path"
-            />
-          </h3>
-        </EuiTitle>
-        <pre>{JSON.stringify(getPath(), null, 4)}</pre>
-        <EuiSpacer size="m" />
-        <EuiTitle size="s">
-          <h3>
-            {i18n.translate('xpack.observability_onboarding.inspect.h3.usageLabel', {
-              defaultMessage: 'Usage',
-            })}
-          </h3>
-        </EuiTitle>
-        <pre>{JSON.stringify(getUsage(), null, 4)}</pre>
-      </StepPanelContent>
-    </StepPanel>
-  );
-}
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/components/app/custom_logs/install_elastic_agent.tsx b/x-pack/plugins/observability_solution/observability_onboarding/public/components/app/custom_logs/install_elastic_agent.tsx
deleted file mode 100644
index 85eb4eecd4eee7..00000000000000
--- a/x-pack/plugins/observability_solution/observability_onboarding/public/components/app/custom_logs/install_elastic_agent.tsx
+++ /dev/null
@@ -1,359 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { EuiButton, EuiCallOut, EuiHorizontalRule, EuiSpacer, EuiText } from '@elastic/eui';
-import { i18n } from '@kbn/i18n';
-import { useKibana } from '@kbn/kibana-react-plugin/public';
-import { default as React, useCallback, useEffect, useState } from 'react';
-import {
-  SingleDatasetLocatorParams,
-  SINGLE_DATASET_LOCATOR_ID,
-} from '@kbn/deeplinks-observability/locators';
-import { EaInstallProgressStepId } from '../../../../common/logs_flow_progress_step_id';
-import { useFlowProgressTelemetry } from '../../../hooks/use_flow_progress_telemetry';
-import { ObservabilityOnboardingPluginSetupDeps } from '../../../plugin';
-import { useWizard } from '.';
-import { FETCH_STATUS, useFetcher } from '../../../hooks/use_fetcher';
-import {
-  ElasticAgentPlatform,
-  getElasticAgentSetupCommand,
-} from '../../shared/get_elastic_agent_setup_command';
-import { InstallElasticAgentSteps, EuiStepStatus } from '../../shared/install_elastic_agent_steps';
-import { StepPanel, StepPanelContent, StepPanelFooter } from '../../shared/step_panel';
-import { ApiKeyBanner } from './api_key_banner';
-import { BackButton } from '../../shared/back_button';
-import { WindowsInstallStep } from '../../shared/windows_install_step';
-import { TroubleshootingLink } from '../../shared/troubleshooting_link';
-
-const defaultDatasetName = '';
-
-export function InstallElasticAgent() {
-  const {
-    services: { share },
-  } = useKibana<ObservabilityOnboardingPluginSetupDeps>();
-
-  const singleDatasetLocator =
-    share.url.locators.get<SingleDatasetLocatorParams>(SINGLE_DATASET_LOCATOR_ID);
-
-  const { goBack, getState, setState } = useWizard();
-  const wizardState = getState();
-  const { integrationName: integration, datasetName: dataset, autoDownloadConfig } = wizardState;
-
-  const [elasticAgentPlatform, setElasticAgentPlatform] =
-    useState<ElasticAgentPlatform>('linux-tar');
-
-  const enforcedDatasetName =
-    (integration === dataset ? dataset : `${integration}.${dataset}`) ?? defaultDatasetName;
-
-  async function onContinue() {
-    await singleDatasetLocator!.navigate({
-      integration,
-      dataset: enforcedDatasetName,
-      origin: { id: 'application-log-onboarding' },
-    });
-  }
-
-  function onAutoDownloadConfig() {
-    setState((state) => ({
-      ...state,
-      autoDownloadConfig: !state.autoDownloadConfig,
-    }));
-  }
-
-  const { data: monitoringRole, status: monitoringRoleStatus } = useFetcher((callApi) => {
-    if (!hasAlreadySavedFlow(getState())) {
-      return callApi('GET /internal/observability_onboarding/logs/setup/privileges');
-    }
-  }, []);
-
-  const { data: setup } = useFetcher((callApi) => {
-    return callApi('GET /internal/observability_onboarding/logs/setup/environment');
-  }, []);
-
-  const {
-    data: installShipperSetup,
-    status: installShipperSetupStatus,
-    error,
-  } = useFetcher(
-    (callApi) => {
-      const { datasetName, serviceName, namespace, customConfigurations, logFilePaths } =
-        getState();
-      if (!hasAlreadySavedFlow(getState()) && monitoringRole?.hasPrivileges && datasetName) {
-        return callApi('POST /internal/observability_onboarding/logs/flow', {
-          params: {
-            body: {
-              name: datasetName,
-              type: 'logFiles',
-              state: {
-                datasetName,
-                serviceName,
-                namespace,
-                customConfigurations,
-                logFilePaths,
-              },
-            },
-          },
-        });
-      }
-    },
-    [monitoringRole?.hasPrivileges]
-  );
-
-  const { status: saveOnboardingStateDataStatus } = useFetcher((callApi) => {
-    const {
-      onboardingId,
-      datasetName,
-      serviceName,
-      namespace,
-      customConfigurations,
-      logFilePaths,
-    } = getState();
-    if (onboardingId) {
-      return callApi('PUT /internal/observability_onboarding/flow/{onboardingId}', {
-        params: {
-          path: { onboardingId },
-          body: {
-            state: {
-              datasetName,
-              serviceName,
-              namespace,
-              customConfigurations,
-              logFilePaths,
-            },
-          },
-        },
-      });
-    }
-  }, []);
-
-  const { apiKeyEncoded, onboardingId } = installShipperSetup ?? getState();
-
-  const { data: yamlConfig = '', status: yamlConfigStatus } = useFetcher(
-    (callApi) => {
-      if (apiKeyEncoded && onboardingId) {
-        return callApi('GET /internal/observability_onboarding/elastic_agent/config', {
-          headers: { authorization: `ApiKey ${apiKeyEncoded}` },
-          params: { query: { onboardingId } },
-        });
-      }
-    },
-    [apiKeyEncoded, onboardingId, saveOnboardingStateDataStatus === FETCH_STATUS.SUCCESS]
-  );
-
-  useEffect(() => {
-    setState((state) => ({ ...state, onboardingId, apiKeyEncoded }));
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [onboardingId, apiKeyEncoded]);
-
-  const {
-    data: progressData,
-    status: progressStatus,
-    refetch: refetchProgress,
-  } = useFetcher(
-    (callApi) => {
-      if (onboardingId) {
-        return callApi('GET /internal/observability_onboarding/flow/{onboardingId}/progress', {
-          params: { path: { onboardingId } },
-        });
-      }
-    },
-    [onboardingId]
-  );
-
-  const progressSucceded = progressStatus === FETCH_STATUS.SUCCESS;
-
-  useEffect(() => {
-    if (progressSucceded) {
-      setTimeout(() => {
-        refetchProgress();
-      }, 2000);
-    }
-  }, [progressSucceded, refetchProgress]);
-
-  useFlowProgressTelemetry(progressData?.progress, 'custom_logs');
-
-  const getCheckLogsStep = useCallback(() => {
-    const progress = progressData?.progress;
-    if (progress) {
-      const stepStatus = progress?.['logs-ingest']?.status as EuiStepStatus;
-      const title =
-        stepStatus === 'loading'
-          ? CHECK_LOGS_LABELS.loading
-          : stepStatus === 'complete'
-          ? CHECK_LOGS_LABELS.completed
-          : CHECK_LOGS_LABELS.incomplete;
-      return {
-        title,
-        status: stepStatus,
-        'data-test-subj': 'obltOnboardingCheckLogsStep',
-      };
-    }
-    return {
-      title: CHECK_LOGS_LABELS.incomplete,
-      status: 'incomplete' as const,
-    };
-  }, [progressData?.progress]);
-
-  const isInstallStarted = progressData?.progress['ea-download'] !== undefined;
-  const isInstallCompleted = progressData?.progress?.['ea-status']?.status === 'complete';
-  const autoDownloadConfigStatus = (progressData?.progress?.['ea-config']?.status ??
-    'incomplete') as EuiStepStatus;
-
-  return (
-    <StepPanel
-      panelFooter={
-        <StepPanelFooter
-          items={[
-            <BackButton onBack={goBack} />,
-            <EuiButton
-              data-test-subj="obltOnboardingExploreLogs"
-              color="success"
-              fill
-              iconType="magnifyWithPlus"
-              onClick={onContinue}
-            >
-              {i18n.translate('xpack.observability_onboarding.steps.exploreLogs', {
-                defaultMessage: 'Explore logs',
-              })}
-            </EuiButton>,
-          ]}
-        />
-      }
-    >
-      <StepPanelContent>
-        <EuiText color="subdued">
-          <p>
-            {i18n.translate('xpack.observability_onboarding.installElasticAgent.description', {
-              defaultMessage:
-                'To collect the data from your system and stream it to Elastic, you first need to install a shipping tool on the machine generating the logs. In this case, the shipping tool is an agent developed by Elastic.',
-            })}
-          </p>
-        </EuiText>
-        <EuiSpacer size="m" />
-        {integration && (
-          <>
-            <EuiCallOut
-              title={i18n.translate(
-                'xpack.observability_onboarding.installElasticAgent.integrationSuccessCallout.title',
-                {
-                  defaultMessage: '{integrationName} integration installed.',
-                  values: {
-                    integrationName: integration,
-                  },
-                }
-              )}
-              color="success"
-              iconType="check"
-              data-test-subj="obltOnboardingCustomIntegrationInstalled"
-            />
-            <EuiSpacer size="m" />
-          </>
-        )}
-        {apiKeyEncoded && onboardingId ? (
-          <ApiKeyBanner
-            payload={{ apiKeyEncoded, onboardingId }}
-            hasPrivileges
-            status={FETCH_STATUS.SUCCESS}
-          />
-        ) : (
-          monitoringRoleStatus !== FETCH_STATUS.NOT_INITIATED &&
-          monitoringRoleStatus !== FETCH_STATUS.LOADING && (
-            <ApiKeyBanner
-              payload={installShipperSetup}
-              hasPrivileges={monitoringRole?.hasPrivileges}
-              status={installShipperSetupStatus}
-              error={error}
-            />
-          )
-        )}
-        <EuiSpacer size="m" />
-        <InstallElasticAgentSteps
-          installAgentPlatformOptions={[
-            {
-              label: i18n.translate(
-                'xpack.observability_onboarding.installElasticAgent.installStep.choosePlatform.linux',
-                { defaultMessage: 'Linux' }
-              ),
-              id: 'linux-tar',
-            },
-            {
-              label: i18n.translate(
-                'xpack.observability_onboarding.installElasticAgent.installStep.choosePlatform.macOS',
-                { defaultMessage: 'MacOS' }
-              ),
-              id: 'macos',
-            },
-            {
-              label: i18n.translate(
-                'xpack.observability_onboarding.installElasticAgent.installStep.choosePlatform.windows',
-                { defaultMessage: 'Windows' }
-              ),
-              id: 'windows',
-              disableSteps: true,
-              children: (
-                <WindowsInstallStep docsLink="https://www.elastic.co/guide/en/observability/current/logs-stream.html" />
-              ),
-            },
-          ]}
-          onSelectPlatform={(id) => setElasticAgentPlatform(id)}
-          selectedPlatform={elasticAgentPlatform}
-          installAgentCommand={getElasticAgentSetupCommand({
-            elasticAgentPlatform,
-            apiKeyEncoded,
-            apiEndpoint: setup?.apiEndpoint,
-            scriptDownloadUrl: setup?.scriptDownloadUrl,
-            elasticAgentVersion: setup?.elasticAgentVersion,
-            autoDownloadConfig,
-            onboardingId,
-          })}
-          autoDownloadConfig={autoDownloadConfig}
-          onToggleAutoDownloadConfig={onAutoDownloadConfig}
-          installAgentStatus={
-            installShipperSetupStatus === FETCH_STATUS.LOADING
-              ? 'loading'
-              : isInstallCompleted
-              ? 'complete'
-              : 'current'
-          }
-          showInstallProgressSteps={isInstallStarted}
-          installProgressSteps={
-            (progressData?.progress ?? {}) as Partial<
-              Record<EaInstallProgressStepId, { status: EuiStepStatus; message?: string }>
-            >
-          }
-          configureAgentStatus={
-            yamlConfigStatus === FETCH_STATUS.LOADING ? 'loading' : autoDownloadConfigStatus
-          }
-          configureAgentYaml={yamlConfig}
-          appendedSteps={[getCheckLogsStep()]}
-        />
-      </StepPanelContent>
-      <EuiHorizontalRule />
-      <TroubleshootingLink />
-    </StepPanel>
-  );
-}
-
-type WizardState = ReturnType<ReturnType<typeof useWizard>['getState']>;
-function hasAlreadySavedFlow({ apiKeyEncoded, onboardingId }: WizardState) {
-  return Boolean(apiKeyEncoded && onboardingId);
-}
-
-const CHECK_LOGS_LABELS = {
-  incomplete: i18n.translate(
-    'xpack.observability_onboarding.installElasticAgent.progress.logsIngest.incompleteTitle',
-    { defaultMessage: 'Ship logs to Elastic Observability' }
-  ),
-  loading: i18n.translate(
-    'xpack.observability_onboarding.installElasticAgent.progress.logsIngest.loadingTitle',
-    { defaultMessage: 'Waiting for logs to be shipped...' }
-  ),
-  completed: i18n.translate(
-    'xpack.observability_onboarding.installElasticAgent.progress.logsIngest.completedTitle',
-    { defaultMessage: 'Logs are being shipped!' }
-  ),
-};
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/components/app/custom_logs/select_logs.tsx b/x-pack/plugins/observability_solution/observability_onboarding/public/components/app/custom_logs/select_logs.tsx
deleted file mode 100644
index 9dbab2b657c09d..00000000000000
--- a/x-pack/plugins/observability_solution/observability_onboarding/public/components/app/custom_logs/select_logs.tsx
+++ /dev/null
@@ -1,216 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-/* eslint-disable @elastic/eui/href-or-on-click */
-
-import React, { PropsWithChildren, MouseEvent } from 'react';
-import {
-  EuiTitle,
-  EuiLink,
-  EuiButton,
-  EuiFlexGroup,
-  EuiFlexItem,
-  EuiHorizontalRule,
-  EuiSpacer,
-  EuiCard,
-  EuiIcon,
-  EuiIconProps,
-} from '@elastic/eui';
-import { i18n } from '@kbn/i18n';
-import { StepPanel, StepPanelContent, StepPanelFooter } from '../../shared/step_panel';
-import { useWizard } from '.';
-import { useKibanaNavigation } from '../../../hooks/use_kibana_navigation';
-
-export function SelectLogs() {
-  const { navigateToKibanaUrl, navigateToAppUrl } = useKibanaNavigation();
-  const { goToStep, setState } = useWizard();
-
-  function onBack() {
-    navigateToKibanaUrl('/app/observabilityOnboarding');
-  }
-
-  return (
-    <StepPanel
-      title={i18n.translate('xpack.observability_onboarding.selectLogs.chooseType', {
-        defaultMessage: 'What logs do you want to collect?',
-      })}
-      panelFooter={
-        <StepPanelFooter
-          items={[
-            <EuiButton
-              data-test-subj="observabilityOnboardingSelectLogsBackButton"
-              color="text"
-              onClick={onBack}
-            >
-              {i18n.translate('xpack.observability_onboarding.steps.back', {
-                defaultMessage: 'Back',
-              })}
-            </EuiButton>,
-            <></>,
-          ]}
-        />
-      }
-    >
-      <StepPanelContent>
-        <EuiFlexGroup>
-          <EuiFlexItem grow={false} style={{ width: '50%' }}>
-            <OptionCard
-              title={i18n.translate('xpack.observability_onboarding.selectLogs.streamLogFiles', {
-                defaultMessage: 'Stream log files',
-              })}
-              iconType="desktop"
-              onClick={() => {
-                setState((state) => ({ ...state, logsType: 'log-file' }));
-                goToStep('configureLogs');
-              }}
-              description={i18n.translate(
-                'xpack.observability_onboarding.selectLogs.streamLogFiles.description',
-                {
-                  defaultMessage: 'Stream your log file or directory.',
-                }
-              )}
-            />
-          </EuiFlexItem>
-        </EuiFlexGroup>
-        <EuiHorizontalRule margin="l" />
-        <LogsTypeSection
-          title={i18n.translate('xpack.observability_onboarding.selectLogs.networkStreamingLogs', {
-            defaultMessage: 'Network streaming logs',
-          })}
-        >
-          <EuiFlexGroup>
-            <EuiFlexItem>
-              <OptionCard
-                title={i18n.translate('xpack.observability_onboarding.selectLogs.sysLog', {
-                  defaultMessage: 'TCP/UDP/Syslog',
-                })}
-                iconType="documents"
-                onClick={() => {}}
-                description={i18n.translate(
-                  'xpack.observability_onboarding.selectLogs.sysLog.description',
-                  {
-                    defaultMessage: 'Stream logs over TCP or UDP ports or from your syslog server.',
-                  }
-                )}
-              />
-            </EuiFlexItem>
-            <EuiFlexItem>
-              <OptionCard
-                title={i18n.translate(
-                  'xpack.observability_onboarding.selectLogs.httpEndpointLogs',
-                  {
-                    defaultMessage: 'HTTP Endpoint',
-                  }
-                )}
-                iconType="documents"
-                onClick={() => {}}
-                description={i18n.translate(
-                  'xpack.observability_onboarding.selectLogs.httpEndpointLogs.description',
-                  {
-                    defaultMessage: 'Collect JSON data from listening HTTP port.',
-                  }
-                )}
-              />
-            </EuiFlexItem>
-          </EuiFlexGroup>
-        </LogsTypeSection>
-        <EuiHorizontalRule margin="l" />
-        <LogsTypeSection
-          title={i18n.translate('xpack.observability_onboarding.selectLogs.other', {
-            defaultMessage: 'Other',
-          })}
-        >
-          <EuiFlexGroup>
-            <EuiFlexItem>
-              <OptionCard
-                title={i18n.translate('xpack.observability_onboarding.selectLogs.uploadLogFiles', {
-                  defaultMessage: 'Upload log files',
-                })}
-                iconType="exportAction"
-                onClick={() => {}}
-                description={i18n.translate(
-                  'xpack.observability_onboarding.selectLogs.uploadLogFiles.description',
-                  {
-                    defaultMessage:
-                      'Upload data from a CSV, TSV, JSON or other log file type for analysis.',
-                  }
-                )}
-              />
-            </EuiFlexItem>
-            <EuiFlexItem>
-              <OptionCard
-                title={i18n.translate('xpack.observability_onboarding.selectLogs.useOwnShipper', {
-                  defaultMessage: 'Get an API key',
-                })}
-                iconType="package"
-                onClick={() => {}}
-                description={i18n.translate(
-                  'xpack.observability_onboarding.selectLogs.useOwnShipper.description',
-                  {
-                    defaultMessage:
-                      'Use your own shipper to collect logs data by generating an API key.',
-                  }
-                )}
-              />
-            </EuiFlexItem>
-          </EuiFlexGroup>
-          <EuiSpacer size="m" />
-          <EuiLink
-            data-test-subj="observabilityOnboardingSelectLogsExploreOtherIntegrationsLink"
-            href="#"
-            target="_blank"
-            onClick={(event: MouseEvent) => {
-              event.preventDefault();
-              navigateToAppUrl('/integrations/browse/observability');
-            }}
-          >
-            {i18n.translate('xpack.observability_onboarding.exploreOtherIntegrations', {
-              defaultMessage: 'Explore other integrations',
-            })}
-          </EuiLink>
-        </LogsTypeSection>
-      </StepPanelContent>
-    </StepPanel>
-  );
-}
-
-function LogsTypeSection({ title, children }: PropsWithChildren<{ title: string }>) {
-  return (
-    <>
-      <EuiTitle size="s">
-        <h3>{title}</h3>
-      </EuiTitle>
-      <EuiSpacer size="m" />
-      {children}
-    </>
-  );
-}
-
-function OptionCard({
-  title,
-  iconType,
-  onClick,
-  description,
-}: {
-  title: string;
-  iconType: EuiIconProps['type'];
-  onClick: () => void;
-  description: string;
-}) {
-  return (
-    <EuiCard
-      layout="horizontal"
-      icon={<EuiIcon type={iconType} size="l" />}
-      title={title}
-      titleSize="xs"
-      paddingSize="m"
-      onClick={onClick}
-      hasBorder={true}
-      description={description}
-    />
-  );
-}
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/components/app/home/index.tsx b/x-pack/plugins/observability_solution/observability_onboarding/public/components/app/home/index.tsx
deleted file mode 100644
index 0c5c331b1506ff..00000000000000
--- a/x-pack/plugins/observability_solution/observability_onboarding/public/components/app/home/index.tsx
+++ /dev/null
@@ -1,366 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import {
-  EuiBadge,
-  EuiButton,
-  EuiCard,
-  EuiFlexGroup,
-  EuiFlexItem,
-  EuiHorizontalRule,
-  EuiIcon,
-  EuiLink,
-  EuiSpacer,
-  EuiText,
-  EuiTitle,
-  useEuiTheme,
-  EuiPanel,
-} from '@elastic/eui';
-import { i18n } from '@kbn/i18n';
-import { useBreadcrumbs } from '@kbn/observability-shared-plugin/public';
-import React from 'react';
-import styled from '@emotion/styled';
-import { breadcrumbsApp } from '../../../application/app';
-import { useKibanaNavigation } from '../../../hooks/use_kibana_navigation';
-import apacheIcon from '../../../icons/apache.svg';
-import apmIcon from '../../../icons/apm.svg';
-import awsIcon from '../../../icons/aws.svg';
-import azureIcon from '../../../icons/azure.svg';
-import gcpIcon from '../../../icons/gcp.svg';
-import kinesisIcon from '../../../icons/kinesis.svg';
-import kubernetesIcon from '../../../icons/kubernetes.svg';
-import loggingIcon from '../../../icons/logging.svg';
-import nginxIcon from '../../../icons/nginx.svg';
-import opentelemetryIcon from '../../../icons/opentelemetry.svg';
-import systemIcon from '../../../icons/system.svg';
-
-const StyledItem = styled(EuiFlexItem)`
-  flex-direction: row;
-  &:before {
-    content: '•';
-    margin-right: 20px;
-  }
-`;
-
-export function Home() {
-  useBreadcrumbs([], breadcrumbsApp);
-  const { euiTheme } = useEuiTheme();
-
-  const { navigateToKibanaUrl } = useKibanaNavigation();
-
-  const handleClickSystemLogs = () => {
-    navigateToKibanaUrl('/app/observabilityOnboarding/systemLogs');
-  };
-  const handleClickCustomLogs = () => {
-    navigateToKibanaUrl('/app/observabilityOnboarding/customLogs');
-  };
-  const handleClickApmSetupGuide = () => {
-    navigateToKibanaUrl('/app/apm/tutorial');
-  };
-  const handleClickKubernetesSetupGuide = () => {
-    navigateToKibanaUrl('/app/integrations/detail/kubernetes');
-  };
-  const handleClickIntegrations = () => {
-    navigateToKibanaUrl('/app/integrations');
-  };
-  const handleClickSampleData = () => {
-    navigateToKibanaUrl('/app/home#/tutorial_directory/sampleData');
-  };
-  const handleClickUploadFile = () => {
-    navigateToKibanaUrl('/app/home#/tutorial_directory/fileDataViz');
-  };
-
-  return (
-    <EuiPanel hasShadow={false} color="transparent">
-      <EuiFlexGroup
-        direction="column"
-        alignItems="center"
-        style={{ margin: 'auto', maxWidth: 800 }}
-      >
-        <EuiFlexItem grow={false}>
-          <EuiSpacer />
-          <EuiTitle size="l" data-test-subj="obltOnboardingHomeTitle">
-            <h1>
-              {i18n.translate('xpack.observability_onboarding.home.title', {
-                defaultMessage: 'Onboard Observability data',
-              })}
-            </h1>
-          </EuiTitle>
-        </EuiFlexItem>
-        <EuiFlexItem grow={false}>
-          <EuiText color="subdued" style={{ textAlign: 'center' }}>
-            <p>
-              {i18n.translate('xpack.observability_onboarding.home.description', {
-                defaultMessage: 'Select your method for collecting data into Observability.',
-              })}
-            </p>
-          </EuiText>
-          <EuiSpacer />
-        </EuiFlexItem>
-        <EuiFlexItem grow={false} style={{ width: '100%' }}>
-          <EuiFlexGroup alignItems="stretch">
-            <EuiFlexItem>
-              <EuiCard
-                icon={<EuiIcon type={systemIcon} size="l" />}
-                betaBadgeProps={{
-                  'data-test-subj': 'obltOnboardingHomeQuickstartBadge',
-                  color: 'accent',
-                  label: i18n.translate(
-                    'xpack.observability_onboarding.card.systemLogs.quickstartBadge',
-                    { defaultMessage: 'Quick start' }
-                  ),
-                }}
-                title={i18n.translate('xpack.observability_onboarding.card.systemLogs.title', {
-                  defaultMessage: 'Stream host system logs',
-                })}
-                footer={
-                  <EuiButton
-                    onClick={handleClickSystemLogs}
-                    color="primary"
-                    fill
-                    data-test-subj="obltOnboardingHomeStartSystemLogStream"
-                  >
-                    {getStartedLabel}
-                  </EuiButton>
-                }
-                style={{
-                  borderColor: euiTheme.colors.accent,
-                  borderWidth: 2,
-                }}
-                paddingSize="m"
-                display="plain"
-                hasBorder
-                onClick={handleClickSystemLogs}
-              >
-                <EuiSpacer size="s" />
-                <EuiBadge color="hollow">{elasticAgentLabel}</EuiBadge>
-                <EuiSpacer size="m" />
-                <EuiText color="subdued" size="s" textAlign="center">
-                  <p>
-                    {i18n.translate('xpack.observability_onboarding.card.systemLogs.description1', {
-                      defaultMessage:
-                        'The quickest path to onboard log data from your own machine or server.',
-                    })}
-                  </p>
-                </EuiText>
-                <EuiSpacer size="s" />
-              </EuiCard>
-            </EuiFlexItem>
-            <EuiFlexItem>
-              <EuiCard
-                icon={<EuiIcon type={loggingIcon} size="l" />}
-                title={i18n.translate('xpack.observability_onboarding.card.customLogs.title', {
-                  defaultMessage: 'Stream log files',
-                })}
-                footer={
-                  <EuiButton
-                    onClick={handleClickCustomLogs}
-                    color="primary"
-                    fill
-                    data-test-subj="obltOnboardingHomeStartLogFileStream"
-                  >
-                    {getStartedLabel}
-                  </EuiButton>
-                }
-                paddingSize="m"
-                display="plain"
-                hasBorder
-                onClick={handleClickCustomLogs}
-              >
-                <EuiSpacer size="s" />
-                <EuiBadge color="hollow">{elasticAgentLabel}</EuiBadge>
-                <EuiSpacer size="m" />
-                <EuiText color="subdued" size="s" textAlign="center">
-                  <p>
-                    {i18n.translate(
-                      'xpack.observability_onboarding.card.customLogs.description.text',
-                      {
-                        defaultMessage:
-                          'Stream any logs into Elastic in a simple way and explore their data.',
-                      }
-                    )}
-                  </p>
-                </EuiText>
-                <EuiSpacer size="s" />
-              </EuiCard>
-            </EuiFlexItem>
-          </EuiFlexGroup>
-        </EuiFlexItem>
-        <EuiFlexItem grow={false} style={{ width: '100%' }}>
-          <EuiFlexGroup alignItems="stretch">
-            <EuiFlexItem>
-              <EuiCard
-                icon={
-                  <EuiFlexGroup gutterSize="m" justifyContent="center">
-                    <EuiIcon type={apmIcon} size="l" />
-                    <EuiIcon type={opentelemetryIcon} size="l" />
-                  </EuiFlexGroup>
-                }
-                title={i18n.translate('xpack.observability_onboarding.card.apm.title', {
-                  defaultMessage: 'Collect application performance data',
-                })}
-                description={
-                  <EuiText color="subdued" size="s" textAlign="center">
-                    <p>
-                      {i18n.translate('xpack.observability_onboarding.card.apm.description', {
-                        defaultMessage:
-                          'Collect traces, logs, and metrics from OpenTelemetry or APM custom agent.',
-                      })}
-                    </p>
-                  </EuiText>
-                }
-                footer={
-                  <EuiButton
-                    onClick={handleClickApmSetupGuide}
-                    color="primary"
-                    data-test-subj="obltOnboardingHomeStartApmTutorial"
-                  >
-                    {getStartedLabel}
-                  </EuiButton>
-                }
-                paddingSize="m"
-                titleSize="xs"
-                display="plain"
-                hasBorder
-                onClick={handleClickApmSetupGuide}
-              />
-            </EuiFlexItem>
-            <EuiFlexItem>
-              <EuiCard
-                icon={<EuiIcon type={kubernetesIcon} size="l" />}
-                title={i18n.translate('xpack.observability_onboarding.card.k8s.title', {
-                  defaultMessage: 'Collect Kubernetes clusters data',
-                })}
-                description={
-                  <EuiText color="subdued" size="s" textAlign="center">
-                    <p>
-                      {i18n.translate('xpack.observability_onboarding.card.k8s.description', {
-                        defaultMessage:
-                          'Collect logs and metrics from Kubernetes clusters with Elastic Agent.',
-                      })}
-                    </p>
-                  </EuiText>
-                }
-                footer={
-                  <EuiButton
-                    onClick={handleClickKubernetesSetupGuide}
-                    color="primary"
-                    data-test-subj="obltOnboardingHomeGoToKubernetesIntegration"
-                  >
-                    {getStartedLabel}
-                  </EuiButton>
-                }
-                titleSize="xs"
-                paddingSize="m"
-                display="plain"
-                hasBorder
-                onClick={handleClickKubernetesSetupGuide}
-              />
-            </EuiFlexItem>
-          </EuiFlexGroup>
-        </EuiFlexItem>
-        <EuiFlexItem grow={false} style={{ width: '100%' }}>
-          <EuiCard
-            icon={
-              <EuiFlexGroup gutterSize="m" justifyContent="center">
-                <EuiIcon type={kinesisIcon} size="l" />
-                <EuiIcon type={awsIcon} size="l" />
-                <EuiIcon type={apacheIcon} size="l" />
-                <EuiIcon type={nginxIcon} size="l" />
-                <EuiIcon type={gcpIcon} size="l" />
-                <EuiIcon type={azureIcon} size="l" />
-              </EuiFlexGroup>
-            }
-            title={i18n.translate('xpack.observability_onboarding.card.integrations.title', {
-              defaultMessage: 'Explore 300+ ways of ingesting data with our integrations',
-            })}
-            footer={
-              <>
-                <EuiButton
-                  onClick={handleClickIntegrations}
-                  color="primary"
-                  data-test-subj="obltOnboardingHomeExploreIntegrations"
-                >
-                  {i18n.translate('xpack.observability_onboarding.card.integrations.start', {
-                    defaultMessage: 'Start exploring',
-                  })}
-                </EuiButton>
-                <EuiHorizontalRule margin="m" />
-                <EuiFlexGroup justifyContent="center" alignItems="center">
-                  <EuiFlexItem grow={false}>
-                    {i18n.translate('xpack.observability_onboarding.card.integrations.quickLinks', {
-                      defaultMessage: 'Quick links:',
-                    })}
-                  </EuiFlexItem>
-                  <EuiFlexItem grow={false}>
-                    <EuiFlexGroup style={{ flexWrap: 'nowrap' }} alignItems="flexStart">
-                      <EuiFlexItem grow={false}>
-                        <EuiLink
-                          onClick={handleClickSampleData}
-                          data-test-subj="obltOnboardingHomeUseSampleData"
-                        >
-                          {i18n.translate(
-                            'xpack.observability_onboarding.card.integrations.sampleData',
-                            { defaultMessage: 'Use sample data' }
-                          )}
-                        </EuiLink>
-                      </EuiFlexItem>
-                      <EuiFlexItem grow={false}>
-                        <StyledItem>
-                          <EuiLink
-                            onClick={handleClickUploadFile}
-                            data-test-subj="obltOnboardingHomeUploadAFile"
-                          >
-                            {i18n.translate(
-                              'xpack.observability_onboarding.card.integrations.uploadFile',
-                              { defaultMessage: 'Upload a file' }
-                            )}
-                          </EuiLink>
-                        </StyledItem>
-                      </EuiFlexItem>
-                      <EuiFlexItem grow={false}>
-                        <StyledItem>
-                          <EuiLink
-                            data-test-subj="observabilityOnboardingHomeAwsFirehoseLink"
-                            href="https://www.elastic.co/guide/en/kinesis/current/aws-firehose-setup-guide.html"
-                            target="_blank"
-                            external
-                            style={{
-                              whiteSpace: 'nowrap',
-                            }}
-                          >
-                            {i18n.translate(
-                              'xpack.observability_onboarding.card.integrations.awsFirehose',
-                              { defaultMessage: 'AWS Firehose' }
-                            )}
-                          </EuiLink>
-                        </StyledItem>
-                      </EuiFlexItem>
-                    </EuiFlexGroup>
-                  </EuiFlexItem>
-                </EuiFlexGroup>
-                <EuiSpacer size="m" />
-              </>
-            }
-            titleSize="xs"
-            paddingSize="m"
-            display="plain"
-            hasBorder
-          />
-        </EuiFlexItem>
-      </EuiFlexGroup>
-    </EuiPanel>
-  );
-}
-
-const getStartedLabel = i18n.translate('xpack.observability_onboarding.card.getStarted', {
-  defaultMessage: 'Get started',
-});
-
-const elasticAgentLabel = i18n.translate('xpack.observability_onboarding.card.elasticAgent', {
-  defaultMessage: 'Elastic Agent',
-});
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/components/app/system_logs/index.tsx b/x-pack/plugins/observability_solution/observability_onboarding/public/components/app/system_logs/index.tsx
deleted file mode 100644
index 2b5bf2320c18ce..00000000000000
--- a/x-pack/plugins/observability_solution/observability_onboarding/public/components/app/system_logs/index.tsx
+++ /dev/null
@@ -1,48 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { i18n } from '@kbn/i18n';
-import { createWizardContext, Step } from '../../../context/create_wizard_context';
-import { InstallElasticAgent } from './install_elastic_agent';
-
-interface WizardState {
-  elasticAgentPlatform: 'linux-tar' | 'macos' | 'windows';
-  autoDownloadConfig: boolean;
-  apiKeyEncoded: string;
-  onboardingId: string;
-}
-
-const initialState: WizardState = {
-  elasticAgentPlatform: 'linux-tar',
-  autoDownloadConfig: false,
-  apiKeyEncoded: '',
-  onboardingId: '',
-};
-
-export type SystemLogsSteps = 'installElasticAgent';
-
-const steps: Record<SystemLogsSteps, Step> = {
-  installElasticAgent: {
-    component: InstallElasticAgent,
-    title: i18n.translate('xpack.observability_onboarding.systemLogs.installShipper.title', {
-      defaultMessage: 'Install shipper to collect system logs',
-    }),
-  },
-};
-
-const {
-  Provider,
-  useWizard,
-  routes: systemLogsRoutes,
-} = createWizardContext({
-  initialState,
-  initialStep: 'installElasticAgent',
-  steps,
-  basePath: '/systemLogs',
-});
-
-export { Provider, useWizard, systemLogsRoutes };
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/components/app/system_logs/install_elastic_agent.tsx b/x-pack/plugins/observability_solution/observability_onboarding/public/components/app/system_logs/install_elastic_agent.tsx
deleted file mode 100644
index 634296daa10d6e..00000000000000
--- a/x-pack/plugins/observability_solution/observability_onboarding/public/components/app/system_logs/install_elastic_agent.tsx
+++ /dev/null
@@ -1,326 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import {
-  EuiButton,
-  EuiFlexGroup,
-  EuiFlexItem,
-  EuiHorizontalRule,
-  EuiSpacer,
-  EuiText,
-} from '@elastic/eui';
-import {
-  AllDatasetsLocatorParams,
-  ALL_DATASETS_LOCATOR_ID,
-  SingleDatasetLocatorParams,
-  SINGLE_DATASET_LOCATOR_ID,
-} from '@kbn/deeplinks-observability/locators';
-import { i18n } from '@kbn/i18n';
-import { useKibana } from '@kbn/kibana-react-plugin/public';
-import { default as React, useCallback, useEffect, useState } from 'react';
-import { EaInstallProgressStepId } from '../../../../common/logs_flow_progress_step_id';
-import { useFlowProgressTelemetry } from '../../../hooks/use_flow_progress_telemetry';
-import { useWizard } from '.';
-import { FETCH_STATUS, useFetcher } from '../../../hooks/use_fetcher';
-import { ObservabilityOnboardingPluginSetupDeps } from '../../../plugin';
-import { BackButton } from '../../shared/back_button';
-import {
-  ElasticAgentPlatform,
-  getElasticAgentSetupCommand,
-} from '../../shared/get_elastic_agent_setup_command';
-import { EuiStepStatus, InstallElasticAgentSteps } from '../../shared/install_elastic_agent_steps';
-import { StepPanel, StepPanelContent, StepPanelFooter } from '../../shared/step_panel';
-import { TroubleshootingLink } from '../../shared/troubleshooting_link';
-import { WindowsInstallStep } from '../../shared/windows_install_step';
-import { ApiKeyBanner } from '../custom_logs/api_key_banner';
-import { SystemIntegrationBanner, SystemIntegrationBannerState } from './system_integration_banner';
-
-export function InstallElasticAgent() {
-  const {
-    services: { share },
-  } = useKibana<ObservabilityOnboardingPluginSetupDeps>();
-
-  const singleDatasetLocator =
-    share.url.locators.get<SingleDatasetLocatorParams>(SINGLE_DATASET_LOCATOR_ID);
-  const allDataSetsLocator =
-    share.url.locators.get<AllDatasetsLocatorParams>(ALL_DATASETS_LOCATOR_ID);
-
-  const { goBack, getState, setState } = useWizard();
-  const wizardState = getState();
-  const [elasticAgentPlatform, setElasticAgentPlatform] =
-    useState<ElasticAgentPlatform>('linux-tar');
-  const [systemIntegrationStatus, setSystemIntegrationStatus] =
-    useState<SystemIntegrationBannerState>('pending');
-
-  const onIntegrationStatusChange = useCallback((status: SystemIntegrationBannerState) => {
-    setSystemIntegrationStatus(status);
-  }, []);
-
-  const datasetName = 'system-logs';
-
-  async function onContinue() {
-    if (systemIntegrationStatus === 'rejected') {
-      await allDataSetsLocator!.navigate({
-        origin: { id: 'application-log-onboarding' },
-      });
-      return;
-    }
-
-    await singleDatasetLocator!.navigate({
-      integration: 'system',
-      dataset: 'system.syslog',
-      origin: { id: 'application-log-onboarding' },
-    });
-  }
-
-  function onAutoDownloadConfig() {
-    setState((state) => ({
-      ...state,
-      autoDownloadConfig: !state.autoDownloadConfig,
-    }));
-  }
-
-  const { data: monitoringRole, status: monitoringRoleStatus } = useFetcher((callApi) => {
-    return callApi('GET /internal/observability_onboarding/logs/setup/privileges');
-  }, []);
-
-  const { data: setup } = useFetcher((callApi) => {
-    return callApi('GET /internal/observability_onboarding/logs/setup/environment');
-  }, []);
-
-  const {
-    data: installShipperSetup,
-    status: installShipperSetupStatus,
-    error,
-  } = useFetcher(
-    (callApi) => {
-      if (monitoringRole?.hasPrivileges) {
-        return callApi('POST /internal/observability_onboarding/logs/flow', {
-          params: {
-            body: {
-              name: datasetName,
-              type: 'systemLogs',
-            },
-          },
-        });
-      }
-    },
-    [monitoringRole?.hasPrivileges]
-  );
-
-  const { apiKeyEncoded, onboardingId } = installShipperSetup ?? getState();
-
-  const { data: yamlConfig = '', status: yamlConfigStatus } = useFetcher(
-    (callApi) => {
-      if (apiKeyEncoded && onboardingId) {
-        return callApi('GET /internal/observability_onboarding/elastic_agent/config', {
-          headers: { authorization: `ApiKey ${apiKeyEncoded}` },
-          params: { query: { onboardingId } },
-        });
-      }
-    },
-    [apiKeyEncoded, onboardingId, installShipperSetupStatus === FETCH_STATUS.SUCCESS]
-  );
-
-  useEffect(() => {
-    setState((state) => ({ ...state, onboardingId, apiKeyEncoded }));
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [onboardingId, apiKeyEncoded]);
-
-  const {
-    data: progressData,
-    status: progressStatus,
-    refetch: refetchProgress,
-  } = useFetcher(
-    (callApi) => {
-      if (onboardingId) {
-        return callApi('GET /internal/observability_onboarding/flow/{onboardingId}/progress', {
-          params: { path: { onboardingId } },
-        });
-      }
-    },
-    [onboardingId]
-  );
-
-  const progressSucceded = progressStatus === FETCH_STATUS.SUCCESS;
-
-  useEffect(() => {
-    if (progressSucceded) {
-      setTimeout(() => {
-        refetchProgress();
-      }, 2000);
-    }
-  }, [progressSucceded, refetchProgress]);
-
-  useFlowProgressTelemetry(progressData?.progress, 'system_logs');
-
-  const getCheckLogsStep = useCallback(() => {
-    const progress = progressData?.progress;
-    if (progress) {
-      const stepStatus = progress?.['logs-ingest']?.status as EuiStepStatus;
-      const title =
-        stepStatus === 'loading'
-          ? CHECK_LOGS_LABELS.loading
-          : stepStatus === 'complete'
-          ? CHECK_LOGS_LABELS.completed
-          : CHECK_LOGS_LABELS.incomplete;
-      return {
-        title,
-        status: stepStatus,
-        'data-test-subj': 'obltOnboardingCheckLogsStep',
-      };
-    }
-    return {
-      title: CHECK_LOGS_LABELS.incomplete,
-      status: 'incomplete' as const,
-    };
-  }, [progressData?.progress]);
-
-  const isInstallStarted = progressData?.progress['ea-download'] !== undefined;
-  const isInstallCompleted = progressData?.progress?.['ea-status']?.status === 'complete';
-  const autoDownloadConfigStatus = progressData?.progress?.['ea-config']?.status as EuiStepStatus;
-
-  return (
-    <StepPanel
-      panelFooter={
-        <StepPanelFooter
-          items={[
-            <BackButton onBack={goBack} />,
-            <EuiFlexGroup justifyContent="flexEnd" alignItems="center">
-              <EuiFlexItem grow={false}>
-                <EuiButton
-                  color="success"
-                  fill
-                  iconType="magnifyWithPlus"
-                  onClick={onContinue}
-                  data-test-subj="obltOnboardingExploreLogs"
-                  disabled={systemIntegrationStatus === 'pending'}
-                >
-                  {i18n.translate('xpack.observability_onboarding.steps.exploreLogs', {
-                    defaultMessage: 'Explore logs',
-                  })}
-                </EuiButton>
-              </EuiFlexItem>
-            </EuiFlexGroup>,
-          ]}
-        />
-      }
-    >
-      <StepPanelContent>
-        <EuiText color="subdued">
-          <p>
-            {i18n.translate(
-              'xpack.observability_onboarding.systemLogs.installElasticAgent.description',
-              {
-                defaultMessage:
-                  'To collect the data from your system and stream it to Elastic, you first need to install a shipping tool on the machine generating the logs. In this case, the shipping tool is an agent developed by Elastic.',
-              }
-            )}
-          </p>
-        </EuiText>
-        <EuiSpacer size="m" />
-        <SystemIntegrationBanner onStatusChange={onIntegrationStatusChange} />
-        <EuiSpacer size="m" />
-        {apiKeyEncoded && onboardingId ? (
-          <ApiKeyBanner
-            payload={{ apiKeyEncoded, onboardingId }}
-            hasPrivileges
-            status={FETCH_STATUS.SUCCESS}
-          />
-        ) : (
-          monitoringRoleStatus !== FETCH_STATUS.NOT_INITIATED &&
-          monitoringRoleStatus !== FETCH_STATUS.LOADING && (
-            <ApiKeyBanner
-              payload={installShipperSetup}
-              hasPrivileges={monitoringRole?.hasPrivileges}
-              status={installShipperSetupStatus}
-              error={error}
-            />
-          )
-        )}
-        <EuiSpacer size="m" />
-        <InstallElasticAgentSteps
-          installAgentPlatformOptions={[
-            {
-              label: i18n.translate(
-                'xpack.observability_onboarding.installElasticAgent.installStep.choosePlatform.linux',
-                { defaultMessage: 'Linux' }
-              ),
-              id: 'linux-tar',
-            },
-            {
-              label: i18n.translate(
-                'xpack.observability_onboarding.installElasticAgent.installStep.choosePlatform.macOS',
-                { defaultMessage: 'MacOS' }
-              ),
-              id: 'macos',
-            },
-            {
-              label: i18n.translate(
-                'xpack.observability_onboarding.installElasticAgent.installStep.choosePlatform.windows',
-                { defaultMessage: 'Windows' }
-              ),
-              id: 'windows',
-              disableSteps: true,
-              children: (
-                <WindowsInstallStep docsLink="https://www.elastic.co/guide/en/welcome-to-elastic/current/getting-started-observability.html" />
-              ),
-            },
-          ]}
-          onSelectPlatform={(id) => setElasticAgentPlatform(id)}
-          selectedPlatform={elasticAgentPlatform}
-          installAgentCommand={getElasticAgentSetupCommand({
-            elasticAgentPlatform,
-            apiKeyEncoded,
-            apiEndpoint: setup?.apiEndpoint,
-            scriptDownloadUrl: setup?.scriptDownloadUrl,
-            elasticAgentVersion: setup?.elasticAgentVersion,
-            autoDownloadConfig: wizardState.autoDownloadConfig,
-            onboardingId,
-          })}
-          autoDownloadConfig={wizardState.autoDownloadConfig}
-          onToggleAutoDownloadConfig={onAutoDownloadConfig}
-          installAgentStatus={
-            installShipperSetupStatus === FETCH_STATUS.LOADING
-              ? 'loading'
-              : isInstallCompleted
-              ? 'complete'
-              : 'current'
-          }
-          showInstallProgressSteps={isInstallStarted}
-          installProgressSteps={
-            (progressData?.progress ?? {}) as Partial<
-              Record<EaInstallProgressStepId, { status: EuiStepStatus; message?: string }>
-            >
-          }
-          configureAgentStatus={
-            yamlConfigStatus === FETCH_STATUS.LOADING ? 'loading' : autoDownloadConfigStatus
-          }
-          configureAgentYaml={yamlConfig}
-          appendedSteps={[getCheckLogsStep()]}
-        />
-      </StepPanelContent>
-      <EuiHorizontalRule />
-      <TroubleshootingLink />
-    </StepPanel>
-  );
-}
-
-const CHECK_LOGS_LABELS = {
-  incomplete: i18n.translate(
-    'xpack.observability_onboarding.systemLogs.installElasticAgent.progress.logsIngest.incompleteTitle',
-    { defaultMessage: 'Ship logs to Elastic Observability' }
-  ),
-  loading: i18n.translate(
-    'xpack.observability_onboarding.systemLogs.installElasticAgent.progress.logsIngest.loadingTitle',
-    { defaultMessage: 'Waiting for logs to be shipped...' }
-  ),
-  completed: i18n.translate(
-    'xpack.observability_onboarding.systemLogs.installElasticAgent.progress.logsIngest.completedTitle',
-    { defaultMessage: 'Logs are being shipped!' }
-  ),
-};
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/components/app/system_logs/system_integration_banner.tsx b/x-pack/plugins/observability_solution/observability_onboarding/public/components/app/system_logs/system_integration_banner.tsx
deleted file mode 100644
index ecff9ae69b95fe..00000000000000
--- a/x-pack/plugins/observability_solution/observability_onboarding/public/components/app/system_logs/system_integration_banner.tsx
+++ /dev/null
@@ -1,167 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { EuiCallOut, EuiFlexGroup, EuiFlexItem, EuiLink, EuiLoadingSpinner } from '@elastic/eui';
-import { i18n } from '@kbn/i18n';
-import { FormattedMessage } from '@kbn/i18n-react';
-import React, { useCallback, useEffect, useState } from 'react';
-import type { MouseEvent } from 'react';
-import {
-  SystemIntegrationError,
-  useInstallSystemIntegration,
-} from '../../../hooks/use_install_system_integration';
-import { useKibanaNavigation } from '../../../hooks/use_kibana_navigation';
-import { PopoverTooltip } from '../../shared/popover_tooltip';
-
-export type SystemIntegrationBannerState = 'pending' | 'resolved' | 'rejected';
-
-export function SystemIntegrationBanner({
-  onStatusChange,
-}: {
-  onStatusChange: (status: SystemIntegrationBannerState) => void;
-}) {
-  const { navigateToAppUrl } = useKibanaNavigation();
-  const [integrationVersion, setIntegrationVersion] = useState<string>();
-  const [error, setError] = useState<SystemIntegrationError>();
-
-  const onIntegrationCreationSuccess = useCallback(
-    ({ version }: { version?: string }) => {
-      setIntegrationVersion(version);
-      onStatusChange('resolved');
-    },
-    [onStatusChange]
-  );
-
-  const onIntegrationCreationFailure = useCallback(
-    (e: SystemIntegrationError) => {
-      setError(e);
-      onStatusChange('rejected');
-    },
-    [onStatusChange]
-  );
-
-  const { performRequest, requestState } = useInstallSystemIntegration({
-    onIntegrationCreationSuccess,
-    onIntegrationCreationFailure,
-  });
-
-  useEffect(() => {
-    performRequest();
-  }, [performRequest]);
-
-  const isInstallingIntegration = requestState.state === 'pending';
-  const hasFailedInstallingIntegration = requestState.state === 'rejected';
-  const hasInstalledIntegration = requestState.state === 'resolved';
-
-  if (isInstallingIntegration) {
-    return (
-      <EuiCallOut
-        title={
-          <EuiFlexGroup alignItems="center" gutterSize="m">
-            <EuiFlexItem grow={false}>
-              <EuiLoadingSpinner size="m" />
-            </EuiFlexItem>
-            <EuiFlexItem>
-              {i18n.translate('xpack.observability_onboarding.systemIntegration.installing', {
-                defaultMessage: 'Installing system integration',
-              })}
-            </EuiFlexItem>
-          </EuiFlexGroup>
-        }
-        color="primary"
-        data-test-subj="obltOnboardingSystemLogsInstallingIntegration"
-      />
-    );
-  }
-  if (hasFailedInstallingIntegration) {
-    return (
-      <EuiFlexItem>
-        <EuiCallOut
-          title={i18n.translate('xpack.observability_onboarding.systemIntegration.status.failed', {
-            defaultMessage: 'System integration installation failed',
-          })}
-          color="warning"
-          iconType="warning"
-          data-test-subj="obltOnboardingSystemLogsIntegrationInstallationFailed"
-        >
-          {error?.message}
-        </EuiCallOut>
-      </EuiFlexItem>
-    );
-  }
-  if (hasInstalledIntegration) {
-    return (
-      <EuiFlexItem>
-        <EuiCallOut
-          title={
-            <FormattedMessage
-              id="xpack.observability_onboarding.systemIntegration.installed"
-              defaultMessage="System integration installed. {systemIntegrationTooltip}"
-              values={{
-                systemIntegrationTooltip: (
-                  <PopoverTooltip
-                    dataTestSubj="obltOnboardingSystemLogsIntegrationInfo"
-                    ariaLabel={i18n.translate(
-                      'xpack.observability_onboarding.systemIntegration.installed.tooltip.label',
-                      {
-                        defaultMessage: 'Integration details',
-                      }
-                    )}
-                  >
-                    <EuiFlexGroup direction="column" gutterSize="xs">
-                      <EuiFlexItem>
-                        {i18n.translate(
-                          'xpack.observability_onboarding.systemIntegration.installed.tooltip.description',
-                          {
-                            defaultMessage:
-                              'Integrations streamline connecting your data to the Elastic Stack.',
-                          }
-                        )}
-                      </EuiFlexItem>
-                      <EuiFlexItem style={{ flexDirection: 'row', alignItems: 'center' }}>
-                        <FormattedMessage
-                          id="xpack.observability_onboarding.systemIntegration.installed.tooltip.link"
-                          defaultMessage="{learnMoreLink} about the data you can collect using the Systems integration."
-                          values={{
-                            learnMoreLink: (
-                              <EuiLink
-                                data-test-subj="observabilityOnboardingSystemIntegrationLearnMore"
-                                target="_blank"
-                                style={{ marginRight: '3px' }}
-                                onClick={(event: MouseEvent) => {
-                                  event.preventDefault();
-                                  navigateToAppUrl(
-                                    `/integrations/detail/system-${integrationVersion}`
-                                  );
-                                }}
-                              >
-                                {i18n.translate(
-                                  'xpack.observability_onboarding.systemIntegration.installed.tooltip.link.label',
-                                  {
-                                    defaultMessage: 'Learn more',
-                                  }
-                                )}
-                              </EuiLink>
-                            ),
-                          }}
-                        />
-                      </EuiFlexItem>
-                    </EuiFlexGroup>
-                  </PopoverTooltip>
-                ),
-              }}
-            />
-          }
-          color="success"
-          iconType="check"
-          data-test-subj="obltOnboardingSystemLogsIntegrationInstalled"
-        />
-      </EuiFlexItem>
-    );
-  }
-  return null;
-}
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/components/shared/back_button.tsx b/x-pack/plugins/observability_solution/observability_onboarding/public/components/shared/back_button.tsx
deleted file mode 100644
index fb9fcb0293debe..00000000000000
--- a/x-pack/plugins/observability_solution/observability_onboarding/public/components/shared/back_button.tsx
+++ /dev/null
@@ -1,25 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { EuiButtonEmpty } from '@elastic/eui';
-import { i18n } from '@kbn/i18n';
-import React from 'react';
-
-export function BackButton({ onBack }: { onBack: () => void }) {
-  return (
-    <EuiButtonEmpty
-      data-test-subj="observabilityOnboardingBackButtonBackButton"
-      iconType="arrowLeft"
-      color="primary"
-      onClick={onBack}
-    >
-      {i18n.translate('xpack.observability_onboarding.steps.back', {
-        defaultMessage: 'Back',
-      })}
-    </EuiButtonEmpty>
-  );
-}
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/components/shared/filmstrip_transition.tsx b/x-pack/plugins/observability_solution/observability_onboarding/public/components/shared/filmstrip_transition.tsx
deleted file mode 100644
index c851e677a42da2..00000000000000
--- a/x-pack/plugins/observability_solution/observability_onboarding/public/components/shared/filmstrip_transition.tsx
+++ /dev/null
@@ -1,66 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React, { PropsWithChildren } from 'react';
-import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
-
-export type TransitionState = 'ready' | 'back' | 'next';
-
-export function FilmstripTransition({
-  children,
-  duration,
-  transition,
-}: PropsWithChildren<{ duration: number; transition: TransitionState }>) {
-  return (
-    <div
-      style={{
-        display: 'flex',
-        flexFlow: 'column nowrap',
-        flexGrow: 1,
-        position: 'relative',
-        zIndex: 0,
-        transitionTimingFunction: 'ease-in-out',
-        transition: transition !== 'ready' ? `transform ${duration}ms` : undefined,
-        transform:
-          transition === 'ready'
-            ? 'translateX(0)'
-            : transition === 'back'
-            ? 'translateX(200%)'
-            : 'translateX(-200%)',
-      }}
-    >
-      {children}
-    </div>
-  );
-}
-
-export function FilmstripFrame({
-  children,
-  position,
-}: PropsWithChildren<{ position: 'left' | 'center' | 'right' }>) {
-  return (
-    <EuiFlexGroup
-      // alignItems="center"
-      // justifyContent="spaceAround"
-      alignItems="flexStart"
-      style={
-        position !== 'center'
-          ? {
-              position: 'absolute',
-              width: '100%',
-              height: '100%',
-              transform: position === 'left' ? 'translateX(-200%)' : 'translateX(200%)',
-              pointerEvents: 'none',
-            }
-          : undefined
-      }
-    >
-      <EuiFlexItem>{children}</EuiFlexItem>
-      {/* <EuiFlexItem grow={false}>{children}</EuiFlexItem>*/}
-    </EuiFlexGroup>
-  );
-}
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/components/shared/get_elastic_agent_setup_command.ts b/x-pack/plugins/observability_solution/observability_onboarding/public/components/shared/get_elastic_agent_setup_command.ts
deleted file mode 100644
index 4bcd9aeeac3d99..00000000000000
--- a/x-pack/plugins/observability_solution/observability_onboarding/public/components/shared/get_elastic_agent_setup_command.ts
+++ /dev/null
@@ -1,49 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-import { flatten, zip } from 'lodash';
-
-export type ElasticAgentPlatform = 'linux-tar' | 'macos' | 'windows';
-
-export function getElasticAgentSetupCommand({
-  elasticAgentPlatform,
-  apiKeyEncoded = '$API_KEY',
-  apiEndpoint = '$API_ENDPOINT',
-  scriptDownloadUrl = '$SCRIPT_DOWNLOAD_URL',
-  elasticAgentVersion = '$ELASTIC_AGENT_VERSION',
-  autoDownloadConfig = false,
-  onboardingId = '$ONBOARDING_ID',
-}: {
-  elasticAgentPlatform: ElasticAgentPlatform;
-  apiKeyEncoded: string | undefined;
-  apiEndpoint: string | undefined;
-  scriptDownloadUrl: string | undefined;
-  elasticAgentVersion: string | undefined;
-  autoDownloadConfig: boolean;
-  onboardingId: string | undefined;
-}) {
-  const setupScriptFilename = 'standalone_agent_setup.sh';
-  const LINUX_MACOS_COMMAND = oneLine`
-      curl ${scriptDownloadUrl} -o ${setupScriptFilename} &&
-      sudo bash ${setupScriptFilename} ${apiKeyEncoded} ${apiEndpoint} ${elasticAgentVersion} ${onboardingId} ${
-    autoDownloadConfig ? `autoDownloadConfig=1` : ''
-  }
-    `;
-  const PLATFORM_COMMAND: Record<ElasticAgentPlatform, string> = {
-    'linux-tar': LINUX_MACOS_COMMAND,
-    macos: LINUX_MACOS_COMMAND,
-    windows: oneLine`
-      curl -O https://elastic.co/agent-setup.sh &&
-      sudo bash agent-setup.sh -- service.name=my-service --url=https://elasticsearch:8220 --enrollment-token=SRSc2ozWUItWXNuWE5oZzdERFU6anJtY0FIzhSRGlzeTJYcUF5UklfUQ==
-    `,
-  };
-  return PLATFORM_COMMAND[elasticAgentPlatform];
-}
-
-function oneLine(parts: TemplateStringsArray, ...args: string[]) {
-  const str = flatten(zip(parts, args)).join('');
-  return str.replace(/\s+/g, ' ').trim();
-}
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/components/shared/install_elastic_agent_steps.tsx b/x-pack/plugins/observability_solution/observability_onboarding/public/components/shared/install_elastic_agent_steps.tsx
deleted file mode 100644
index 5aed3d3db511b3..00000000000000
--- a/x-pack/plugins/observability_solution/observability_onboarding/public/components/shared/install_elastic_agent_steps.tsx
+++ /dev/null
@@ -1,429 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import {
-  EuiButton,
-  EuiButtonGroup,
-  EuiCallOut,
-  EuiCodeBlock,
-  EuiFlexGroup,
-  EuiFlexItem,
-  EuiIconTip,
-  EuiLink,
-  EuiSkeletonRectangle,
-  EuiSpacer,
-  EuiSteps,
-  EuiStepsProps,
-  EuiSwitch,
-  EuiText,
-} from '@elastic/eui';
-import { i18n } from '@kbn/i18n';
-import { Buffer } from 'buffer';
-import React, { ReactNode } from 'react';
-import { intersection } from 'lodash';
-import { FormattedMessage } from '@kbn/i18n-react';
-import { EaInstallProgressStepId } from '../../../common/logs_flow_progress_step_id';
-import { StepStatus } from './step_status';
-
-export type EuiStepStatus = EuiStepsProps['steps'][number]['status'];
-
-interface Props<PlatformId extends string> {
-  installAgentPlatformOptions: Array<{
-    label: string;
-    id: PlatformId;
-    isDisabled?: boolean;
-    disableSteps?: boolean;
-    children?: ReactNode;
-  }>;
-  onSelectPlatform: (id: PlatformId) => void;
-  selectedPlatform: PlatformId;
-  installAgentCommand: string;
-  autoDownloadConfig: boolean;
-  onToggleAutoDownloadConfig: () => void;
-  installAgentStatus: EuiStepStatus;
-  showInstallProgressSteps: boolean;
-  installProgressSteps: Partial<
-    Record<EaInstallProgressStepId, { status: EuiStepStatus; message?: string }>
-  >;
-  configureAgentStatus: EuiStepStatus;
-  configureAgentYaml: string;
-  appendedSteps?: Array<Omit<EuiStepsProps['steps'][number], 'children'>>;
-}
-
-export function InstallElasticAgentSteps<PlatformId extends string>({
-  installAgentPlatformOptions,
-  onSelectPlatform,
-  selectedPlatform,
-  installAgentCommand,
-  autoDownloadConfig,
-  onToggleAutoDownloadConfig,
-  installAgentStatus,
-  showInstallProgressSteps,
-  installProgressSteps,
-  configureAgentStatus,
-  configureAgentYaml,
-  appendedSteps = [],
-}: Props<PlatformId>) {
-  const configPath =
-    selectedPlatform === 'macos'
-      ? '/Library/Elastic/Agent/elastic-agent.yml'
-      : '/opt/Elastic/Agent/elastic-agent.yml';
-
-  const isInstallStarted =
-    intersection(Object.keys(installProgressSteps), Object.keys(PROGRESS_STEP_TITLES(configPath)))
-      .length > 0;
-  const autoDownloadConfigStep = getStep('ea-config', installProgressSteps, configPath);
-
-  const customInstallStep = installAgentPlatformOptions.find(
-    (step) => step.id === selectedPlatform
-  )?.children;
-  const disableSteps = installAgentPlatformOptions.find(
-    (step) => step.id === selectedPlatform
-  )?.disableSteps;
-
-  const installStepDefault = (
-    <>
-      <EuiCodeBlock language="bash" isCopyable>
-        {installAgentCommand}
-      </EuiCodeBlock>
-      <EuiSpacer size="m" />
-      {showInstallProgressSteps && (
-        <>
-          <EuiSpacer size="m" />
-          <EuiFlexGroup direction="column" gutterSize="m">
-            {(['ea-download', 'ea-extract', 'ea-install', 'ea-status'] as const).map((stepId) => {
-              const { title, status, message } = getStep(stepId, installProgressSteps, configPath);
-              return <StepStatus status={status} title={title} message={message} />;
-            })}
-          </EuiFlexGroup>
-        </>
-      )}
-    </>
-  );
-
-  const configureStep = (
-    <>
-      <EuiText color="subdued">
-        <p>
-          {autoDownloadConfig
-            ? i18n.translate(
-                'xpack.observability_onboarding.installElasticAgent.configStep.auto.description',
-                {
-                  defaultMessage:
-                    'The agent config below will be downloaded by the install script and written to ({configPath}). This will overwrite any existing agent configuration.',
-                  values: {
-                    configPath,
-                  },
-                }
-              )
-            : i18n.translate(
-                'xpack.observability_onboarding.installElasticAgent.configStep.manual.description',
-                {
-                  defaultMessage:
-                    'Add the following configuration to {configPath} on the host where you installed the Elastic Agent.',
-                  values: {
-                    configPath,
-                  },
-                }
-              )}
-        </p>
-      </EuiText>
-      <EuiSpacer size="m" />
-      <EuiSkeletonRectangle
-        isLoading={false}
-        contentAriaLabel={i18n.translate(
-          'xpack.observability_onboarding.installElasticAgent.configStep.yamlCodeBlockdescription',
-          { defaultMessage: 'Elastic Agent yaml configuration' }
-        )}
-        width="100%"
-        height={300}
-        borderRadius="s"
-      >
-        <EuiCodeBlock
-          language="yaml"
-          isCopyable
-          style={{
-            opacity: autoDownloadConfig ? '.5' : '1',
-          }}
-        >
-          {configureAgentYaml}
-        </EuiCodeBlock>
-      </EuiSkeletonRectangle>
-      <EuiSpacer size="m" />
-      <EuiButton
-        iconType="download"
-        color="primary"
-        href={`data:application/yaml;base64,${Buffer.from(configureAgentYaml, 'utf8').toString(
-          'base64'
-        )}`}
-        download="elastic-agent.yml"
-        target="_blank"
-        isDisabled={autoDownloadConfig}
-        data-test-subj="obltOnboardingConfigureElasticAgentStepDownloadConfig"
-      >
-        {i18n.translate(
-          'xpack.observability_onboarding.installElasticAgent.configStep.downloadConfigButton',
-          { defaultMessage: 'Download config file' }
-        )}
-      </EuiButton>
-      {showInstallProgressSteps && autoDownloadConfig ? (
-        <>
-          <EuiSpacer size="m" />
-          <EuiFlexGroup direction="column">
-            <StepStatus
-              status={autoDownloadConfigStep.status}
-              title={autoDownloadConfigStep.title}
-              message={autoDownloadConfigStep.message}
-            />
-          </EuiFlexGroup>
-        </>
-      ) : null}
-    </>
-  );
-
-  return (
-    <EuiSteps
-      steps={[
-        {
-          'data-test-subj': 'obltOnboardingInstallElasticAgentStep',
-          title: i18n.translate(
-            'xpack.observability_onboarding.installElasticAgent.installStep.title',
-            { defaultMessage: 'Install the Elastic Agent' }
-          ),
-          status: installAgentStatus,
-          children: (
-            <>
-              <EuiText color="subdued">
-                <p>
-                  <FormattedMessage
-                    id="xpack.observability_onboarding.installElasticAgent.installStep.description"
-                    defaultMessage="Select your platform, and run the install command in your terminal to enroll and start the Elastic Agent. Do this for each host. Review {hostRequirementsLink} before installing."
-                    values={{
-                      hostRequirementsLink: (
-                        <EuiLink
-                          data-test-subj="observabilityOnboardingInstallElasticAgentStepsHostRequirementsAndOtherInstallationOptionsLink"
-                          external
-                          href="https://www.elastic.co/guide/en/fleet/8.7/elastic-agent-installation.html"
-                        >
-                          {i18n.translate(
-                            'xpack.observability_onboarding.installElasticAgent.installStep.hostRequirements',
-                            {
-                              defaultMessage: 'host requirements and other installation options',
-                            }
-                          )}
-                        </EuiLink>
-                      ),
-                    }}
-                  />
-                </p>
-              </EuiText>
-              <EuiSpacer size="l" />
-              <EuiSwitch
-                label={
-                  <EuiFlexGroup alignItems="center" gutterSize="xs" responsive={false}>
-                    <EuiFlexItem grow={false}>
-                      {i18n.translate(
-                        'xpack.observability_onboarding.installElasticAgent.installStep.autoDownloadConfig',
-                        {
-                          defaultMessage: "Automatically download the agent's config",
-                        }
-                      )}
-                    </EuiFlexItem>
-                    <EuiFlexItem grow={false}>
-                      <EuiIconTip
-                        content={i18n.translate(
-                          'xpack.observability_onboarding.installElasticAgent.installStep.autoDownloadConfig.tooltip',
-                          {
-                            defaultMessage:
-                              "Turn on to add a string to the following code block that downloads the agent's standard configuration to your host during installation. Turn off to manually configure the agent in the next step.",
-                          }
-                        )}
-                        position="right"
-                      />
-                    </EuiFlexItem>
-                  </EuiFlexGroup>
-                }
-                checked={autoDownloadConfig}
-                onChange={onToggleAutoDownloadConfig}
-                disabled={disableSteps || isInstallStarted}
-                data-test-subj="obltOnboardingInstallElasticAgentAutoDownloadConfig"
-              />
-              <EuiSpacer size="l" />
-              {autoDownloadConfig && (
-                <>
-                  <EuiCallOut
-                    title={i18n.translate(
-                      'xpack.observability_onboarding.installElasticAgent.installStep.autoDownloadConfig.overwriteWarning',
-                      {
-                        defaultMessage:
-                          'Automatically downloading the agent config will overwrite any existing agent config on your host.',
-                      }
-                    )}
-                    color="warning"
-                    iconType="warning"
-                    data-test-subj="obltOnboardingInstallElasticAgentAutoDownloadConfigCallout"
-                  />
-                  <EuiSpacer size="l" />
-                </>
-              )}
-              <EuiButtonGroup
-                isFullWidth
-                legend={i18n.translate(
-                  'xpack.observability_onboarding.installElasticAgent.installStep.choosePlatform',
-                  { defaultMessage: 'Choose platform' }
-                )}
-                options={installAgentPlatformOptions.map(({ id, label, isDisabled }) => ({
-                  id,
-                  label,
-                  isDisabled,
-                }))}
-                type="single"
-                idSelected={selectedPlatform}
-                onChange={(id: string) => {
-                  onSelectPlatform(id as PlatformId);
-                }}
-                isDisabled={isInstallStarted}
-              />
-              <EuiSpacer size="m" />
-              {customInstallStep || installStepDefault}
-            </>
-          ),
-        },
-        {
-          'data-test-subj': 'obltOnboardingConfigureElasticAgentStep',
-          title: i18n.translate(
-            'xpack.observability_onboarding.installElasticAgent.configureStep.title',
-            { defaultMessage: 'Configure the Elastic Agent' }
-          ),
-          status: disableSteps ? 'disabled' : configureAgentStatus,
-          children: disableSteps ? <></> : configureStep,
-        },
-        ...appendedSteps.map((euiStep) => ({
-          children: null,
-          ...euiStep,
-          status: disableSteps ? 'disabled' : euiStep.status,
-          'data-test-subj': euiStep['data-test-subj'],
-        })),
-      ]}
-    />
-  );
-}
-
-function getStep(
-  id: EaInstallProgressStepId,
-  installProgressSteps: Props<string>['installProgressSteps'],
-  configPath: string
-): { title: string; status: EuiStepStatus; message?: string } {
-  const { loadingTitle, completedTitle, incompleteTitle } = PROGRESS_STEP_TITLES(configPath)[id];
-  const stepProgress = installProgressSteps[id];
-  if (stepProgress) {
-    const { status, message } = stepProgress;
-    const title =
-      status === 'loading'
-        ? loadingTitle
-        : status === 'complete'
-        ? completedTitle
-        : incompleteTitle;
-    return {
-      title,
-      status: status ?? ('incomplete' as const),
-      message,
-    };
-  }
-
-  return {
-    title: incompleteTitle,
-    status: 'incomplete' as const,
-  };
-}
-
-const PROGRESS_STEP_TITLES: (
-  configPath: string
-) => Record<
-  EaInstallProgressStepId,
-  Record<'incompleteTitle' | 'loadingTitle' | 'completedTitle', string>
-> = (configPath: string) => ({
-  'ea-download': {
-    incompleteTitle: i18n.translate(
-      'xpack.observability_onboarding.installElasticAgent.progress.eaDownload.incompleteTitle',
-      { defaultMessage: 'Download Elastic Agent' }
-    ),
-    loadingTitle: i18n.translate(
-      'xpack.observability_onboarding.installElasticAgent.progress.eaDownload.loadingTitle',
-      { defaultMessage: 'Downloading Elastic Agent' }
-    ),
-    completedTitle: i18n.translate(
-      'xpack.observability_onboarding.installElasticAgent.progress.eaDownload.completedTitle',
-      { defaultMessage: 'Elastic Agent downloaded' }
-    ),
-  },
-  'ea-extract': {
-    incompleteTitle: i18n.translate(
-      'xpack.observability_onboarding.installElasticAgent.progress.eaExtract.incompleteTitle',
-      { defaultMessage: 'Extract Elastic Agent' }
-    ),
-    loadingTitle: i18n.translate(
-      'xpack.observability_onboarding.installElasticAgent.progress.eaExtract.loadingTitle',
-      { defaultMessage: 'Extracting Elastic Agent' }
-    ),
-    completedTitle: i18n.translate(
-      'xpack.observability_onboarding.installElasticAgent.progress.eaExtract.completedTitle',
-      { defaultMessage: 'Elastic Agent extracted' }
-    ),
-  },
-  'ea-install': {
-    incompleteTitle: i18n.translate(
-      'xpack.observability_onboarding.installElasticAgent.progress.eaInstall.incompleteTitle',
-      { defaultMessage: 'Install Elastic Agent' }
-    ),
-    loadingTitle: i18n.translate(
-      'xpack.observability_onboarding.installElasticAgent.progress.eaInstall.loadingTitle',
-      { defaultMessage: 'Installing Elastic Agent' }
-    ),
-    completedTitle: i18n.translate(
-      'xpack.observability_onboarding.installElasticAgent.progress.eaInstall.completedTitle',
-      { defaultMessage: 'Elastic Agent installed' }
-    ),
-  },
-  'ea-status': {
-    incompleteTitle: i18n.translate(
-      'xpack.observability_onboarding.installElasticAgent.progress.eaStatus.incompleteTitle',
-      { defaultMessage: 'Connect to the Elastic Agent' }
-    ),
-    loadingTitle: i18n.translate(
-      'xpack.observability_onboarding.installElasticAgent.progress.eaStatus.loadingTitle',
-      {
-        defaultMessage: 'Connecting to the Elastic Agent',
-      }
-    ),
-    completedTitle: i18n.translate(
-      'xpack.observability_onboarding.installElasticAgent.progress.eaStatus.completedTitle',
-      {
-        defaultMessage: 'Connected to the Elastic Agent',
-      }
-    ),
-  },
-  'ea-config': {
-    incompleteTitle: i18n.translate(
-      'xpack.observability_onboarding.installElasticAgent.progress.eaConfig.incompleteTitle',
-      { defaultMessage: 'Configure the agent' }
-    ),
-    loadingTitle: i18n.translate(
-      'xpack.observability_onboarding.installElasticAgent.progress.eaConfig.loadingTitle',
-      { defaultMessage: 'Downloading Elastic Agent config' }
-    ),
-    completedTitle: i18n.translate(
-      'xpack.observability_onboarding.installElasticAgent.progress.eaConfig.completedTitle',
-      {
-        defaultMessage: 'Elastic Agent config written to {configPath}',
-        values: {
-          configPath,
-        },
-      }
-    ),
-  },
-});
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/components/shared/optional_form_row.tsx b/x-pack/plugins/observability_solution/observability_onboarding/public/components/shared/optional_form_row.tsx
deleted file mode 100644
index ca92e441a27258..00000000000000
--- a/x-pack/plugins/observability_solution/observability_onboarding/public/components/shared/optional_form_row.tsx
+++ /dev/null
@@ -1,44 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { EuiFlexGroup, EuiFlexItem, EuiFormRow, EuiFormRowProps, useEuiTheme } from '@elastic/eui';
-import { i18n } from '@kbn/i18n';
-import React from 'react';
-
-type OptionalFormRowProps = EuiFormRowProps;
-
-export function OptionalFormRow(props: OptionalFormRowProps) {
-  const { euiTheme } = useEuiTheme();
-
-  const { label, children, helpText } = props;
-  return (
-    <EuiFormRow
-      css={{
-        '.euiFormLabel': {
-          width: '100%',
-        },
-        '.euiFormLabel > .euiFlexGroup > div:last-of-type': {
-          fontWeight: 'normal',
-          color: euiTheme.colors.subduedText,
-        },
-      }}
-      label={
-        <EuiFlexGroup justifyContent="spaceBetween">
-          <EuiFlexItem grow={false}>{label}</EuiFlexItem>
-          <EuiFlexItem grow={false}>
-            {i18n.translate('xpack.observability_onboarding.form.optional', {
-              defaultMessage: 'Optional',
-            })}
-          </EuiFlexItem>
-        </EuiFlexGroup>
-      }
-      helpText={helpText}
-    >
-      {children}
-    </EuiFormRow>
-  );
-}
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/components/shared/popover_tooltip.tsx b/x-pack/plugins/observability_solution/observability_onboarding/public/components/shared/popover_tooltip.tsx
deleted file mode 100644
index 8a0e8b53e7350c..00000000000000
--- a/x-pack/plugins/observability_solution/observability_onboarding/public/components/shared/popover_tooltip.tsx
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { EuiButtonIcon, EuiPopover, EuiPopoverTitle } from '@elastic/eui';
-import React, { useState } from 'react';
-
-interface PopoverTooltipProps {
-  ariaLabel?: string;
-  iconType?: string;
-  title?: string;
-  children: React.ReactNode;
-  dataTestSubj: string;
-}
-
-export function PopoverTooltip({
-  ariaLabel,
-  iconType = 'iInCircle',
-  title,
-  children,
-  dataTestSubj,
-}: PopoverTooltipProps) {
-  const [isPopoverOpen, setIsPopoverOpen] = useState(false);
-
-  return (
-    <EuiPopover
-      panelPaddingSize="s"
-      anchorPosition={'upCenter'}
-      isOpen={isPopoverOpen}
-      closePopover={() => setIsPopoverOpen(false)}
-      style={{ margin: '-5px 0 0 -5px' }}
-      button={
-        <EuiButtonIcon
-          data-test-subj={dataTestSubj}
-          aria-label={ariaLabel}
-          onClick={(event: React.MouseEvent<HTMLButtonElement>) => {
-            setIsPopoverOpen(!isPopoverOpen);
-            event.stopPropagation();
-          }}
-          size="xs"
-          color="primary"
-          iconType={iconType}
-        />
-      }
-    >
-      {title && <EuiPopoverTitle>{title}</EuiPopoverTitle>}
-      {children}
-    </EuiPopover>
-  );
-}
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/components/shared/step_panel.tsx b/x-pack/plugins/observability_solution/observability_onboarding/public/components/shared/step_panel.tsx
deleted file mode 100644
index ea1ddbba406a8b..00000000000000
--- a/x-pack/plugins/observability_solution/observability_onboarding/public/components/shared/step_panel.tsx
+++ /dev/null
@@ -1,84 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React, { ReactNode } from 'react';
-import {
-  EuiFlexGroup,
-  EuiFlexItem,
-  EuiPanel,
-  EuiPanelProps,
-  EuiSpacer,
-  EuiTitle,
-  useEuiTheme,
-} from '@elastic/eui';
-
-interface StepPanelProps {
-  title?: string;
-  panelProps?: EuiPanelProps;
-  panelFooter?: ReactNode;
-  children?: ReactNode;
-}
-
-export function StepPanel(props: StepPanelProps) {
-  const { title, children, panelFooter } = props;
-  const panelProps = props.panelProps ?? null;
-  return (
-    <>
-      <EuiPanel {...panelProps}>
-        <EuiFlexGroup direction="column" gutterSize="none">
-          {title ? (
-            <>
-              <EuiFlexItem>
-                <EuiTitle size="m">
-                  <h2>{title}</h2>
-                </EuiTitle>
-              </EuiFlexItem>
-              <EuiSpacer size="m" />
-            </>
-          ) : (
-            <EuiSpacer size="s" />
-          )}
-          {children}
-        </EuiFlexGroup>
-      </EuiPanel>
-      <EuiSpacer size="l" />
-      {panelFooter}
-    </>
-  );
-}
-
-interface StepPanelContentProps {
-  children?: ReactNode;
-}
-export function StepPanelContent(props: StepPanelContentProps) {
-  const { children } = props;
-  return <EuiFlexItem>{children}</EuiFlexItem>;
-}
-
-interface StepPanelFooterProps {
-  children?: ReactNode;
-  items?: ReactNode[];
-}
-export function StepPanelFooter(props: StepPanelFooterProps) {
-  const { items = [], children } = props;
-  const { euiTheme } = useEuiTheme();
-
-  return (
-    <EuiFlexItem grow={false} style={{ marginBottom: euiTheme.size.l }}>
-      {children}
-      {items && (
-        <EuiFlexGroup justifyContent="spaceBetween">
-          {items.map((itemReactNode, index) => (
-            <EuiFlexItem key={index} grow={false}>
-              {itemReactNode}
-            </EuiFlexItem>
-          ))}
-        </EuiFlexGroup>
-      )}
-    </EuiFlexItem>
-  );
-}
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/components/shared/step_status.tsx b/x-pack/plugins/observability_solution/observability_onboarding/public/components/shared/step_status.tsx
deleted file mode 100644
index d2a5341fda731c..00000000000000
--- a/x-pack/plugins/observability_solution/observability_onboarding/public/components/shared/step_status.tsx
+++ /dev/null
@@ -1,72 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import {
-  EuiFlexGroup,
-  EuiFlexItem,
-  EuiStepsProps,
-  EuiPanel,
-  EuiText,
-  EuiCallOut,
-  EuiLoadingSpinner,
-} from '@elastic/eui';
-import React from 'react';
-
-export function StepStatus({
-  status,
-  title,
-  message,
-}: {
-  status: EuiStepsProps['steps'][number]['status'];
-  title: string;
-  message?: string;
-}) {
-  if (status === 'loading') {
-    return (
-      <EuiFlexItem data-test-subj={`obltOnboardingStepStatus-${status}`}>
-        <EuiPanel color="transparent">
-          <EuiFlexGroup gutterSize="s" alignItems="center">
-            <EuiFlexItem grow={false}>
-              <EuiLoadingSpinner size="m" />
-            </EuiFlexItem>
-            <EuiFlexItem grow={false}>
-              <EuiText color="subdued">{title}</EuiText>
-            </EuiFlexItem>
-          </EuiFlexGroup>
-        </EuiPanel>
-      </EuiFlexItem>
-    );
-  }
-  if (status === 'complete') {
-    return (
-      <EuiFlexItem data-test-subj={`obltOnboardingStepStatus-${status}`}>
-        <EuiCallOut title={title} color="success" iconType="check">
-          {message}
-        </EuiCallOut>
-      </EuiFlexItem>
-    );
-  }
-  if (status === 'danger') {
-    return (
-      <EuiFlexItem data-test-subj={`obltOnboardingStepStatus-${status}`}>
-        <EuiCallOut title={title} color="danger" iconType="warning">
-          {message}
-        </EuiCallOut>
-      </EuiFlexItem>
-    );
-  }
-  if (status === 'warning') {
-    return (
-      <EuiFlexItem data-test-subj={`obltOnboardingStepStatus-${status}`}>
-        <EuiCallOut title={title} color="warning" iconType="warning">
-          {message}
-        </EuiCallOut>
-      </EuiFlexItem>
-    );
-  }
-  return null;
-}
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/components/shared/troubleshooting_link.tsx b/x-pack/plugins/observability_solution/observability_onboarding/public/components/shared/troubleshooting_link.tsx
deleted file mode 100644
index df03636769a585..00000000000000
--- a/x-pack/plugins/observability_solution/observability_onboarding/public/components/shared/troubleshooting_link.tsx
+++ /dev/null
@@ -1,28 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React from 'react';
-import { EuiButtonEmpty, EuiFlexGroup } from '@elastic/eui';
-import { i18n } from '@kbn/i18n';
-
-export function TroubleshootingLink() {
-  return (
-    <EuiFlexGroup alignItems="center" justifyContent="center">
-      <EuiButtonEmpty
-        data-test-subj="observabilityOnboardingTroubleshootingLinkTroubleshootingButton"
-        iconType="help"
-        color="primary"
-        href="https://www.elastic.co/guide/en/observability/current/logs-troubleshooting.html"
-        target="_blank"
-      >
-        {i18n.translate('xpack.observability_onboarding.installElasticAgent.troubleshooting', {
-          defaultMessage: 'Troubleshooting',
-        })}
-      </EuiButtonEmpty>
-    </EuiFlexGroup>
-  );
-}
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/components/shared/windows_install_step.tsx b/x-pack/plugins/observability_solution/observability_onboarding/public/components/shared/windows_install_step.tsx
deleted file mode 100644
index 31300d3c575e14..00000000000000
--- a/x-pack/plugins/observability_solution/observability_onboarding/public/components/shared/windows_install_step.tsx
+++ /dev/null
@@ -1,49 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { EuiButton, EuiFlexGroup, EuiFlexItem, EuiText } from '@elastic/eui';
-import { i18n } from '@kbn/i18n';
-import React from 'react';
-
-const DEFAULT_STANDALONE_ELASTIC_AGENT_DOCS =
-  'https://www.elastic.co/guide/en/fleet/current/install-standalone-elastic-agent.html';
-
-export function WindowsInstallStep({
-  docsLink = DEFAULT_STANDALONE_ELASTIC_AGENT_DOCS,
-}: {
-  docsLink?: string;
-}) {
-  return (
-    <EuiFlexGroup direction="column">
-      <EuiFlexItem grow={false}>
-        <EuiText color="subdued">
-          <p>
-            {i18n.translate('xpack.observability_onboarding.windows.installStep.description', {
-              defaultMessage:
-                'This onboarding is currently only available for Linux and MacOS systems. See our documentation for information on streaming log files to Elastic from a Windows system.',
-            })}
-          </p>
-        </EuiText>
-      </EuiFlexItem>
-      <EuiFlexItem grow={false}>
-        <EuiButton
-          iconSide="right"
-          iconType="popout"
-          color="primary"
-          href={docsLink}
-          target="_blank"
-          style={{ width: 'fit-content' }}
-          data-test-subj="obltOnboardingInstallElasticAgentWindowsDocsLink"
-        >
-          {i18n.translate('xpack.observability_onboarding.windows.installStep.link.label', {
-            defaultMessage: 'Read docs',
-          })}
-        </EuiButton>
-      </EuiFlexItem>
-    </EuiFlexGroup>
-  );
-}
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/hooks/use_flow_progress_telemetry.test.tsx b/x-pack/plugins/observability_solution/observability_onboarding/public/hooks/use_flow_progress_telemetry.test.tsx
index 8ba06304489abe..aede0d27bd4ef7 100644
--- a/x-pack/plugins/observability_solution/observability_onboarding/public/hooks/use_flow_progress_telemetry.test.tsx
+++ b/x-pack/plugins/observability_solution/observability_onboarding/public/hooks/use_flow_progress_telemetry.test.tsx
@@ -47,7 +47,7 @@ describe('useFlowProgressTelemetry', () => {
     expect(render.result.current.analytics.reportEvent).toHaveBeenCalledWith(
       'observability_onboarding',
       {
-        uses_legacy_onboarding_page: true,
+        uses_legacy_onboarding_page: false,
         flow: 'test-flow',
         step: 'ea-download',
         step_status: 'complete',
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/hooks/use_flow_progress_telemetry.ts b/x-pack/plugins/observability_solution/observability_onboarding/public/hooks/use_flow_progress_telemetry.ts
index 25d4b61d9d7513..95d93ad6af985f 100644
--- a/x-pack/plugins/observability_solution/observability_onboarding/public/hooks/use_flow_progress_telemetry.ts
+++ b/x-pack/plugins/observability_solution/observability_onboarding/public/hooks/use_flow_progress_telemetry.ts
@@ -6,12 +6,13 @@
  */
 
 import { useEffect, useState } from 'react';
+import { EuiStepsProps } from '@elastic/eui';
 import { type LogsFlowProgressStepId } from '../../common/logs_flow_progress_step_id';
 import { OBSERVABILITY_ONBOARDING_TELEMETRY_EVENT } from '../../common/telemetry_events';
-import { type EuiStepStatus } from '../components/shared/install_elastic_agent_steps';
-import { useExperimentalOnboardingFlag } from './use_experimental_onboarding_flag';
 import { useKibana } from './use_kibana';
 
+type EuiStepStatus = EuiStepsProps['steps'][number]['status'];
+
 type StepsProgress = Partial<
   Record<LogsFlowProgressStepId, { status: EuiStepStatus; message?: string }>
 >;
@@ -23,7 +24,6 @@ export function useFlowProgressTelemetry(progress: StepsProgress | undefined, fl
   const {
     services: { analytics },
   } = useKibana();
-  const experimentalOnboardingFlowEnabled = useExperimentalOnboardingFlag();
   const [previousReportedSteps] = useState<Map<LogsFlowProgressStepId, EuiStepStatus>>(new Map());
 
   useEffect(() => {
@@ -43,7 +43,7 @@ export function useFlowProgressTelemetry(progress: StepsProgress | undefined, fl
       }
 
       analytics.reportEvent(OBSERVABILITY_ONBOARDING_TELEMETRY_EVENT.eventType, {
-        uses_legacy_onboarding_page: !experimentalOnboardingFlowEnabled,
+        uses_legacy_onboarding_page: false,
         flow: flowId,
         step: stepId,
         step_status: step.status,
@@ -51,5 +51,5 @@ export function useFlowProgressTelemetry(progress: StepsProgress | undefined, fl
       });
       previousReportedSteps.set(stepId, step.status);
     });
-  }, [analytics, experimentalOnboardingFlowEnabled, flowId, progress, previousReportedSteps]);
+  }, [analytics, flowId, progress, previousReportedSteps]);
 }
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/plugin.ts b/x-pack/plugins/observability_solution/observability_onboarding/public/plugin.ts
index acaa03b1b11874..8afe3b29c30e06 100644
--- a/x-pack/plugins/observability_solution/observability_onboarding/public/plugin.ts
+++ b/x-pack/plugins/observability_solution/observability_onboarding/public/plugin.ts
@@ -67,7 +67,6 @@ export class ObservabilityOnboardingPlugin
 
     const pluginSetupDeps = plugins;
 
-    const isServerless = this.ctx.env.packageInfo.buildFlavor === 'serverless';
     // set xpack.observability_onboarding.ui.enabled: true
     // and go to /app/observabilityOnboarding
     if (isObservabilityOnboardingUiEnabled) {
@@ -93,7 +92,6 @@ export class ObservabilityOnboardingPlugin
             core: coreStart,
             deps: pluginSetupDeps,
             appMountParameters,
-            experimentalOnboardingFlowEnabled: isServerless,
             corePlugins: corePlugins as ObservabilityOnboardingPluginStartDeps,
             config,
           });
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/routes/index.tsx b/x-pack/plugins/observability_solution/observability_onboarding/public/routes/index.tsx
deleted file mode 100644
index 9684d54374e84b..00000000000000
--- a/x-pack/plugins/observability_solution/observability_onboarding/public/routes/index.tsx
+++ /dev/null
@@ -1,43 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import * as t from 'io-ts';
-import React from 'react';
-import { Redirect } from 'react-router-dom';
-import { customLogsRoutes } from '../components/app/custom_logs';
-import { systemLogsRoutes } from '../components/app/system_logs';
-import { Home } from '../components/app/home';
-
-export type RouteParams<T extends keyof typeof routes> = DecodeParams<typeof routes[T]['params']>;
-
-type DecodeParams<TParams extends Params | undefined> = {
-  [key in keyof TParams]: TParams[key] extends t.Any ? t.TypeOf<TParams[key]> : never;
-};
-
-export interface Params {
-  query?: t.HasProps;
-  path?: t.HasProps;
-}
-
-export const baseRoutes = {
-  '/': {
-    handler: () => <Home />,
-    params: {},
-    exact: true,
-  },
-  '/overview': {
-    handler: () => <Redirect to="/" />,
-    params: {},
-    exact: true,
-  },
-};
-
-export const routes = {
-  ...baseRoutes,
-  ...customLogsRoutes,
-  ...systemLogsRoutes,
-};
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/routes/templates/custom_logs.tsx b/x-pack/plugins/observability_solution/observability_onboarding/public/routes/templates/custom_logs.tsx
deleted file mode 100644
index b2c3bd61273f76..00000000000000
--- a/x-pack/plugins/observability_solution/observability_onboarding/public/routes/templates/custom_logs.tsx
+++ /dev/null
@@ -1,109 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { EuiFlexGroup, EuiFlexItem, EuiSpacer, EuiTitle } from '@elastic/eui';
-import { i18n } from '@kbn/i18n';
-import { useBreadcrumbs } from '@kbn/observability-shared-plugin/public';
-import React, { ComponentType, useRef, useState } from 'react';
-import { useKibana } from '@kbn/kibana-react-plugin/public';
-import { ObservabilityOnboardingPluginContextValue } from '../../plugin';
-import { breadcrumbsApp } from '../../application/app';
-import { Provider as WizardProvider } from '../../components/app/custom_logs';
-import {
-  FilmstripFrame,
-  FilmstripTransition,
-  TransitionState,
-} from '../../components/shared/filmstrip_transition';
-import { ObservabilityOnboardingHeaderActionMenu } from '../../components/app/header_action_menu';
-
-interface Props {
-  children: React.ReactNode;
-}
-
-export function CustomLogs({ children }: Props) {
-  useBreadcrumbs(
-    [
-      {
-        text: i18n.translate('xpack.observability_onboarding.breadcrumbs.customLogs', {
-          defaultMessage: 'Stream log files',
-        }),
-      },
-    ],
-    breadcrumbsApp
-  );
-  return <AnimatedTransitionsWizard>{children}</AnimatedTransitionsWizard>;
-}
-
-const TRANSITION_DURATION = 180;
-
-function AnimatedTransitionsWizard({ children }: Props) {
-  const [transition, setTransition] = useState<TransitionState>('ready');
-  const [title, setTitle] = useState<string>();
-  const TransitionComponent = useRef<ComponentType>(() => null);
-
-  const {
-    services: { config },
-  } = useKibana<ObservabilityOnboardingPluginContextValue>();
-
-  const isServerless = config.serverless.enabled;
-
-  function onChangeStep({
-    direction,
-    stepTitle,
-    StepComponent,
-  }: {
-    direction: 'back' | 'next';
-    stepTitle?: string;
-    StepComponent: ComponentType;
-  }) {
-    setTransition(direction);
-    setTitle(stepTitle);
-    TransitionComponent.current = StepComponent;
-    setTimeout(() => {
-      setTransition('ready');
-    }, TRANSITION_DURATION + 10);
-  }
-
-  return (
-    <WizardProvider transitionDuration={TRANSITION_DURATION} onChangeStep={onChangeStep}>
-      <EuiFlexGroup direction="column" alignItems="center">
-        <EuiFlexItem grow={false}>
-          <EuiSpacer size="l" />
-          <EuiFlexGroup direction="row">
-            <EuiFlexItem grow={false}>
-              <EuiTitle size="l" data-test-subj="obltOnboardingStreamLogFilePageHeader">
-                <h1>
-                  {title
-                    ? title
-                    : i18n.translate('xpack.observability_onboarding.title.collectCustomLogs', {
-                        defaultMessage: 'Stream log files to Elastic',
-                      })}
-                </h1>
-              </EuiTitle>
-            </EuiFlexItem>
-            {isServerless && (
-              <EuiFlexItem grow={false} css={{ position: 'absolute', right: 10 }}>
-                <ObservabilityOnboardingHeaderActionMenu />
-              </EuiFlexItem>
-            )}
-          </EuiFlexGroup>
-        </EuiFlexItem>
-        <EuiFlexItem grow={1} style={{ width: '50%' }}>
-          <FilmstripTransition duration={TRANSITION_DURATION} transition={transition}>
-            <FilmstripFrame
-              position={
-                transition === 'ready' ? 'center' : transition === 'back' ? 'left' : 'right'
-              }
-            >
-              {children}
-            </FilmstripFrame>
-          </FilmstripTransition>
-        </EuiFlexItem>
-      </EuiFlexGroup>
-    </WizardProvider>
-  );
-}
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/routes/templates/system_logs.tsx b/x-pack/plugins/observability_solution/observability_onboarding/public/routes/templates/system_logs.tsx
deleted file mode 100644
index 76fa413de173ec..00000000000000
--- a/x-pack/plugins/observability_solution/observability_onboarding/public/routes/templates/system_logs.tsx
+++ /dev/null
@@ -1,74 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { EuiFlexGroup, EuiFlexItem, EuiSpacer, EuiTitle } from '@elastic/eui';
-import { i18n } from '@kbn/i18n';
-import { useBreadcrumbs } from '@kbn/observability-shared-plugin/public';
-import React from 'react';
-import { useKibana } from '@kbn/kibana-react-plugin/public';
-import { breadcrumbsApp } from '../../application/app';
-import { Provider as WizardProvider } from '../../components/app/system_logs';
-import { ObservabilityOnboardingHeaderActionMenu } from '../../components/app/header_action_menu';
-import { ObservabilityOnboardingPluginContextValue } from '../../plugin';
-
-interface Props {
-  children: React.ReactNode;
-}
-
-export function SystemLogs({ children }: Props) {
-  useBreadcrumbs(
-    [
-      {
-        text: i18n.translate('xpack.observability_onboarding.breadcrumbs.systemLogs', {
-          defaultMessage: 'System logs',
-        }),
-      },
-    ],
-    breadcrumbsApp
-  );
-
-  const {
-    services: { config },
-  } = useKibana<ObservabilityOnboardingPluginContextValue>();
-
-  const isServerless = config.serverless.enabled;
-  return (
-    <WizardProvider>
-      <EuiFlexGroup direction="column" alignItems="center">
-        <EuiFlexItem grow={false}>
-          <EuiSpacer size="l" />
-          <EuiFlexGroup direction="row">
-            <EuiFlexItem grow={false}>
-              <EuiTitle size="l" data-test-subj="obltOnboardingSystemLogsFilePageHeader">
-                <h1>
-                  {i18n.translate('xpack.observability_onboarding.title.collectSystemLogs', {
-                    defaultMessage: 'Install shipper to collect system logs',
-                  })}
-                </h1>
-              </EuiTitle>
-            </EuiFlexItem>
-            {isServerless && (
-              <EuiFlexItem grow={false} css={{ position: 'absolute', right: 10 }}>
-                <ObservabilityOnboardingHeaderActionMenu />
-              </EuiFlexItem>
-            )}
-          </EuiFlexGroup>
-        </EuiFlexItem>
-        <EuiFlexItem grow={1} style={{ width: '50%' }}>
-          <div
-            style={{
-              display: 'flex',
-              flexFlow: 'column nowrap',
-            }}
-          >
-            {children}
-          </div>
-        </EuiFlexItem>
-      </EuiFlexGroup>
-    </WizardProvider>
-  );
-}
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/server/routes/logs/route.ts b/x-pack/plugins/observability_solution/observability_onboarding/server/routes/logs/route.ts
index 3f0627cd9a4bf9..c7a411441658e1 100644
--- a/x-pack/plugins/observability_solution/observability_onboarding/server/routes/logs/route.ts
+++ b/x-pack/plugins/observability_solution/observability_onboarding/server/routes/logs/route.ts
@@ -58,7 +58,11 @@ const installShipperSetupRoute = createObservabilityOnboardingServerRoute({
       core.setup.http.basePath.publicBaseUrl ?? // priority given to server.publicBaseUrl
       plugins.cloud?.setup?.kibanaUrl ?? // then cloud id
       getFallbackKibanaUrl(coreStart); // falls back to local network binding
-    const scriptDownloadUrl = `${kibanaUrl}/plugins/observabilityOnboarding/assets/standalone_agent_setup.sh`;
+    const installScriptPath = coreStart.http.staticAssets.getPluginAssetHref(
+      'standalone_agent_setup.sh'
+    );
+
+    const scriptDownloadUrl = `${kibanaUrl}${installScriptPath}`;
     const apiEndpoint = `${kibanaUrl}/internal/observability_onboarding`;
 
     return {
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/tsconfig.json b/x-pack/plugins/observability_solution/observability_onboarding/tsconfig.json
index ff0fe8696ce811..b03e6d6ffe6d59 100644
--- a/x-pack/plugins/observability_solution/observability_onboarding/tsconfig.json
+++ b/x-pack/plugins/observability_solution/observability_onboarding/tsconfig.json
@@ -18,7 +18,6 @@
     "@kbn/observability-plugin",
     "@kbn/i18n",
     "@kbn/core-http-browser",
-    "@kbn/ui-theme",
     "@kbn/server-route-repository",
     "@kbn/config-schema",
     "@kbn/shared-ux-router",
diff --git a/x-pack/plugins/observability_solution/profiling/public/components/async_component.tsx b/x-pack/plugins/observability_solution/profiling/public/components/async_component.tsx
index 7e94702e227ceb..5d86340fe79f35 100644
--- a/x-pack/plugins/observability_solution/profiling/public/components/async_component.tsx
+++ b/x-pack/plugins/observability_solution/profiling/public/components/async_component.tsx
@@ -4,7 +4,14 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-import { EuiFlexGroup, EuiFlexItem, EuiLoadingChart, EuiText, EuiIcon } from '@elastic/eui';
+import {
+  EuiFlexGroup,
+  EuiFlexGroupProps,
+  EuiFlexItem,
+  EuiLoadingChart,
+  EuiText,
+  EuiIcon,
+} from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import React from 'react';
 import { AsyncState, AsyncStatus } from '../hooks/use_async';
@@ -18,7 +25,7 @@ export function AsyncComponent({
   style,
   alignTop,
 }: AsyncState<any> & {
-  style?: React.ComponentProps<typeof EuiFlexGroup>['style'];
+  style?: EuiFlexGroupProps['style'];
   children: React.ReactElement;
   mono?: boolean;
   size: 'm' | 'l' | 'xl';
diff --git a/x-pack/plugins/observability_solution/slo/public/embeddable/slo/overview/group_view/group_view.tsx b/x-pack/plugins/observability_solution/slo/public/embeddable/slo/overview/group_view/group_view.tsx
index a6dc74bdf99ef9..04e3543b02565f 100644
--- a/x-pack/plugins/observability_solution/slo/public/embeddable/slo/overview/group_view/group_view.tsx
+++ b/x-pack/plugins/observability_solution/slo/public/embeddable/slo/overview/group_view/group_view.tsx
@@ -5,19 +5,21 @@
  * 2.0.
  */
 
-import React, { useState, useEffect } from 'react';
 import { Filter } from '@kbn/es-query';
+import React, { useEffect, useState } from 'react';
 import { Subject } from 'rxjs';
-import { SLOView } from '../../../../pages/slos/components/toggle_slo_view';
 import { GroupView } from '../../../../pages/slos/components/grouped_slos/group_view';
+import { GroupByField } from '../../../../pages/slos/components/slo_list_group_by';
+import { SLOView } from '../../../../pages/slos/components/toggle_slo_view';
+import { SortField } from '../../../../pages/slos/hooks/use_url_search_state';
 import { buildCombinedKqlQuery } from './helpers/build_kql_query';
 
 interface Props {
-  groupBy: string;
+  groupBy: GroupByField;
   groups?: string[];
   kqlQuery?: string;
   sloView: SLOView;
-  sort?: string;
+  sort?: SortField;
   filters?: Filter[];
   reloadSubject: Subject<boolean>;
 }
diff --git a/x-pack/plugins/observability_solution/slo/public/embeddable/slo/overview/group_view/helpers/build_kql_query.test.ts b/x-pack/plugins/observability_solution/slo/public/embeddable/slo/overview/group_view/helpers/build_kql_query.test.ts
index 4c3b4b5f3abc86..fff968f7459f3c 100644
--- a/x-pack/plugins/observability_solution/slo/public/embeddable/slo/overview/group_view/helpers/build_kql_query.test.ts
+++ b/x-pack/plugins/observability_solution/slo/public/embeddable/slo/overview/group_view/helpers/build_kql_query.test.ts
@@ -5,10 +5,14 @@
  * 2.0.
  */
 
+import { GroupByField } from '../../../../../pages/slos/components/slo_list_group_by';
 import { buildCombinedKqlQuery } from './build_kql_query';
 
 describe('buildCombinedKqlQuery', () => {
-  const testData = [
+  const testData: Array<{
+    title: string;
+    props: { kqlQuery: string; groups: string[]; groupBy: GroupByField };
+  }> = [
     {
       title: 'no selected groups, with kql',
       props: {
diff --git a/x-pack/plugins/observability_solution/slo/public/embeddable/slo/overview/group_view/helpers/build_kql_query.ts b/x-pack/plugins/observability_solution/slo/public/embeddable/slo/overview/group_view/helpers/build_kql_query.ts
index 3a053f028b86ac..019536a2156a5f 100644
--- a/x-pack/plugins/observability_solution/slo/public/embeddable/slo/overview/group_view/helpers/build_kql_query.ts
+++ b/x-pack/plugins/observability_solution/slo/public/embeddable/slo/overview/group_view/helpers/build_kql_query.ts
@@ -5,10 +5,12 @@
  * 2.0.
  */
 
+import { GroupByField } from '../../../../../pages/slos/components/slo_list_group_by';
+
 interface Props {
   kqlQuery: string;
   groups: string[];
-  groupBy: string;
+  groupBy: GroupByField;
 }
 
 export const buildCombinedKqlQuery = ({ groups, groupBy, kqlQuery }: Props) => {
diff --git a/x-pack/plugins/observability_solution/slo/public/embeddable/slo/overview/group_view/slo_group_filters.tsx b/x-pack/plugins/observability_solution/slo/public/embeddable/slo/overview/group_view/slo_group_filters.tsx
index 48b9df92c73a65..2f32d360853bb3 100644
--- a/x-pack/plugins/observability_solution/slo/public/embeddable/slo/overview/group_view/slo_group_filters.tsx
+++ b/x-pack/plugins/observability_solution/slo/public/embeddable/slo/overview/group_view/slo_group_filters.tsx
@@ -4,23 +4,22 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-import './slo_group_filters.scss';
-import React, { useState, useEffect, useMemo } from 'react';
-import { FormattedMessage } from '@kbn/i18n-react';
+import { EuiComboBox, EuiComboBoxOptionOption, EuiFormRow, EuiSelect, EuiText } from '@elastic/eui';
 import { Filter } from '@kbn/es-query';
-import { debounce } from 'lodash';
-import { EuiFormRow, EuiComboBox, EuiSelect, EuiComboBoxOptionOption, EuiText } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
-
+import { FormattedMessage } from '@kbn/i18n-react';
+import { debounce } from 'lodash';
+import React, { useEffect, useMemo, useState } from 'react';
+import { sloAppId } from '../../../../../common';
+import { SLO_SUMMARY_DESTINATION_INDEX_NAME } from '../../../../../common/constants';
+import { useCreateDataView } from '../../../../hooks/use_create_data_view';
 import { useFetchSloGroups } from '../../../../hooks/use_fetch_slo_groups';
-import { useGetSettings } from '../../../../pages/slo_settings/use_get_settings';
-
 import { SLI_OPTIONS } from '../../../../pages/slo_edit/constants';
+import { useGetSettings } from '../../../../pages/slo_settings/use_get_settings';
 import { useKibana } from '../../../../utils/kibana_react';
-import { useCreateDataView } from '../../../../hooks/use_create_data_view';
-import { SLO_SUMMARY_DESTINATION_INDEX_NAME } from '../../../../../common/constants';
-import { sloAppId } from '../../../../../common';
-import type { GroupFilters, GroupBy } from '../types';
+import type { GroupBy, GroupFilters } from '../types';
+import './slo_group_filters.scss';
+
 interface Option {
   value: string;
   text: string;
@@ -171,7 +170,7 @@ export function SloGroupFilters({ selectedFilters, onSelected }: Props) {
       >
         <EuiSelect
           fullWidth
-          data-test-subj="o11ySloGroupConfigurationSelect"
+          data-test-subj="sloGroupOverviewConfigurationGroupBy"
           options={groupByOptions}
           value={selectedGroupBy}
           onChange={(e) => {
@@ -207,7 +206,7 @@ export function SloGroupFilters({ selectedFilters, onSelected }: Props) {
             defaultMessage: 'Select a {selectedGroupByLabel}',
             values: { selectedGroupByLabel },
           })}
-          data-test-subj="sloGroup"
+          data-test-subj="sloGroupOverviewConfigurationGroup"
           options={groupOptions}
           selectedOptions={selectedGroupOptions}
           async
@@ -233,6 +232,7 @@ export function SloGroupFilters({ selectedFilters, onSelected }: Props) {
         }
       >
         <SearchBar
+          dataTestSubj="sloGroupOverviewConfigurationKqlBar"
           appName={sloAppId}
           placeholder={PLACEHOLDER}
           indexPatterns={dataView ? [dataView] : []}
diff --git a/x-pack/plugins/observability_solution/slo/public/embeddable/slo/overview/overview_mode_selector.tsx b/x-pack/plugins/observability_solution/slo/public/embeddable/slo/overview/overview_mode_selector.tsx
index e3be666e8a5725..1db7ea9099ce19 100644
--- a/x-pack/plugins/observability_solution/slo/public/embeddable/slo/overview/overview_mode_selector.tsx
+++ b/x-pack/plugins/observability_solution/slo/public/embeddable/slo/overview/overview_mode_selector.tsx
@@ -39,6 +39,7 @@ export interface OverviewModeSelectorProps {
 export function OverviewModeSelector({ value, onChange }: OverviewModeSelectorProps) {
   return (
     <EuiButtonGroup
+      data-test-subj="sloOverviewModeSelector"
       isFullWidth
       legend="This is a basic group"
       options={overviewModeOptions}
diff --git a/x-pack/plugins/observability_solution/slo/public/embeddable/slo/overview/slo_configuration.tsx b/x-pack/plugins/observability_solution/slo/public/embeddable/slo/overview/slo_configuration.tsx
index 136d9ec92a2d89..5f5d2ca91ac22c 100644
--- a/x-pack/plugins/observability_solution/slo/public/embeddable/slo/overview/slo_configuration.tsx
+++ b/x-pack/plugins/observability_solution/slo/public/embeddable/slo/overview/slo_configuration.tsx
@@ -73,7 +73,7 @@ function SingleSloConfiguration({ overviewMode, onCreate, onCancel }: SingleConf
         <EuiFlexGroup>
           <EuiFlexItem>
             <EuiFlexGroup>
-              <EuiFlexItem grow>
+              <EuiFlexItem data-test-subj="singleSloSelector" grow>
                 <SloSelector
                   singleSelection={true}
                   hasError={hasError}
@@ -157,7 +157,7 @@ function GroupSloConfiguration({
 
   return (
     <>
-      <EuiFlyoutBody className="sloOverviewEmbeddable">
+      <EuiFlyoutBody data-test-subj="sloGroupOverviewConfiguration">
         <EuiFlexGroup>
           <EuiFlexItem>
             <EuiFlexGroup>
@@ -200,7 +200,7 @@ export function SloConfiguration({ initialInput, onCreate, onCancel }: SloConfig
   );
 
   return (
-    <EuiFlyout onClose={onCancel}>
+    <EuiFlyout data-test-subj="sloSingleOverviewConfiguration" onClose={onCancel}>
       <EuiFlyoutHeader>
         <EuiFlexGroup direction="column">
           <EuiFlexItem>
diff --git a/x-pack/plugins/observability_solution/slo/public/embeddable/slo/overview/slo_embeddable_factory.tsx b/x-pack/plugins/observability_solution/slo/public/embeddable/slo/overview/slo_embeddable_factory.tsx
index 08d0876bfe5aec..a4f26679dd1dde 100644
--- a/x-pack/plugins/observability_solution/slo/public/embeddable/slo/overview/slo_embeddable_factory.tsx
+++ b/x-pack/plugins/observability_solution/slo/public/embeddable/slo/overview/slo_embeddable_factory.tsx
@@ -138,6 +138,7 @@ export const getOverviewEmbeddableFactory = (deps: SloEmbeddableDeps) => {
               return (
                 <Wrapper>
                   <EuiFlexGroup
+                    data-test-subj="sloGroupOverviewPanel"
                     data-shared-item=""
                     justifyContent="flexEnd"
                     wrap
@@ -154,7 +155,7 @@ export const getOverviewEmbeddableFactory = (deps: SloEmbeddableDeps) => {
                             embeddable: api,
                           } as ActionExecutionContext);
                         }}
-                        data-test-subj="o11ySloAlertsWrapperSlOsIncludedLink"
+                        data-test-subj="o11ySloOverviewEditCriteriaLink"
                       >
                         {i18n.translate('xpack.slo.overviewEmbeddable.editCriteriaLabel', {
                           defaultMessage: 'Edit criteria',
diff --git a/x-pack/plugins/observability_solution/slo/public/embeddable/slo/overview/slo_overview.tsx b/x-pack/plugins/observability_solution/slo/public/embeddable/slo/overview/slo_overview.tsx
index 5d2ca2597f69ed..72a0b57be723b0 100644
--- a/x-pack/plugins/observability_solution/slo/public/embeddable/slo/overview/slo_overview.tsx
+++ b/x-pack/plugins/observability_solution/slo/public/embeddable/slo/overview/slo_overview.tsx
@@ -105,7 +105,7 @@ export function SloOverview({ sloId, sloInstanceId, remoteName, reloadSubject }:
   const historicalSliData = formatHistoricalData(historicalSummary, 'sli_value');
 
   return (
-    <div data-shared-item="" style={{ width: '100%' }}>
+    <div data-test-subj="sloSingleOverviewPanel" data-shared-item="" style={{ width: '100%' }}>
       <SloCardChart
         slo={slo}
         historicalSliData={historicalSliData ?? []}
diff --git a/x-pack/plugins/observability_solution/slo/public/hooks/use_fetch_slo_groups.ts b/x-pack/plugins/observability_solution/slo/public/hooks/use_fetch_slo_groups.ts
index 75f3865558d1ba..dd52db476b2f39 100644
--- a/x-pack/plugins/observability_solution/slo/public/hooks/use_fetch_slo_groups.ts
+++ b/x-pack/plugins/observability_solution/slo/public/hooks/use_fetch_slo_groups.ts
@@ -22,11 +22,12 @@ import {
   SLO_SUMMARY_DESTINATION_INDEX_PATTERN,
 } from '../../common/constants';
 import { SearchState } from '../pages/slos/hooks/use_url_search_state';
+import { GroupByField } from '../pages/slos/components/slo_list_group_by';
 
 interface SLOGroupsParams {
   page?: number;
   perPage?: number;
-  groupBy?: string;
+  groupBy?: GroupByField;
   groupsFilter?: string[];
   kqlQuery?: string;
   tagsFilter?: SearchState['tagsFilter'];
diff --git a/x-pack/plugins/observability_solution/slo/public/hooks/use_fetch_slo_inspect.ts b/x-pack/plugins/observability_solution/slo/public/hooks/use_fetch_slo_inspect.ts
index b868768d45c725..0bd671cf74776f 100644
--- a/x-pack/plugins/observability_solution/slo/public/hooks/use_fetch_slo_inspect.ts
+++ b/x-pack/plugins/observability_solution/slo/public/hooks/use_fetch_slo_inspect.ts
@@ -16,13 +16,8 @@ interface SLOInspectResponse {
   rollUpTransform: TransformPutTransformRequest;
   summaryTransform: TransformPutTransformRequest;
   temporaryDoc: Record<string, any>;
-}
-
-export interface UseInspectSLOResponse {
-  data: SLOInspectResponse | undefined;
-  isLoading: boolean;
-  isSuccess: boolean;
-  isError: boolean;
+  rollUpTransformCompositeQuery: string;
+  summaryTransformCompositeQuery: string;
 }
 
 export function useFetchSloInspect(slo: CreateSLOInput, shouldInspect: boolean) {
diff --git a/x-pack/plugins/observability_solution/slo/public/pages/slo_edit/components/common/slo_inspect/code_block_accordion.tsx b/x-pack/plugins/observability_solution/slo/public/pages/slo_edit/components/common/slo_inspect/code_block_accordion.tsx
new file mode 100644
index 00000000000000..ed7beac737e962
--- /dev/null
+++ b/x-pack/plugins/observability_solution/slo/public/pages/slo_edit/components/common/slo_inspect/code_block_accordion.tsx
@@ -0,0 +1,41 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { ReactNode } from 'react';
+import { EuiAccordion, EuiCodeBlock, EuiTitle } from '@elastic/eui';
+
+export function CodeBlockAccordion({
+  id,
+  label,
+  json,
+  extraAction,
+  children,
+}: {
+  id: string;
+  label: string;
+  json?: any;
+  extraAction?: ReactNode;
+  children?: ReactNode;
+}) {
+  return (
+    <EuiAccordion
+      id={id}
+      extraAction={extraAction}
+      buttonContent={
+        <EuiTitle size="xs">
+          <h3>{label}</h3>
+        </EuiTitle>
+      }
+    >
+      {children ?? (
+        <EuiCodeBlock language="json" fontSize="m" paddingSize="m" isCopyable={true}>
+          {JSON.stringify(json, null, 2)}
+        </EuiCodeBlock>
+      )}
+    </EuiAccordion>
+  );
+}
diff --git a/x-pack/plugins/observability_solution/slo/public/pages/slo_edit/components/common/slo_inspect/loading_state.tsx b/x-pack/plugins/observability_solution/slo/public/pages/slo_edit/components/common/slo_inspect/loading_state.tsx
new file mode 100644
index 00000000000000..02082dc6693257
--- /dev/null
+++ b/x-pack/plugins/observability_solution/slo/public/pages/slo_edit/components/common/slo_inspect/loading_state.tsx
@@ -0,0 +1,19 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiFlexGroup, EuiFlexItem, EuiLoadingSpinner } from '@elastic/eui';
+import React from 'react';
+
+export function LoadingState() {
+  return (
+    <EuiFlexGroup alignItems="center" justifyContent="center" style={{ height: '100%' }}>
+      <EuiFlexItem grow={false}>
+        <EuiLoadingSpinner size="xl" />
+      </EuiFlexItem>
+    </EuiFlexGroup>
+  );
+}
diff --git a/x-pack/plugins/observability_solution/slo/public/pages/slo_edit/components/common/slo_inspect/req_code_viewer.tsx b/x-pack/plugins/observability_solution/slo/public/pages/slo_edit/components/common/slo_inspect/req_code_viewer.tsx
new file mode 100644
index 00000000000000..f160dc0aa33c01
--- /dev/null
+++ b/x-pack/plugins/observability_solution/slo/public/pages/slo_edit/components/common/slo_inspect/req_code_viewer.tsx
@@ -0,0 +1,124 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+/* eslint-disable @elastic/eui/href-or-on-click */
+
+import { EuiButtonEmpty, EuiCopy, EuiFlexGroup, EuiFlexItem, EuiSpacer } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import { XJsonLang } from '@kbn/monaco';
+import React, { ReactNode, useCallback } from 'react';
+import { CodeEditor } from '@kbn/code-editor';
+import { compressToEncodedURIComponent } from 'lz-string';
+import { useKibana } from '../../../../../utils/kibana_react';
+
+interface RequestCodeViewerProps {
+  value: string;
+}
+
+const copyToClipboardLabel = i18n.translate('xpack.slo.requests.copyToClipboardLabel', {
+  defaultMessage: 'Copy to clipboard',
+});
+
+export function RequestCodeViewer({ value }: RequestCodeViewerProps) {
+  const {
+    application: { navigateToUrl },
+    share: {
+      url: { locators },
+    },
+  } = useKibana().services;
+
+  // "Open in Console" button
+  const devToolsDataUri = compressToEncodedURIComponent(value);
+  const consoleHref = locators
+    .get('CONSOLE_APP_LOCATOR')
+    ?.useUrl({ loadFrom: `data:text/plain,${devToolsDataUri}` });
+
+  const handleDevToolsLinkClick = useCallback(
+    () => consoleHref && navigateToUrl && navigateToUrl(consoleHref),
+    [consoleHref, navigateToUrl]
+  );
+
+  const actions: Array<{ name: string; action: ReactNode }> = [];
+
+  actions.push({
+    name: 'openInConsole',
+    action: (
+      <EuiButtonEmpty
+        size="xs"
+        flush="right"
+        iconType="wrench"
+        href={consoleHref}
+        onClick={handleDevToolsLinkClick}
+        data-test-subj="inspectorRequestOpenInConsoleButton"
+      >
+        {openInConsoleLabel}
+      </EuiButtonEmpty>
+    ),
+  });
+
+  return (
+    <EuiFlexGroup
+      direction="column"
+      gutterSize="s"
+      wrap={false}
+      responsive={false}
+      css={{ height: 800 }}
+    >
+      <EuiFlexItem grow={false}>
+        <EuiSpacer size="s" />
+        <EuiFlexGroup justifyContent="flexEnd" gutterSize="m" wrap>
+          <EuiFlexItem grow={false}>
+            <div>
+              <EuiCopy textToCopy={value}>
+                {(copy) => (
+                  <EuiButtonEmpty
+                    size="xs"
+                    flush="right"
+                    iconType="copyClipboard"
+                    onClick={copy}
+                    data-test-subj="inspectorRequestCopyClipboardButton"
+                  >
+                    {copyToClipboardLabel}
+                  </EuiButtonEmpty>
+                )}
+              </EuiCopy>
+            </div>
+          </EuiFlexItem>
+          {!!actions &&
+            actions.map((item) => (
+              <EuiFlexItem grow={false} key={item.name}>
+                <div>{item.action}</div>
+              </EuiFlexItem>
+            ))}
+        </EuiFlexGroup>
+      </EuiFlexItem>
+      <EuiFlexItem grow={true} data-test-subj="inspectorRequestCodeViewerContainer">
+        <CodeEditor
+          languageId={XJsonLang.ID}
+          value={value}
+          options={{
+            readOnly: true,
+            lineNumbers: 'off',
+            fontSize: 12,
+            minimap: {
+              enabled: false,
+            },
+            folding: true,
+            scrollBeyondLastLine: false,
+            wordWrap: 'on',
+            wrappingIndent: 'indent',
+            automaticLayout: true,
+          }}
+        />
+      </EuiFlexItem>
+    </EuiFlexGroup>
+  );
+}
+
+const openInConsoleLabel = i18n.translate('xpack.slo.requests.openInConsoleLabel', {
+  defaultMessage: 'Open in Console',
+});
diff --git a/x-pack/plugins/observability_solution/slo/public/pages/slo_edit/components/common/slo_inspect.tsx b/x-pack/plugins/observability_solution/slo/public/pages/slo_edit/components/common/slo_inspect/slo_inspect.tsx
similarity index 82%
rename from x-pack/plugins/observability_solution/slo/public/pages/slo_edit/components/common/slo_inspect.tsx
rename to x-pack/plugins/observability_solution/slo/public/pages/slo_edit/components/common/slo_inspect/slo_inspect.tsx
index 223105572f6670..9399492f0ad282 100644
--- a/x-pack/plugins/observability_solution/slo/public/pages/slo_edit/components/common/slo_inspect.tsx
+++ b/x-pack/plugins/observability_solution/slo/public/pages/slo_edit/components/common/slo_inspect/slo_inspect.tsx
@@ -5,18 +5,13 @@
  * 2.0.
  */
 import {
-  EuiAccordion,
   EuiButton,
   EuiButtonEmpty,
   EuiButtonIcon,
-  EuiCodeBlock,
-  EuiFlexGroup,
-  EuiFlexItem,
   EuiFlyout,
   EuiFlyoutBody,
   EuiFlyoutFooter,
   EuiFlyoutHeader,
-  EuiLoadingSpinner,
   EuiSpacer,
   EuiTitle,
   EuiToolTip,
@@ -29,14 +24,17 @@ import {
 } from '@kbn/ingest-pipelines-plugin/public';
 import { useFetcher } from '@kbn/observability-shared-plugin/public';
 import { GetSLOResponse } from '@kbn/slo-schema';
-import React, { ReactNode, useState } from 'react';
+import React, { useState } from 'react';
 import { useFormContext } from 'react-hook-form';
 import { enableInspectEsQueries } from '@kbn/observability-plugin/common';
-import { useKibana } from '../../../../utils/kibana_react';
-import { useFetchSloInspect } from '../../../../hooks/use_fetch_slo_inspect';
-import { usePluginContext } from '../../../../hooks/use_plugin_context';
-import { transformCreateSLOFormToCreateSLOInput } from '../../helpers/process_slo_form_values';
-import { CreateSLOForm } from '../../types';
+import { useKibana } from '../../../../../utils/kibana_react';
+import { useFetchSloInspect } from '../../../../../hooks/use_fetch_slo_inspect';
+import { usePluginContext } from '../../../../../hooks/use_plugin_context';
+import { transformCreateSLOFormToCreateSLOInput } from '../../../helpers/process_slo_form_values';
+import { CreateSLOForm } from '../../../types';
+import { CodeBlockAccordion } from './code_block_accordion';
+import { LoadingState } from './loading_state';
+import { RequestCodeViewer } from './req_code_viewer';
 
 interface Props {
   slo?: GetSLOResponse;
@@ -180,6 +178,29 @@ function SLOInspect({ slo, disabled }: Props) {
                 )}
                 json={inspectSloData.temporaryDoc}
               />
+              <EuiSpacer size="s" />
+
+              <CodeBlockAccordion
+                id="rollupTransformQuery"
+                label={i18n.translate(
+                  'xpack.slo.sLOInspect.codeBlockAccordion.transformQueryLabel',
+                  { defaultMessage: 'Rollup Transform query composite' }
+                )}
+              >
+                <RequestCodeViewer value={inspectSloData.rollUpTransformCompositeQuery} />
+              </CodeBlockAccordion>
+
+              <EuiSpacer size="s" />
+
+              <CodeBlockAccordion
+                id="summmaryTransformQuery"
+                label={i18n.translate(
+                  'xpack.slo.sLOInspect.codeBlockAccordion.summaryTransformQueryLabel',
+                  { defaultMessage: 'Summary Transform query composite' }
+                )}
+              >
+                <RequestCodeViewer value={inspectSloData.summaryTransformCompositeQuery} />
+              </CodeBlockAccordion>
             </>
           )}
         </EuiFlyoutBody>
@@ -230,41 +251,3 @@ function SLOInspect({ slo, disabled }: Props) {
     </>
   );
 }
-
-function CodeBlockAccordion({
-  id,
-  label,
-  json,
-  extraAction,
-}: {
-  id: string;
-  label: string;
-  json: any;
-  extraAction?: ReactNode;
-}) {
-  return (
-    <EuiAccordion
-      id={id}
-      extraAction={extraAction}
-      buttonContent={
-        <EuiTitle size="xs">
-          <h3>{label}</h3>
-        </EuiTitle>
-      }
-    >
-      <EuiCodeBlock language="json" fontSize="m" paddingSize="m" isCopyable={true}>
-        {JSON.stringify(json, null, 2)}
-      </EuiCodeBlock>
-    </EuiAccordion>
-  );
-}
-
-export function LoadingState() {
-  return (
-    <EuiFlexGroup alignItems="center" justifyContent="center" style={{ height: '100%' }}>
-      <EuiFlexItem grow={false}>
-        <EuiLoadingSpinner size="xl" />
-      </EuiFlexItem>
-    </EuiFlexGroup>
-  );
-}
diff --git a/x-pack/plugins/observability_solution/slo/public/pages/slo_edit/components/slo_edit_form_footer.tsx b/x-pack/plugins/observability_solution/slo/public/pages/slo_edit/components/slo_edit_form_footer.tsx
index 7a52a07c6d0b01..267fd7f6d98517 100644
--- a/x-pack/plugins/observability_solution/slo/public/pages/slo_edit/components/slo_edit_form_footer.tsx
+++ b/x-pack/plugins/observability_solution/slo/public/pages/slo_edit/components/slo_edit_form_footer.tsx
@@ -25,7 +25,7 @@ import {
 } from '../helpers/process_slo_form_values';
 import { CreateSLOForm } from '../types';
 import { EquivalentApiRequest } from './common/equivalent_api_request';
-import { SLOInspectWrapper } from './common/slo_inspect';
+import { SLOInspectWrapper } from './common/slo_inspect/slo_inspect';
 
 export interface Props {
   slo?: GetSLOResponse;
diff --git a/x-pack/plugins/observability_solution/slo/public/pages/slos/components/card_view/slo_card_item.tsx b/x-pack/plugins/observability_solution/slo/public/pages/slos/components/card_view/slo_card_item.tsx
index 29aa44a2f06c81..c6f6e1834ff83e 100644
--- a/x-pack/plugins/observability_solution/slo/public/pages/slos/components/card_view/slo_card_item.tsx
+++ b/x-pack/plugins/observability_solution/slo/public/pages/slos/components/card_view/slo_card_item.tsx
@@ -244,6 +244,12 @@ export function SloCardChart({
               title: slo.name,
               subtitle: subTitle,
               value: sliValue,
+              trendA11yTitle: i18n.translate('xpack.slo.slo.sLOGridItem.trendA11yLabel', {
+                defaultMessage: `The "{title}" trend`,
+                values: {
+                  title: slo.name,
+                },
+              }),
               trendShape: MetricTrendShape.Area,
               trend: historicalSliData?.map((d) => ({
                 x: d.key as number,
diff --git a/x-pack/plugins/observability_solution/slo/public/pages/slos/components/grouped_slos/group_list_view.tsx b/x-pack/plugins/observability_solution/slo/public/pages/slos/components/grouped_slos/group_list_view.tsx
index e356411fca1833..4caa79e90d28c9 100644
--- a/x-pack/plugins/observability_solution/slo/public/pages/slos/components/grouped_slos/group_list_view.tsx
+++ b/x-pack/plugins/observability_solution/slo/public/pages/slos/components/grouped_slos/group_list_view.tsx
@@ -10,8 +10,8 @@ import {
   EuiBadge,
   EuiFlexGroup,
   EuiFlexItem,
-  EuiLink,
   EuiHorizontalRule,
+  EuiLink,
   EuiSpacer,
   EuiTablePagination,
   EuiText,
@@ -19,27 +19,28 @@ import {
   EuiTitle,
   EuiToolTip,
 } from '@elastic/eui';
+import { CoreStart } from '@kbn/core-lifecycle-browser';
 import { Filter } from '@kbn/es-query';
 import { i18n } from '@kbn/i18n';
-import React, { memo, useState } from 'react';
 import { GroupSummary } from '@kbn/slo-schema';
-import { CoreStart } from '@kbn/core-lifecycle-browser';
-import { useKibana } from '../../../../utils/kibana_react';
+import React, { memo, useState } from 'react';
 import { paths } from '../../../../../common/locators/paths';
 import { useFetchSloList } from '../../../../hooks/use_fetch_slo_list';
+import { useKibana } from '../../../../utils/kibana_react';
 import { SLI_OPTIONS } from '../../../slo_edit/constants';
 import { useSloFormattedSLIValue } from '../../hooks/use_slo_summary';
+import type { SortDirection, SortField } from '../../hooks/use_url_search_state';
 import { SlosView } from '../slos_view';
+import { GroupByField } from '../slo_list_group_by';
 import { SLOView } from '../toggle_slo_view';
-import type { SortDirection } from '../../hooks/use_url_search_state';
 
 interface Props {
   group: string;
   kqlQuery?: string;
   sloView: SLOView;
-  sort?: string;
+  sort?: SortField;
   direction?: SortDirection;
-  groupBy: string;
+  groupBy: GroupByField;
   summary?: GroupSummary;
   filters?: Filter[];
 }
@@ -155,45 +156,59 @@ export function GroupListView({
                     })}
                   </EuiBadge>
                 </EuiFlexItem>
+
                 <EuiFlexItem>
-                  <EuiToolTip
-                    content={
-                      <>
-                        <EuiText size="s">
-                          {i18n.translate('xpack.slo.group.totalSloViolatedTooltip', {
-                            defaultMessage: 'SLO: {name}',
-                            values: {
-                              name: summary?.worst.slo?.name,
-                            },
-                          })}
-                        </EuiText>
-                        <EuiText size="s">
-                          {i18n.translate('xpack.slo.group.totalSloViolatedTooltip.instance', {
-                            defaultMessage: 'Instance: {instance}',
-                            values: {
-                              instance: summary?.worst.slo?.instanceId,
-                            },
-                          })}
-                        </EuiText>
-                      </>
-                    }
-                  >
-                    <EuiLink
-                      data-test-subj="o11yGroupListViewLink"
-                      href={basePath.prepend(
-                        paths.sloDetails(summary!.worst.slo?.id, summary!.worst.slo?.instanceId)
-                      )}
-                    >
+                  {group === 'NO_DATA' ? (
+                    <span>
                       {i18n.translate('xpack.slo.group.worstPerforming', {
                         defaultMessage: 'Worst performing: ',
                       })}
-                      <EuiTextColor
-                        color={summary?.worst.status !== 'HEALTHY' ? 'danger' : undefined}
+                      <strong>
+                        {i18n.translate('xpack.slo.group.worstPerforming.notAvailable', {
+                          defaultMessage: 'N/A',
+                        })}
+                      </strong>
+                    </span>
+                  ) : (
+                    <EuiToolTip
+                      content={
+                        <>
+                          <EuiText size="s">
+                            {i18n.translate('xpack.slo.group.totalSloViolatedTooltip', {
+                              defaultMessage: 'SLO: {name}',
+                              values: {
+                                name: summary?.worst.slo?.name,
+                              },
+                            })}
+                          </EuiText>
+                          <EuiText size="s">
+                            {i18n.translate('xpack.slo.group.totalSloViolatedTooltip.instance', {
+                              defaultMessage: 'Instance: {instance}',
+                              values: {
+                                instance: summary?.worst.slo?.instanceId,
+                              },
+                            })}
+                          </EuiText>
+                        </>
+                      }
+                    >
+                      <EuiLink
+                        data-test-subj="o11yGroupListViewLink"
+                        href={basePath.prepend(
+                          paths.sloDetails(summary!.worst.slo?.id, summary!.worst.slo?.instanceId)
+                        )}
                       >
-                        <strong>{worstSLI}</strong>
-                      </EuiTextColor>
-                    </EuiLink>
-                  </EuiToolTip>
+                        {i18n.translate('xpack.slo.group.worstPerforming', {
+                          defaultMessage: 'Worst performing: ',
+                        })}
+                        <EuiTextColor
+                          color={summary?.worst.status !== 'HEALTHY' ? 'danger' : undefined}
+                        >
+                          <strong>{worstSLI}</strong>
+                        </EuiTextColor>
+                      </EuiLink>
+                    </EuiToolTip>
+                  )}
                 </EuiFlexItem>
               </EuiFlexGroup>
             }
diff --git a/x-pack/plugins/observability_solution/slo/public/pages/slos/components/grouped_slos/group_view.tsx b/x-pack/plugins/observability_solution/slo/public/pages/slos/components/grouped_slos/group_view.tsx
index f268ecd0028ea9..207be28bf72645 100644
--- a/x-pack/plugins/observability_solution/slo/public/pages/slos/components/grouped_slos/group_view.tsx
+++ b/x-pack/plugins/observability_solution/slo/public/pages/slos/components/grouped_slos/group_view.tsx
@@ -5,21 +5,22 @@
  * 2.0.
  */
 import { EuiEmptyPrompt, EuiFlexItem, EuiLoadingSpinner, EuiTablePagination } from '@elastic/eui';
-import React, { useEffect } from 'react';
 import { Filter } from '@kbn/es-query';
+import React, { useEffect } from 'react';
 import { useFetchSloGroups } from '../../../../hooks/use_fetch_slo_groups';
-import { useUrlSearchState } from '../../hooks/use_url_search_state';
+import type { SortDirection } from '../../hooks/use_url_search_state';
+import { SortField, useUrlSearchState } from '../../hooks/use_url_search_state';
+import { GroupByField } from '../slo_list_group_by';
 import { SLOView } from '../toggle_slo_view';
 import { SloGroupListEmpty } from './group_list_empty';
 import { SloGroupListError } from './group_list_error';
 import { GroupListView } from './group_list_view';
-import type { SortDirection } from '../../hooks/use_url_search_state';
 
 interface Props {
-  groupBy: string;
+  groupBy: GroupByField;
   kqlQuery?: string;
   sloView: SLOView;
-  sort?: string;
+  sort?: SortField;
   direction?: SortDirection;
   filters?: Filter[];
   lastRefreshTime?: number;
diff --git a/x-pack/plugins/observability_solution/slo/public/plugin.ts b/x-pack/plugins/observability_solution/slo/public/plugin.ts
index 2f6dbaab39493e..5b25f97742c86c 100644
--- a/x-pack/plugins/observability_solution/slo/public/plugin.ts
+++ b/x-pack/plugins/observability_solution/slo/public/plugin.ts
@@ -15,7 +15,6 @@ import {
   PluginInitializerContext,
 } from '@kbn/core/public';
 import { BehaviorSubject, firstValueFrom } from 'rxjs';
-import { registerReactEmbeddableFactory } from '@kbn/embeddable-plugin/public';
 import { SloPublicPluginsSetup, SloPublicPluginsStart } from './types';
 import { PLUGIN_NAME, sloAppId } from '../common';
 import type { SloPublicSetup, SloPublicStart } from './types';
@@ -104,14 +103,16 @@ export class SloPlugin
             return { width: 12, height: 8 };
           }
         );
-        registerReactEmbeddableFactory(SLO_OVERVIEW_EMBEDDABLE_ID, async () => {
-          const deps = { ...coreStart, ...pluginsStart };
-
-          const { getOverviewEmbeddableFactory } = await import(
-            './embeddable/slo/overview/slo_embeddable_factory'
-          );
-          return getOverviewEmbeddableFactory(deps);
-        });
+        pluginsSetup.embeddable.registerReactEmbeddableFactory(
+          SLO_OVERVIEW_EMBEDDABLE_ID,
+          async () => {
+            const deps = { ...coreStart, ...pluginsStart };
+            const { getOverviewEmbeddableFactory } = await import(
+              './embeddable/slo/overview/slo_embeddable_factory'
+            );
+            return getOverviewEmbeddableFactory(deps);
+          }
+        );
         const registerSloAlertsEmbeddableFactory = async () => {
           const { SloAlertsEmbeddableFactoryDefinition } = await import(
             './embeddable/slo/alerts/slo_alerts_embeddable_factory'
@@ -124,7 +125,7 @@ export class SloPlugin
         };
         registerSloAlertsEmbeddableFactory();
 
-        registerReactEmbeddableFactory(SLO_ERROR_BUDGET_ID, async () => {
+        pluginsSetup.embeddable.registerReactEmbeddableFactory(SLO_ERROR_BUDGET_ID, async () => {
           const deps = { ...coreStart, ...pluginsStart };
 
           const { getErrorBudgetEmbeddableFactory } = await import(
diff --git a/x-pack/plugins/observability_solution/slo/server/services/__snapshots__/create_slo.test.ts.snap b/x-pack/plugins/observability_solution/slo/server/services/__snapshots__/create_slo.test.ts.snap
index a8bf14900b2cfe..6303588a918a68 100644
--- a/x-pack/plugins/observability_solution/slo/server/services/__snapshots__/create_slo.test.ts.snap
+++ b/x-pack/plugins/observability_solution/slo/server/services/__snapshots__/create_slo.test.ts.snap
@@ -183,6 +183,16 @@ Array [
       "isTempDoc": true,
       "kibanaUrl": "http://myhost.com/mock-server-basepath",
       "latestSliTimestamp": null,
+      "monitor": Object {
+        "config_id": null,
+        "name": null,
+      },
+      "observer": Object {
+        "geo": Object {
+          "name": null,
+        },
+        "name": null,
+      },
       "service": Object {
         "environment": "irrelevant",
         "name": "irrelevant",
diff --git a/x-pack/plugins/observability_solution/slo/server/services/__snapshots__/reset_slo.test.ts.snap b/x-pack/plugins/observability_solution/slo/server/services/__snapshots__/reset_slo.test.ts.snap
index edf23b4e5e7160..6c472f3a3450ae 100644
--- a/x-pack/plugins/observability_solution/slo/server/services/__snapshots__/reset_slo.test.ts.snap
+++ b/x-pack/plugins/observability_solution/slo/server/services/__snapshots__/reset_slo.test.ts.snap
@@ -470,6 +470,16 @@ exports[`ResetSLO resets all associated resources 11`] = `
           "isTempDoc": true,
           "kibanaUrl": "http://myhost.com/mock-server-basepath",
           "latestSliTimestamp": null,
+          "monitor": Object {
+            "config_id": null,
+            "name": null,
+          },
+          "observer": Object {
+            "geo": Object {
+              "name": null,
+            },
+            "name": null,
+          },
           "service": Object {
             "environment": "irrelevant",
             "name": "irrelevant",
diff --git a/x-pack/plugins/observability_solution/slo/server/services/create_slo.ts b/x-pack/plugins/observability_solution/slo/server/services/create_slo.ts
index d6e8b1a309df84..ce8258a222df3d 100644
--- a/x-pack/plugins/observability_solution/slo/server/services/create_slo.ts
+++ b/x-pack/plugins/observability_solution/slo/server/services/create_slo.ts
@@ -9,6 +9,7 @@ import { TransformPutTransformRequest } from '@elastic/elasticsearch/lib/api/typ
 import { ElasticsearchClient, IBasePath, Logger } from '@kbn/core/server';
 import { ALL_VALUE, CreateSLOParams, CreateSLOResponse } from '@kbn/slo-schema';
 import { v4 as uuidv4 } from 'uuid';
+import { getTransformQueryComposite } from './utils/get_transform_compite_query';
 import {
   getSLOSummaryPipelineId,
   getSLOSummaryTransformId,
@@ -94,23 +95,27 @@ export class CreateSLO {
     rollUpTransform: TransformPutTransformRequest;
     summaryTransform: TransformPutTransformRequest;
     temporaryDoc: Record<string, any>;
+    rollUpTransformCompositeQuery: string;
+    summaryTransformCompositeQuery: string;
   } {
     const slo = this.toSLO(params);
     validateSLO(slo);
 
     const rollUpTransform = this.transformManager.inspect(slo);
     const pipeline = getSLOSummaryPipelineTemplate(slo, this.spaceId, this.basePath);
-
     const summaryTransform = this.summaryTransformManager.inspect(slo);
-
     const temporaryDoc = createTempSummaryDocument(slo, this.spaceId, this.basePath);
 
     return {
+      slo,
       pipeline,
       temporaryDoc,
       summaryTransform,
       rollUpTransform,
-      slo,
+      // @ts-expect-error there is some issue with deprecated types being used in es types
+      rollUpTransformCompositeQuery: getTransformQueryComposite(rollUpTransform),
+      // @ts-expect-error there is some issue with deprecated types being used in es types
+      summaryTransformCompositeQuery: getTransformQueryComposite(summaryTransform),
     };
   }
 
diff --git a/x-pack/plugins/observability_solution/slo/server/services/find_slo_groups.ts b/x-pack/plugins/observability_solution/slo/server/services/find_slo_groups.ts
index c962c7ae926ea1..9931a8c8c6c6f0 100644
--- a/x-pack/plugins/observability_solution/slo/server/services/find_slo_groups.ts
+++ b/x-pack/plugins/observability_solution/slo/server/services/find_slo_groups.ts
@@ -4,15 +4,19 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-import { FindSLOGroupsParams, FindSLOGroupsResponse, Pagination } from '@kbn/slo-schema';
-import { ElasticsearchClient, SavedObjectsClientContract } from '@kbn/core/server';
-import { findSLOGroupsResponseSchema } from '@kbn/slo-schema';
-import { Logger } from '@kbn/core/server';
-import { getListOfSummaryIndices } from './slo_settings';
-import { typedSearch } from '../utils/queries';
-import { IllegalArgumentError } from '../errors';
+import { ElasticsearchClient, Logger, SavedObjectsClientContract } from '@kbn/core/server';
+import {
+  FindSLOGroupsParams,
+  FindSLOGroupsResponse,
+  findSLOGroupsResponseSchema,
+  Pagination,
+  sloGroupWithSummaryResponseSchema,
+} from '@kbn/slo-schema';
 import { DEFAULT_SLO_GROUPS_PAGE_SIZE } from '../../common/constants';
-import { Status } from '../domain/models';
+import { IllegalArgumentError } from '../errors';
+import { typedSearch } from '../utils/queries';
+import { getListOfSummaryIndices } from './slo_settings';
+import { EsSummaryDocument } from './summary_transform_generator/helpers/create_temp_summary';
 import { getElasticsearchQueryOrThrow } from './transform_generators';
 
 const DEFAULT_PAGE = 1;
@@ -32,12 +36,6 @@ function toPagination(params: FindSLOGroupsParams): Pagination {
   };
 }
 
-interface SliDocument {
-  sliValue: number;
-  status: Status;
-  'slo.id': string;
-}
-
 export class FindSLOGroups {
   constructor(
     private esClient: ElasticsearchClient,
@@ -151,28 +149,37 @@ export class FindSLOGroups {
     });
 
     const total = response.aggregations?.distinct_items?.value ?? 0;
-    const results =
-      response.aggregations?.groupBy?.buckets.reduce((acc, bucket) => {
-        const sliDocument = bucket.worst?.hits?.hits[0]?._source as SliDocument;
-        if (String(bucket.key).endsWith('.temp') && groupBy === '_index') {
-          return acc;
+    const results = response.aggregations?.groupBy?.buckets
+      .map((bucket) => {
+        const sourceSummaryDoc = bucket.worst?.hits?.hits[0]?._source as EsSummaryDocument;
+        const groupKey = String(bucket.key);
+        if (groupKey.endsWith('.temp') && groupBy === '_index') {
+          return undefined;
         }
-        return [
-          ...acc,
-          {
-            group: bucket.key,
-            groupBy,
-            summary: {
-              total: bucket.doc_count ?? 0,
-              worst: sliDocument,
-              violated: bucket.violated?.doc_count,
-              healthy: bucket.healthy?.doc_count,
-              degrading: bucket.degrading?.doc_count,
-              noData: bucket.noData?.doc_count,
+
+        return sloGroupWithSummaryResponseSchema.encode({
+          group: groupKey,
+          groupBy: groupBy!,
+          summary: {
+            total: bucket.doc_count ?? 0,
+            worst: {
+              sliValue: sourceSummaryDoc.sliValue,
+              status: sourceSummaryDoc.status,
+              slo: {
+                id: sourceSummaryDoc.slo.id,
+                instanceId: sourceSummaryDoc.slo.instanceId,
+                name: sourceSummaryDoc.slo.name,
+              },
             },
+            violated: bucket.violated?.doc_count,
+            healthy: bucket.healthy?.doc_count,
+            degrading: bucket.degrading?.doc_count,
+            noData: bucket.noData?.doc_count,
           },
-        ];
-      }, [] as Array<Record<'group' | 'groupBy' | 'summary', any>>) ?? [];
+        });
+      })
+      .filter((result) => result !== undefined) as unknown as FindSLOGroupsResponse['results'];
+
     return findSLOGroupsResponseSchema.encode({
       page: pagination.page,
       perPage: pagination.perPage,
diff --git a/x-pack/plugins/observability_solution/slo/server/services/summary_transform_generator/helpers/create_temp_summary.ts b/x-pack/plugins/observability_solution/slo/server/services/summary_transform_generator/helpers/create_temp_summary.ts
index 9d4ca3a4afca5a..fc2fdc6f22f2e2 100644
--- a/x-pack/plugins/observability_solution/slo/server/services/summary_transform_generator/helpers/create_temp_summary.ts
+++ b/x-pack/plugins/observability_solution/slo/server/services/summary_transform_generator/helpers/create_temp_summary.ts
@@ -11,6 +11,7 @@ import * as t from 'io-ts';
 import { Indicator, IndicatorTypes, SLODefinition, Status } from '../../../domain/models';
 
 export interface EsSummaryDocument {
+  // apm specific fields
   service: {
     environment: string | null;
     name: string | null;
@@ -19,6 +20,18 @@ export interface EsSummaryDocument {
     name: string | null;
     type: string | null;
   };
+  // synthetics specific fields
+  monitor: {
+    config_id: string | null;
+    name: string | null;
+  };
+  observer: {
+    geo: {
+      name: string | null;
+    };
+    name: string | null;
+  };
+  // common fields
   slo: {
     // >= 8.14: Add indicator.params on the temporary summary as well as real summary through summary pipeline
     indicator: { type: IndicatorTypes } | Indicator;
@@ -60,6 +73,7 @@ export function createTempSummaryDocument(
   const apmParams = 'environment' in slo.indicator.params ? slo.indicator.params : null;
 
   const doc = {
+    // apm specific fields
     service: {
       environment: apmParams?.environment ?? null,
       name: apmParams?.service ?? null,
@@ -68,6 +82,17 @@ export function createTempSummaryDocument(
       name: apmParams?.transactionName ?? null,
       type: apmParams?.transactionType ?? null,
     },
+    // synthetics specific fields
+    monitor: {
+      name: null,
+      config_id: null,
+    },
+    observer: {
+      name: null,
+      geo: {
+        name: null,
+      },
+    },
     slo: {
       // 8.14 adds indicator.params through transform summary pipeline, i.e. indicator.params might be undefined
       indicator: slo.indicator,
diff --git a/x-pack/plugins/observability_solution/slo/server/services/unsafe_federated/remote_summary_doc_to_slo.test.ts b/x-pack/plugins/observability_solution/slo/server/services/unsafe_federated/remote_summary_doc_to_slo.test.ts
index cb80fd27d0cc14..be91f8b694753a 100644
--- a/x-pack/plugins/observability_solution/slo/server/services/unsafe_federated/remote_summary_doc_to_slo.test.ts
+++ b/x-pack/plugins/observability_solution/slo/server/services/unsafe_federated/remote_summary_doc_to_slo.test.ts
@@ -28,6 +28,16 @@ describe('FromRemoteSummaryDocToSlo', () => {
             name: null,
             type: null,
           },
+          monitor: {
+            name: null,
+            config_id: null,
+          },
+          observer: {
+            name: null,
+            geo: {
+              name: null,
+            },
+          },
           slo: {
             indicator: {
               type: 'sli.kql.custom',
@@ -84,6 +94,16 @@ describe('FromRemoteSummaryDocToSlo', () => {
             name: null,
             type: null,
           },
+          monitor: {
+            name: null,
+            config_id: null,
+          },
+          observer: {
+            name: null,
+            geo: {
+              name: null,
+            },
+          },
           slo: {
             indicator: {
               type: 'sli.kql.custom',
diff --git a/x-pack/plugins/observability_solution/slo/server/services/utils/get_transform_compite_query.ts b/x-pack/plugins/observability_solution/slo/server/services/utils/get_transform_compite_query.ts
new file mode 100644
index 00000000000000..6ed34a9cd0aa4b
--- /dev/null
+++ b/x-pack/plugins/observability_solution/slo/server/services/utils/get_transform_compite_query.ts
@@ -0,0 +1,44 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  AggregationsCompositeAggregationSource,
+  TransformPutTransformRequest,
+} from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
+import { createEsParams } from '../../utils/queries';
+
+export function getTransformQueryComposite(transform: TransformPutTransformRequest['body']) {
+  let transformQueryString: string = '';
+  if (transform) {
+    const pivotGroupBy = transform.pivot?.group_by ?? {};
+    const transformQuery = createEsParams({
+      body: {
+        size: 0,
+        query: transform.source.query,
+        runtime_mappings: transform.source.runtime_mappings,
+        aggs: {
+          groupBy: {
+            composite: {
+              sources: Object.keys(pivotGroupBy).map((key) => ({
+                [key]: pivotGroupBy[key] as AggregationsCompositeAggregationSource,
+              })),
+            },
+            aggs: transform?.pivot?.aggregations,
+          },
+        },
+      },
+    });
+
+    transformQueryString = `POST ${transform.source.index}/_search\n${JSON.stringify(
+      transformQuery.body,
+      null,
+      2
+    )}`;
+  }
+
+  return transformQueryString;
+}
diff --git a/x-pack/plugins/observability_solution/slo/tsconfig.json b/x-pack/plugins/observability_solution/slo/tsconfig.json
index 1260fdef33c242..34ce93e23f5746 100644
--- a/x-pack/plugins/observability_solution/slo/tsconfig.json
+++ b/x-pack/plugins/observability_solution/slo/tsconfig.json
@@ -93,5 +93,7 @@
     "@kbn/datemath",
     "@kbn/presentation-containers",
     "@kbn/dashboard-plugin",
+    "@kbn/monaco",
+    "@kbn/code-editor",
   ]
 }
diff --git a/x-pack/plugins/observability_solution/synthetics/public/apps/synthetics/components/step_details_page/step_waterfall_chart/waterfall/waterfall_header/waterfall_legend_item.tsx b/x-pack/plugins/observability_solution/synthetics/public/apps/synthetics/components/step_details_page/step_waterfall_chart/waterfall/waterfall_header/waterfall_legend_item.tsx
index 236cb8c8c47cfe..2908c88cb0e39e 100644
--- a/x-pack/plugins/observability_solution/synthetics/public/apps/synthetics/components/step_details_page/step_waterfall_chart/waterfall/waterfall_header/waterfall_legend_item.tsx
+++ b/x-pack/plugins/observability_solution/synthetics/public/apps/synthetics/components/step_details_page/step_waterfall_chart/waterfall/waterfall_header/waterfall_legend_item.tsx
@@ -8,7 +8,7 @@
 import { EuiFlexGroup, EuiIcon, EuiText } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { euiStyled } from '@kbn/kibana-react-plugin/common';
-import React, { MouseEventHandler, useCallback, useState } from 'react';
+import React, { AriaRole, MouseEventHandler, useCallback, useState } from 'react';
 
 export function WaterfallLegendItem<T = string>({
   id,
@@ -37,7 +37,8 @@ export function WaterfallLegendItem<T = string>({
   const ariaLabel = `${label}${isClickable ? ` - ${title}` : ''}`;
 
   return (
-    <EuiFlexGroupLegendItem
+    <EuiFlexGroup
+      component={StyledLegendItem}
       role={isClickable ? 'checkbox' : 'listitem'}
       title={title}
       aria-label={ariaLabel}
@@ -54,11 +55,11 @@ export function WaterfallLegendItem<T = string>({
       <EuiIcon color={color} size="m" type={isBoxFilled ? 'stopFilled' : 'stopSlash'} />
 
       <EuiText size="xs">{label}</EuiText>
-    </EuiFlexGroupLegendItem>
+    </EuiFlexGroup>
   );
 }
 
-const EuiFlexGroupLegendItem = euiStyled(EuiFlexGroup)`
+const StyledLegendItem = euiStyled.div<{ role: AriaRole }>`
   flex-grow: 0;
   flex-shrink: 0;
   &:active {
diff --git a/x-pack/plugins/observability_solution/synthetics/server/synthetics_service/service_api_client.ts b/x-pack/plugins/observability_solution/synthetics/server/synthetics_service/service_api_client.ts
index 4f504d50de2b72..f5c996e5efc59c 100644
--- a/x-pack/plugins/observability_solution/synthetics/server/synthetics_service/service_api_client.ts
+++ b/x-pack/plugins/observability_solution/synthetics/server/synthetics_service/service_api_client.ts
@@ -115,6 +115,10 @@ export class ServiceAPIClient {
           this.logger.error(e);
         }
       }
+    } else {
+      this.logger.debug(
+        'Failed to fetch isAllowed status. Locations were not fetched from manifest.'
+      );
     }
 
     return { allowed: false, signupUrl: null };
diff --git a/x-pack/plugins/observability_solution/synthetics/server/synthetics_service/synthetics_service.ts b/x-pack/plugins/observability_solution/synthetics/server/synthetics_service/synthetics_service.ts
index a9e36289b1698e..b2cf070b5bb341 100644
--- a/x-pack/plugins/observability_solution/synthetics/server/synthetics_service/synthetics_service.ts
+++ b/x-pack/plugins/observability_solution/synthetics/server/synthetics_service/synthetics_service.ts
@@ -17,6 +17,7 @@ import {
 import { DEFAULT_SPACE_ID } from '@kbn/spaces-plugin/common';
 import { ALL_SPACES_ID } from '@kbn/spaces-plugin/common/constants';
 import pMap from 'p-map';
+import moment from 'moment';
 import { registerCleanUpTask } from './private_location/clean_up_task';
 import { SyntheticsServerSetup } from '../types';
 import { syntheticsMonitorType, syntheticsParamType } from '../../common/types/saved_objects';
@@ -149,6 +150,9 @@ export class SyntheticsService {
       service.throttling = result.throttling;
       service.locations = result.locations;
       service.apiClient.locations = result.locations;
+      this.logger.debug(
+        `Fetched ${service.locations} Synthetics service locations from manifest: ${this.config.manifestUrl}`
+      );
     } catch (e) {
       this.logger.error(e);
     }
@@ -170,6 +174,8 @@ export class SyntheticsService {
             // Perform the work of the task. The return value should fit the TaskResult interface.
             async run() {
               const { state } = taskInstance;
+              service.logger.debug(`Running synthetics monitors sync task.`);
+              service.checkMissingSchedule(state);
               try {
                 await service.registerServiceLocations();
 
@@ -180,6 +186,12 @@ export class SyntheticsService {
                 if (service.isAllowed && service.config.manifestUrl) {
                   void service.setupIndexTemplates();
                   await service.pushConfigs();
+                } else {
+                  if (!service.isAllowed) {
+                    service.logger.debug(
+                      'User is not allowed to access Synthetics service. Please contact support.'
+                    );
+                  }
                 }
               } catch (e) {
                 sendErrorTelemetryEvents(service.logger, service.server.telemetry, {
@@ -455,6 +467,9 @@ export class SyntheticsService {
 
           await syncAllLocations(PER_PAGE);
         } catch (e) {
+          this.logger.error(`Failed to run Synthetics sync task with error: ${e.message}`);
+          this.logger.error(e);
+
           sendErrorTelemetryEvents(service.logger, service.server.telemetry, {
             reason: 'Failed to push configs to service',
             message: e?.message,
@@ -463,7 +478,6 @@ export class SyntheticsService {
             status: e.status,
             stackVersion: service.server.stackVersion,
           });
-          this.logger.error(e);
         }
       }
     }
@@ -648,6 +662,35 @@ export class SyntheticsService {
 
     return this.formatConfigs(configDataList) as MonitorFields[];
   }
+  checkMissingSchedule(state: Record<string, string>) {
+    try {
+      const lastRunAt = state.lastRunAt;
+      const current = moment();
+
+      if (lastRunAt) {
+        // log if it has missed last schedule
+        const diff = moment(lastRunAt).diff(current, 'minutes');
+        const syncInterval = Number((this.config.syncInterval ?? '5m').split('m')[0]);
+        if (diff > syncInterval) {
+          const message = `Synthetics monitor sync task has missed its schedule, it last ran ${diff} ago.`;
+          this.logger.warn(message);
+          sendErrorTelemetryEvents(this.logger, this.server.telemetry, {
+            message,
+            reason: 'Failed to run synthetics sync task on schedule',
+            type: 'syncTaskMissedSchedule',
+            stackVersion: this.server.stackVersion,
+          });
+        } else {
+          this.logger.debug(
+            `Synthetics monitor sync task is running as expected, it last ran ${diff} minutes ago.`
+          );
+        }
+      }
+      state.lastRunAt = current.toISOString();
+    } catch (e) {
+      this.logger.error(e);
+    }
+  }
 }
 
 class IndexTemplateInstallationError extends Error {
diff --git a/x-pack/plugins/observability_solution/ux/public/components/app/rum_dashboard/visitor_breakdown_map/embedded_map.test.tsx b/x-pack/plugins/observability_solution/ux/public/components/app/rum_dashboard/visitor_breakdown_map/embedded_map.test.tsx
index b2ba69ff8bc943..77b05fa7170b00 100644
--- a/x-pack/plugins/observability_solution/ux/public/components/app/rum_dashboard/visitor_breakdown_map/embedded_map.test.tsx
+++ b/x-pack/plugins/observability_solution/ux/public/components/app/rum_dashboard/visitor_breakdown_map/embedded_map.test.tsx
@@ -10,7 +10,6 @@ import React from 'react';
 
 import { EmbeddedMap } from './embedded_map';
 import { KibanaContextProvider } from '@kbn/kibana-react-plugin/public';
-import { embeddablePluginMock } from '@kbn/embeddable-plugin/public/mocks';
 
 describe('Embedded Map', () => {
   test('it renders', () => {
@@ -26,19 +25,13 @@ describe('Embedded Map', () => {
   });
 });
 
-const mockEmbeddable = embeddablePluginMock.createStartContract();
-
-mockEmbeddable.getEmbeddableFactory = jest.fn().mockImplementation(() => ({
-  create: () => ({
-    reload: jest.fn(),
-    setRenderTooltipContent: jest.fn(),
-    setLayerList: jest.fn(),
-  }),
-}));
+const mockMapsStartService = {
+  Map: jest.fn().mockImplementation(() => <div data-test-subj="mockMap" />),
+};
 
 const mockCore: () => any[] = () => {
   const core = {
-    embeddable: mockEmbeddable,
+    maps: mockMapsStartService,
   };
 
   return [core];
diff --git a/x-pack/plugins/observability_solution/ux/public/components/app/rum_dashboard/visitor_breakdown_map/embedded_map.tsx b/x-pack/plugins/observability_solution/ux/public/components/app/rum_dashboard/visitor_breakdown_map/embedded_map.tsx
index e00f7ff7c71128..cfd68881416af0 100644
--- a/x-pack/plugins/observability_solution/ux/public/components/app/rum_dashboard/visitor_breakdown_map/embedded_map.tsx
+++ b/x-pack/plugins/observability_solution/ux/public/components/app/rum_dashboard/visitor_breakdown_map/embedded_map.tsx
@@ -5,13 +5,9 @@
  * 2.0.
  */
 
-import React, { useEffect, useState, useRef } from 'react';
-import { v4 as uuidv4 } from 'uuid';
+import React from 'react';
 import styled from 'styled-components';
 
-import { MapEmbeddable, MapEmbeddableInput } from '@kbn/maps-plugin/public';
-import { MAP_SAVED_OBJECT_TYPE } from '@kbn/maps-plugin/common';
-import { ErrorEmbeddable, ViewMode, isErrorEmbeddable } from '@kbn/embeddable-plugin/public';
 import type { RenderTooltipContentParams } from '@kbn/maps-plugin/public';
 import { useLayerList } from './use_layer_list';
 import { useLegacyUrlParams } from '../../../../context/url_params_context/use_url_params';
@@ -38,7 +34,7 @@ const EmbeddedPanel = styled.div`
 `;
 
 export function EmbeddedMapComponent() {
-  const { rangeId, urlParams } = useLegacyUrlParams();
+  const { urlParams } = useLegacyUrlParams();
 
   const { start, end, serviceName } = urlParams;
 
@@ -46,35 +42,7 @@ export function EmbeddedMapComponent() {
 
   const layerList = useLayerList();
 
-  const [embeddable, setEmbeddable] = useState<MapEmbeddable | ErrorEmbeddable | undefined>();
-
-  const embeddableRoot: React.RefObject<HTMLDivElement> = useRef<HTMLDivElement>(null);
-
-  const { embeddable: embeddablePlugin, maps } = useKibanaServices();
-
-  if (!embeddablePlugin) {
-    throw new Error('Embeddable start plugin not found');
-  }
-  const factory = embeddablePlugin.getEmbeddableFactory(MAP_SAVED_OBJECT_TYPE);
-
-  const input: MapEmbeddableInput = {
-    attributes: { title: '' },
-    id: uuidv4(),
-    filters: mapFilters,
-    viewMode: ViewMode.VIEW,
-    isLayerTOCOpen: false,
-    query: {
-      query: 'transaction.type : "page-load"',
-      language: 'kuery',
-    },
-    ...(start && {
-      timeRange: {
-        from: new Date(start!).toISOString(),
-        to: new Date(end!).toISOString(),
-      },
-    }),
-    hideFilterActions: true,
-  };
+  const { maps } = useKibanaServices();
 
   function renderTooltipContent({
     addFilters,
@@ -95,71 +63,30 @@ export function EmbeddedMapComponent() {
     return <MapToolTip {...props} features={features} />;
   }
 
-  useEffect(() => {
-    if (embeddable != null && serviceName) {
-      embeddable.updateInput({ filters: mapFilters });
-      embeddable.reload();
-    }
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [mapFilters]);
-
-  // DateRange updated useEffect
-  useEffect(() => {
-    if (embeddable != null && start != null && end != null) {
-      const timeRange = {
-        from: new Date(start).toISOString(),
-        to: new Date(end).toISOString(),
-      };
-      embeddable.updateInput({ timeRange });
-      embeddable.reload();
-    }
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [start, end, rangeId]);
-
-  useEffect(() => {
-    async function setupEmbeddable() {
-      if (!factory) {
-        throw new Error('Map embeddable not found.');
-      }
-      const embeddableObject: any = await factory.create({
-        ...input,
-        title: 'Visitors by region',
-      });
-
-      if (embeddableObject && !isErrorEmbeddable(embeddableObject)) {
-        embeddableObject.setRenderTooltipContent(renderTooltipContent);
-        const basemapLayerDescriptor = maps
-          ? await maps.createLayerDescriptors.createBasemapLayerDescriptor()
-          : null;
-        if (basemapLayerDescriptor) {
-          layerList.unshift(basemapLayerDescriptor);
-        }
-        await embeddableObject.setLayerList(layerList);
-      }
-
-      setEmbeddable(embeddableObject);
-    }
-
-    setupEmbeddable();
-
-    // we want this effect to execute exactly once after the component mounts
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, []);
-
-  // We can only render after embeddable has already initialized
-  useEffect(() => {
-    if (embeddableRoot.current && embeddable && serviceName) {
-      embeddable.render(embeddableRoot.current);
-    }
-  }, [embeddable, embeddableRoot, serviceName]);
-
   return (
     <EmbeddedPanel>
-      <div
-        data-test-subj="xpack.ux.regionMap.embeddedPanel"
-        className="embPanel__content"
-        ref={embeddableRoot}
-      />
+      <div data-test-subj="xpack.ux.regionMap.embeddedPanel" className="embPanel__content">
+        {serviceName &&
+          maps &&
+          maps.Map({
+            title: 'Visitors by region',
+            filters: mapFilters,
+            isLayerTOCOpen: false,
+            query: {
+              query: 'transaction.type : "page-load"',
+              language: 'kuery',
+            },
+            ...(start && {
+              timeRange: {
+                from: new Date(start!).toISOString(),
+                to: new Date(end!).toISOString(),
+              },
+            }),
+            hideFilterActions: true,
+            layerList,
+            getTooltipRenderer: () => renderTooltipContent,
+          })}
+      </div>
     </EmbeddedPanel>
   );
 }
diff --git a/x-pack/plugins/osquery/cypress/e2e/all/alerts_response_actions_form.cy.ts b/x-pack/plugins/osquery/cypress/e2e/all/alerts_response_actions_form.cy.ts
index 9d5ede4c04dbec..3c091a2882e088 100644
--- a/x-pack/plugins/osquery/cypress/e2e/all/alerts_response_actions_form.cy.ts
+++ b/x-pack/plugins/osquery/cypress/e2e/all/alerts_response_actions_form.cy.ts
@@ -24,224 +24,229 @@ import {
 import { clickRuleName, inputQuery, typeInECSFieldInput } from '../../tasks/live_query';
 import { closeDateTabIfVisible, closeToastIfVisible } from '../../tasks/integrations';
 
-describe('Alert Event Details - Response Actions Form', { tags: ['@ess', '@serverless'] }, () => {
-  let multiQueryPackId: string;
-  let multiQueryPackName: string;
-  let ruleId: string;
-  let ruleName: string;
-  let packId: string;
-  let packName: string;
-  const packData = packFixture();
-  const multiQueryPackData = multiQueryPackFixture();
-  before(() => {
-    initializeDataViews();
-  });
-  beforeEach(() => {
-    loadPack(packData).then((data) => {
-      packId = data.saved_object_id;
-      packName = data.name;
-    });
-    loadPack(multiQueryPackData).then((data) => {
-      multiQueryPackId = data.saved_object_id;
-      multiQueryPackName = data.name;
-    });
-    loadRule().then((data) => {
-      ruleId = data.id;
-      ruleName = data.name;
-    });
-  });
-  afterEach(() => {
-    cleanupPack(packId);
-    cleanupPack(multiQueryPackId);
-    cleanupRule(ruleId);
-  });
-
-  it('adds response actions with osquery with proper validation and form values', () => {
-    cy.visit('/app/security/rules');
-    clickRuleName(ruleName);
-    cy.getBySel('globalLoadingIndicator').should('not.exist');
-    cy.getBySel('editRuleSettingsLink').click();
-    cy.getBySel('globalLoadingIndicator').should('not.exist');
-    closeDateTabIfVisible();
-    cy.getBySel('edit-rule-actions-tab').click();
-    cy.getBySel('globalLoadingIndicator').should('not.exist');
-    cy.contains('Response actions are run on each rule execution.');
-    cy.getBySel(OSQUERY_RESPONSE_ACTION_ADD_BUTTON).click();
-
-    cy.getBySel(RESPONSE_ACTIONS_ERRORS).within(() => {
-      cy.contains('Query is a required field');
-      cy.contains('The timeout value must be 60 seconds or higher.').should('not.exist');
-    });
-
-    // check if changing error state of one input doesn't clear other errors - START
-    cy.getBySel(RESPONSE_ACTIONS_ITEM_0).within(() => {
-      cy.contains('Advanced').click();
-      cy.getBySel('timeout-input').clear();
-      cy.contains('The timeout value must be 60 seconds or higher.');
-    });
-
-    cy.getBySel(RESPONSE_ACTIONS_ERRORS).within(() => {
-      cy.contains('Query is a required field');
-      cy.contains('The timeout value must be 60 seconds or higher.');
-    });
-
-    cy.getBySel(RESPONSE_ACTIONS_ITEM_0).within(() => {
-      cy.getBySel('timeout-input').type('6');
-      cy.contains('The timeout value must be 60 seconds or higher.');
-    });
-    cy.getBySel(RESPONSE_ACTIONS_ERRORS).within(() => {
-      cy.contains('Query is a required field');
-      cy.contains('The timeout value must be 60 seconds or higher.');
-    });
-    cy.getBySel(RESPONSE_ACTIONS_ITEM_0).within(() => {
-      cy.getBySel('timeout-input').type('6');
-      cy.contains('The timeout value must be 60 seconds or higher.').should('not.exist');
-    });
-    cy.getBySel(RESPONSE_ACTIONS_ERRORS).within(() => {
-      cy.contains('Query is a required field');
-    });
-    cy.getBySel(RESPONSE_ACTIONS_ITEM_0).within(() => {
-      cy.getBySel('timeout-input').type('6');
-    });
-    cy.getBySel(RESPONSE_ACTIONS_ERRORS).within(() => {
-      cy.contains('Query is a required field');
-      cy.contains('The timeout value must be 60 seconds or higher.').should('not.exist');
-    });
-    // check if changing error state of one input doesn't clear other errors - END
+// Failing: See https://github.com/elastic/kibana/issues/169785
+describe.skip(
+  'Alert Event Details - Response Actions Form',
+  { tags: ['@ess', '@serverless'] },
+  () => {
+    let multiQueryPackId: string;
+    let multiQueryPackName: string;
+    let ruleId: string;
+    let ruleName: string;
+    let packId: string;
+    let packName: string;
+    const packData = packFixture();
+    const multiQueryPackData = multiQueryPackFixture();
+    before(() => {
+      initializeDataViews();
+    });
+    beforeEach(() => {
+      loadPack(packData).then((data) => {
+        packId = data.saved_object_id;
+        packName = data.name;
+      });
+      loadPack(multiQueryPackData).then((data) => {
+        multiQueryPackId = data.saved_object_id;
+        multiQueryPackName = data.name;
+      });
+      loadRule().then((data) => {
+        ruleId = data.id;
+        ruleName = data.name;
+      });
+    });
+    afterEach(() => {
+      cleanupPack(packId);
+      cleanupPack(multiQueryPackId);
+      cleanupRule(ruleId);
+    });
+
+    it('adds response actions with osquery with proper validation and form values', () => {
+      cy.visit('/app/security/rules');
+      clickRuleName(ruleName);
+      cy.getBySel('globalLoadingIndicator').should('not.exist');
+      cy.getBySel('editRuleSettingsLink').click();
+      cy.getBySel('globalLoadingIndicator').should('not.exist');
+      closeDateTabIfVisible();
+      cy.getBySel('edit-rule-actions-tab').click();
+      cy.getBySel('globalLoadingIndicator').should('not.exist');
+      cy.contains('Response actions are run on each rule execution.');
+      cy.getBySel(OSQUERY_RESPONSE_ACTION_ADD_BUTTON).click();
+
+      cy.getBySel(RESPONSE_ACTIONS_ERRORS).within(() => {
+        cy.contains('Query is a required field');
+        cy.contains('The timeout value must be 60 seconds or higher.').should('not.exist');
+      });
 
-    cy.getBySel(RESPONSE_ACTIONS_ITEM_0).within(() => {
-      cy.contains('Query is a required field');
-      inputQuery('select * from uptime1');
-    });
-    cy.getBySel(OSQUERY_RESPONSE_ACTION_ADD_BUTTON).click();
-    cy.getBySel(RESPONSE_ACTIONS_ITEM_1).within(() => {
-      cy.contains('Run a set of queries in a pack').click();
-    });
-    cy.getBySel(RESPONSE_ACTIONS_ERRORS)
-      .within(() => {
-        cy.contains('Pack is a required field');
-      })
-      .should('exist');
-    cy.getBySel(RESPONSE_ACTIONS_ITEM_1).within(() => {
-      cy.contains('Pack is a required field');
-      cy.getBySel('comboBoxInput').type(`${packName}{downArrow}{enter}`);
-    });
+      // check if changing error state of one input doesn't clear other errors - START
+      cy.getBySel(RESPONSE_ACTIONS_ITEM_0).within(() => {
+        cy.contains('Advanced').click();
+        cy.getBySel('timeout-input').clear();
+        cy.contains('The timeout value must be 60 seconds or higher.');
+      });
 
-    cy.getBySel(OSQUERY_RESPONSE_ACTION_ADD_BUTTON).click();
+      cy.getBySel(RESPONSE_ACTIONS_ERRORS).within(() => {
+        cy.contains('Query is a required field');
+        cy.contains('The timeout value must be 60 seconds or higher.');
+      });
+
+      cy.getBySel(RESPONSE_ACTIONS_ITEM_0).within(() => {
+        cy.getBySel('timeout-input').type('6');
+        cy.contains('The timeout value must be 60 seconds or higher.');
+      });
+      cy.getBySel(RESPONSE_ACTIONS_ERRORS).within(() => {
+        cy.contains('Query is a required field');
+        cy.contains('The timeout value must be 60 seconds or higher.');
+      });
+      cy.getBySel(RESPONSE_ACTIONS_ITEM_0).within(() => {
+        cy.getBySel('timeout-input').type('6');
+        cy.contains('The timeout value must be 60 seconds or higher.').should('not.exist');
+      });
+      cy.getBySel(RESPONSE_ACTIONS_ERRORS).within(() => {
+        cy.contains('Query is a required field');
+      });
+      cy.getBySel(RESPONSE_ACTIONS_ITEM_0).within(() => {
+        cy.getBySel('timeout-input').type('6');
+      });
+      cy.getBySel(RESPONSE_ACTIONS_ERRORS).within(() => {
+        cy.contains('Query is a required field');
+        cy.contains('The timeout value must be 60 seconds or higher.').should('not.exist');
+      });
+      // check if changing error state of one input doesn't clear other errors - END
 
-    cy.getBySel(RESPONSE_ACTIONS_ITEM_2)
-      .within(() => {
+      cy.getBySel(RESPONSE_ACTIONS_ITEM_0).within(() => {
         cy.contains('Query is a required field');
-        inputQuery('select * from uptime');
-        cy.contains('Query is a required field').should('not.exist');
-        cy.contains('Advanced').click();
-        typeInECSFieldInput('{downArrow}{enter}');
-        cy.getBySel('osqueryColumnValueSelect').type('days{downArrow}{enter}');
-      })
-      .clickOutside();
-
-    cy.getBySel('ruleEditSubmitButton').click();
-    cy.contains(`${ruleName} was saved`).should('exist');
-    closeToastIfVisible();
-
-    cy.getBySel('globalLoadingIndicator').should('not.exist');
-    cy.getBySel('editRuleSettingsLink').click();
-    cy.getBySel('globalLoadingIndicator').should('not.exist');
-    cy.getBySel('edit-rule-actions-tab').click();
-    cy.getBySel(RESPONSE_ACTIONS_ITEM_0).within(() => {
-      cy.contains('select * from uptime1');
-    });
-    cy.getBySel(RESPONSE_ACTIONS_ITEM_2).within(() => {
-      cy.contains('select * from uptime');
-      cy.contains('Custom key/value pairs. e.g. {"application":"foo-bar","env":"production"}');
-      cy.contains('Days of uptime');
-    });
-    cy.getBySel(RESPONSE_ACTIONS_ITEM_1).within(() => {
-      cy.getBySel('comboBoxSearchInput').should('have.value', packName);
-      cy.getBySel('comboBoxInput').type('{selectall}{backspace}{enter}');
-    });
-    cy.getBySel(RESPONSE_ACTIONS_ITEM_0).within(() => {
-      cy.contains('select * from uptime1');
-      cy.getBySel('remove-response-action').click();
-    });
-    cy.getBySel(RESPONSE_ACTIONS_ITEM_0)
-      .within(() => {
-        cy.getBySel('comboBoxSearchInput').click();
-        cy.contains('Search for a pack to run');
+        inputQuery('select * from uptime1');
+      });
+      cy.getBySel(OSQUERY_RESPONSE_ACTION_ADD_BUTTON).click();
+      cy.getBySel(RESPONSE_ACTIONS_ITEM_1).within(() => {
+        cy.contains('Run a set of queries in a pack').click();
+      });
+      cy.getBySel(RESPONSE_ACTIONS_ERRORS)
+        .within(() => {
+          cy.contains('Pack is a required field');
+        })
+        .should('exist');
+      cy.getBySel(RESPONSE_ACTIONS_ITEM_1).within(() => {
         cy.contains('Pack is a required field');
         cy.getBySel('comboBoxInput').type(`${packName}{downArrow}{enter}`);
-        cy.contains(packName);
-      })
-      .clickOutside();
-    cy.getBySel(RESPONSE_ACTIONS_ITEM_1).within(() => {
-      cy.contains('select * from uptime');
-      cy.contains('Custom key/value pairs. e.g. {"application":"foo-bar","env":"production"}');
-      cy.contains('Days of uptime');
-    });
-
-    cy.intercept('PUT', '/api/detection_engine/rules').as('saveRuleSingleQuery');
-
-    cy.getBySel('ruleEditSubmitButton').click();
-    cy.wait('@saveRuleSingleQuery', { timeout: 15000 }).should(({ request }) => {
-      const oneQuery = [
-        {
-          interval: 3600,
-          query: 'select * from uptime;',
-          id: Object.keys(packData.queries)[0],
-        },
-      ];
-      expect(request.body.response_actions[0].params.queries).to.deep.equal(oneQuery);
-    });
-
-    cy.contains(`${ruleName} was saved`).should('exist');
-    closeToastIfVisible();
-
-    cy.getBySel('globalLoadingIndicator').should('not.exist');
-    cy.getBySel('editRuleSettingsLink').click();
-    cy.getBySel('globalLoadingIndicator').should('not.exist');
-
-    cy.getBySel('edit-rule-actions-tab').click();
-    cy.getBySel(RESPONSE_ACTIONS_ITEM_0)
-      .within(() => {
+      });
+
+      cy.getBySel(OSQUERY_RESPONSE_ACTION_ADD_BUTTON).click();
+
+      cy.getBySel(RESPONSE_ACTIONS_ITEM_2)
+        .within(() => {
+          cy.contains('Query is a required field');
+          inputQuery('select * from uptime');
+          cy.contains('Query is a required field').should('not.exist');
+          cy.contains('Advanced').click();
+          typeInECSFieldInput('{downArrow}{enter}');
+          cy.getBySel('osqueryColumnValueSelect').type('days{downArrow}{enter}');
+        })
+        .clickOutside();
+
+      cy.getBySel('ruleEditSubmitButton').click();
+      cy.contains(`${ruleName} was saved`).should('exist');
+      closeToastIfVisible();
+
+      cy.getBySel('globalLoadingIndicator').should('not.exist');
+      cy.getBySel('editRuleSettingsLink').click();
+      cy.getBySel('globalLoadingIndicator').should('not.exist');
+      cy.getBySel('edit-rule-actions-tab').click();
+      cy.getBySel(RESPONSE_ACTIONS_ITEM_0).within(() => {
+        cy.contains('select * from uptime1');
+      });
+      cy.getBySel(RESPONSE_ACTIONS_ITEM_2).within(() => {
+        cy.contains('select * from uptime');
+        cy.contains('Custom key/value pairs. e.g. {"application":"foo-bar","env":"production"}');
+        cy.contains('Days of uptime');
+      });
+      cy.getBySel(RESPONSE_ACTIONS_ITEM_1).within(() => {
         cy.getBySel('comboBoxSearchInput').should('have.value', packName);
-        cy.getBySel('comboBoxInput').type(
-          `{selectall}{backspace}${multiQueryPackName}{downArrow}{enter}`
-        );
-        cy.contains('SELECT * FROM memory_info;');
-        cy.contains('SELECT * FROM system_info;');
-      })
-      .clickOutside();
-
-    cy.getBySel(RESPONSE_ACTIONS_ITEM_1)
-      .within(() => {
+        cy.getBySel('comboBoxInput').type('{selectall}{backspace}{enter}');
+      });
+      cy.getBySel(RESPONSE_ACTIONS_ITEM_0).within(() => {
+        cy.contains('select * from uptime1');
+        cy.getBySel('remove-response-action').click();
+      });
+      cy.getBySel(RESPONSE_ACTIONS_ITEM_0)
+        .within(() => {
+          cy.getBySel('comboBoxSearchInput').click();
+          cy.contains('Search for a pack to run');
+          cy.contains('Pack is a required field');
+          cy.getBySel('comboBoxInput').type(`${packName}{downArrow}{enter}`);
+          cy.contains(packName);
+        })
+        .clickOutside();
+      cy.getBySel(RESPONSE_ACTIONS_ITEM_1).within(() => {
         cy.contains('select * from uptime');
         cy.contains('Custom key/value pairs. e.g. {"application":"foo-bar","env":"production"}');
         cy.contains('Days of uptime');
-      })
-      .clickOutside();
-    cy.intercept('PUT', '/api/detection_engine/rules').as('saveRuleMultiQuery');
-
-    cy.contains('Save changes').click();
-    cy.wait('@saveRuleMultiQuery', { timeout: 15000 }).should(({ request }) => {
-      const threeQueries = [
-        {
-          interval: 3600,
-          query: 'SELECT * FROM memory_info;',
-          platform: 'linux',
-          id: Object.keys(multiQueryPackData.queries)[0],
-        },
-        {
-          interval: 3600,
-          query: 'SELECT * FROM system_info;',
-          id: Object.keys(multiQueryPackData.queries)[1],
-        },
-        {
-          interval: 10,
-          query: 'select opera_extensions.* from users join opera_extensions using (uid);',
-          id: Object.keys(multiQueryPackData.queries)[2],
-        },
-      ];
-      expect(request.body.response_actions[0].params.queries).to.deep.equal(threeQueries);
-    });
-  });
-});
+      });
+
+      cy.intercept('PUT', '/api/detection_engine/rules').as('saveRuleSingleQuery');
+
+      cy.getBySel('ruleEditSubmitButton').click();
+      cy.wait('@saveRuleSingleQuery', { timeout: 15000 }).should(({ request }) => {
+        const oneQuery = [
+          {
+            interval: 3600,
+            query: 'select * from uptime;',
+            id: Object.keys(packData.queries)[0],
+          },
+        ];
+        expect(request.body.response_actions[0].params.queries).to.deep.equal(oneQuery);
+      });
+
+      cy.contains(`${ruleName} was saved`).should('exist');
+      closeToastIfVisible();
+
+      cy.getBySel('globalLoadingIndicator').should('not.exist');
+      cy.getBySel('editRuleSettingsLink').click();
+      cy.getBySel('globalLoadingIndicator').should('not.exist');
+
+      cy.getBySel('edit-rule-actions-tab').click();
+      cy.getBySel(RESPONSE_ACTIONS_ITEM_0)
+        .within(() => {
+          cy.getBySel('comboBoxSearchInput').should('have.value', packName);
+          cy.getBySel('comboBoxInput').type(
+            `{selectall}{backspace}${multiQueryPackName}{downArrow}{enter}`
+          );
+          cy.contains('SELECT * FROM memory_info;');
+          cy.contains('SELECT * FROM system_info;');
+        })
+        .clickOutside();
+
+      cy.getBySel(RESPONSE_ACTIONS_ITEM_1)
+        .within(() => {
+          cy.contains('select * from uptime');
+          cy.contains('Custom key/value pairs. e.g. {"application":"foo-bar","env":"production"}');
+          cy.contains('Days of uptime');
+        })
+        .clickOutside();
+      cy.intercept('PUT', '/api/detection_engine/rules').as('saveRuleMultiQuery');
+
+      cy.contains('Save changes').click();
+      cy.wait('@saveRuleMultiQuery', { timeout: 15000 }).should(({ request }) => {
+        const threeQueries = [
+          {
+            interval: 3600,
+            query: 'SELECT * FROM memory_info;',
+            platform: 'linux',
+            id: Object.keys(multiQueryPackData.queries)[0],
+          },
+          {
+            interval: 3600,
+            query: 'SELECT * FROM system_info;',
+            id: Object.keys(multiQueryPackData.queries)[1],
+          },
+          {
+            interval: 10,
+            query: 'select opera_extensions.* from users join opera_extensions using (uid);',
+            id: Object.keys(multiQueryPackData.queries)[2],
+          },
+        ];
+        expect(request.body.response_actions[0].params.queries).to.deep.equal(threeQueries);
+      });
+    });
+  }
+);
diff --git a/x-pack/plugins/osquery/cypress/e2e/api/packs.cy.ts b/x-pack/plugins/osquery/cypress/e2e/api/packs.cy.ts
new file mode 100644
index 00000000000000..5dc8d62ca37b45
--- /dev/null
+++ b/x-pack/plugins/osquery/cypress/e2e/api/packs.cy.ts
@@ -0,0 +1,79 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ServerlessRoleName } from '../../support/roles';
+import {
+  addOsqueryToAgentPolicy,
+  cleanupAgentPolicy,
+  cleanupPack,
+  createPack,
+  getInstalledOsqueryIntegrationVersion,
+  getPack,
+  loadAgentPolicy,
+} from '../../tasks/api_fixtures';
+
+describe('Packs', { tags: ['@ess', '@serverless'] }, () => {
+  let policyId: string;
+
+  beforeEach(() => {
+    cy.login(ServerlessRoleName.SOC_MANAGER);
+    loadAgentPolicy().then((item) => {
+      policyId = item.id;
+
+      return getInstalledOsqueryIntegrationVersion().then((response) =>
+        addOsqueryToAgentPolicy(policyId, item.name, response.version)
+      );
+    });
+  });
+
+  afterEach(() => {
+    cleanupAgentPolicy(policyId);
+  });
+
+  describe('Duplicate policy ids', () => {
+    let packId: string;
+    beforeEach(() => {
+      createPack({
+        policy_ids: Array(1000).fill(policyId),
+      }).then((response) => {
+        packId = response.body.data.saved_object_id;
+        expect(response.status).to.eq(200);
+      });
+    });
+    afterEach(() => {
+      cleanupPack(packId);
+    });
+
+    it('should strip duplicate policy ids when saving pack', () => {
+      getPack(packId).then((response) => {
+        expect(response.status).to.eq(200);
+        expect(response.body.data.policy_ids).to.have.length(1);
+        expect(response.body.data.policy_ids[0]).to.eq(policyId);
+      });
+    });
+  });
+
+  describe('Non existent policy id should return bad request error', () => {
+    const nonExistentPolicyId = 'non-existent-policy-id';
+    it('single non-existent policy id', () => {
+      createPack({
+        policy_ids: [nonExistentPolicyId],
+      }).then((response) => {
+        expect(response.status).to.eq(400);
+        expect(response.body.message).to.contain(nonExistentPolicyId);
+      });
+    });
+    it('multiple policy ids with one non-existent policy id', () => {
+      createPack({
+        policy_ids: [...Array(999).fill(policyId), nonExistentPolicyId],
+      }).then((response) => {
+        expect(response.status).to.eq(400);
+        expect(response.body.message).to.contain(nonExistentPolicyId);
+      });
+    });
+  });
+});
diff --git a/x-pack/plugins/osquery/cypress/tasks/api_fixtures.ts b/x-pack/plugins/osquery/cypress/tasks/api_fixtures.ts
index fb4dc1f646e838..a9492880bfb6b2 100644
--- a/x-pack/plugins/osquery/cypress/tasks/api_fixtures.ts
+++ b/x-pack/plugins/osquery/cypress/tasks/api_fixtures.ts
@@ -9,7 +9,11 @@ import type {
   RuleCreateProps,
   RuleResponse,
 } from '@kbn/security-solution-plugin/common/api/detection_engine';
-import type { AgentPolicy } from '@kbn/fleet-plugin/common';
+import type {
+  AgentPolicy,
+  CreatePackagePolicyResponse,
+  PackagePolicy,
+} from '@kbn/fleet-plugin/common';
 import type { Case } from '@kbn/cases-plugin/common';
 import { API_VERSIONS } from '../../common/constants';
 import type { SavedQuerySOFormData } from '../../public/saved_queries/form/use_saved_query_form';
@@ -108,6 +112,39 @@ export const loadPack = (payload: Partial<PackItem> = {}, space = 'default') =>
     url: `/s/${space}/api/osquery/packs`,
   }).then((response) => response.body.data);
 
+export const createPack = (payload: Partial<PackItem> = {}) =>
+  request<{ data: PackSavedObject; message?: string }>({
+    method: 'POST',
+    failOnStatusCode: false,
+    body: {
+      ...payload,
+      name: generateRandomStringName(1)[0],
+      shards: {},
+      queries: {
+        test: {
+          ecs_mapping: {},
+          interval: 3600,
+          query: 'select * from uptime;',
+        },
+      },
+      enabled: true,
+    },
+    headers: {
+      'Elastic-Api-Version': API_VERSIONS.public.v1,
+    },
+
+    url: `/s/default/api/osquery/packs`,
+  });
+
+export const getPack = (packId: string) =>
+  request<{ data: PackItem }>({
+    method: 'GET',
+    url: `/api/osquery/packs/${packId}`,
+    headers: {
+      'Elastic-Api-Version': API_VERSIONS.public.v1,
+    },
+  });
+
 export const cleanupPack = (id: string, space = 'default') => {
   request({
     method: 'DELETE',
@@ -304,6 +341,45 @@ export const loadAgentPolicy = () =>
     url: '/api/fleet/agent_policies',
   }).then((response) => response.body.item);
 
+export const getInstalledOsqueryIntegrationVersion = () =>
+  request<{ item: PackagePolicy }>({
+    method: 'GET',
+    url: `/api/fleet/epm/packages/osquery_manager`,
+    headers: {
+      'x-elastic-internal-product': 'security-solution',
+      'elastic-api-version': API_VERSIONS.public.v1,
+    },
+  }).then((response) => response.body.item);
+
+export const addOsqueryToAgentPolicy = (
+  agentPolicyId: string,
+  agentPolicyName: string,
+  integrationVersion?: string
+) =>
+  request<CreatePackagePolicyResponse>({
+    method: 'POST',
+    url: '/api/fleet/package_policies',
+    headers: {
+      'elastic-api-version': API_VERSIONS.public.v1,
+    },
+    body: {
+      policy_id: agentPolicyId,
+      package: {
+        name: 'osquery_manager',
+        version: integrationVersion,
+      },
+      name: `Policy for ${agentPolicyName}`,
+      description: '',
+      namespace: 'default',
+      inputs: {
+        'osquery_manager-osquery': {
+          enabled: true,
+          streams: {},
+        },
+      },
+    },
+  });
+
 export const cleanupAgentPolicy = (agentPolicyId: string) =>
   request({
     method: 'POST',
diff --git a/x-pack/plugins/osquery/server/handlers/action/create_action_handler.ts b/x-pack/plugins/osquery/server/handlers/action/create_action_handler.ts
index 42612b25a673d9..2d6c47cdb8f54b 100644
--- a/x-pack/plugins/osquery/server/handlers/action/create_action_handler.ts
+++ b/x-pack/plugins/osquery/server/handlers/action/create_action_handler.ts
@@ -29,7 +29,7 @@ interface Metadata {
 interface CreateActionHandlerOptions {
   soClient?: SavedObjectsClientContract;
   metadata?: Metadata;
-  alertData?: ParsedTechnicalFields;
+  alertData?: ParsedTechnicalFields & { _index: string };
   error?: string;
 }
 
diff --git a/x-pack/plugins/osquery/server/handlers/action/create_action_service.ts b/x-pack/plugins/osquery/server/handlers/action/create_action_service.ts
index 1ec052e0bbb77b..e5e54e40c382a1 100644
--- a/x-pack/plugins/osquery/server/handlers/action/create_action_service.ts
+++ b/x-pack/plugins/osquery/server/handlers/action/create_action_service.ts
@@ -23,7 +23,7 @@ export const createActionService = (osqueryContext: OsqueryAppContext) => {
 
   const create = async (
     params: CreateLiveQueryRequestBodySchema,
-    alertData?: ParsedTechnicalFields
+    alertData?: ParsedTechnicalFields & { _index: string }
   ) => {
     const error = validateLicense(licenses);
 
diff --git a/x-pack/plugins/osquery/server/handlers/action/create_queries.test.ts b/x-pack/plugins/osquery/server/handlers/action/create_queries.test.ts
index 29386c3db90dbd..6d6924fb8017e5 100644
--- a/x-pack/plugins/osquery/server/handlers/action/create_queries.test.ts
+++ b/x-pack/plugins/osquery/server/handlers/action/create_queries.test.ts
@@ -60,7 +60,7 @@ describe('create queries', () => {
           process: {
             pid,
           },
-        } as unknown as ParsedTechnicalFields,
+        } as unknown as ParsedTechnicalFields & { _index: string },
         osqueryContext: {} as OsqueryAppContext,
       });
       expect(queries[0].query).toBe(`SELECT * FROM processes where pid=${pid};`);
@@ -77,7 +77,7 @@ describe('create queries', () => {
         agents: [TEST_AGENT],
         alertData: {
           process: { pid },
-        } as unknown as ParsedTechnicalFields,
+        } as unknown as ParsedTechnicalFields & { _index: string },
         osqueryContext: {} as OsqueryAppContext,
       });
       expect(queries[0].query).toBe(`SELECT * FROM processes where pid=${pid};`);
@@ -89,7 +89,7 @@ describe('create queries', () => {
         agents: [TEST_AGENT],
         alertData: {
           process: {},
-        } as unknown as ParsedTechnicalFields,
+        } as unknown as ParsedTechnicalFields & { _index: string },
         osqueryContext: {} as OsqueryAppContext,
       });
       expect(queries[0].query).toBe('SELECT * FROM processes where pid={{process.pid}};');
diff --git a/x-pack/plugins/osquery/server/handlers/action/create_queries.ts b/x-pack/plugins/osquery/server/handlers/action/create_queries.ts
index cf7f2563b3fbba..b71dd503db2838 100644
--- a/x-pack/plugins/osquery/server/handlers/action/create_queries.ts
+++ b/x-pack/plugins/osquery/server/handlers/action/create_queries.ts
@@ -17,7 +17,7 @@ import { isSavedQueryPrebuilt } from '../../routes/saved_query/utils';
 
 interface CreateDynamicQueriesParams {
   params: CreateLiveQueryRequestBodySchema;
-  alertData?: ParsedTechnicalFields;
+  alertData?: ParsedTechnicalFields & { _index: string };
   agents: string[];
   osqueryContext: OsqueryAppContext;
   error?: string;
@@ -71,7 +71,7 @@ export const createDynamicQueries = async ({
 
 export const replacedQueries = (
   query: string | undefined,
-  alertData?: ParsedTechnicalFields
+  alertData?: ParsedTechnicalFields & { _index: string }
 ): { query: string | undefined; error?: string } => {
   if (alertData && query) {
     const { result, skipped } = replaceParamsQuery(query, alertData);
diff --git a/x-pack/plugins/osquery/server/routes/live_query/create_live_query_route.ts b/x-pack/plugins/osquery/server/routes/live_query/create_live_query_route.ts
index fff242db7475ca..c93b58cf5af73c 100644
--- a/x-pack/plugins/osquery/server/routes/live_query/create_live_query_route.ts
+++ b/x-pack/plugins/osquery/server/routes/live_query/create_live_query_route.ts
@@ -11,6 +11,7 @@ import markdown from 'remark-parse-no-trim';
 import { some, filter } from 'lodash';
 import deepEqual from 'fast-deep-equal';
 import type { ECSMappingOrUndefined } from '@kbn/osquery-io-ts-types';
+import type { ParsedTechnicalFields } from '@kbn/rule-registry-plugin/common';
 import type { CreateLiveQueryRequestBodySchema } from '../../../common/api';
 import { createLiveQueryRequestBodySchema } from '../../../common/api';
 import { API_VERSIONS } from '../../../common/constants';
@@ -59,7 +60,9 @@ export const createLiveQueryRoute = (router: IRouter, osqueryContext: OsqueryApp
           ?.getRacClientWithRequest(request);
 
         const alertData = request.body.alert_ids?.length
-          ? await client?.get({ id: request.body.alert_ids[0] })
+          ? ((await client?.get({ id: request.body.alert_ids[0] })) as ParsedTechnicalFields & {
+              _index: string;
+            })
           : undefined;
 
         if (isInvalid) {
diff --git a/x-pack/plugins/osquery/server/routes/pack/create_pack_route.ts b/x-pack/plugins/osquery/server/routes/pack/create_pack_route.ts
index ea94b8783bd451..c81a31f9fb610e 100644
--- a/x-pack/plugins/osquery/server/routes/pack/create_pack_route.ts
+++ b/x-pack/plugins/osquery/server/routes/pack/create_pack_route.ts
@@ -89,7 +89,16 @@ export const createPackRoute = (router: IRouter, osqueryContext: OsqueryAppConte
           }
         )) ?? { items: [] };
 
-        const policiesList = getInitialPolicies(packagePolicies, policy_ids, shards);
+        const { policiesList, invalidPolicies } = getInitialPolicies(
+          packagePolicies,
+          policy_ids,
+          shards
+        );
+        if (invalidPolicies?.length) {
+          return response.badRequest({
+            body: `The following policy ids are invalid: ${invalidPolicies.join(', ')}`,
+          });
+        }
 
         const agentPolicies = await agentPolicyService?.getByIds(
           internalSavedObjectsClient,
diff --git a/x-pack/plugins/osquery/server/routes/pack/update_pack_route.ts b/x-pack/plugins/osquery/server/routes/pack/update_pack_route.ts
index 1697718a00ba0a..845da5a17a803c 100644
--- a/x-pack/plugins/osquery/server/routes/pack/update_pack_route.ts
+++ b/x-pack/plugins/osquery/server/routes/pack/update_pack_route.ts
@@ -112,7 +112,17 @@ export const updatePackRoute = (router: IRouter, osqueryContext: OsqueryAppConte
           )
         );
 
-        const policiesList = getInitialPolicies(packagePolicies, policy_ids, shards);
+        const { policiesList, invalidPolicies } = getInitialPolicies(
+          packagePolicies,
+          policy_ids,
+          shards
+        );
+
+        if (invalidPolicies?.length) {
+          return response.badRequest({
+            body: `The following policy ids are invalid: ${invalidPolicies.join(', ')}`,
+          });
+        }
 
         const agentPolicies = await agentPolicyService?.getByIds(
           internalSavedObjectsClient,
diff --git a/x-pack/plugins/osquery/server/routes/pack/utils.ts b/x-pack/plugins/osquery/server/routes/pack/utils.ts
index 3f3c9fa90c746d..3eeb32003b2ed0 100644
--- a/x-pack/plugins/osquery/server/routes/pack/utils.ts
+++ b/x-pack/plugins/osquery/server/routes/pack/utils.ts
@@ -5,7 +5,18 @@
  * 2.0.
  */
 
-import { isEmpty, pick, reduce, isArray, filter, uniq, map, mapKeys } from 'lodash';
+import {
+  isEmpty,
+  pick,
+  reduce,
+  isArray,
+  filter,
+  uniq,
+  map,
+  mapKeys,
+  difference,
+  intersection,
+} from 'lodash';
 import { satisfies } from 'semver';
 import type { AgentPolicy, PackagePolicy } from '@kbn/fleet-plugin/common';
 import type { Shard } from '../../../common/utils/converters';
@@ -106,17 +117,26 @@ export const getInitialPolicies = (
   packagePolicies: PackagePolicy[] | never[],
   policyIds: string[] = [],
   shards?: Shard
-) => {
+): { policiesList: string[]; invalidPolicies?: string[] } => {
+  const supportedPackagePolicies = filter(packagePolicies, (packagePolicy) =>
+    satisfies(packagePolicy.package?.version ?? '', '>=0.6.0')
+  );
+
+  const supportedPackagePolicyIds = uniq(map(supportedPackagePolicies, 'policy_id'));
   // we want to find all policies, because this is a global pack
   if (shards?.['*']) {
-    const supportedPackagePolicyIds = filter(packagePolicies, (packagePolicy) =>
-      satisfies(packagePolicy.package?.version ?? '', '>=0.6.0')
-    );
-
-    return uniq(map(supportedPackagePolicyIds, 'policy_id'));
+    return { policiesList: supportedPackagePolicyIds };
   }
 
-  return policyIds;
+  // Return only policyIds that are present in supportedPackagePolicyIds
+  const policiesList = intersection(uniq(policyIds), supportedPackagePolicyIds);
+  // Collect leftover policyIds
+  const invalidPolicies = difference(uniq(policyIds), policiesList);
+
+  return {
+    policiesList,
+    ...(invalidPolicies.length && { invalidPolicies }),
+  };
 };
 
 export const findMatchingShards = (agentPolicies: AgentPolicy[] | undefined, shards?: Shard) => {
diff --git a/x-pack/plugins/painless_lab/public/application/index.tsx b/x-pack/plugins/painless_lab/public/application/index.tsx
index a4e795b2d78396..251f797ee0d86c 100644
--- a/x-pack/plugins/painless_lab/public/application/index.tsx
+++ b/x-pack/plugins/painless_lab/public/application/index.tsx
@@ -7,33 +7,27 @@
 
 import React from 'react';
 import { render, unmountComponentAtNode } from 'react-dom';
-import type {
-  CoreSetup,
-  CoreStart,
-  HttpSetup,
-  ChromeStart,
-  ThemeServiceStart,
-} from '@kbn/core/public';
+import type { CoreSetup, CoreStart, HttpSetup, ChromeStart } from '@kbn/core/public';
 
-import { createKibanaReactContext, KibanaThemeProvider } from '../shared_imports';
+import { createKibanaReactContext, KibanaRenderContextProvider } from '../shared_imports';
 
 import { Links } from '../links';
 import { AppContextProvider } from './context';
 import { Main } from './components/main';
+import { PainlessLabStartServices } from '../types';
 
 interface AppDependencies {
   http: HttpSetup;
-  I18nContext: CoreStart['i18n']['Context'];
   uiSettings: CoreSetup['uiSettings'];
   settings: CoreStart['settings'];
   links: Links;
   chrome: ChromeStart;
-  theme: ThemeServiceStart;
+  startServices: PainlessLabStartServices;
 }
 
 export function renderApp(
   element: HTMLElement | null,
-  { http, I18nContext, uiSettings, links, chrome, theme, settings }: AppDependencies
+  { http, uiSettings, links, chrome, settings, startServices }: AppDependencies
 ) {
   if (!element) {
     return () => undefined;
@@ -41,18 +35,16 @@ export function renderApp(
   const { Provider: KibanaReactContextProvider } = createKibanaReactContext({
     uiSettings,
     settings,
-    theme,
   });
   render(
-    <I18nContext>
-      <KibanaThemeProvider theme$={theme.theme$}>
-        <KibanaReactContextProvider>
-          <AppContextProvider value={{ http, links, chrome }}>
-            <Main />
-          </AppContextProvider>
-        </KibanaReactContextProvider>
-      </KibanaThemeProvider>
-    </I18nContext>,
+    <KibanaRenderContextProvider {...startServices}>
+      <KibanaReactContextProvider>
+        <AppContextProvider value={{ http, links, chrome }}>
+          <Main />
+        </AppContextProvider>
+      </KibanaReactContextProvider>
+    </KibanaRenderContextProvider>,
+
     element
   );
   return () => unmountComponentAtNode(element);
diff --git a/x-pack/plugins/painless_lab/public/plugin.tsx b/x-pack/plugins/painless_lab/public/plugin.tsx
index 61a89791b76d78..02ff77d5a862df 100644
--- a/x-pack/plugins/painless_lab/public/plugin.tsx
+++ b/x-pack/plugins/painless_lab/public/plugin.tsx
@@ -52,13 +52,15 @@ export class PainlessLabUIPlugin implements Plugin<void, void, PluginDependencie
         const [core] = await getStartServices();
 
         const {
-          i18n: { Context: I18nContext },
           notifications,
           docLinks,
           chrome,
           settings,
+          analytics,
+          i18n: i18nStart,
           theme,
         } = core;
+        const startServices = { analytics, i18n: i18nStart, theme };
 
         const license = await firstValueFrom(licensing.license$);
         const licenseStatus = checkLicenseStatus(license);
@@ -71,13 +73,12 @@ export class PainlessLabUIPlugin implements Plugin<void, void, PluginDependencie
 
         const { renderApp } = await import('./application');
         const tearDownApp = renderApp(element, {
-          I18nContext,
           http,
           uiSettings,
           links: getLinks(docLinks),
           chrome,
-          theme,
           settings,
+          startServices,
         });
 
         return () => {
diff --git a/x-pack/plugins/painless_lab/public/shared_imports.ts b/x-pack/plugins/painless_lab/public/shared_imports.ts
index 20a5ade3ca7c2a..bf0e1fcaffda30 100644
--- a/x-pack/plugins/painless_lab/public/shared_imports.ts
+++ b/x-pack/plugins/painless_lab/public/shared_imports.ts
@@ -5,4 +5,6 @@
  * 2.0.
  */
 
-export { createKibanaReactContext, KibanaThemeProvider } from '@kbn/kibana-react-plugin/public';
+export { createKibanaReactContext } from '@kbn/kibana-react-plugin/public';
+
+export { KibanaRenderContextProvider } from '@kbn/react-kibana-context-render';
diff --git a/x-pack/plugins/painless_lab/public/types.ts b/x-pack/plugins/painless_lab/public/types.ts
index afdc1e8c11b3d7..693488860aff0f 100644
--- a/x-pack/plugins/painless_lab/public/types.ts
+++ b/x-pack/plugins/painless_lab/public/types.ts
@@ -8,9 +8,16 @@
 import { HomePublicPluginSetup } from '@kbn/home-plugin/public';
 import { DevToolsSetup } from '@kbn/dev-tools-plugin/public';
 import { LicensingPluginSetup } from '@kbn/licensing-plugin/public';
+import { AnalyticsServiceStart, I18nStart, ThemeServiceStart } from '@kbn/core/public';
 
 export interface PluginDependencies {
   licensing: LicensingPluginSetup;
   home: HomePublicPluginSetup;
   devTools: DevToolsSetup;
 }
+
+export interface PainlessLabStartServices {
+  analytics: Pick<AnalyticsServiceStart, 'reportEvent'>;
+  i18n: I18nStart;
+  theme: Pick<ThemeServiceStart, 'theme$'>;
+}
diff --git a/x-pack/plugins/painless_lab/tsconfig.json b/x-pack/plugins/painless_lab/tsconfig.json
index 1b993284dea640..857711e8da847a 100644
--- a/x-pack/plugins/painless_lab/tsconfig.json
+++ b/x-pack/plugins/painless_lab/tsconfig.json
@@ -20,6 +20,7 @@
     "@kbn/i18n-react",
     "@kbn/config-schema",
     "@kbn/code-editor",
+    "@kbn/react-kibana-context-render",
   ],
   "exclude": [
     "target/**/*",
diff --git a/x-pack/plugins/remote_clusters/__jest__/client_integration/add/remote_clusters_add.test.ts b/x-pack/plugins/remote_clusters/__jest__/client_integration/add/remote_clusters_add.test.ts
index 0a73eddd6e5c71..43157fa157f0b5 100644
--- a/x-pack/plugins/remote_clusters/__jest__/client_integration/add/remote_clusters_add.test.ts
+++ b/x-pack/plugins/remote_clusters/__jest__/client_integration/add/remote_clusters_add.test.ts
@@ -40,12 +40,12 @@ describe('Create Remote cluster', () => {
     test('should have a toggle to Skip unavailable remote cluster', () => {
       expect(actions.skipUnavailableSwitch.exists()).toBe(true);
 
-      // By default it should be set to "false"
-      expect(actions.skipUnavailableSwitch.isChecked()).toBe(false);
+      // By default it should be set to "true"
+      expect(actions.skipUnavailableSwitch.isChecked()).toBe(true);
 
       actions.skipUnavailableSwitch.toggle();
 
-      expect(actions.skipUnavailableSwitch.isChecked()).toBe(true);
+      expect(actions.skipUnavailableSwitch.isChecked()).toBe(false);
     });
 
     describe('on prem', () => {
diff --git a/x-pack/plugins/remote_clusters/public/application/sections/components/remote_cluster_form/remote_cluster_form.tsx b/x-pack/plugins/remote_clusters/public/application/sections/components/remote_cluster_form/remote_cluster_form.tsx
index 0e5bda323c825f..22415edc091a95 100644
--- a/x-pack/plugins/remote_clusters/public/application/sections/components/remote_cluster_form/remote_cluster_form.tsx
+++ b/x-pack/plugins/remote_clusters/public/application/sections/components/remote_cluster_form/remote_cluster_form.tsx
@@ -50,7 +50,7 @@ import {
 const defaultClusterValues: ClusterPayload = {
   name: '',
   seeds: [],
-  skipUnavailable: false,
+  skipUnavailable: true,
   nodeConnections: 3,
   proxyAddress: '',
   proxySocketConnections: 18,
diff --git a/x-pack/plugins/rule_registry/server/alert_data_client/alerts_client.ts b/x-pack/plugins/rule_registry/server/alert_data_client/alerts_client.ts
index f395ddb4b75f7b..0c449d4f4126a8 100644
--- a/x-pack/plugins/rule_registry/server/alert_data_client/alerts_client.ts
+++ b/x-pack/plugins/rule_registry/server/alert_data_client/alerts_client.ts
@@ -620,7 +620,10 @@ export class AlertsClient {
       }
 
       // move away from pulling data from _source in the future
-      return alert.hits.hits[0]._source;
+      return {
+        ...alert.hits.hits[0]._source,
+        _index: alert.hits.hits[0]._index,
+      };
     } catch (error) {
       this.logger.error(`get threw an error: ${error}`);
       throw error;
diff --git a/x-pack/plugins/rule_registry/server/alert_data_client/tests/get.test.ts b/x-pack/plugins/rule_registry/server/alert_data_client/tests/get.test.ts
index 4185fb7e83eb6d..1526e209e40c0d 100644
--- a/x-pack/plugins/rule_registry/server/alert_data_client/tests/get.test.ts
+++ b/x-pack/plugins/rule_registry/server/alert_data_client/tests/get.test.ts
@@ -112,6 +112,7 @@ describe('get()', () => {
     const result = await alertsClient.get({ id: '1', index: '.alerts-observability.apm.alerts' });
     expect(result).toMatchInlineSnapshot(`
       Object {
+        "_index": ".alerts-observability.apm.alerts",
         "kibana.alert.rule.consumer": "apm",
         "kibana.alert.rule.rule_type_id": "apm.error_rate",
         "kibana.alert.status": "active",
@@ -346,6 +347,7 @@ describe('get()', () => {
 
       expect(result).toMatchInlineSnapshot(`
         Object {
+          "_index": ".alerts-observability.apm.alerts",
           "kibana.alert.rule.consumer": "apm",
           "kibana.alert.rule.rule_type_id": "apm.error_rate",
           "kibana.alert.status": "active",
diff --git a/x-pack/plugins/rule_registry/server/routes/get_alert_by_id.test.ts b/x-pack/plugins/rule_registry/server/routes/get_alert_by_id.test.ts
index 809a5167870a16..b4e94cc3b20b2e 100644
--- a/x-pack/plugins/rule_registry/server/routes/get_alert_by_id.test.ts
+++ b/x-pack/plugins/rule_registry/server/routes/get_alert_by_id.test.ts
@@ -25,13 +25,12 @@ import {
 } from '@kbn/rule-data-utils';
 import { BASE_RAC_ALERTS_API_PATH } from '../../common/constants';
 import { ParsedTechnicalFields } from '../../common/parse_technical_fields';
-import { ParsedExperimentalFields } from '../../common/parse_experimental_fields';
 import { getAlertByIdRoute } from './get_alert_by_id';
 import { requestContextMock } from './__mocks__/request_context';
 import { getReadRequest } from './__mocks__/request_responses';
 import { requestMock, serverMock } from './__mocks__/server';
 
-const getMockAlert = (): ParsedTechnicalFields & ParsedExperimentalFields => ({
+const getMockAlert = (): ParsedTechnicalFields & { _index: string } => ({
   [ALERT_INSTANCE_ID]: 'fake-alert-id',
   [ALERT_RULE_CATEGORY]: 'apm.error_rate',
   [ALERT_RULE_CONSUMER]: 'apm',
@@ -47,6 +46,7 @@ const getMockAlert = (): ParsedTechnicalFields & ParsedExperimentalFields => ({
   [SPACE_IDS]: ['fake-space-id'],
   [TIMESTAMP]: '2021-06-21T21:33:05.713Z',
   [VERSION]: '7.13.0',
+  _index: 'fake-alert-index',
 });
 
 describe('getAlertByIdRoute', () => {
diff --git a/x-pack/plugins/runtime_fields/public/load_editor.tsx b/x-pack/plugins/runtime_fields/public/load_editor.tsx
index b9c8b8983eb013..d04a8e0707ada2 100644
--- a/x-pack/plugins/runtime_fields/public/load_editor.tsx
+++ b/x-pack/plugins/runtime_fields/public/load_editor.tsx
@@ -55,7 +55,7 @@ export const getRuntimeFieldEditorLoader =
               ctx={ctx}
             />
           </KibanaReactContextProvider>,
-          { theme$: theme.theme$ }
+          core
         )
       );
 
diff --git a/x-pack/plugins/runtime_fields/public/plugin.test.ts b/x-pack/plugins/runtime_fields/public/plugin.test.ts
index 38a37839145d6a..b911f211638e50 100644
--- a/x-pack/plugins/runtime_fields/public/plugin.test.ts
+++ b/x-pack/plugins/runtime_fields/public/plugin.test.ts
@@ -8,8 +8,8 @@
 import { CoreSetup } from '@kbn/core/public';
 import { coreMock, themeServiceMock } from '@kbn/core/public/mocks';
 
-jest.mock('@kbn/kibana-react-plugin/public', () => {
-  const original = jest.requireActual('@kbn/kibana-react-plugin/public');
+jest.mock('@kbn/react-kibana-mount', () => {
+  const original = jest.requireActual('@kbn/react-kibana-mount');
 
   return {
     ...original,
diff --git a/x-pack/plugins/runtime_fields/public/shared_imports.ts b/x-pack/plugins/runtime_fields/public/shared_imports.ts
index 98f62f3ffbb71c..0794e0c9f55a08 100644
--- a/x-pack/plugins/runtime_fields/public/shared_imports.ts
+++ b/x-pack/plugins/runtime_fields/public/shared_imports.ts
@@ -22,6 +22,8 @@ export { fieldValidators } from '@kbn/es-ui-shared-plugin/static/forms/helpers';
 
 export { TextField } from '@kbn/es-ui-shared-plugin/static/forms/components';
 
-export { toMountPoint, createKibanaReactContext } from '@kbn/kibana-react-plugin/public';
+export { createKibanaReactContext } from '@kbn/kibana-react-plugin/public';
+
+export { toMountPoint } from '@kbn/react-kibana-mount';
 
 export { CodeEditor } from '@kbn/code-editor';
diff --git a/x-pack/plugins/runtime_fields/tsconfig.json b/x-pack/plugins/runtime_fields/tsconfig.json
index 4127b838a70f6d..f2f2a6e27e6c18 100644
--- a/x-pack/plugins/runtime_fields/tsconfig.json
+++ b/x-pack/plugins/runtime_fields/tsconfig.json
@@ -17,6 +17,7 @@
     "@kbn/monaco",
     "@kbn/code-editor",
     "@kbn/code-editor-mock",
+    "@kbn/react-kibana-mount",
   ],
   "exclude": [
     "target/**/*",
diff --git a/x-pack/plugins/search_notebooks/common/types.ts b/x-pack/plugins/search_notebooks/common/types.ts
index 12af52d8e0a047..58922ed4abc6c1 100644
--- a/x-pack/plugins/search_notebooks/common/types.ts
+++ b/x-pack/plugins/search_notebooks/common/types.ts
@@ -5,21 +5,77 @@
  * 2.0.
  */
 
+import { schema } from '@kbn/config-schema';
 import { NotebookDefinition } from '@kbn/ipynb';
 
 export interface NotebookInformation {
   id: string;
   title: string;
   description: string;
+  link?: {
+    title: string;
+    url: string;
+  };
 }
 export interface NotebookCatalog {
   notebooks: NotebookInformation[];
 }
 
 export interface Notebook extends NotebookInformation {
-  link?: {
-    title: string;
-    url: string;
-  };
   notebook: NotebookDefinition;
 }
+
+export const NotebookCatalogSchema = schema.object(
+  {
+    notebooks: schema.arrayOf(
+      schema.object(
+        {
+          id: schema.string(),
+          title: schema.string(),
+          description: schema.string(),
+          url: schema.uri(),
+          link: schema.maybe(
+            schema.object({
+              title: schema.string(),
+              url: schema.uri(),
+            })
+          ),
+        },
+        {
+          unknowns: 'allow',
+        }
+      ),
+      { minSize: 1 }
+    ),
+  },
+  {
+    unknowns: 'allow',
+  }
+);
+const NotebookCellSchema = schema.object(
+  {
+    attachments: schema.maybe(schema.any()),
+    auto_number: schema.maybe(schema.number()),
+    cell_type: schema.maybe(schema.string()),
+    execution_count: schema.maybe(schema.nullable(schema.number())),
+    id: schema.maybe(schema.string()),
+    input: schema.maybe(schema.arrayOf(schema.string())),
+    metadata: schema.maybe(schema.any()),
+    outputs: schema.maybe(schema.arrayOf(schema.any())),
+    prompt_number: schema.maybe(schema.number()),
+    source: schema.maybe(schema.arrayOf(schema.string())),
+  },
+  {
+    unknowns: 'allow',
+  }
+);
+
+export const NotebookSchema = schema.object(
+  {
+    cells: schema.arrayOf(NotebookCellSchema, { minSize: 1 }),
+    metadata: schema.maybe(schema.any()),
+  },
+  {
+    unknowns: 'allow',
+  }
+);
diff --git a/x-pack/plugins/search_notebooks/server/config.ts b/x-pack/plugins/search_notebooks/server/config.ts
index 112bbd0509845f..20d7297b56b83c 100644
--- a/x-pack/plugins/search_notebooks/server/config.ts
+++ b/x-pack/plugins/search_notebooks/server/config.ts
@@ -12,6 +12,13 @@ export * from './types';
 
 const configSchema = schema.object({
   enabled: schema.boolean({ defaultValue: true }),
+  catalog: schema.maybe(
+    schema.object({
+      url: schema.uri(),
+      ttl: schema.number({ defaultValue: 900 }),
+      errorTTL: schema.number({ defaultValue: 3600 }),
+    })
+  ),
 });
 
 type SearchNotebooksSchema = TypeOf<typeof configSchema>;
diff --git a/x-pack/plugins/search_notebooks/server/lib/notebook_catalog.test.ts b/x-pack/plugins/search_notebooks/server/lib/notebook_catalog.test.ts
index 0c6e4874b4bf17..7b0e345ece0290 100644
--- a/x-pack/plugins/search_notebooks/server/lib/notebook_catalog.test.ts
+++ b/x-pack/plugins/search_notebooks/server/lib/notebook_catalog.test.ts
@@ -10,44 +10,489 @@ import type { Logger } from '@kbn/logging';
 
 // Mocking dependencies
 jest.mock('fs/promises');
+jest.mock('node-fetch');
+// eslint-disable-next-line @typescript-eslint/no-var-requires
+const fetchMock = require('node-fetch') as jest.Mock;
 
 const mockLogger: Logger = {
   warn: jest.fn(),
   error: jest.fn(),
 } as Partial<Logger> as Logger;
 
-import { getNotebook, DEFAULT_NOTEBOOKS } from './notebook_catalog';
+import {
+  getNotebook,
+  getNotebookCatalog,
+  DEFAULT_NOTEBOOKS,
+  NotebookCatalogFetchOptions,
+  getNotebookMetadata,
+} from './notebook_catalog';
+import { createNotebooksCache } from '../utils';
+import { RemoteNotebookCatalog, SearchNotebooksConfig } from '../config';
+import { NotebookDefinition } from '@kbn/ipynb';
 
-describe('getNotebook', () => {
-  const options = { logger: mockLogger };
+const emptyNotebookCache = createNotebooksCache();
+const baseConfig: SearchNotebooksConfig = { enabled: true };
+const staticOptions: NotebookCatalogFetchOptions = {
+  cache: emptyNotebookCache,
+  config: baseConfig,
+  logger: mockLogger,
+};
+const dynamicOptions: NotebookCatalogFetchOptions = {
+  cache: emptyNotebookCache,
+  config: {
+    ...baseConfig,
+    catalog: {
+      url: 'http://localhost:1000/catalog.json',
+      ttl: 30,
+      errorTTL: 120,
+    },
+  },
+  logger: mockLogger,
+};
+describe('Notebook Catalog', () => {
+  const fakeNow = new Date('1999-12-31T23:59:59.999Z');
+  beforeAll(() => {
+    jest.useFakeTimers();
+    jest.setSystemTime(fakeNow);
+  });
   beforeEach(() => {
     // Reset mocks and cache before each test
-    jest.clearAllMocks();
+    jest.resetAllMocks();
+    // Reset the notebook cache
+    dynamicOptions.cache = createNotebooksCache();
   });
 
-  it('throws an error if given an unknown notebook id', async () => {
-    await expect(getNotebook('some-fake-id', options)).rejects.toThrow('Unknown Notebook ID');
-    expect(mockLogger.warn).toHaveBeenCalledTimes(1);
-  });
+  describe('getNotebookCatalog', () => {
+    describe('static notebooks', () => {
+      it('returns default notebooks when theres an empty catalog config', async () => {
+        await expect(getNotebookCatalog(staticOptions)).resolves.toBe(DEFAULT_NOTEBOOKS);
+      });
+    });
+
+    describe('remote catalog', () => {
+      it('fetches catalog from configured URL', async () => {
+        const mockCatalog: RemoteNotebookCatalog = {
+          notebooks: [
+            {
+              id: 'unit-test',
+              title: 'Test',
+              description: 'Test notebook',
+              url: 'http://localhost:3000/my_notebook.ipynb',
+            },
+          ],
+        };
+        const mockResp = {
+          status: 200,
+          statusText: 'OK',
+          ok: true,
+          json: jest.fn().mockResolvedValue(mockCatalog),
+        };
+        fetchMock.mockResolvedValue(mockResp);
+        await expect(getNotebookCatalog(dynamicOptions)).resolves.toEqual({
+          notebooks: [
+            {
+              id: 'unit-test',
+              title: 'Test',
+              description: 'Test notebook',
+            },
+          ],
+        });
+
+        expect(fetchMock).toHaveBeenCalledTimes(1);
+        expect(fetchMock).toHaveBeenCalledWith(dynamicOptions.config.catalog!.url, {
+          method: 'GET',
+          headers: { 'Content-Type': 'application/json' },
+        });
+      });
+      it('caches catalog on fetch', async () => {
+        const mockCatalog: RemoteNotebookCatalog = {
+          notebooks: [
+            {
+              id: 'unit-test',
+              title: 'Test',
+              description: 'Test notebook',
+              url: 'http://localhost:3000/my_notebook.ipynb',
+            },
+          ],
+        };
+        const mockResp = {
+          status: 200,
+          statusText: 'OK',
+          ok: true,
+          json: jest.fn().mockResolvedValue(mockCatalog),
+        };
+        fetchMock.mockResolvedValue(mockResp);
+
+        await getNotebookCatalog(dynamicOptions);
+        expect(dynamicOptions.cache.catalog).toBeDefined();
+        expect(dynamicOptions.cache.catalog).toEqual({
+          ...mockCatalog,
+          timestamp: fakeNow,
+        });
+      });
+      it('defaults to static notebooks if fetch fails with non-200', async () => {
+        const mockResp = {
+          ok: false,
+          status: 404,
+          statusText: 'NOT_FOUND',
+        };
+        fetchMock.mockResolvedValue(mockResp);
+        await expect(getNotebookCatalog(dynamicOptions)).resolves.toEqual(DEFAULT_NOTEBOOKS);
+      });
+      it('defaults to static notebooks if fetch fails with error', async () => {
+        fetchMock.mockRejectedValue(new Error('Failed to Fetch'));
+        await expect(getNotebookCatalog(dynamicOptions)).resolves.toEqual(DEFAULT_NOTEBOOKS);
+      });
+      it('defaults to static notebooks if fetch returns invalid catalog', async () => {
+        const mockBadCatalog = {
+          notebooks: [
+            {
+              id: 'unit-test',
+              title: 'Test',
+            },
+          ],
+        };
+        const mockResp = {
+          status: 200,
+          statusText: 'OK',
+          ok: true,
+          json: jest.fn().mockResolvedValue(mockBadCatalog),
+        };
+        fetchMock.mockResolvedValue(mockResp);
+        await expect(getNotebookCatalog(dynamicOptions)).resolves.toEqual(DEFAULT_NOTEBOOKS);
+      });
+      it('returns cached catalog if within TTL', async () => {
+        const mockCatalog: RemoteNotebookCatalog = {
+          notebooks: [
+            {
+              id: 'unit-test',
+              title: 'Test',
+              description: 'Test notebook',
+              url: 'http://localhost:3000/my_notebook.ipynb',
+            },
+          ],
+        };
+        dynamicOptions.cache.catalog = {
+          ...mockCatalog,
+          timestamp: new Date('1999-12-31T23:59:58.999Z'),
+        };
+
+        await expect(getNotebookCatalog(dynamicOptions)).resolves.toEqual({
+          notebooks: [
+            {
+              id: 'unit-test',
+              title: 'Test',
+              description: 'Test notebook',
+            },
+          ],
+        });
+        expect(fetchMock).toHaveBeenCalledTimes(0);
+      });
+      it('fetches catalog if cached catalog TTL is expired', async () => {
+        const mockCatalog: RemoteNotebookCatalog = {
+          notebooks: [
+            {
+              id: 'unit-test',
+              title: 'Test',
+              description: 'Test notebook',
+              url: 'http://localhost:3000/my_notebook.ipynb',
+            },
+          ],
+        };
+        const mockResp = {
+          status: 200,
+          statusText: 'OK',
+          ok: true,
+          json: jest.fn().mockResolvedValue(mockCatalog),
+        };
+        fetchMock.mockResolvedValue(mockResp);
+        dynamicOptions.cache.catalog = {
+          ...mockCatalog,
+          timestamp: new Date('1999-12-31T23:58:59.999Z'),
+        };
 
-  it('throws an error if the file is not found', async () => {
-    const notebookId = DEFAULT_NOTEBOOKS.notebooks[0].id;
-    jest.mocked(fs.access).mockReset().mockRejectedValue(new Error('Boom'));
+        await expect(getNotebookCatalog(dynamicOptions)).resolves.toEqual({
+          notebooks: [
+            {
+              id: 'unit-test',
+              title: 'Test',
+              description: 'Test notebook',
+            },
+          ],
+        });
 
-    await expect(getNotebook(notebookId, options)).rejects.toThrow('Failed to fetch notebook.');
+        expect(fetchMock).toHaveBeenCalledTimes(1);
+        expect(fetchMock).toHaveBeenCalledWith(dynamicOptions.config.catalog!.url, {
+          method: 'GET',
+          headers: { 'Content-Type': 'application/json' },
+        });
+      });
+      it('returns cached notebooks in case of error and within error TTL', async () => {
+        const mockCatalog: RemoteNotebookCatalog = {
+          notebooks: [
+            {
+              id: 'unit-test',
+              title: 'Test',
+              description: 'Test notebook',
+              url: 'http://localhost:3000/my_notebook.ipynb',
+            },
+          ],
+        };
+        dynamicOptions.cache.catalog = {
+          ...mockCatalog,
+          timestamp: new Date('1999-12-31T23:58:59.999Z'),
+        };
+        fetchMock.mockRejectedValue(new Error('Failed to Fetch'));
+        await expect(getNotebookCatalog(dynamicOptions)).resolves.toEqual({
+          notebooks: [
+            {
+              id: 'unit-test',
+              title: 'Test',
+              description: 'Test notebook',
+            },
+          ],
+        });
+        expect(fetchMock).toHaveBeenCalledTimes(1);
+      });
+      it('returns static notebooks in case of error and cache outside error TTL', async () => {
+        const mockCatalog: RemoteNotebookCatalog = {
+          notebooks: [
+            {
+              id: 'unit-test',
+              title: 'Test',
+              description: 'Test notebook',
+              url: 'http://localhost:3000/my_notebook.ipynb',
+            },
+          ],
+        };
+        dynamicOptions.cache.catalog = {
+          ...mockCatalog,
+          timestamp: new Date('1999-12-31T12:10:00.000Z'),
+        };
+        fetchMock.mockRejectedValue(new Error('Failed to Fetch'));
+        await expect(getNotebookCatalog(dynamicOptions)).resolves.toEqual(DEFAULT_NOTEBOOKS);
+        expect(fetchMock).toHaveBeenCalledTimes(1);
+      });
+      it('allows additional data, but removes it from results', async () => {
+        const mockCatalog = {
+          notebooks: [
+            {
+              id: 'unit-test',
+              title: 'Test',
+              description: 'Test notebook',
+              url: 'http://localhost:3000/my_notebook.ipynb',
+              tags: ['search', 'vector', 'ml'],
+            },
+          ],
+          categories: ['test', 'test2'],
+        };
+        const mockResp = {
+          status: 200,
+          statusText: 'OK',
+          ok: true,
+          json: jest.fn().mockResolvedValue(mockCatalog),
+        };
+        fetchMock.mockResolvedValue(mockResp);
+
+        const result = await getNotebookCatalog(dynamicOptions);
+        expect(result).toEqual({
+          notebooks: [
+            {
+              id: 'unit-test',
+              title: 'Test',
+              description: 'Test notebook',
+            },
+          ],
+        });
+        expect(dynamicOptions.cache.catalog).toBeDefined();
+        expect(dynamicOptions.cache.catalog).toEqual({
+          ...mockCatalog,
+          timestamp: fakeNow,
+        });
+      });
+    });
+  });
+
+  describe('getNotebookMetadata', () => {
+    const fakeNotebookId = 'unit-test';
+    it('returns data from static notebooks', () => {
+      expect(getNotebookMetadata(DEFAULT_NOTEBOOKS.notebooks[0].id, staticOptions.cache)).toEqual(
+        DEFAULT_NOTEBOOKS.notebooks[0]
+      );
+    });
+    it('returns undefined for unknown static notebook id', () => {
+      expect(getNotebookMetadata(fakeNotebookId, staticOptions.cache)).toBeUndefined();
+    });
+    it('returns data from notebook catalog cache', () => {
+      dynamicOptions.cache.catalog = {
+        notebooks: [
+          {
+            id: fakeNotebookId,
+            title: 'Fake Notebook',
+            description: 'This is a fake notebook',
+            url: 'http://localhost:4000/fake_notebook.ipynb',
+          },
+        ],
+        timestamp: fakeNow,
+      };
+      expect(getNotebookMetadata(fakeNotebookId, dynamicOptions.cache)).toEqual({
+        id: fakeNotebookId,
+        title: 'Fake Notebook',
+        description: 'This is a fake notebook',
+      });
+    });
+    it('returns undefined when there is a catalog cache without notebook id', () => {
+      dynamicOptions.cache.catalog = {
+        notebooks: [
+          {
+            id: 'fake-notebook',
+            title: 'Fake Notebook',
+            description: 'This is a fake notebook',
+            url: 'http://localhost:4000/fake_notebook.ipynb',
+          },
+        ],
+        timestamp: fakeNow,
+      };
+      expect(getNotebookMetadata(fakeNotebookId, dynamicOptions.cache)).toBeUndefined();
+    });
   });
 
-  it('Reads notebook', async () => {
-    const notebookId = DEFAULT_NOTEBOOKS.notebooks[0].id;
+  describe('getNotebook', () => {
+    const fakeNotebookId = 'unit-test';
+
+    describe('static notebooks', () => {
+      it('throws an error if given an unknown notebook id', async () => {
+        await expect(getNotebook(fakeNotebookId, staticOptions)).rejects.toThrow(
+          'Unknown Notebook ID'
+        );
+        expect(mockLogger.warn).toHaveBeenCalledTimes(1);
+      });
+
+      it('throws an error if the file is not found', async () => {
+        const notebookId = DEFAULT_NOTEBOOKS.notebooks[0].id;
+        jest.mocked(fs.access).mockReset().mockRejectedValue(new Error('Boom'));
+
+        await expect(getNotebook(notebookId, staticOptions)).rejects.toThrow(
+          'Failed to fetch notebook.'
+        );
+      });
+
+      it('Reads notebook', async () => {
+        const notebookId = DEFAULT_NOTEBOOKS.notebooks[0].id;
+
+        jest.mocked(fs.access).mockReset().mockResolvedValue(undefined);
+
+        await expect(getNotebook(notebookId, staticOptions)).resolves.toMatchObject({
+          cells: expect.anything(),
+          metadata: expect.anything(),
+        });
+        expect(mockLogger.warn).not.toHaveBeenCalled();
+        expect(mockLogger.error).not.toHaveBeenCalled();
+        expect(fs.access).toHaveBeenCalledWith(expect.stringContaining(`${notebookId}.json`), 0);
+      });
+    });
+    describe('remote catalog', () => {
+      beforeEach(() => {
+        fetchMock.mockReset();
+        // Reset the notebook cache
+        dynamicOptions.cache = createNotebooksCache();
+        dynamicOptions.cache.catalog = {
+          notebooks: [
+            {
+              id: 'unit-test',
+              title: 'Test',
+              description: 'Test notebook',
+              url: 'http://localhost:3000/my_notebook.ipynb',
+            },
+          ],
+          timestamp: fakeNow,
+        };
+      });
+
+      it('fetches notebook using url in cached catalog', async () => {
+        const mockNotebook: NotebookDefinition = {
+          cells: [
+            {
+              cell_type: 'markdown',
+              source: ['# Hello World'],
+            },
+          ],
+        };
+        const mockResp = {
+          status: 200,
+          statusText: 'OK',
+          ok: true,
+          json: jest.fn().mockResolvedValue(mockNotebook),
+        };
+        fetchMock.mockResolvedValue(mockResp);
+
+        await expect(getNotebook(fakeNotebookId, dynamicOptions)).resolves.toEqual(mockNotebook);
+        expect(fetchMock).toHaveBeenCalledTimes(1);
+        expect(fetchMock).toHaveBeenCalledWith('http://localhost:3000/my_notebook.ipynb', {
+          method: 'GET',
+          headers: { 'Content-Type': 'application/json' },
+        });
+      });
+      it('returns notebook from cache if available', async () => {
+        const mockNotebook: NotebookDefinition = {
+          cells: [
+            {
+              cell_type: 'markdown',
+              source: ['# Hello World'],
+            },
+          ],
+        };
+        dynamicOptions.cache.notebooks[fakeNotebookId] = {
+          ...mockNotebook,
+          timestamp: new Date('1999-12-31T23:59:30.000Z'),
+        };
+
+        await expect(getNotebook(fakeNotebookId, dynamicOptions)).resolves.toEqual(mockNotebook);
+        expect(fetchMock).toHaveBeenCalledTimes(0);
+      });
+      it('fetches notebook if cached notebook ttl is expired', async () => {
+        const mockNotebook: NotebookDefinition = {
+          cells: [
+            {
+              cell_type: 'markdown',
+              source: ['# Hello World'],
+            },
+          ],
+        };
+        dynamicOptions.cache.notebooks[fakeNotebookId] = {
+          ...mockNotebook,
+          timestamp: new Date('1999-12-31T23:57:59.999Z'),
+        };
+        const mockResp = {
+          status: 200,
+          statusText: 'OK',
+          ok: true,
+          json: jest.fn().mockResolvedValue(mockNotebook),
+        };
+        fetchMock.mockResolvedValue(mockResp);
+
+        await getNotebook(fakeNotebookId, dynamicOptions);
+        expect(fetchMock).toHaveBeenCalledTimes(1);
+        expect(fetchMock).toHaveBeenCalledWith('http://localhost:3000/my_notebook.ipynb', {
+          method: 'GET',
+          headers: { 'Content-Type': 'application/json' },
+        });
+      });
+      it("returns undefined if can't fetch notebook", async () => {
+        const mockResp = {
+          status: 404,
+          statusText: 'NOT_FOUND',
+          ok: false,
+        };
+        fetchMock.mockResolvedValue(mockResp);
 
-    jest.mocked(fs.access).mockReset().mockResolvedValue(undefined);
+        await expect(getNotebook(fakeNotebookId, dynamicOptions)).resolves.toBeUndefined();
+      });
+      it("returns undefined if can't fetch notebook throws an error", async () => {
+        fetchMock.mockRejectedValue(new Error('Boom!!'));
 
-    await expect(getNotebook(notebookId, options)).resolves.toMatchObject({
-      cells: expect.anything(),
-      metadata: expect.anything(),
+        await expect(getNotebook(fakeNotebookId, dynamicOptions)).resolves.toBeUndefined();
+      });
     });
-    expect(mockLogger.warn).not.toHaveBeenCalled();
-    expect(mockLogger.error).not.toHaveBeenCalled();
-    expect(fs.access).toHaveBeenCalledWith(expect.stringContaining(`${notebookId}.json`), 0);
   });
 });
diff --git a/x-pack/plugins/search_notebooks/server/lib/notebook_catalog.ts b/x-pack/plugins/search_notebooks/server/lib/notebook_catalog.ts
index 1034e14b0bd7e1..6ee2a628f04db8 100644
--- a/x-pack/plugins/search_notebooks/server/lib/notebook_catalog.ts
+++ b/x-pack/plugins/search_notebooks/server/lib/notebook_catalog.ts
@@ -5,15 +5,40 @@
  * 2.0.
  */
 
+import fetch from 'node-fetch';
 import fs from 'fs/promises';
 import path from 'path';
 import { i18n } from '@kbn/i18n';
 import type { Logger } from '@kbn/logging';
 import { NotebookDefinition } from '@kbn/ipynb';
 
-import { NotebookCatalog, NotebookInformation } from '../../common/types';
+import {
+  NotebookCatalog,
+  NotebookInformation,
+  NotebookCatalogSchema,
+  NotebookSchema,
+} from '../../common/types';
+
+import type { SearchNotebooksConfig } from '../config';
+import type { NotebooksCache, RemoteNotebookCatalog } from '../types';
+import {
+  cleanCachedNotebook,
+  cleanCachedNotebookCatalog,
+  cleanNotebookMetadata,
+  dateWithinTTL,
+} from '../utils';
 
 const NOTEBOOKS_DATA_DIR = '../data';
+const FETCH_OPTIONS = {
+  method: 'GET',
+  headers: { 'Content-Type': 'application/json' },
+};
+
+export interface NotebookCatalogFetchOptions {
+  cache: NotebooksCache;
+  config: SearchNotebooksConfig;
+  logger: Logger;
+}
 
 export const DEFAULT_NOTEBOOKS: NotebookCatalog = {
   notebooks: [
@@ -85,10 +110,28 @@ export const NOTEBOOKS_MAP: Record<string, NotebookInformation> =
 
 const NOTEBOOK_IDS = DEFAULT_NOTEBOOKS.notebooks.map(({ id }) => id);
 
+export const getNotebookCatalog = async ({
+  config,
+  cache,
+  logger,
+}: NotebookCatalogFetchOptions) => {
+  if (config.catalog && config.catalog.url) {
+    const catalog = await fetchNotebookCatalog(config.catalog, cache, logger);
+    if (catalog) {
+      return catalog;
+    }
+  }
+  return DEFAULT_NOTEBOOKS;
+};
+
 export const getNotebook = async (
   notebookId: string,
-  { logger }: { logger: Logger }
-): Promise<NotebookDefinition> => {
+  options: NotebookCatalogFetchOptions
+): Promise<NotebookDefinition | undefined> => {
+  const { cache, logger } = options;
+  if (cache.catalog) {
+    return fetchNotebook(notebookId, options);
+  }
   // Only server pre-defined notebooks, since we're reading files from disk only allow IDs
   // for the known notebooks so that we aren't attempting to read any file from disk given user input
   if (!NOTEBOOK_IDS.includes(notebookId)) {
@@ -114,3 +157,87 @@ export const getNotebook = async (
     );
   }
 };
+
+export const getNotebookMetadata = (id: string, cache: NotebooksCache) => {
+  if (cache.catalog) {
+    const nbInfo = cache.catalog.notebooks.find((nb) => nb.id === id);
+    return nbInfo ? cleanNotebookMetadata(nbInfo) : undefined;
+  }
+  if (!NOTEBOOKS_MAP.hasOwnProperty(id)) {
+    return undefined;
+  }
+
+  return NOTEBOOKS_MAP[id];
+};
+
+type CatalogConfig = Readonly<{
+  url: string;
+  ttl: number;
+  errorTTL: number;
+}>;
+
+export const fetchNotebookCatalog = async (
+  catalogConfig: CatalogConfig,
+  cache: NotebooksCache,
+  logger: Logger
+): Promise<NotebookCatalog | null> => {
+  if (cache.catalog && dateWithinTTL(cache.catalog.timestamp, catalogConfig.ttl)) {
+    return cleanCachedNotebookCatalog(cache.catalog);
+  }
+
+  try {
+    const resp = await fetch(catalogConfig.url, FETCH_OPTIONS);
+    if (resp.ok) {
+      const respJson = await resp.json();
+      const catalog: RemoteNotebookCatalog = NotebookCatalogSchema.validate(respJson);
+      cache.catalog = { ...catalog, timestamp: new Date() };
+      return cleanCachedNotebookCatalog(cache.catalog);
+    } else {
+      throw new Error(`Failed to fetch notebook ${resp.status} ${resp.statusText}`);
+    }
+  } catch (e) {
+    logger.warn(
+      `Failed to fetch search notebooks catalog from configured URL ${catalogConfig.url}.`
+    );
+    logger.warn(e);
+    if (cache.catalog && dateWithinTTL(cache.catalog.timestamp, catalogConfig.errorTTL)) {
+      // If we can't fetch the catalog but we have it cached and it's within the error TTL,
+      // returned the cached value.
+      return cleanCachedNotebookCatalog(cache.catalog);
+    }
+  }
+
+  return null;
+};
+
+export const fetchNotebook = async (
+  id: string,
+  { cache, config, logger }: NotebookCatalogFetchOptions
+): Promise<NotebookDefinition | undefined> => {
+  if (!cache.catalog || !config.catalog) return undefined;
+  const catalogConfig = config.catalog;
+  const nbInfo = cache.catalog.notebooks.find((nb) => nb.id === id);
+  if (!nbInfo) return undefined;
+  if (cache.notebooks[id] && dateWithinTTL(cache.notebooks[id].timestamp, catalogConfig.ttl)) {
+    return cleanCachedNotebook(cache.notebooks[id]);
+  }
+  if (!nbInfo.url) return undefined;
+
+  try {
+    const resp = await fetch(nbInfo.url, FETCH_OPTIONS);
+    if (resp.ok) {
+      const respJSON = await resp.json();
+      const notebook: NotebookDefinition = NotebookSchema.validate(respJSON);
+      cache.notebooks[id] = { ...notebook, timestamp: new Date() };
+      return notebook;
+    } else {
+      logger.warn(
+        `Failed to fetch search notebook from URL ${nbInfo.url}\n${resp.status}: ${resp.statusText}`
+      );
+    }
+  } catch (e) {
+    logger.warn(`Failed to fetch search notebook from URL ${nbInfo.url}`);
+    logger.warn(e);
+  }
+  return undefined;
+};
diff --git a/x-pack/plugins/search_notebooks/server/plugin.ts b/x-pack/plugins/search_notebooks/server/plugin.ts
index 247c62d5ec7c61..f5d5348ec7fc78 100644
--- a/x-pack/plugins/search_notebooks/server/plugin.ts
+++ b/x-pack/plugins/search_notebooks/server/plugin.ts
@@ -13,19 +13,22 @@ import type {
   Logger,
 } from '@kbn/core/server';
 
-import { SearchNotebooksPluginSetup, SearchNotebooksPluginStart } from './types';
-import { defineRoutes } from './routes';
 import { SearchNotebooksConfig } from './config';
+import { defineRoutes } from './routes';
+import { SearchNotebooksPluginSetup, SearchNotebooksPluginStart, NotebooksCache } from './types';
+import { createNotebooksCache } from './utils';
 
 export class SearchNotebooksPlugin
   implements Plugin<SearchNotebooksPluginSetup, SearchNotebooksPluginStart>
 {
   private readonly config: SearchNotebooksConfig;
   private readonly logger: Logger;
+  private readonly notebooksCache: NotebooksCache;
 
   constructor(initializerContext: PluginInitializerContext) {
     this.config = initializerContext.config.get<SearchNotebooksConfig>();
     this.logger = initializerContext.logger.get();
+    this.notebooksCache = createNotebooksCache();
   }
 
   public setup(core: CoreSetup) {
@@ -35,7 +38,12 @@ export class SearchNotebooksPlugin
     const router = core.http.createRouter();
 
     // Register server side APIs
-    defineRoutes(router, this.logger);
+    defineRoutes({
+      config: this.config,
+      logger: this.logger,
+      notebooksCache: this.notebooksCache,
+      router,
+    });
 
     return {};
   }
diff --git a/x-pack/plugins/search_notebooks/server/routes/index.ts b/x-pack/plugins/search_notebooks/server/routes/index.ts
index 199f18698e6fe3..0e5294b71e2df5 100644
--- a/x-pack/plugins/search_notebooks/server/routes/index.ts
+++ b/x-pack/plugins/search_notebooks/server/routes/index.ts
@@ -6,22 +6,26 @@
  */
 
 import { schema } from '@kbn/config-schema';
-import type { IRouter } from '@kbn/core/server';
-import type { Logger } from '@kbn/logging';
 import { NotebookDefinition } from '@kbn/ipynb';
 
 import { INTRODUCTION_NOTEBOOK } from '../../common/constants';
-import { DEFAULT_NOTEBOOKS, NOTEBOOKS_MAP, getNotebook } from '../lib/notebook_catalog';
+import { getNotebookCatalog, getNotebook, getNotebookMetadata } from '../lib/notebook_catalog';
+import type { RouteDependencies } from '../types';
 
-export function defineRoutes(router: IRouter, logger: Logger) {
+export function defineRoutes({ config, notebooksCache, logger, router }: RouteDependencies) {
   router.get(
     {
       path: '/internal/search_notebooks/notebooks',
       validate: {},
+      options: {
+        access: 'internal',
+      },
     },
     async (_context, _request, response) => {
+      const notebooks = await getNotebookCatalog({ cache: notebooksCache, config, logger });
+
       return response.ok({
-        body: DEFAULT_NOTEBOOKS,
+        body: notebooks,
         headers: { 'content-type': 'application/json' },
       });
     }
@@ -35,6 +39,9 @@ export function defineRoutes(router: IRouter, logger: Logger) {
           notebookId: schema.string(),
         }),
       },
+      options: {
+        access: 'internal',
+      },
     },
     async (_, request, response) => {
       const notebookId = request.params.notebookId;
@@ -46,18 +53,23 @@ export function defineRoutes(router: IRouter, logger: Logger) {
         });
       }
 
-      if (!NOTEBOOKS_MAP.hasOwnProperty(notebookId)) {
+      const notebookMetadata = getNotebookMetadata(notebookId, notebooksCache);
+      if (!notebookMetadata) {
         logger.warn(`Unknown search notebook requested ${notebookId}`);
         return response.notFound();
       }
-
-      const notebookMetadata = NOTEBOOKS_MAP[notebookId];
-      let notebook: NotebookDefinition;
+      let notebook: NotebookDefinition | undefined;
       try {
-        notebook = await getNotebook(notebookId, { logger });
+        notebook = await getNotebook(notebookId, { cache: notebooksCache, config, logger });
       } catch (e) {
+        logger.warn(`Error getting search notebook ${notebookId}.`);
+        logger.warn(e);
         return response.customError(e.message);
       }
+      if (!notebook) {
+        logger.warn(`Search notebook requested ${notebookId} not found or failed to fetch.`);
+        return response.notFound();
+      }
       return response.ok({
         body: {
           ...notebookMetadata,
diff --git a/x-pack/plugins/search_notebooks/server/types.ts b/x-pack/plugins/search_notebooks/server/types.ts
index f21d521aaf9352..596565244a611f 100644
--- a/x-pack/plugins/search_notebooks/server/types.ts
+++ b/x-pack/plugins/search_notebooks/server/types.ts
@@ -5,7 +5,41 @@
  * 2.0.
  */
 
+import type { IRouter } from '@kbn/core/server';
+import type { NotebookDefinition } from '@kbn/ipynb';
+import type { Logger } from '@kbn/logging';
+
+import type { SearchNotebooksConfig } from './config';
+import type { NotebookCatalog, NotebookInformation } from '../common/types';
+
 // eslint-disable-next-line @typescript-eslint/no-empty-interface
 export interface SearchNotebooksPluginSetup {}
 // eslint-disable-next-line @typescript-eslint/no-empty-interface
 export interface SearchNotebooksPluginStart {}
+
+export interface RouteDependencies {
+  config: SearchNotebooksConfig;
+  logger: Logger;
+  notebooksCache: NotebooksCache;
+  router: IRouter;
+}
+
+export interface RemoteNotebookInformation extends NotebookInformation {
+  url: string;
+}
+
+export interface RemoteNotebookCatalog extends NotebookCatalog {
+  notebooks: RemoteNotebookInformation[];
+}
+
+export interface CachedNotebookCatalog extends RemoteNotebookCatalog {
+  timestamp: Date;
+}
+
+export interface CachedNotebook extends NotebookDefinition {
+  timestamp: Date;
+}
+export interface NotebooksCache {
+  catalog?: CachedNotebookCatalog;
+  notebooks: Record<string, CachedNotebook>;
+}
diff --git a/x-pack/plugins/search_notebooks/server/utils.test.ts b/x-pack/plugins/search_notebooks/server/utils.test.ts
new file mode 100644
index 00000000000000..cf7824661d9e2a
--- /dev/null
+++ b/x-pack/plugins/search_notebooks/server/utils.test.ts
@@ -0,0 +1,28 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import * as utils from './utils';
+
+describe('Search Notebooks Utils', () => {
+  // Party Like It's
+  const fakeNow = new Date('1999-12-31T23:59:59.999Z');
+  beforeAll(() => {
+    jest.useFakeTimers();
+    jest.setSystemTime(fakeNow);
+  });
+
+  describe('dateWithinTTL', () => {
+    it('return true if value is withing TTL of now', () => {
+      expect(utils.dateWithinTTL(new Date('1999-12-31T23:59:58.999Z'), 10)).toBe(true);
+      expect(utils.dateWithinTTL(new Date('1999-12-31T23:59:49.999Z'), 10)).toBe(true);
+    });
+    it('returns false is value is older than TTL', () => {
+      expect(utils.dateWithinTTL(new Date('1999-12-31T23:59:48.999Z'), 10)).toBe(false);
+      expect(utils.dateWithinTTL(new Date('1999-12-31T23:59:39.999Z'), 10)).toBe(false);
+    });
+  });
+});
diff --git a/x-pack/plugins/search_notebooks/server/utils.ts b/x-pack/plugins/search_notebooks/server/utils.ts
new file mode 100644
index 00000000000000..4028d6776dd03e
--- /dev/null
+++ b/x-pack/plugins/search_notebooks/server/utils.ts
@@ -0,0 +1,46 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { NotebookDefinition } from '@kbn/ipynb';
+import { NotebookCatalog, NotebookInformation } from '../common/types';
+import type {
+  CachedNotebook,
+  CachedNotebookCatalog,
+  NotebooksCache,
+  RemoteNotebookInformation,
+} from './types';
+
+export function createNotebooksCache(): NotebooksCache {
+  return {
+    notebooks: {},
+  };
+}
+
+export function dateWithinTTL(value: Date, ttl: number) {
+  return (Date.now() - value.getTime()) / 1000 <= ttl;
+}
+
+export function cleanCachedNotebookCatalog(catalog: CachedNotebookCatalog): NotebookCatalog {
+  const notebooks = catalog.notebooks.map(cleanNotebookMetadata);
+  return {
+    notebooks,
+  };
+}
+export function cleanCachedNotebook(notebook: CachedNotebook): NotebookDefinition {
+  const { timestamp, ...result } = notebook;
+  return result;
+}
+
+export function cleanNotebookMetadata(nb: RemoteNotebookInformation): NotebookInformation {
+  const { id, title, description, link } = nb;
+  return {
+    description,
+    id,
+    link,
+    title,
+  };
+}
diff --git a/x-pack/plugins/search_playground/kibana.jsonc b/x-pack/plugins/search_playground/kibana.jsonc
index 07c5866b34029b..221d5bf9e1873e 100644
--- a/x-pack/plugins/search_playground/kibana.jsonc
+++ b/x-pack/plugins/search_playground/kibana.jsonc
@@ -20,7 +20,8 @@
       "triggersActionsUi",
     ],
     "optionalPlugins": [
-      "cloud"
+      "cloud",
+      "usageCollection",
     ],
     "requiredBundles": [
       "kibanaReact"
diff --git a/x-pack/plugins/search_playground/public/components/chat.tsx b/x-pack/plugins/search_playground/public/components/chat.tsx
index d0c28117fcca4c..59e52778e42ca8 100644
--- a/x-pack/plugins/search_playground/public/components/chat.tsx
+++ b/x-pack/plugins/search_playground/public/components/chat.tsx
@@ -68,13 +68,13 @@ export const Chat = () => {
         data: buildFormData(data),
       }
     );
-    usageTracker.click(AnalyticsEvents.chatQuestionSent);
+    usageTracker?.click(AnalyticsEvents.chatQuestionSent);
 
     resetField(ChatFormFields.question);
   };
   const handleStopRequest = () => {
     stopRequest();
-    usageTracker.click(AnalyticsEvents.chatRequestStopped);
+    usageTracker?.click(AnalyticsEvents.chatRequestStopped);
   };
   const chatMessages = useMemo(
     () => [
@@ -101,15 +101,15 @@ export const Chat = () => {
     });
     setIsRegenerating(false);
 
-    usageTracker.click(AnalyticsEvents.chatRegenerateMessages);
+    usageTracker?.click(AnalyticsEvents.chatRegenerateMessages);
   };
   const handleClearChat = () => {
     setMessages([]);
-    usageTracker.click(AnalyticsEvents.chatCleared);
+    usageTracker?.click(AnalyticsEvents.chatCleared);
   };
 
   useEffect(() => {
-    usageTracker.load(AnalyticsEvents.chatPageLoaded);
+    usageTracker?.load(AnalyticsEvents.chatPageLoaded);
   }, [usageTracker]);
 
   return (
diff --git a/x-pack/plugins/search_playground/public/components/edit_context/edit_context_flyout.tsx b/x-pack/plugins/search_playground/public/components/edit_context/edit_context_flyout.tsx
index 5a3a6065cba3ae..c56b1848e70f4f 100644
--- a/x-pack/plugins/search_playground/public/components/edit_context/edit_context_flyout.tsx
+++ b/x-pack/plugins/search_playground/public/components/edit_context/edit_context_flyout.tsx
@@ -65,23 +65,23 @@ export const EditContextFlyout: React.FC<EditContextFlyoutProps> = ({ onClose })
       ...tempSourceFields,
       [index]: [field],
     });
-    usageTracker.click(AnalyticsEvents.editContextFieldToggled);
+    usageTracker?.click(AnalyticsEvents.editContextFieldToggled);
   };
 
   const saveSourceFields = () => {
-    usageTracker.click(AnalyticsEvents.editContextSaved);
+    usageTracker?.click(AnalyticsEvents.editContextSaved);
     onChangeSourceFields(tempSourceFields);
     onChangeSize(docSize);
     onClose();
   };
 
   const handleDocSizeChange = (e: React.ChangeEvent<HTMLSelectElement>) => {
-    usageTracker.click(AnalyticsEvents.editContextDocSizeChanged);
+    usageTracker?.click(AnalyticsEvents.editContextDocSizeChanged);
     setDocSize(Number(e.target.value));
   };
 
   useEffect(() => {
-    usageTracker.load(AnalyticsEvents.editContextFlyoutOpened);
+    usageTracker?.load(AnalyticsEvents.editContextFlyoutOpened);
   }, [usageTracker]);
 
   return (
diff --git a/x-pack/plugins/search_playground/public/components/message_list/citations_table.tsx b/x-pack/plugins/search_playground/public/components/message_list/citations_table.tsx
index aaa6fcb650f962..feca593604a928 100644
--- a/x-pack/plugins/search_playground/public/components/message_list/citations_table.tsx
+++ b/x-pack/plugins/search_playground/public/components/message_list/citations_table.tsx
@@ -32,12 +32,12 @@ export const CitationsTable: React.FC<CitationsTableProps> = ({ citations }) =>
     if (itemIdToExpandedRowMapValues[citation.metadata._id]) {
       delete itemIdToExpandedRowMapValues[citation.metadata._id];
 
-      usageTracker.click(AnalyticsEvents.citationDetailsCollapsed);
+      usageTracker?.click(AnalyticsEvents.citationDetailsCollapsed);
     } else {
       itemIdToExpandedRowMapValues[citation.metadata._id] = (
         <EuiText size="s">{citation.content}</EuiText>
       );
-      usageTracker.click(AnalyticsEvents.citationDetailsExpanded);
+      usageTracker?.click(AnalyticsEvents.citationDetailsExpanded);
     }
 
     setItemIdToExpandedRowMap(itemIdToExpandedRowMapValues);
diff --git a/x-pack/plugins/search_playground/public/components/message_list/retrieval_docs_flyout.tsx b/x-pack/plugins/search_playground/public/components/message_list/retrieval_docs_flyout.tsx
index 80d6e1dbe5bdc0..38ddc9cc4458ae 100644
--- a/x-pack/plugins/search_playground/public/components/message_list/retrieval_docs_flyout.tsx
+++ b/x-pack/plugins/search_playground/public/components/message_list/retrieval_docs_flyout.tsx
@@ -81,7 +81,7 @@ export const RetrievalDocsFlyout: React.FC<RetrievalDocsFlyoutProps> = ({
   ];
 
   useEffect(() => {
-    usageTracker.load(AnalyticsEvents.retrievalDocsFlyoutOpened);
+    usageTracker?.load(AnalyticsEvents.retrievalDocsFlyoutOpened);
   }, [usageTracker]);
 
   return (
diff --git a/x-pack/plugins/search_playground/public/components/set_up_connector_panel_for_start_chat.tsx b/x-pack/plugins/search_playground/public/components/set_up_connector_panel_for_start_chat.tsx
index 2bd885b46514bc..2430cd4e6c7a0a 100644
--- a/x-pack/plugins/search_playground/public/components/set_up_connector_panel_for_start_chat.tsx
+++ b/x-pack/plugins/search_playground/public/components/set_up_connector_panel_for_start_chat.tsx
@@ -36,19 +36,19 @@ export const SetUpConnectorPanelForStartChat: React.FC = () => {
     setConnectorFlyoutOpen(false);
   };
   const handleSetupGenAiConnector = () => {
-    usageTracker.click(AnalyticsEvents.genAiConnectorCreated);
+    usageTracker?.click(AnalyticsEvents.genAiConnectorCreated);
     setConnectorFlyoutOpen(true);
   };
 
   useEffect(() => {
     if (connectors?.length) {
       if (showCallout) {
-        usageTracker.load(AnalyticsEvents.genAiConnectorAdded);
+        usageTracker?.load(AnalyticsEvents.genAiConnectorAdded);
       } else {
-        usageTracker.load(AnalyticsEvents.genAiConnectorExists);
+        usageTracker?.load(AnalyticsEvents.genAiConnectorExists);
       }
     } else {
-      usageTracker.load(AnalyticsEvents.genAiConnectorSetup);
+      usageTracker?.load(AnalyticsEvents.genAiConnectorSetup);
     }
   }, [connectors?.length, showCallout, usageTracker]);
 
@@ -82,6 +82,7 @@ export const SetUpConnectorPanelForStartChat: React.FC = () => {
             defaultMessage="You need to connect to a large-language model to use this feature. Start by adding connection details for your LLM provider."
           />
         }
+        dataTestSubj="connectToLLMChatPanel"
       >
         <EuiFlexGroup>
           <EuiFlexItem grow={false}>
diff --git a/x-pack/plugins/search_playground/public/components/sources_panel/sources_panel_for_start_chat.tsx b/x-pack/plugins/search_playground/public/components/sources_panel/sources_panel_for_start_chat.tsx
index 8e2b2b7896c5ec..5a270fe3d44ddc 100644
--- a/x-pack/plugins/search_playground/public/components/sources_panel/sources_panel_for_start_chat.tsx
+++ b/x-pack/plugins/search_playground/public/components/sources_panel/sources_panel_for_start_chat.tsx
@@ -35,6 +35,7 @@ export const SourcesPanelForStartChat: React.FC = () => {
           "Select the Elasticsearch indices you'd like to query, providing additional context for the LLM.",
       })}
       isValid={!!selectedIndices.length}
+      dataTestSubj="selectIndicesChatPanel"
     >
       {!!selectedIndices?.length && (
         <EuiFlexItem>
diff --git a/x-pack/plugins/search_playground/public/components/start_chat_panel.tsx b/x-pack/plugins/search_playground/public/components/start_chat_panel.tsx
index c08d9bdbeeafd1..996f088090d295 100644
--- a/x-pack/plugins/search_playground/public/components/start_chat_panel.tsx
+++ b/x-pack/plugins/search_playground/public/components/start_chat_panel.tsx
@@ -22,6 +22,7 @@ interface StartChatPanelProps {
   title: string;
   description: string | React.ReactNode;
   isValid?: boolean;
+  dataTestSubj: string;
 }
 
 export const StartChatPanel: FC<PropsWithChildren<StartChatPanelProps>> = ({
@@ -29,8 +30,9 @@ export const StartChatPanel: FC<PropsWithChildren<StartChatPanelProps>> = ({
   description,
   children,
   isValid,
+  dataTestSubj,
 }) => (
-  <EuiPanel hasBorder paddingSize="l">
+  <EuiPanel hasBorder paddingSize="l" data-test-subj={dataTestSubj}>
     <EuiFlexGroup alignItems="center" justifyContent="spaceBetween">
       <EuiTitle size="xs">
         <h5>{title}</h5>
diff --git a/x-pack/plugins/search_playground/public/components/start_new_chat.tsx b/x-pack/plugins/search_playground/public/components/start_new_chat.tsx
index eef59b44820ea3..0db891438cb3d0 100644
--- a/x-pack/plugins/search_playground/public/components/start_new_chat.tsx
+++ b/x-pack/plugins/search_playground/public/components/start_new_chat.tsx
@@ -37,7 +37,7 @@ export const StartNewChat: React.FC<StartNewChatProps> = ({ onStartClick }) => {
   const usageTracker = useUsageTracker();
 
   useEffect(() => {
-    usageTracker.load(AnalyticsEvents.startNewChatPageLoaded);
+    usageTracker?.load(AnalyticsEvents.startNewChatPageLoaded);
   }, [usageTracker]);
 
   return (
@@ -85,7 +85,7 @@ export const StartNewChat: React.FC<StartNewChatProps> = ({ onStartClick }) => {
           <SourcesPanelForStartChat />
         </EuiFlexItem>
 
-        <EuiFlexGroup justifyContent="flexEnd">
+        <EuiFlexGroup justifyContent="flexEnd" data-test-subj="startChatButton">
           <EuiButton
             fill
             iconType="arrowRight"
diff --git a/x-pack/plugins/search_playground/public/components/summarization_panel/include_citations_field.tsx b/x-pack/plugins/search_playground/public/components/summarization_panel/include_citations_field.tsx
index 06f0236dd2bcd6..75212a2ba9cc30 100644
--- a/x-pack/plugins/search_playground/public/components/summarization_panel/include_citations_field.tsx
+++ b/x-pack/plugins/search_playground/public/components/summarization_panel/include_citations_field.tsx
@@ -23,7 +23,7 @@ export const IncludeCitationsField: React.FC<IncludeCitationsFieldProps> = ({
   const usageTracker = useUsageTracker();
   const handleChange = (value: boolean) => {
     onChange(value);
-    usageTracker.click(`${AnalyticsEvents.includeCitations}_${String(value)}`);
+    usageTracker?.click(`${AnalyticsEvents.includeCitations}_${String(value)}`);
   };
 
   return (
diff --git a/x-pack/plugins/search_playground/public/components/summarization_panel/instructions_field.tsx b/x-pack/plugins/search_playground/public/components/summarization_panel/instructions_field.tsx
index d4e909c3f1dd20..baea917937264f 100644
--- a/x-pack/plugins/search_playground/public/components/summarization_panel/instructions_field.tsx
+++ b/x-pack/plugins/search_playground/public/components/summarization_panel/instructions_field.tsx
@@ -29,7 +29,7 @@ export const InstructionsField: React.FC<InstructionsFieldProps> = ({ value, onC
   };
   const handleBlur = () => {
     if (baseValue !== value) {
-      usageTracker.click(AnalyticsEvents.instructionsFieldChanged);
+      usageTracker?.click(AnalyticsEvents.instructionsFieldChanged);
     }
     setBaseValue('');
   };
diff --git a/x-pack/plugins/search_playground/public/components/summarization_panel/summarization_model.tsx b/x-pack/plugins/search_playground/public/components/summarization_panel/summarization_model.tsx
index dc390479a5b1bb..13a77d0c01e102 100644
--- a/x-pack/plugins/search_playground/public/components/summarization_panel/summarization_model.tsx
+++ b/x-pack/plugins/search_playground/public/components/summarization_panel/summarization_model.tsx
@@ -97,7 +97,7 @@ export const SummarizationModel: React.FC<SummarizationModelProps> = ({
   );
 
   useEffect(() => {
-    usageTracker.click(
+    usageTracker?.click(
       `${AnalyticsEvents.modelSelected}_${selectedModel.value || selectedModel.connectorType}`
     );
   }, [usageTracker, selectedModel]);
diff --git a/x-pack/plugins/search_playground/public/components/toolbar.tsx b/x-pack/plugins/search_playground/public/components/toolbar.tsx
index b35062fa80eb69..e322c9c6bb3ff3 100644
--- a/x-pack/plugins/search_playground/public/components/toolbar.tsx
+++ b/x-pack/plugins/search_playground/public/components/toolbar.tsx
@@ -13,7 +13,7 @@ import { EditContextAction } from './edit_context/edit_context_action';
 
 export const Toolbar: React.FC = () => {
   return (
-    <EuiFlexGroup gutterSize="s">
+    <EuiFlexGroup gutterSize="s" data-test-subj="playground-header-actions">
       <EditContextAction />
       <ViewQueryAction />
       <ViewCodeAction />
diff --git a/x-pack/plugins/search_playground/public/components/view_code/examples/__snapshots__/py_lang_client.test.tsx.snap b/x-pack/plugins/search_playground/public/components/view_code/examples/__snapshots__/py_lang_client.test.tsx.snap
index 8506071050eb87..1b930bbc80a742 100644
--- a/x-pack/plugins/search_playground/public/components/view_code/examples/__snapshots__/py_lang_client.test.tsx.snap
+++ b/x-pack/plugins/search_playground/public/components/view_code/examples/__snapshots__/py_lang_client.test.tsx.snap
@@ -10,41 +10,41 @@ from openai import OpenAI
 
 
 es_client = Elasticsearch(
-  \\"http://my-local-cloud-instance\\",
-  api_key=os.environ[\\"ES_API_KEY\\"]
+    \\"http://my-local-cloud-instance\\",
+    api_key=os.environ[\\"ES_API_KEY\\"]
 )
       
 
 openai_client = OpenAI(
-  api_key=os.environ[\\"OPENAI_API_KEY\\"],
+    api_key=os.environ[\\"OPENAI_API_KEY\\"],
 )
 
 index_source_fields = {
-  \\"index1\\": [
-    \\"field1\\"
-  ],
-  \\"index2\\": [
-    \\"field2\\"
-  ]
+    \\"index1\\": [
+        \\"field1\\"
+    ],
+    \\"index2\\": [
+        \\"field2\\"
+    ]
 }
 
 def get_elasticsearch_results(query):
-  es_query = {
-    \\"query\\": {},
-    \\"size\\": 10
-  }
+    es_query = {
+        \\"query\\": {},
+        \\"size\\": 10
+    }
 
-  result = es.search(index=\\"index1,index2\\", body=es_query)
-  return result[\\"hits\\"][\\"hits\\"]
+    result = es_client.search(index=\\"index1,index2\\", body=es_query)
+    return result[\\"hits\\"][\\"hits\\"]
 
 def create_openai_prompt(question, results):
-  context = \\"\\"
-  for hit in results:
-    source_field = index_source_fields.get(hit[\\"_index\\"])[0]
-    hit_context = hit[\\"_source\\"][source_field]
-    context += f\\"{hit_context}\\\\n\\"
+    context = \\"\\"
+    for hit in results:
+      source_field = index_source_fields.get(hit[\\"_index\\"])[0]
+      hit_context = hit[\\"_source\\"][source_field]
+      context += f\\"{hit_context}\\\\n\\"
 
-  prompt = f\\"\\"\\"
+    prompt = f\\"\\"\\"
   Instructions:
   
   - Your prompt
@@ -62,25 +62,25 @@ def create_openai_prompt(question, results):
   Answer:
   \\"\\"\\"
 
-  return prompt
+    return prompt
 
 def generate_openai_completion(user_prompt):
-  response = openai_client.chat.completions.create(
-    model=\\"gpt-3.5-turbo\\",
-    messages=[
-      {\\"role\\": \\"system\\", \\"content\\": \\"You are an assistant for question-answering tasks.\\"},
-      {\\"role\\": \\"user\\", \\"content\\": user_prompt},
-    ]
-  )
+    response = openai_client.chat.completions.create(
+        model=\\"gpt-3.5-turbo\\",
+        messages=[
+            {\\"role\\": \\"system\\", \\"content\\": \\"You are an assistant for question-answering tasks.\\"},
+            {\\"role\\": \\"user\\", \\"content\\": user_prompt},
+        ]
+    )
 
-  return response.choices[0].message.content
+    return response.choices[0].message.content
 
 if __name__ == \\"__main__\\":
-  question = \\"my question\\"
-  elasticsearch_results = get_elasticsearch_results(question)
-  context_prompt = create_openai_prompt(question, elasticsearch_results)
-  openai_completion = generate_openai_completion(context_prompt)
-  print(openai_completion)
+    question = \\"my question\\"
+    elasticsearch_results = get_elasticsearch_results(question)
+    context_prompt = create_openai_prompt(question, elasticsearch_results)
+    openai_completion = generate_openai_completion(context_prompt)
+    print(openai_completion)
 
 "
 `;
diff --git a/x-pack/plugins/search_playground/public/components/view_code/examples/__snapshots__/py_langchain_python.test.tsx.snap b/x-pack/plugins/search_playground/public/components/view_code/examples/__snapshots__/py_langchain_python.test.tsx.snap
index e6735a416e52c8..96d069736c8971 100644
--- a/x-pack/plugins/search_playground/public/components/view_code/examples/__snapshots__/py_langchain_python.test.tsx.snap
+++ b/x-pack/plugins/search_playground/public/components/view_code/examples/__snapshots__/py_langchain_python.test.tsx.snap
@@ -14,36 +14,32 @@ from langchain.prompts.prompt import PromptTemplate
 import os
 
 es_client = Elasticsearch(
-  \\"http://my-local-cloud-instance\\",
-  api_key=os.environ[\\"ES_API_KEY\\"]
+    \\"http://my-local-cloud-instance\\",
+    api_key=os.environ[\\"ES_API_KEY\\"]
 )
       
 
 def build_query(query):
-  return {
-    \\"query\\": {}
-  }
+    return {
+        \\"query\\": {}
+    }
 
 index_source_fields = {
-  \\"index1\\": [
-    \\"field1\\"
-  ],
-  \\"index2\\": [
-    \\"field2\\"
-  ]
+    \\"index1\\": \\"field1\\",
+    \\"index2\\": \\"field2\\"
 }
 
 retriever = ElasticsearchRetriever(
-  index_name=\\"index1,index2\\",
-  body_func=build_query,
-  content_field=index_source_fields,
-  es_client=es_client
+    index_name=\\"index1,index2\\",
+    body_func=build_query,
+    content_field=index_source_fields,
+    es_client=es_client
 )
 
 model = ChatOpenAI(openai_api_key=os.environ[\\"OPENAI_API_KEY\\"], model_name=\\"gpt-3.5-turbo\\")
 
 ANSWER_PROMPT = ChatPromptTemplate.from_template(
-  f\\"\\"\\"
+    \\"\\"\\"
   Instructions:
   
   - Your prompt
@@ -65,14 +61,14 @@ ANSWER_PROMPT = ChatPromptTemplate.from_template(
 DEFAULT_DOCUMENT_PROMPT = PromptTemplate.from_template(template=\\"{page_content}\\")
 
 def _combine_documents(
-  docs, document_prompt=DEFAULT_DOCUMENT_PROMPT, document_separator=\\"\\\\n\\\\n\\"
+    docs, document_prompt=DEFAULT_DOCUMENT_PROMPT, document_separator=\\"\\\\n\\\\n\\"
 ):
-  doc_strings = [format_document(doc, document_prompt) for doc in docs]
-  return document_separator.join(doc_strings)
+    doc_strings = [format_document(doc, document_prompt) for doc in docs]
+    return document_separator.join(doc_strings)
 
 _context = {
-  \\"context\\": retriever | _combine_documents,
-  \\"question\\": RunnablePassthrough(),
+    \\"context\\": retriever | _combine_documents,
+    \\"question\\": RunnablePassthrough(),
 }
 
 chain = _context | ANSWER_PROMPT | model | StrOutputParser()
diff --git a/x-pack/plugins/search_playground/public/components/view_code/examples/py_lang_client.tsx b/x-pack/plugins/search_playground/public/components/view_code/examples/py_lang_client.tsx
index 6f78f727952993..e7532706627d3f 100644
--- a/x-pack/plugins/search_playground/public/components/view_code/examples/py_lang_client.tsx
+++ b/x-pack/plugins/search_playground/public/components/view_code/examples/py_lang_client.tsx
@@ -23,52 +23,52 @@ from openai import OpenAI
 ${clientDetails}
 
 openai_client = OpenAI(
-  api_key=os.environ["OPENAI_API_KEY"],
+    api_key=os.environ["OPENAI_API_KEY"],
 )
 
-index_source_fields = ${JSON.stringify(formValues.source_fields, null, 2)}
+index_source_fields = ${JSON.stringify(formValues.source_fields, null, 4)}
 
 def get_elasticsearch_results(query):
-  es_query = ${getESQuery({
-    ...formValues.elasticsearch_query,
-    size: formValues.doc_size,
-  })}
+    es_query = ${getESQuery({
+      ...formValues.elasticsearch_query,
+      size: formValues.doc_size,
+    })}
 
-  result = es.search(index="${formValues.indices.join(',')}", body=es_query)
-  return result["hits"]["hits"]
+    result = es_client.search(index="${formValues.indices.join(',')}", body=es_query)
+    return result["hits"]["hits"]
 
 def create_openai_prompt(question, results):
-  context = ""
-  for hit in results:
-    source_field = index_source_fields.get(hit["_index"])[0]
-    hit_context = hit["_source"][source_field]
-    context += f"{hit_context}\\n"
+    context = ""
+    for hit in results:
+      source_field = index_source_fields.get(hit["_index"])[0]
+      hit_context = hit["_source"][source_field]
+      context += f"{hit_context}\\n"
 
-  prompt = f"""${Prompt(formValues.prompt, {
-    context: true,
-    citations: formValues.citations,
-    type: 'openai',
-  })}"""
+    prompt = f"""${Prompt(formValues.prompt, {
+      context: true,
+      citations: formValues.citations,
+      type: 'openai',
+    })}"""
 
-  return prompt
+    return prompt
 
 def generate_openai_completion(user_prompt):
-  response = openai_client.chat.completions.create(
-    model="gpt-3.5-turbo",
-    messages=[
-      {"role": "system", "content": "You are an assistant for question-answering tasks."},
-      {"role": "user", "content": user_prompt},
-    ]
-  )
+    response = openai_client.chat.completions.create(
+        model="gpt-3.5-turbo",
+        messages=[
+            {"role": "system", "content": "You are an assistant for question-answering tasks."},
+            {"role": "user", "content": user_prompt},
+        ]
+    )
 
-  return response.choices[0].message.content
+    return response.choices[0].message.content
 
 if __name__ == "__main__":
-  question = "my question"
-  elasticsearch_results = get_elasticsearch_results(question)
-  context_prompt = create_openai_prompt(question, elasticsearch_results)
-  openai_completion = generate_openai_completion(context_prompt)
-  print(openai_completion)
+    question = "my question"
+    elasticsearch_results = get_elasticsearch_results(question)
+    context_prompt = create_openai_prompt(question, elasticsearch_results)
+    openai_completion = generate_openai_completion(context_prompt)
+    print(openai_completion)
 
 `}
   </EuiCodeBlock>
diff --git a/x-pack/plugins/search_playground/public/components/view_code/examples/py_langchain_python.tsx b/x-pack/plugins/search_playground/public/components/view_code/examples/py_langchain_python.tsx
index 127d3786bcaf58..bb029aad05413b 100644
--- a/x-pack/plugins/search_playground/public/components/view_code/examples/py_langchain_python.tsx
+++ b/x-pack/plugins/search_playground/public/components/view_code/examples/py_langchain_python.tsx
@@ -11,6 +11,14 @@ import { ChatForm } from '../../../types';
 import { Prompt } from '../../../../common/prompt';
 import { getESQuery } from './utils';
 
+export const getSourceFields = (sourceFields: ChatForm['source_fields']) => {
+  const fields = Object.keys(sourceFields).reduce<Record<string, string>>((acc, index: string) => {
+    acc[index] = sourceFields[index][0];
+    return acc;
+  }, {});
+  return JSON.stringify(fields, null, 4);
+};
+
 export const LANGCHAIN_PYTHON = (formValues: ChatForm, clientDetails: string) => (
   <EuiCodeBlock language="py" isCopyable overflowHeight="100%">
     {`## Install the required packages
@@ -27,38 +35,38 @@ import os
 ${clientDetails}
 
 def build_query(query):
-  return ${getESQuery(formValues.elasticsearch_query)}
+    return ${getESQuery(formValues.elasticsearch_query)}
 
-index_source_fields = ${JSON.stringify(formValues.source_fields, null, 2)}
+index_source_fields = ${getSourceFields(formValues.source_fields)}
 
 retriever = ElasticsearchRetriever(
-  index_name="${formValues.indices.join(',')}",
-  body_func=build_query,
-  content_field=index_source_fields,
-  es_client=es_client
+    index_name="${formValues.indices.join(',')}",
+    body_func=build_query,
+    content_field=index_source_fields,
+    es_client=es_client
 )
 
 model = ChatOpenAI(openai_api_key=os.environ["OPENAI_API_KEY"], model_name="gpt-3.5-turbo")
 
 ANSWER_PROMPT = ChatPromptTemplate.from_template(
-  f"""${Prompt(formValues.prompt, {
-    context: true,
-    citations: formValues.citations,
-    type: 'openai',
-  })}"""
+    """${Prompt(formValues.prompt, {
+      context: true,
+      citations: formValues.citations,
+      type: 'openai',
+    })}"""
 )
 
 DEFAULT_DOCUMENT_PROMPT = PromptTemplate.from_template(template="{page_content}")
 
 def _combine_documents(
-  docs, document_prompt=DEFAULT_DOCUMENT_PROMPT, document_separator="\\n\\n"
+    docs, document_prompt=DEFAULT_DOCUMENT_PROMPT, document_separator="\\n\\n"
 ):
-  doc_strings = [format_document(doc, document_prompt) for doc in docs]
-  return document_separator.join(doc_strings)
+    doc_strings = [format_document(doc, document_prompt) for doc in docs]
+    return document_separator.join(doc_strings)
 
 _context = {
-  "context": retriever | _combine_documents,
-  "question": RunnablePassthrough(),
+    "context": retriever | _combine_documents,
+    "question": RunnablePassthrough(),
 }
 
 chain = _context | ANSWER_PROMPT | model | StrOutputParser()
diff --git a/x-pack/plugins/search_playground/public/components/view_code/examples/utils.test.ts b/x-pack/plugins/search_playground/public/components/view_code/examples/utils.test.ts
new file mode 100644
index 00000000000000..30676bc1d6bc13
--- /dev/null
+++ b/x-pack/plugins/search_playground/public/components/view_code/examples/utils.test.ts
@@ -0,0 +1,51 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { getESQuery } from './utils';
+
+describe('getESQuery', () => {
+  it('should stringify and format the query correctly', () => {
+    const query = {
+      query: {
+        bool: {
+          should: [
+            {
+              match: {
+                field: '{query}',
+              },
+            },
+            {
+              match: {
+                field: '{query}',
+              },
+            },
+          ],
+        },
+      },
+    };
+    expect(getESQuery(query)).toMatchInlineSnapshot(`
+      "{
+              \\"query\\": {
+                  \\"bool\\": {
+                      \\"should\\": [
+                          {
+                              \\"match\\": {
+                                  \\"field\\": query
+                              }
+                          },
+                          {
+                              \\"match\\": {
+                                  \\"field\\": query
+                              }
+                          }
+                      ]
+                  }
+              }
+          }"
+    `);
+  });
+});
diff --git a/x-pack/plugins/search_playground/public/components/view_code/examples/utils.ts b/x-pack/plugins/search_playground/public/components/view_code/examples/utils.ts
index 6d44442f588a21..6c37ccc662e18d 100644
--- a/x-pack/plugins/search_playground/public/components/view_code/examples/utils.ts
+++ b/x-pack/plugins/search_playground/public/components/view_code/examples/utils.ts
@@ -7,10 +7,10 @@
 
 export const getESQuery = (query: any) => {
   try {
-    return JSON.stringify(query, null, 2)
-      .replace('"{query}"', 'query')
+    return JSON.stringify(query, null, 4)
+      .replace(/"{query}"/g, 'query')
       .split('\n')
-      .map((line) => `  ${line}`)
+      .map((line) => `    ${line}`)
       .join('\n')
       .trim();
   } catch (e) {
diff --git a/x-pack/plugins/search_playground/public/components/view_code/view_code_flyout.tsx b/x-pack/plugins/search_playground/public/components/view_code/view_code_flyout.tsx
index b9eba5baa673b7..374bd6c0c511ec 100644
--- a/x-pack/plugins/search_playground/public/components/view_code/view_code_flyout.tsx
+++ b/x-pack/plugins/search_playground/public/components/view_code/view_code_flyout.tsx
@@ -37,15 +37,15 @@ export const ES_CLIENT_DETAILS = (cloud: CloudSetup | undefined) => {
   if (cloud) {
     return `
 es_client = Elasticsearch(
-  "${cloud.elasticsearchUrl}",
-  api_key=os.environ["ES_API_KEY"]
+    "${cloud.elasticsearchUrl}",
+    api_key=os.environ["ES_API_KEY"]
 )
       `;
   }
 
   return `
 es_client = Elasticsearch(
-  "<your-elasticsearch-url>"
+    "<your-elasticsearch-url>"
 )
   `;
 };
@@ -70,11 +70,11 @@ export const ViewCodeFlyout: React.FC<ViewCodeFlyoutProps> = ({ onClose }) => {
   };
 
   useEffect(() => {
-    usageTracker.load(AnalyticsEvents.viewCodeFlyoutOpened);
+    usageTracker?.load(AnalyticsEvents.viewCodeFlyoutOpened);
   }, [usageTracker]);
 
   useEffect(() => {
-    usageTracker.click(`${AnalyticsEvents.viewCodeLanguageChange}_${selectedLanguage}`);
+    usageTracker?.click(`${AnalyticsEvents.viewCodeLanguageChange}_${selectedLanguage}`);
   }, [usageTracker, selectedLanguage]);
 
   return (
diff --git a/x-pack/plugins/search_playground/public/components/view_query/view_query_flyout.tsx b/x-pack/plugins/search_playground/public/components/view_query/view_query_flyout.tsx
index 621fecfaf72d48..d808fec85aaa48 100644
--- a/x-pack/plugins/search_playground/public/components/view_query/view_query_flyout.tsx
+++ b/x-pack/plugins/search_playground/public/components/view_query/view_query_flyout.tsx
@@ -106,7 +106,7 @@ export const ViewQueryFlyout: React.FC<ViewQueryFlyoutProps> = ({ onClose }) =>
       ...tempQueryFields,
       [index]: newFields,
     });
-    usageTracker.count(AnalyticsEvents.viewQueryFieldsUpdated, newFields.length);
+    usageTracker?.count(AnalyticsEvents.viewQueryFieldsUpdated, newFields.length);
   };
 
   const saveQuery = () => {
@@ -117,12 +117,12 @@ export const ViewQueryFlyout: React.FC<ViewQueryFlyoutProps> = ({ onClose }) =>
     const groupedQueryFields = groupTypeQueryFields(fields, tempQueryFields);
 
     groupedQueryFields.forEach((typeQueryFields) =>
-      usageTracker.click(`${AnalyticsEvents.viewQuerySaved}_${typeQueryFields}`)
+      usageTracker?.click(`${AnalyticsEvents.viewQuerySaved}_${typeQueryFields}`)
     );
   };
 
   useEffect(() => {
-    usageTracker.load(AnalyticsEvents.viewQueryFlyoutOpened);
+    usageTracker?.load(AnalyticsEvents.viewQueryFlyoutOpened);
   }, [usageTracker]);
 
   return (
diff --git a/x-pack/plugins/search_playground/public/hooks/use_source_indices_field.ts b/x-pack/plugins/search_playground/public/hooks/use_source_indices_field.ts
index 1704181d7bc949..342be7c1917782 100644
--- a/x-pack/plugins/search_playground/public/hooks/use_source_indices_field.ts
+++ b/x-pack/plugins/search_playground/public/hooks/use_source_indices_field.ts
@@ -91,7 +91,10 @@ export const useSourceIndicesFields = () => {
 
       onElasticsearchQueryChange(createQuery(defaultFields, fields));
       onSourceFieldsChange(defaultSourceFields);
-      usageTracker.count(AnalyticsEvents.sourceFieldsLoaded, Object.values(fields)?.flat()?.length);
+      usageTracker?.count(
+        AnalyticsEvents.sourceFieldsLoaded,
+        Object.values(fields)?.flat()?.length
+      );
     } else {
       setNoFieldsIndicesWarning(null);
     }
@@ -103,14 +106,14 @@ export const useSourceIndicesFields = () => {
     const newIndices = [...selectedIndices, newIndex];
     setLoading(true);
     onIndicesChange(newIndices);
-    usageTracker.count(AnalyticsEvents.sourceIndexUpdated, newIndices.length);
+    usageTracker?.count(AnalyticsEvents.sourceIndexUpdated, newIndices.length);
   };
 
   const removeIndex = (index: IndexName) => {
     const newIndices = selectedIndices.filter((indexName: string) => indexName !== index);
     setLoading(true);
     onIndicesChange(newIndices);
-    usageTracker.count(AnalyticsEvents.sourceIndexUpdated, newIndices.length);
+    usageTracker?.count(AnalyticsEvents.sourceIndexUpdated, newIndices.length);
   };
 
   return {
diff --git a/x-pack/plugins/search_playground/public/hooks/use_usage_tracker.test.ts b/x-pack/plugins/search_playground/public/hooks/use_usage_tracker.test.ts
index 2f2d118c0646d2..9fb74674504f8d 100644
--- a/x-pack/plugins/search_playground/public/hooks/use_usage_tracker.test.ts
+++ b/x-pack/plugins/search_playground/public/hooks/use_usage_tracker.test.ts
@@ -30,15 +30,15 @@ describe('useUsageTracker', () => {
   it('returns bound functions for tracking usage', () => {
     const { result } = renderHook(() => useUsageTracker());
 
-    expect(typeof result.current.click).toBe('function');
-    expect(typeof result.current.count).toBe('function');
-    expect(typeof result.current.load).toBe('function');
+    expect(typeof result.current?.click).toBe('function');
+    expect(typeof result.current?.count).toBe('function');
+    expect(typeof result.current?.load).toBe('function');
   });
 
   it('calls reportUiCounter with correct arguments for click', () => {
     const { result } = renderHook(() => useUsageTracker());
 
-    result.current.click('button_click');
+    result.current?.click('button_click');
 
     expect(reportUiCounter).toHaveBeenCalledWith('search_playground', 'click', 'button_click');
   });
@@ -46,7 +46,7 @@ describe('useUsageTracker', () => {
   it('calls reportUiCounter with correct arguments for count', () => {
     const { result } = renderHook(() => useUsageTracker());
 
-    result.current.count('item_count');
+    result.current?.count('item_count');
 
     expect(reportUiCounter).toHaveBeenCalledWith('search_playground', 'count', 'item_count');
   });
@@ -54,8 +54,21 @@ describe('useUsageTracker', () => {
   it('calls reportUiCounter with correct arguments for load', () => {
     const { result } = renderHook(() => useUsageTracker());
 
-    result.current.load('page_loaded');
+    result.current?.load('page_loaded');
 
     expect(reportUiCounter).toHaveBeenCalledWith('search_playground', 'loaded', 'page_loaded');
   });
+
+  it('does not  reportUiCounter if usageCollection is not loaded properly', () => {
+    reportUiCounter = jest.fn();
+    (useKibana as jest.Mock).mockReturnValue({
+      services: { usageCollection: undefined },
+    });
+
+    const { result } = renderHook(() => useUsageTracker());
+
+    result.current?.load('page_loaded');
+
+    expect(reportUiCounter).toHaveBeenCalledTimes(0);
+  });
 });
diff --git a/x-pack/plugins/search_playground/public/hooks/use_usage_tracker.ts b/x-pack/plugins/search_playground/public/hooks/use_usage_tracker.ts
index e8b63c120da0e3..7764c0d84c85d2 100644
--- a/x-pack/plugins/search_playground/public/hooks/use_usage_tracker.ts
+++ b/x-pack/plugins/search_playground/public/hooks/use_usage_tracker.ts
@@ -14,24 +14,25 @@ const APP_TRACKER_NAME = 'search_playground';
 export const useUsageTracker = () => {
   const { usageCollection } = useKibana().services;
 
-  return useMemo(
-    () => ({
-      click: usageCollection.reportUiCounter.bind(
-        usageCollection,
-        APP_TRACKER_NAME,
-        METRIC_TYPE.CLICK
-      ),
-      count: usageCollection.reportUiCounter.bind(
-        usageCollection,
-        APP_TRACKER_NAME,
-        METRIC_TYPE.COUNT
-      ),
-      load: usageCollection.reportUiCounter.bind(
-        usageCollection,
-        APP_TRACKER_NAME,
-        METRIC_TYPE.LOADED
-      ),
-    }),
-    [usageCollection]
-  );
+  return useMemo(() => {
+    if (usageCollection) {
+      return {
+        click: usageCollection.reportUiCounter.bind(
+          usageCollection,
+          APP_TRACKER_NAME,
+          METRIC_TYPE.CLICK
+        ),
+        count: usageCollection.reportUiCounter.bind(
+          usageCollection,
+          APP_TRACKER_NAME,
+          METRIC_TYPE.COUNT
+        ),
+        load: usageCollection.reportUiCounter.bind(
+          usageCollection,
+          APP_TRACKER_NAME,
+          METRIC_TYPE.LOADED
+        ),
+      };
+    }
+  }, [usageCollection]);
 };
diff --git a/x-pack/plugins/search_playground/public/providers/playground_provider.tsx b/x-pack/plugins/search_playground/public/providers/playground_provider.tsx
index b03ebaffb7da0d..301bbfe89b2e47 100644
--- a/x-pack/plugins/search_playground/public/providers/playground_provider.tsx
+++ b/x-pack/plugins/search_playground/public/providers/playground_provider.tsx
@@ -25,7 +25,7 @@ export const PlaygroundProvider: FC<PropsWithChildren<PlaygroundProviderProps>>
     defaultValues: {
       prompt: 'You are an assistant for question-answering tasks.',
       doc_size: 3,
-      source_fields: [],
+      source_fields: {},
       indices: defaultValues?.indices || [],
     },
   });
diff --git a/x-pack/plugins/search_playground/public/types.ts b/x-pack/plugins/search_playground/public/types.ts
index 1bfbca56f8f443..6f8552d753bbb0 100644
--- a/x-pack/plugins/search_playground/public/types.ts
+++ b/x-pack/plugins/search_playground/public/types.ts
@@ -40,7 +40,7 @@ export interface SearchPlaygroundPluginStart {
 
 export interface AppPluginStartDependencies {
   history: AppMountParameters['history'];
-  usageCollection: UsageCollectionStart;
+  usageCollection?: UsageCollectionStart;
   navigation: NavigationPublicPluginStart;
   triggersActionsUi: TriggersAndActionsUIPublicPluginStart;
   share: SharePluginStart;
@@ -52,7 +52,7 @@ export interface AppServicesContext {
   share: SharePluginStart;
   cloud?: CloudSetup;
   triggersActionsUi: TriggersAndActionsUIPublicPluginStart;
-  usageCollection: UsageCollectionStart;
+  usageCollection?: UsageCollectionStart;
 }
 
 export enum ChatFormFields {
@@ -74,7 +74,7 @@ export interface ChatForm {
   [ChatFormFields.indices]: string[];
   [ChatFormFields.summarizationModel]: LLMModel;
   [ChatFormFields.elasticsearchQuery]: { query: QueryDslQueryContainer };
-  [ChatFormFields.sourceFields]: string[];
+  [ChatFormFields.sourceFields]: { [index: string]: string[] };
   [ChatFormFields.docSize]: number;
   [ChatFormFields.queryFields]: { [index: string]: string[] };
 }
diff --git a/x-pack/plugins/search_playground/server/lib/conversational_chain.test.ts b/x-pack/plugins/search_playground/server/lib/conversational_chain.test.ts
index 64b741ac548c91..5d3d82d4ba80ee 100644
--- a/x-pack/plugins/search_playground/server/lib/conversational_chain.test.ts
+++ b/x-pack/plugins/search_playground/server/lib/conversational_chain.test.ts
@@ -8,7 +8,7 @@
 import type { Client } from '@elastic/elasticsearch';
 import { createAssist as Assist } from '../utils/assist';
 import { ConversationalChain } from './conversational_chain';
-import { FakeListLLM } from 'langchain/llms/fake';
+import { FakeListChatModel } from '@langchain/core/utils/testing';
 import { BaseChatModel } from '@langchain/core/language_models/chat_models';
 import { Message } from 'ai';
 
@@ -18,6 +18,7 @@ describe('conversational chain', () => {
     chat: Message[],
     expectedFinalAnswer: string,
     expectedDocs: any,
+    expectedTokens: any,
     expectedSearchRequest: any
   ) => {
     const searchMock = jest.fn().mockImplementation(() => {
@@ -49,7 +50,7 @@ describe('conversational chain', () => {
       },
     };
 
-    const llm = new FakeListLLM({
+    const llm = new FakeListChatModel({
       responses,
     });
 
@@ -99,10 +100,16 @@ describe('conversational chain', () => {
       .reduce((acc, v) => acc + v.replace(/0:"(.*)"\n/, '$1'), '');
     expect(textValue).toEqual(expectedFinalAnswer);
 
-    const docValue = streamToValue
+    const annotations = streamToValue
       .filter((v) => v[0] === '8')
-      .reduce((acc, v) => acc + v.replace(/8:(.*)\n/, '$1'), '');
-    expect(JSON.parse(docValue)).toEqual(expectedDocs);
+      .map((entry) => entry.replace(/8:(.*)\n/, '$1'), '')
+      .map((entry) => JSON.parse(entry))
+      .reduce((acc, v) => acc.concat(v), []);
+
+    const docValues = annotations.filter((v: { type: string }) => v.type === 'retrieved_docs');
+    const tokens = annotations.filter((v: { type: string }) => v.type.endsWith('_token_count'));
+    expect(docValues).toEqual(expectedDocs);
+    expect(tokens).toEqual(expectedTokens);
     expect(searchMock.mock.calls[0]).toEqual(expectedSearchRequest);
   };
 
@@ -125,10 +132,10 @@ describe('conversational chain', () => {
           ],
           type: 'retrieved_docs',
         },
-        {
-          count: 15,
-          type: 'context_token_count',
-        },
+      ],
+      [
+        { type: 'context_token_count', count: 15 },
+        { type: 'prompt_token_count', count: 5 },
       ],
       [
         {
@@ -169,10 +176,10 @@ describe('conversational chain', () => {
           ],
           type: 'retrieved_docs',
         },
-        {
-          count: 15,
-          type: 'context_token_count',
-        },
+      ],
+      [
+        { type: 'context_token_count', count: 15 },
+        { type: 'prompt_token_count', count: 5 },
       ],
       [
         {
@@ -213,10 +220,10 @@ describe('conversational chain', () => {
           ],
           type: 'retrieved_docs',
         },
-        {
-          count: 15,
-          type: 'context_token_count',
-        },
+      ],
+      [
+        { type: 'context_token_count', count: 15 },
+        { type: 'prompt_token_count', count: 5 },
       ],
       [
         {
diff --git a/x-pack/plugins/search_playground/server/lib/conversational_chain.ts b/x-pack/plugins/search_playground/server/lib/conversational_chain.ts
index 1d47753402db4a..1ec7bfb20c017f 100644
--- a/x-pack/plugins/search_playground/server/lib/conversational_chain.ts
+++ b/x-pack/plugins/search_playground/server/lib/conversational_chain.ts
@@ -130,7 +130,7 @@ class ConversationalChainFn {
         question: (input) => input.question,
       },
       prompt,
-      this.options.model,
+      this.options.model.withConfig({ metadata: { type: 'question_answer_qa' } }),
     ]);
 
     const conversationalRetrievalQAChain = RunnableSequence.from([
@@ -140,11 +140,7 @@ class ConversationalChainFn {
       },
       answerChain,
       new BytesOutputParser(),
-    ]).withConfig({
-      metadata: {
-        type: 'conversational_retrieval_qa',
-      },
-    });
+    ]);
 
     const stream = await conversationalRetrievalQAChain.stream(
       {
@@ -163,7 +159,7 @@ class ConversationalChainFn {
               tags,
               metadata: Record<string, string>
             ) {
-              if (metadata?.type === 'conversational_retrieval_qa') {
+              if (metadata?.type === 'question_answer_qa') {
                 data.appendMessageAnnotation({
                   type: 'prompt_token_count',
                   count: getTokenEstimateFromMessages(msg),
diff --git a/x-pack/plugins/search_playground/server/routes.ts b/x-pack/plugins/search_playground/server/routes.ts
index 738faa75162d0b..60e95ed399097c 100644
--- a/x-pack/plugins/search_playground/server/routes.ts
+++ b/x-pack/plugins/search_playground/server/routes.ts
@@ -6,7 +6,6 @@
  */
 
 import { schema } from '@kbn/config-schema';
-import { streamFactory } from '@kbn/ml-response-stream/server';
 import type { Logger } from '@kbn/logging';
 import { IRouter, StartServicesAccessor } from '@kbn/core/server';
 import { sendMessageEvent, SendMessageEventData } from './analytics/events';
@@ -14,6 +13,7 @@ import { fetchFields } from './lib/fetch_query_source_fields';
 import { AssistClientOptionsWithClient, createAssist as Assist } from './utils/assist';
 import { ConversationalChain } from './lib/conversational_chain';
 import { errorHandler } from './utils/error_handler';
+import { handleStreamResponse } from './utils/handle_stream_response';
 import {
   APIRoutes,
   SearchPlaygroundPluginStart,
@@ -143,27 +143,6 @@ export function defineRoutes({
         throw e;
       }
 
-      const { end, push, responseWithHeaders } = streamFactory(request.headers, logger);
-
-      const reader = (stream as ReadableStream).getReader();
-      const textDecoder = new TextDecoder();
-
-      function pushStreamUpdate() {
-        reader
-          .read()
-          .then(({ done, value }: { done: boolean; value?: Uint8Array }) => {
-            if (done) {
-              end();
-              return;
-            }
-            push(textDecoder.decode(value));
-            pushStreamUpdate();
-          })
-          .catch(() => {});
-      }
-
-      pushStreamUpdate();
-
       analytics.reportEvent<SendMessageEventData>(sendMessageEvent.eventType, {
         connectorType:
           connector.actionTypeId +
@@ -172,7 +151,7 @@ export function defineRoutes({
         isCitationsEnabled: data.citations,
       });
 
-      return response.ok(responseWithHeaders);
+      return handleStreamResponse({ logger, stream, response, request });
     })
   );
 
diff --git a/x-pack/plugins/search_playground/server/utils/handle_stream_response.test.ts b/x-pack/plugins/search_playground/server/utils/handle_stream_response.test.ts
new file mode 100644
index 00000000000000..464a2bf8548d0a
--- /dev/null
+++ b/x-pack/plugins/search_playground/server/utils/handle_stream_response.test.ts
@@ -0,0 +1,98 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { handleStreamResponse } from './handle_stream_response';
+
+jest.mock('@kbn/ml-response-stream/server', () => ({
+  streamFactory: jest.fn().mockReturnValue({
+    end: jest.fn(),
+    push: jest.fn(),
+    responseWithHeaders: jest.fn(),
+  }),
+}));
+
+describe('handleStreamResponse', () => {
+  const logger = {
+    error: jest.fn(),
+  };
+  const response = {
+    ok: jest.fn(() => ({ status: 'ok' })),
+  };
+  let request: {
+    events: { aborted$: { subscribe: jest.Mock }; completed$: { subscribe: jest.Mock } };
+    headers: {};
+  };
+  let stream: { getReader: jest.Mock };
+
+  beforeEach(() => {
+    logger.error.mockClear();
+    response.ok.mockClear();
+    request = {
+      events: {
+        aborted$: {
+          subscribe: jest.fn(),
+        },
+        completed$: {
+          subscribe: jest.fn(),
+        },
+      },
+      headers: {},
+    };
+    stream = {
+      getReader: jest.fn(),
+    };
+  });
+
+  it('should handle stream correctly', async () => {
+    expect.assertions(3);
+    const data = ['Hello', 'World'];
+    const reader = {
+      read: jest
+        .fn()
+        .mockResolvedValueOnce({ done: false, value: new TextEncoder().encode(data[0]) })
+        .mockResolvedValueOnce({ done: false, value: new TextEncoder().encode(data[1]) })
+        .mockResolvedValueOnce({ done: true }),
+    };
+
+    stream.getReader.mockReturnValue(reader);
+
+    // @ts-ignore
+    await handleStreamResponse({ stream, request, response, logger, maxTimeoutMs: 0 });
+    await new Promise((r) => setTimeout(r, 100));
+    expect(reader.read).toHaveBeenCalledTimes(3);
+    expect(response.ok).toHaveBeenCalled();
+    expect(logger.error).not.toHaveBeenCalled();
+  });
+
+  it('should handle decoding errors', async () => {
+    expect.assertions(3);
+    // @ts-ignore
+    jest.spyOn(global, 'TextDecoder').mockImplementation(() => ({
+      decode: jest.fn(() => {
+        throw new Error('Test error');
+      }),
+    }));
+    const reader = {
+      read: jest
+        .fn()
+        .mockResolvedValueOnce({ done: false, value: null })
+        .mockResolvedValueOnce({ done: true }),
+    };
+
+    stream.getReader.mockReturnValue(reader);
+
+    // @ts-ignore
+    await handleStreamResponse({ stream, request, response, logger, maxTimeoutMs: 0 });
+    await new Promise((r) => setTimeout(r, 100));
+
+    expect(reader.read).toHaveBeenCalledTimes(2);
+    expect(logger.error).toHaveBeenCalled();
+    expect(response.ok).toHaveBeenCalled();
+
+    jest.restoreAllMocks();
+  });
+});
diff --git a/x-pack/plugins/search_playground/server/utils/handle_stream_response.ts b/x-pack/plugins/search_playground/server/utils/handle_stream_response.ts
new file mode 100644
index 00000000000000..2e2ed7c9e765b5
--- /dev/null
+++ b/x-pack/plugins/search_playground/server/utils/handle_stream_response.ts
@@ -0,0 +1,68 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { streamFactory } from '@kbn/ml-response-stream/server';
+import type { KibanaRequest, KibanaResponseFactory, Logger } from '@kbn/core/server';
+
+const timeout = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));
+
+export const handleStreamResponse = async ({
+  stream,
+  request,
+  response,
+  logger,
+  maxTimeoutMs = 250,
+}: {
+  stream: ReadableStream;
+  logger: Logger;
+  request: KibanaRequest;
+  response: KibanaResponseFactory;
+  maxTimeoutMs?: number;
+}) => {
+  const { end, push, responseWithHeaders } = streamFactory(request.headers, logger);
+  const reader = (stream as ReadableStream).getReader();
+  const textDecoder = new TextDecoder();
+
+  let handleStopRequest = false;
+  request.events.aborted$.subscribe(() => {
+    handleStopRequest = true;
+  });
+  request.events.completed$.subscribe(() => {
+    handleStopRequest = true;
+  });
+
+  async function pushStreamUpdate() {
+    try {
+      const { done, value }: { done: boolean; value?: Uint8Array } = await reader.read();
+
+      if (done || handleStopRequest) {
+        end();
+        return;
+      }
+
+      let decodedValue;
+      try {
+        decodedValue = textDecoder.decode(value);
+      } catch (e) {
+        decodedValue = '';
+        logger.error(`Could not decode the data: ${e.toString()}`);
+      }
+
+      push(decodedValue);
+
+      await timeout(Math.floor(Math.random() * maxTimeoutMs));
+
+      void pushStreamUpdate();
+    } catch (e) {
+      logger.error(`There was an error: ${e.toString()}`);
+    }
+  }
+
+  void pushStreamUpdate();
+
+  return response.ok(responseWithHeaders);
+};
diff --git a/x-pack/plugins/searchprofiler/kibana.jsonc b/x-pack/plugins/searchprofiler/kibana.jsonc
index cce2712681b310..3c2b0909cef2b4 100644
--- a/x-pack/plugins/searchprofiler/kibana.jsonc
+++ b/x-pack/plugins/searchprofiler/kibana.jsonc
@@ -17,8 +17,7 @@
       "share"
     ],
     "requiredBundles": [
-      "esUiShared",
-      "kibanaReact"
+      "esUiShared"
     ]
   }
 }
diff --git a/x-pack/plugins/searchprofiler/public/application/index.tsx b/x-pack/plugins/searchprofiler/public/application/index.tsx
index 644a2764e85c78..273f65dcb5380c 100644
--- a/x-pack/plugins/searchprofiler/public/application/index.tsx
+++ b/x-pack/plugins/searchprofiler/public/application/index.tsx
@@ -7,45 +7,41 @@
 
 import React from 'react';
 import { render, unmountComponentAtNode } from 'react-dom';
-import { Observable } from 'rxjs';
-import { HttpStart as Http, ToastsSetup, CoreTheme } from '@kbn/core/public';
+import { HttpStart as Http, ToastsSetup } from '@kbn/core/public';
 import { RouteComponentProps } from 'react-router-dom';
 
 import { LicenseStatus } from '../../common';
-import { KibanaThemeProvider } from '../shared_imports';
+import { KibanaRenderContextProvider } from '../shared_imports';
 import { App } from './app';
 import { AppContextProvider } from './contexts/app_context';
 import { ProfileContextProvider } from './contexts/profiler_context';
+import { SearchProfilerStartServices } from '../types';
 
 interface AppDependencies {
   el: HTMLElement;
   http: Http;
-  I18nContext: any;
   notifications: ToastsSetup;
   initialLicenseStatus: LicenseStatus;
-  theme$: Observable<CoreTheme>;
   location: RouteComponentProps['location'];
+  startServices: SearchProfilerStartServices;
 }
 
 export const renderApp = ({
   el,
   http,
-  I18nContext,
   notifications,
   initialLicenseStatus,
-  theme$,
   location,
+  startServices,
 }: AppDependencies) => {
   render(
-    <I18nContext>
-      <KibanaThemeProvider theme$={theme$}>
-        <AppContextProvider args={{ initialLicenseStatus, notifications, http, location }}>
-          <ProfileContextProvider>
-            <App />
-          </ProfileContextProvider>
-        </AppContextProvider>
-      </KibanaThemeProvider>
-    </I18nContext>,
+    <KibanaRenderContextProvider {...startServices}>
+      <AppContextProvider args={{ initialLicenseStatus, notifications, http, location }}>
+        <ProfileContextProvider>
+          <App />
+        </ProfileContextProvider>
+      </AppContextProvider>
+    </KibanaRenderContextProvider>,
     el
   );
 
diff --git a/x-pack/plugins/searchprofiler/public/plugin.ts b/x-pack/plugins/searchprofiler/public/plugin.ts
index a039de9fa0f66a..4d8cecaf31381f 100644
--- a/x-pack/plugins/searchprofiler/public/plugin.ts
+++ b/x-pack/plugins/searchprofiler/public/plugin.ts
@@ -47,7 +47,9 @@ export class SearchProfilerUIPlugin implements Plugin<void, void, AppPublicPlugi
       enableRouting: false,
       mount: async (params) => {
         const [coreStart] = await getStartServices();
-        const { notifications, i18n: i18nDep } = coreStart;
+        const { notifications, analytics, i18n: i18nStart, theme } = coreStart;
+        const startServices = { analytics, i18n: i18nStart, theme };
+
         const { renderApp } = await import('./application');
 
         const license = await firstValueFrom(licensing.license$);
@@ -57,10 +59,9 @@ export class SearchProfilerUIPlugin implements Plugin<void, void, AppPublicPlugi
           http,
           initialLicenseStatus,
           el: params.element,
-          I18nContext: i18nDep.Context,
           notifications: notifications.toasts,
-          theme$: params.theme$,
           location: params.location,
+          startServices,
         });
       },
     });
diff --git a/x-pack/plugins/searchprofiler/public/shared_imports.ts b/x-pack/plugins/searchprofiler/public/shared_imports.ts
index cdb8bffe65b50a..b1af4bab9e62de 100644
--- a/x-pack/plugins/searchprofiler/public/shared_imports.ts
+++ b/x-pack/plugins/searchprofiler/public/shared_imports.ts
@@ -7,4 +7,4 @@
 
 export { ace } from '@kbn/es-ui-shared-plugin/public';
 
-export { KibanaThemeProvider } from '@kbn/kibana-react-plugin/public';
+export { KibanaRenderContextProvider } from '@kbn/react-kibana-context-render';
diff --git a/x-pack/plugins/searchprofiler/public/types.ts b/x-pack/plugins/searchprofiler/public/types.ts
index 50c72993352ad3..bea00be58bacc7 100644
--- a/x-pack/plugins/searchprofiler/public/types.ts
+++ b/x-pack/plugins/searchprofiler/public/types.ts
@@ -9,6 +9,13 @@ import { HomePublicPluginSetup } from '@kbn/home-plugin/public';
 import { DevToolsSetup } from '@kbn/dev-tools-plugin/public';
 import { SharePluginSetup } from '@kbn/share-plugin/public';
 import { LicensingPluginSetup } from '@kbn/licensing-plugin/public';
+import { AnalyticsServiceStart, I18nStart, ThemeServiceStart } from '@kbn/core/public';
+
+export interface SearchProfilerStartServices {
+  analytics: Pick<AnalyticsServiceStart, 'reportEvent'>;
+  i18n: I18nStart;
+  theme: Pick<ThemeServiceStart, 'theme$'>;
+}
 
 export interface AppPublicPluginDependencies {
   licensing: LicensingPluginSetup;
diff --git a/x-pack/plugins/searchprofiler/tsconfig.json b/x-pack/plugins/searchprofiler/tsconfig.json
index b5aff5d6214fc4..b99b0962e39fca 100644
--- a/x-pack/plugins/searchprofiler/tsconfig.json
+++ b/x-pack/plugins/searchprofiler/tsconfig.json
@@ -16,13 +16,13 @@
     "@kbn/licensing-plugin",
     "@kbn/i18n",
     "@kbn/share-plugin",
-    "@kbn/kibana-react-plugin",
     "@kbn/utility-types",
     "@kbn/expect",
     "@kbn/test-jest-helpers",
     "@kbn/i18n-react",
     "@kbn/ace",
     "@kbn/config-schema",
+    "@kbn/react-kibana-context-render",
   ],
   "exclude": [
     "target/**/*",
diff --git a/x-pack/plugins/security/common/index.ts b/x-pack/plugins/security/common/index.ts
index de3e6e8cac0ca7..1a767f778fb7af 100644
--- a/x-pack/plugins/security/common/index.ts
+++ b/x-pack/plugins/security/common/index.ts
@@ -31,6 +31,7 @@ export type {
   RoleIndexPrivilege,
   RoleKibanaPrivilege,
   RoleRemoteIndexPrivilege,
+  RoleRemoteClusterPrivilege,
   FeaturesPrivileges,
   LoginLayout,
   SecurityLicenseFeatures,
diff --git a/x-pack/plugins/security/common/licensing/license_service.test.ts b/x-pack/plugins/security/common/licensing/license_service.test.ts
index 8bf9f4a030051a..f1b80db5cba2db 100644
--- a/x-pack/plugins/security/common/licensing/license_service.test.ts
+++ b/x-pack/plugins/security/common/licensing/license_service.test.ts
@@ -26,6 +26,7 @@ describe('license features', function () {
       allowRoleDocumentLevelSecurity: false,
       allowRoleFieldLevelSecurity: false,
       allowRoleRemoteIndexPrivileges: false,
+      allowRemoteClusterPrivileges: false,
       layout: 'error-es-unavailable',
       allowRbac: false,
       allowSubFeaturePrivileges: false,
@@ -50,6 +51,7 @@ describe('license features', function () {
       allowRoleDocumentLevelSecurity: false,
       allowRoleFieldLevelSecurity: false,
       allowRoleRemoteIndexPrivileges: false,
+      allowRemoteClusterPrivileges: false,
       layout: 'error-xpack-unavailable',
       allowRbac: false,
       allowSubFeaturePrivileges: false,
@@ -78,6 +80,7 @@ describe('license features', function () {
             "allowAuditLogging": false,
             "allowLogin": false,
             "allowRbac": false,
+            "allowRemoteClusterPrivileges": false,
             "allowRoleDocumentLevelSecurity": false,
             "allowRoleFieldLevelSecurity": false,
             "allowRoleRemoteIndexPrivileges": false,
@@ -101,6 +104,7 @@ describe('license features', function () {
             "allowAuditLogging": true,
             "allowLogin": true,
             "allowRbac": true,
+            "allowRemoteClusterPrivileges": true,
             "allowRoleDocumentLevelSecurity": true,
             "allowRoleFieldLevelSecurity": true,
             "allowRoleRemoteIndexPrivileges": true,
@@ -137,6 +141,7 @@ describe('license features', function () {
       allowRoleDocumentLevelSecurity: false,
       allowRoleFieldLevelSecurity: false,
       allowRoleRemoteIndexPrivileges: false,
+      allowRemoteClusterPrivileges: false,
       allowRbac: true,
       allowSubFeaturePrivileges: false,
       allowAuditLogging: false,
@@ -164,6 +169,7 @@ describe('license features', function () {
       allowRoleDocumentLevelSecurity: false,
       allowRoleFieldLevelSecurity: false,
       allowRoleRemoteIndexPrivileges: false,
+      allowRemoteClusterPrivileges: false,
       allowRbac: false,
       allowSubFeaturePrivileges: false,
       allowAuditLogging: false,
@@ -190,6 +196,7 @@ describe('license features', function () {
       allowRoleDocumentLevelSecurity: false,
       allowRoleFieldLevelSecurity: false,
       allowRoleRemoteIndexPrivileges: false,
+      allowRemoteClusterPrivileges: false,
       allowRbac: true,
       allowSubFeaturePrivileges: false,
       allowAuditLogging: false,
@@ -216,6 +223,7 @@ describe('license features', function () {
       allowRoleDocumentLevelSecurity: false,
       allowRoleFieldLevelSecurity: false,
       allowRoleRemoteIndexPrivileges: false,
+      allowRemoteClusterPrivileges: false,
       allowRbac: true,
       allowSubFeaturePrivileges: true,
       allowAuditLogging: true,
@@ -242,6 +250,7 @@ describe('license features', function () {
       allowRoleDocumentLevelSecurity: true,
       allowRoleFieldLevelSecurity: true,
       allowRoleRemoteIndexPrivileges: true,
+      allowRemoteClusterPrivileges: true,
       allowRbac: true,
       allowSubFeaturePrivileges: true,
       allowAuditLogging: true,
diff --git a/x-pack/plugins/security/common/licensing/license_service.ts b/x-pack/plugins/security/common/licensing/license_service.ts
index 70b84e1712e08b..3066d32a72695b 100644
--- a/x-pack/plugins/security/common/licensing/license_service.ts
+++ b/x-pack/plugins/security/common/licensing/license_service.ts
@@ -77,6 +77,7 @@ export class SecurityLicenseService {
         allowRoleDocumentLevelSecurity: false,
         allowRoleFieldLevelSecurity: false,
         allowRoleRemoteIndexPrivileges: false,
+        allowRemoteClusterPrivileges: false,
         allowRbac: false,
         allowSubFeaturePrivileges: false,
         allowUserProfileCollaboration: false,
@@ -98,6 +99,7 @@ export class SecurityLicenseService {
         allowRoleDocumentLevelSecurity: false,
         allowRoleFieldLevelSecurity: false,
         allowRoleRemoteIndexPrivileges: false,
+        allowRemoteClusterPrivileges: false,
         allowRbac: false,
         allowSubFeaturePrivileges: false,
         allowUserProfileCollaboration: false,
@@ -119,6 +121,7 @@ export class SecurityLicenseService {
       allowRoleDocumentLevelSecurity: isLicensePlatinumOrBetter,
       allowRoleFieldLevelSecurity: isLicensePlatinumOrBetter,
       allowRoleRemoteIndexPrivileges: isLicensePlatinumOrBetter,
+      allowRemoteClusterPrivileges: isLicensePlatinumOrBetter,
       allowRbac: true,
       allowUserProfileCollaboration: isLicenseStandardOrBetter,
     };
diff --git a/x-pack/plugins/security/common/model/builtin_es_privileges.ts b/x-pack/plugins/security/common/model/builtin_es_privileges.ts
index b6b5791a4477d4..c2b6801e529617 100644
--- a/x-pack/plugins/security/common/model/builtin_es_privileges.ts
+++ b/x-pack/plugins/security/common/model/builtin_es_privileges.ts
@@ -8,4 +8,5 @@
 export interface BuiltinESPrivileges {
   cluster: string[];
   index: string[];
+  remote_cluster: string[];
 }
diff --git a/x-pack/plugins/security/public/management/role_mappings/role_mappings_api_client.ts b/x-pack/plugins/security/public/management/role_mappings/role_mappings_api_client.ts
index bab0222222dec5..c2b1f08d903194 100644
--- a/x-pack/plugins/security/public/management/role_mappings/role_mappings_api_client.ts
+++ b/x-pack/plugins/security/public/management/role_mappings/role_mappings_api_client.ts
@@ -15,6 +15,7 @@ export interface CheckRoleMappingFeaturesResponse {
   canUseStoredScripts: boolean;
   hasCompatibleRealms: boolean;
   canUseRemoteIndices: boolean;
+  canUseRemoteClusters: boolean;
 }
 
 type DeleteRoleMappingsResponse = Array<{
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/edit_role_page.tsx b/x-pack/plugins/security/public/management/roles/edit_role/edit_role_page.tsx
index 745cb2d68ab07e..56fb561443e824 100644
--- a/x-pack/plugins/security/public/management/roles/edit_role/edit_role_page.tsx
+++ b/x-pack/plugins/security/public/management/roles/edit_role/edit_role_page.tsx
@@ -211,7 +211,7 @@ function useRole(
       ? rolesAPIClient.getRole(roleName)
       : Promise.resolve({
           name: '',
-          elasticsearch: { cluster: [], indices: [], run_as: [] },
+          elasticsearch: { cluster: [], indices: [], run_as: [], remote_cluster: [] },
           kibana: [],
           _unrecognized_applications: [],
         } as Role);
@@ -529,6 +529,9 @@ export const EditRolePage: FunctionComponent<Props> = ({
           canUseRemoteIndices={
             buildFlavor === 'traditional' && featureCheckState.value?.canUseRemoteIndices
           }
+          canUseRemoteClusters={
+            buildFlavor === 'traditional' && featureCheckState.value?.canUseRemoteClusters
+          }
           isDarkMode={isDarkMode}
           buildFlavor={buildFlavor}
         />
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/__snapshots__/elasticsearch_privileges.test.tsx.snap b/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/__snapshots__/elasticsearch_privileges.test.tsx.snap
index 6bd0c97b5e8ac8..7732ac20b4ee95 100644
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/__snapshots__/elasticsearch_privileges.test.tsx.snap
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/__snapshots__/elasticsearch_privileges.test.tsx.snap
@@ -59,6 +59,7 @@ exports[`it renders correctly in serverless mode 1`] = `
             "elasticsearch": Object {
               "cluster": Array [],
               "indices": Array [],
+              "remote_cluster": Array [],
               "run_as": Array [],
             },
             "kibana": Array [],
@@ -141,6 +142,7 @@ exports[`it renders correctly in serverless mode 1`] = `
         "elasticsearch": Object {
           "cluster": Array [],
           "indices": Array [],
+          "remote_cluster": Array [],
           "run_as": Array [],
         },
         "kibana": Array [],
@@ -215,6 +217,7 @@ exports[`it renders without crashing 1`] = `
             "elasticsearch": Object {
               "cluster": Array [],
               "indices": Array [],
+              "remote_cluster": Array [],
               "run_as": Array [],
             },
             "kibana": Array [],
@@ -346,6 +349,7 @@ exports[`it renders without crashing 1`] = `
         "elasticsearch": Object {
           "cluster": Array [],
           "indices": Array [],
+          "remote_cluster": Array [],
           "run_as": Array [],
         },
         "kibana": Array [],
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/__snapshots__/index_privileges.test.tsx.snap b/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/__snapshots__/index_privileges.test.tsx.snap
index d99dac15df58f4..c3df729a7e3ee1 100644
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/__snapshots__/index_privileges.test.tsx.snap
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/__snapshots__/index_privileges.test.tsx.snap
@@ -36,6 +36,7 @@ exports[`it renders without crashing 1`] = `
       "elasticsearch": Object {
         "cluster": Array [],
         "indices": Array [],
+        "remote_cluster": Array [],
         "run_as": Array [],
       },
       "kibana": Array [],
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/__snapshots__/remote_cluster_privileges.test.tsx.snap b/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/__snapshots__/remote_cluster_privileges.test.tsx.snap
new file mode 100644
index 00000000000000..e0939f7f55e024
--- /dev/null
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/__snapshots__/remote_cluster_privileges.test.tsx.snap
@@ -0,0 +1,52 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`it renders without crashing 1`] = `
+<RemoteClusterPrivileges
+  availableRemoteClusterPrivileges={
+    Array [
+      "monitor_enrich",
+    ]
+  }
+  editable={true}
+  license={
+    Object {
+      "features$": Observable {
+        "_subscribe": [Function],
+      },
+      "getFeatures": [MockFunction],
+      "getUnavailableReason": [MockFunction],
+      "hasAtLeast": [MockFunction],
+      "isEnabled": [MockFunction],
+      "isLicenseAvailable": [MockFunction],
+    }
+  }
+  onChange={[MockFunction]}
+  role={
+    Object {
+      "elasticsearch": Object {
+        "cluster": Array [],
+        "indices": Array [],
+        "remote_cluster": Array [
+          Object {
+            "clusters": Array [
+              "cluster1",
+              "cluster2",
+            ],
+            "privileges": Array [
+              "monitor_enrich",
+            ],
+          },
+        ],
+        "run_as": Array [],
+      },
+      "kibana": Array [],
+      "name": "",
+    }
+  }
+  validator={
+    RoleValidator {
+      "shouldValidate": undefined,
+    }
+  }
+/>
+`;
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/__snapshots__/remote_cluster_privileges_form.test.tsx.snap b/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/__snapshots__/remote_cluster_privileges_form.test.tsx.snap
new file mode 100644
index 00000000000000..6f48ce3b977aa3
--- /dev/null
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/__snapshots__/remote_cluster_privileges_form.test.tsx.snap
@@ -0,0 +1,116 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`it renders without crashing 1`] = `
+<Fragment>
+  <EuiSpacer
+    size="m"
+  />
+  <EuiFlexGroup
+    alignItems="center"
+    className="remote-cluster-privilege-form"
+    responsive={false}
+  >
+    <EuiFlexItem>
+      <EuiPanel
+        color="subdued"
+      >
+        <EuiFlexGroup>
+          <EuiFlexItem>
+            <EuiFormRow
+              describedByIds={Array []}
+              display="row"
+              fullWidth={true}
+              hasChildLabel={true}
+              hasEmptyLabelSpace={false}
+              isInvalid={false}
+              label={
+                <FormattedMessage
+                  defaultMessage="Remote clusters"
+                  id="xpack.security.management.editRole.remoteClusterPrivilegeForm.clustersFormRowLabel"
+                  values={Object {}}
+                />
+              }
+              labelType="label"
+            >
+              <RemoteClusterComboBox
+                data-test-subj="remoteClusterClustersInput0"
+                fullWidth={true}
+                isDisabled={false}
+                onChange={[Function]}
+                onCreateOption={[Function]}
+                placeholder="Add a remote cluster…"
+                remoteClusters={Array []}
+                selectedOptions={
+                  Array [
+                    Object {
+                      "label": "cluster1",
+                    },
+                  ]
+                }
+                type="remote_cluster"
+              />
+            </EuiFormRow>
+          </EuiFlexItem>
+          <EuiFlexItem>
+            <EuiFormRow
+              describedByIds={Array []}
+              display="row"
+              fullWidth={true}
+              hasChildLabel={true}
+              hasEmptyLabelSpace={false}
+              isInvalid={false}
+              label={
+                <FormattedMessage
+                  defaultMessage="Privileges"
+                  id="xpack.security.management.editRole.remoteClusterPrivilegeForm.privilegesFormRowLabel"
+                  values={Object {}}
+                />
+              }
+              labelType="label"
+            >
+              <EuiComboBox
+                async={false}
+                compressed={false}
+                data-test-subj="remoteClusterPrivilegesInput0"
+                fullWidth={true}
+                isClearable={true}
+                isDisabled={false}
+                onChange={[Function]}
+                optionMatcher={[Function]}
+                options={
+                  Array [
+                    Object {
+                      "label": "monitor_enrich",
+                    },
+                  ]
+                }
+                placeholder="Add an action…"
+                selectedOptions={
+                  Array [
+                    Object {
+                      "label": "monitor_enrich",
+                    },
+                  ]
+                }
+                singleSelection={false}
+                sortMatchesBy="none"
+              />
+            </EuiFormRow>
+          </EuiFlexItem>
+        </EuiFlexGroup>
+      </EuiPanel>
+    </EuiFlexItem>
+    <EuiFlexItem
+      grow={false}
+    >
+      <EuiButtonIcon
+        aria-label="Delete remote cluster privilege"
+        color="danger"
+        data-test-subj="deleteRemoteClusterPrivilegesButton0"
+        iconType="trash"
+        onClick={[MockFunction]}
+      />
+    </EuiFlexItem>
+  </EuiFlexGroup>
+</Fragment>
+`;
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/__snapshots__/remote_clusters_combo_box.test.tsx.snap b/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/__snapshots__/remote_clusters_combo_box.test.tsx.snap
new file mode 100644
index 00000000000000..158d4882f457cf
--- /dev/null
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/__snapshots__/remote_clusters_combo_box.test.tsx.snap
@@ -0,0 +1,146 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`it renders without crashing 1`] = `
+<EuiComboBox
+  async={false}
+  compressed={false}
+  dat-test-subj="remoteClusterClustersInput0"
+  fullWidth={false}
+  intl={
+    Object {
+      "defaultFormats": Object {},
+      "defaultLocale": "en",
+      "formatDate": [Function],
+      "formatHTMLMessage": [Function],
+      "formatMessage": [Function],
+      "formatNumber": [Function],
+      "formatPlural": [Function],
+      "formatRelative": [Function],
+      "formatTime": [Function],
+      "formats": Object {
+        "date": Object {
+          "full": Object {
+            "day": "numeric",
+            "month": "long",
+            "weekday": "long",
+            "year": "numeric",
+          },
+          "long": Object {
+            "day": "numeric",
+            "month": "long",
+            "year": "numeric",
+          },
+          "medium": Object {
+            "day": "numeric",
+            "month": "short",
+            "year": "numeric",
+          },
+          "short": Object {
+            "day": "numeric",
+            "month": "numeric",
+            "year": "2-digit",
+          },
+        },
+        "number": Object {
+          "currency": Object {
+            "style": "currency",
+          },
+          "percent": Object {
+            "style": "percent",
+          },
+        },
+        "relative": Object {
+          "days": Object {
+            "units": "day",
+          },
+          "hours": Object {
+            "units": "hour",
+          },
+          "minutes": Object {
+            "units": "minute",
+          },
+          "months": Object {
+            "units": "month",
+          },
+          "seconds": Object {
+            "units": "second",
+          },
+          "years": Object {
+            "units": "year",
+          },
+        },
+        "time": Object {
+          "full": Object {
+            "hour": "numeric",
+            "minute": "numeric",
+            "second": "numeric",
+            "timeZoneName": "short",
+          },
+          "long": Object {
+            "hour": "numeric",
+            "minute": "numeric",
+            "second": "numeric",
+            "timeZoneName": "short",
+          },
+          "medium": Object {
+            "hour": "numeric",
+            "minute": "numeric",
+            "second": "numeric",
+          },
+          "short": Object {
+            "hour": "numeric",
+            "minute": "numeric",
+          },
+        },
+      },
+      "formatters": Object {
+        "getDateTimeFormat": [Function],
+        "getMessageFormat": [Function],
+        "getNumberFormat": [Function],
+        "getPluralFormat": [Function],
+        "getRelativeFormat": [Function],
+      },
+      "locale": "en",
+      "messages": Object {},
+      "now": [Function],
+      "onError": [Function],
+      "textComponent": Symbol(react.fragment),
+      "timeZone": null,
+    }
+  }
+  isClearable={true}
+  optionMatcher={[Function]}
+  options={
+    Array [
+      Object {
+        "label": "test2",
+      },
+      Object {
+        "label": "test3",
+      },
+      Object {
+        "isGroupLabelOption": true,
+        "label": "Incompatible clusters",
+      },
+      Object {
+        "append": <EuiIconTip
+          color="inherit"
+          content={
+            <FormattedMessage
+              defaultMessage="This cluster is configured with the certificate based security model and does not support remote cluster privileges. Connect this cluster with the API key based security model instead to use remote cluster privileges."
+              id="xpack.security.management.editRole.remoteClusterPrivilegeForm.remoteClusterSecurityModelWarning"
+              values={Object {}}
+            />
+          }
+          type="warning"
+        />,
+        "disabled": true,
+        "label": "test1",
+      },
+    ]
+  }
+  selectedOptions={Array []}
+  singleSelection={false}
+  sortMatchesBy="none"
+/>
+`;
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/cluster_privileges.test.tsx b/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/cluster_privileges.test.tsx
index 81edde34b4d28d..0793083ca21df7 100644
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/cluster_privileges.test.tsx
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/cluster_privileges.test.tsx
@@ -17,6 +17,7 @@ test('it renders without crashing', () => {
   const role: Role = {
     name: '',
     elasticsearch: {
+      remote_cluster: [],
       cluster: [],
       indices: [],
       run_as: [],
@@ -39,6 +40,7 @@ test('it renders fields as disabled when not editable', () => {
     name: '',
     elasticsearch: {
       cluster: [],
+      remote_cluster: [],
       indices: [],
       run_as: [],
     },
@@ -61,6 +63,7 @@ test('it allows for custom cluster privileges', () => {
     name: '',
     elasticsearch: {
       cluster: ['existing-custom', 'monitor'],
+      remote_cluster: [],
       indices: [],
       run_as: [],
     },
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/elasticsearch_privileges.test.tsx b/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/elasticsearch_privileges.test.tsx
index 3850e55f9211ce..ef914c58522c03 100644
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/elasticsearch_privileges.test.tsx
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/elasticsearch_privileges.test.tsx
@@ -30,6 +30,7 @@ function getProps() {
       name: '',
       elasticsearch: {
         cluster: [],
+        remote_cluster: [],
         indices: [],
         run_as: [],
       },
@@ -43,6 +44,7 @@ function getProps() {
     builtinESPrivileges: {
       cluster: ['all', 'manage', 'monitor'],
       index: ['all', 'read', 'write', 'index'],
+      remote_cluster: [],
     },
     indicesAPIClient: indicesAPIClientMock.create(),
     docLinks,
@@ -75,13 +77,26 @@ test('it renders remote index privileges section when `canUseRemoteIndices` is e
   expect(wrapper.find('IndexPrivileges[indexType="remote_indices"]')).toHaveLength(1);
 });
 
+test('it does not render remote cluster privileges section by default', () => {
+  const wrapper = shallowWithIntl(<ElasticsearchPrivileges {...getProps()} />);
+  expect(wrapper.find('RemoteClusterPrivileges')).toHaveLength(0);
+});
+
+test('it renders remote index privileges section when `canUseRemoteClusters` is enabled', () => {
+  const wrapper = shallowWithIntl(<ElasticsearchPrivileges {...getProps()} canUseRemoteClusters />);
+  expect(wrapper.find('RemoteClusterPrivileges')).toHaveLength(1);
+});
+
 test('it renders fields as disabled when not editable', () => {
-  const wrapper = shallowWithIntl(<ElasticsearchPrivileges {...getProps()} editable={false} />);
+  const wrapper = shallowWithIntl(
+    <ElasticsearchPrivileges {...getProps()} canUseRemoteClusters editable={false} />
+  );
   expect(wrapper.find('EuiComboBox').prop('isDisabled')).toBe(true);
   expect(wrapper.find('ClusterPrivileges').prop('editable')).toBe(false);
   expect(
     wrapper.find('IndexPrivileges').everyWhere((component) => component.prop('editable'))
   ).toBe(false);
+  expect(wrapper.find('RemoteClusterPrivileges').prop('editable')).toBe(false);
 });
 
 test('it renders correctly in serverless mode', () => {
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/elasticsearch_privileges.tsx b/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/elasticsearch_privileges.tsx
index 0aa4900e8715b6..1ff2ede4c575c2 100644
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/elasticsearch_privileges.tsx
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/elasticsearch_privileges.tsx
@@ -25,6 +25,7 @@ import type { PublicMethodsOf } from '@kbn/utility-types';
 
 import { ClusterPrivileges } from './cluster_privileges';
 import { IndexPrivileges } from './index_privileges';
+import { RemoteClusterPrivileges } from './remote_cluster_privileges';
 import type { BuiltinESPrivileges, Role, SecurityLicense } from '../../../../../../common';
 import type { IndicesAPIClient } from '../../../indices_api_client';
 import { CollapsiblePanel } from '../../collapsible_panel';
@@ -43,6 +44,7 @@ interface Props {
   indexPatterns: string[];
   remoteClusters?: Cluster[];
   canUseRemoteIndices?: boolean;
+  canUseRemoteClusters?: boolean;
   isDarkMode?: boolean;
   buildFlavor: BuildFlavor;
 }
@@ -69,6 +71,7 @@ export class ElasticsearchPrivileges extends Component<Props, {}> {
       license,
       builtinESPrivileges,
       canUseRemoteIndices,
+      canUseRemoteClusters,
       buildFlavor,
     } = this.props;
 
@@ -219,6 +222,40 @@ export class ElasticsearchPrivileges extends Component<Props, {}> {
             />
           </>
         )}
+        {buildFlavor === 'traditional' && canUseRemoteClusters && (
+          <>
+            <EuiSpacer />
+            <EuiSpacer />
+
+            <EuiTitle size="xs">
+              <h3>
+                <FormattedMessage
+                  id="xpack.security.management.editRole.elasticSearchPrivileges.remoteClusterPrivilegesTitle"
+                  defaultMessage="Remote cluster privileges"
+                />
+              </h3>
+            </EuiTitle>
+            <EuiSpacer size="s" />
+            <EuiText size="s" color="subdued">
+              <p>
+                <FormattedMessage
+                  id="xpack.security.management.editRole.elasticSearchPrivileges.controlAccessToRemoteClusterDataDescription"
+                  defaultMessage="Control access to the data in remote clusters. "
+                />
+                {this.learnMore(docLinks.links.security.clusterPrivileges)}
+              </p>
+            </EuiText>
+            <RemoteClusterPrivileges
+              remoteClusters={remoteClusters}
+              role={role}
+              validator={validator}
+              license={license}
+              onChange={onChange}
+              availableRemoteClusterPrivileges={builtinESPrivileges.remote_cluster ?? []}
+              editable={editable}
+            />
+          </>
+        )}
       </Fragment>
     );
   };
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/index_privilege_form.test.tsx b/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/index_privilege_form.test.tsx
index fa1bbe2f8c447e..dc7ebaf3b30698 100644
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/index_privilege_form.test.tsx
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/index_privilege_form.test.tsx
@@ -107,70 +107,6 @@ test('should not render clusters field for local indices', () => {
   expect(wrapper.find('[data-test-subj="clustersInput0"]')).toHaveLength(0);
 });
 
-test('should render clusters field for remote indices', () => {
-  const wrapper = shallowWithIntl(
-    <IndexPrivilegeForm
-      indexType="remote_indices"
-      indexPrivilege={{
-        clusters: [],
-        names: [],
-        privileges: [],
-        query: '',
-        field_security: {
-          grant: [],
-        },
-      }}
-      remoteClusters={[
-        {
-          name: 'test1',
-          mode: 'proxy',
-          isConnected: false,
-          initialConnectTimeout: '30s',
-          skipUnavailable: false,
-          proxyAddress: 'localhost:9400',
-          proxySocketConnections: 18,
-          connectedSocketsCount: 0,
-          serverName: 'localhost',
-          securityModel: 'certificate',
-        },
-        {
-          name: 'test2',
-          mode: 'proxy',
-          isConnected: false,
-          initialConnectTimeout: '30s',
-          skipUnavailable: false,
-          proxyAddress: 'localhost:9400',
-          proxySocketConnections: 18,
-          connectedSocketsCount: 0,
-          serverName: 'localhost',
-          securityModel: 'api_key',
-        },
-      ]}
-      formIndex={0}
-      indexPatterns={[]}
-      indicesAPIClient={indicesAPIClientMock.create()}
-      availableIndexPrivileges={['all', 'read', 'write', 'index']}
-      isRoleReadOnly={false}
-      allowDocumentLevelSecurity
-      allowFieldLevelSecurity
-      validator={new RoleValidator()}
-      onChange={jest.fn()}
-      onDelete={jest.fn()}
-    />
-  );
-  const clustersInput = wrapper.find('[data-test-subj="clustersInput0"]');
-  expect(clustersInput).toHaveLength(1);
-  expect(clustersInput.prop('options')).toEqual([
-    { label: 'test2' },
-    { label: expect.anything(), isGroupLabelOption: true },
-    {
-      label: 'test1',
-      disabled: true,
-      append: expect.anything(),
-    },
-  ]);
-});
-
 describe('delete button', () => {
   const props = {
     indexType: 'indices' as const,
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/index_privilege_form.tsx b/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/index_privilege_form.tsx
index 30e1c6423d1ffa..f89195e624f5bb 100644
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/index_privilege_form.tsx
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/index_privilege_form.tsx
@@ -12,7 +12,6 @@ import {
   EuiFlexGroup,
   EuiFlexItem,
   EuiFormRow,
-  EuiIconTip,
   EuiPanel,
   EuiSpacer,
   EuiSwitch,
@@ -27,6 +26,7 @@ import type { monaco } from '@kbn/monaco';
 import type { Cluster } from '@kbn/remote-clusters-plugin/public';
 import type { PublicMethodsOf } from '@kbn/utility-types';
 
+import { RemoteClusterComboBox } from './remote_clusters_combo_box';
 import type { RoleIndexPrivilege, RoleRemoteIndexPrivilege } from '../../../../../../common';
 import type { IndicesAPIClient } from '../../../indices_api_client';
 import type { RoleValidator } from '../../validate_role';
@@ -125,45 +125,6 @@ export class IndexPrivilegeForm extends Component<Props, State> {
   }
 
   private getPrivilegeForm = () => {
-    const remoteClusterOptions: EuiComboBoxOptionOption[] = [];
-    if (this.props.remoteClusters) {
-      const incompatibleOptions: EuiComboBoxOptionOption[] = [];
-      this.props.remoteClusters.forEach((item, i) => {
-        const disabled = item.securityModel !== 'api_key';
-        if (!disabled) {
-          remoteClusterOptions.push({
-            label: item.name,
-          });
-        } else {
-          incompatibleOptions.push({
-            label: item.name,
-            disabled,
-            append: disabled ? (
-              <EuiIconTip
-                type="warning"
-                color="inherit"
-                content={
-                  <FormattedMessage
-                    id="xpack.security.management.editRole.indexPrivilegeForm.remoteIndicesSecurityModelWarning"
-                    defaultMessage="This cluster is configured with the certificate based security model and does not support remote index privileges. Connect this cluster with the API key based security model instead to use remote index privileges."
-                  />
-                }
-              />
-            ) : undefined,
-          });
-        }
-      });
-      if (incompatibleOptions.length) {
-        remoteClusterOptions.push(
-          {
-            label: 'Incompatible clusters',
-            isGroupLabelOption: true,
-          },
-          ...incompatibleOptions
-        );
-      }
-    }
-
     return (
       <>
         <EuiFlexGroup>
@@ -181,9 +142,8 @@ export class IndexPrivilegeForm extends Component<Props, State> {
                   this.props.indexPrivilege as RoleRemoteIndexPrivilege
                 )}
               >
-                <EuiComboBox
+                <RemoteClusterComboBox
                   data-test-subj={`clustersInput${this.props.formIndex}`}
-                  options={remoteClusterOptions}
                   selectedOptions={('clusters' in this.props.indexPrivilege &&
                   this.props.indexPrivilege.clusters
                     ? this.props.indexPrivilege.clusters
@@ -196,6 +156,8 @@ export class IndexPrivilegeForm extends Component<Props, State> {
                     'xpack.security.management.editRole.indexPrivilegeForm.clustersPlaceholder',
                     { defaultMessage: 'Add a remote cluster…' }
                   )}
+                  remoteClusters={this.props.remoteClusters ?? []}
+                  type="remote_indexes"
                   fullWidth
                 />
               </EuiFormRow>
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/index_privileges.test.tsx b/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/index_privileges.test.tsx
index 05ddf9d7d55149..ab125c1ca70760 100644
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/index_privileges.test.tsx
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/index_privileges.test.tsx
@@ -38,6 +38,7 @@ test('it renders without crashing', async () => {
           kibana: [],
           elasticsearch: {
             cluster: [],
+            remote_cluster: [],
             indices: [],
             run_as: [],
           },
@@ -75,6 +76,7 @@ test('it renders an IndexPrivilegeForm for each index privilege on the role', as
           kibana: [],
           elasticsearch: {
             cluster: [],
+            remote_cluster: [],
             indices: [
               {
                 names: ['foo*'],
@@ -129,6 +131,7 @@ test('it renders an IndexPrivilegeForm for each remote index privilege on the ro
           kibana: [],
           elasticsearch: {
             cluster: [],
+            remote_cluster: [],
             indices: [],
             remote_indices: [
               {
@@ -183,6 +186,7 @@ test('it renders fields as disabled when not editable', async () => {
       kibana: [],
       elasticsearch: {
         cluster: [],
+        remote_cluster: [],
         indices: [
           {
             names: ['foo*'],
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/remote_cluster_privileges.test.tsx b/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/remote_cluster_privileges.test.tsx
new file mode 100644
index 00000000000000..5739c0ca2e1d25
--- /dev/null
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/remote_cluster_privileges.test.tsx
@@ -0,0 +1,175 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+
+import { coreMock } from '@kbn/core/public/mocks';
+import { KibanaContextProvider } from '@kbn/kibana-react-plugin/public';
+import type { SecurityLicenseFeatures } from '@kbn/security-plugin-types-common';
+import { mountWithIntl, shallowWithIntl } from '@kbn/test-jest-helpers';
+import '@kbn/code-editor-mock/jest_helper';
+
+import { RemoteClusterPrivileges } from './remote_cluster_privileges';
+import { RemoteClusterPrivilegesForm } from './remote_cluster_privileges_form';
+import { licenseMock } from '../../../../../../common/licensing/index.mock';
+import { RoleValidator } from '../../validate_role';
+
+test('it renders without crashing', async () => {
+  const wrapper = shallowWithIntl(
+    <KibanaContextProvider services={coreMock.createStart()}>
+      <RemoteClusterPrivileges
+        role={{
+          name: '',
+          kibana: [],
+          elasticsearch: {
+            cluster: [],
+            remote_cluster: [
+              {
+                clusters: ['cluster1', 'cluster2'],
+                privileges: ['monitor_enrich'],
+              },
+            ],
+            indices: [],
+            run_as: [],
+          },
+        }}
+        onChange={jest.fn()}
+        editable
+        validator={new RoleValidator()}
+        availableRemoteClusterPrivileges={['monitor_enrich']}
+        license={licenseMock.create()}
+      />
+    </KibanaContextProvider>
+  );
+
+  expect(wrapper.children()).toMatchSnapshot();
+});
+
+test('it renders an RemoteClusterPrivilegesForm for each remote cluster privilege on the role', async () => {
+  const wrapper = mountWithIntl(
+    <KibanaContextProvider services={coreMock.createStart()}>
+      <RemoteClusterPrivileges
+        role={{
+          name: '',
+          kibana: [],
+          elasticsearch: {
+            cluster: [],
+            remote_cluster: [
+              {
+                clusters: ['cluster1', 'cluster2'],
+                privileges: ['monitor_enrich'],
+              },
+              {
+                clusters: ['cluster3', 'cluster4'],
+                privileges: ['monitor_enrich'],
+              },
+              {
+                clusters: ['cluster5', 'cluster6'],
+                privileges: ['monitor_enrich', 'custom-privilege'],
+              },
+            ],
+            indices: [],
+            run_as: [],
+          },
+        }}
+        onChange={jest.fn()}
+        editable
+        validator={new RoleValidator()}
+        availableRemoteClusterPrivileges={['monitor_enrich']}
+        license={licenseMock.create()}
+      />
+    </KibanaContextProvider>
+  );
+
+  expect(wrapper.find(RemoteClusterPrivilegesForm)).toHaveLength(3);
+});
+
+test('it renders fields as disabled when not editable', async () => {
+  const props = {
+    role: {
+      name: '',
+      kibana: [],
+      elasticsearch: {
+        cluster: [],
+        remote_cluster: [
+          {
+            clusters: ['cluster1', 'cluster2'],
+            privileges: ['monitor_enrich'],
+          },
+          {
+            clusters: ['cluster3', 'cluster4'],
+            privileges: ['monitor_enrich'],
+          },
+        ],
+        indices: [],
+        run_as: [],
+      },
+    },
+    onChange: jest.fn(),
+    editable: false,
+    validator: new RoleValidator(),
+    availableRemoteClusterPrivileges: ['monitor_enrich'],
+    license: licenseMock.create(),
+  };
+  const wrapper = mountWithIntl(
+    <KibanaContextProvider services={coreMock.createStart()}>
+      <RemoteClusterPrivileges {...props} />
+    </KibanaContextProvider>
+  );
+
+  expect(
+    wrapper
+      .find('RemoteClusterPrivilegesForm')
+      .everyWhere((component) => component.prop('isRoleReadOnly'))
+  ).toBe(true);
+});
+
+test('it renders fields as disabled when `allowRemoteClusterPrivileges` is set to false', async () => {
+  const license = licenseMock.create();
+
+  license.getFeatures.mockReturnValue({
+    allowRemoteClusterPrivileges: false,
+  } as SecurityLicenseFeatures);
+
+  const props = {
+    role: {
+      name: '',
+      kibana: [],
+      elasticsearch: {
+        cluster: [],
+        remote_cluster: [
+          {
+            clusters: ['cluster1', 'cluster2'],
+            privileges: ['monitor_enrich'],
+          },
+          {
+            clusters: ['cluster3', 'cluster4'],
+            privileges: ['monitor_enrich'],
+          },
+        ],
+        indices: [],
+        run_as: [],
+      },
+    },
+    onChange: jest.fn(),
+    editable: false,
+    validator: new RoleValidator(),
+    availableRemoteClusterPrivileges: ['monitor_enrich'],
+    license: licenseMock.create(),
+  };
+  const wrapper = mountWithIntl(
+    <KibanaContextProvider services={coreMock.createStart()}>
+      <RemoteClusterPrivileges {...props} />
+    </KibanaContextProvider>
+  );
+
+  expect(
+    wrapper
+      .find('RemoteClusterPrivilegesForm')
+      .everyWhere((component) => component.prop('isRoleReadOnly'))
+  ).toBe(true);
+});
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/remote_cluster_privileges.tsx b/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/remote_cluster_privileges.tsx
new file mode 100644
index 00000000000000..7b6096356dd637
--- /dev/null
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/remote_cluster_privileges.tsx
@@ -0,0 +1,147 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiButton, EuiFlexGroup, EuiFlexItem, EuiIconTip, EuiSpacer } from '@elastic/eui';
+import React, { useCallback, useMemo } from 'react';
+
+import { FormattedMessage } from '@kbn/i18n-react';
+import type { Cluster } from '@kbn/remote-clusters-plugin/public';
+
+import { RemoteClusterPrivilegesForm } from './remote_cluster_privileges_form';
+import type { Role, RoleRemoteClusterPrivilege, SecurityLicense } from '../../../../../../common';
+import { isRoleReadOnly } from '../../../../../../common/model';
+import type { RoleValidator } from '../../validate_role';
+
+interface Props {
+  remoteClusters?: Cluster[];
+  role: Role;
+  availableRemoteClusterPrivileges: string[];
+  license: SecurityLicense;
+  onChange: (role: Role) => void;
+  validator: RoleValidator;
+  editable?: boolean;
+}
+
+export const RemoteClusterPrivileges: React.FunctionComponent<Props> = ({
+  remoteClusters,
+  license,
+  availableRemoteClusterPrivileges,
+  role,
+  editable,
+  onChange,
+  validator,
+}) => {
+  const remoteClusterPrivileges = useMemo(() => role.elasticsearch.remote_cluster ?? [], [role]);
+  const remoteClusterPrivilegesDisabled = useMemo(() => {
+    const { allowRemoteClusterPrivileges } = license.getFeatures();
+
+    return !allowRemoteClusterPrivileges;
+  }, [license]);
+
+  const isReadOnly = useMemo(
+    () => !editable || isRoleReadOnly(role) || remoteClusterPrivilegesDisabled,
+    [role, editable, remoteClusterPrivilegesDisabled]
+  );
+
+  const onRoleChange = useCallback(
+    (remoteCluster: RoleRemoteClusterPrivilege[]) => {
+      const roleDraft = {
+        ...role,
+        elasticsearch: {
+          ...role.elasticsearch,
+          remote_cluster: remoteCluster,
+        },
+      };
+
+      onChange(roleDraft);
+    },
+    [onChange, role]
+  );
+
+  const addRemoteClusterPrivilege = useCallback(() => {
+    const newRemoteClusterPrivileges = [
+      ...remoteClusterPrivileges,
+      {
+        clusters: [],
+        privileges: [],
+      },
+    ];
+
+    onRoleChange(newRemoteClusterPrivileges);
+  }, [onRoleChange, remoteClusterPrivileges]);
+
+  const onRemoteClusterPrivilegeChange = useCallback(
+    (privilegeIndex: number) => (updatedPrivilege: RoleRemoteClusterPrivilege) => {
+      const newRemoteClusterPrivileges = [...remoteClusterPrivileges];
+      newRemoteClusterPrivileges[privilegeIndex] = updatedPrivilege;
+
+      onRoleChange(newRemoteClusterPrivileges);
+    },
+    [onRoleChange, remoteClusterPrivileges]
+  );
+
+  const onRemoteClusterPrivilegeDelete = useCallback(
+    (privilegeIndex: number) => () => {
+      const newRemoteClusterPrivileges = [...remoteClusterPrivileges];
+      newRemoteClusterPrivileges.splice(privilegeIndex, 1);
+
+      onRoleChange(newRemoteClusterPrivileges);
+    },
+    [onRoleChange, remoteClusterPrivileges]
+  );
+
+  return (
+    <>
+      {remoteClusterPrivileges.map((remoteClusterPrivilege, i) => (
+        <RemoteClusterPrivilegesForm
+          key={i}
+          isRoleReadOnly={isReadOnly}
+          formIndex={i}
+          validator={validator}
+          availableRemoteClusterPrivileges={availableRemoteClusterPrivileges}
+          remoteClusterPrivilege={remoteClusterPrivilege}
+          remoteClusters={remoteClusters}
+          onChange={onRemoteClusterPrivilegeChange(i)}
+          onDelete={onRemoteClusterPrivilegeDelete(i)}
+        />
+      ))}
+      {editable && (
+        <>
+          <EuiSpacer size="m" />
+          <EuiFlexGroup alignItems="center" gutterSize="s" responsive={false}>
+            <EuiFlexItem grow={false}>
+              <EuiButton
+                iconType="plusInCircle"
+                onClick={addRemoteClusterPrivilege}
+                disabled={remoteClusterPrivilegesDisabled}
+                data-test-subj="addRemoteClusterPrivilegesButton"
+              >
+                <FormattedMessage
+                  id="xpack.security.management.editRole.elasticSearchPrivileges.addRemoteClusterPrivilegesButtonLabel"
+                  defaultMessage="Add remote cluster privilege"
+                />
+              </EuiButton>
+            </EuiFlexItem>
+            {remoteClusterPrivilegesDisabled && (
+              <EuiFlexItem grow={false}>
+                <EuiIconTip
+                  content={
+                    <FormattedMessage
+                      id="xpack.security.management.editRole.elasticSearchPrivileges.remoteClusterPrivilegesLicenseMissing"
+                      defaultMessage="Your license does not allow configuring remote cluster privileges"
+                    />
+                  }
+                  position="right"
+                />
+              </EuiFlexItem>
+            )}
+          </EuiFlexGroup>
+        </>
+      )}
+    </>
+  );
+};
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/remote_cluster_privileges_form.test.tsx b/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/remote_cluster_privileges_form.test.tsx
new file mode 100644
index 00000000000000..c1bbc330a9070d
--- /dev/null
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/remote_cluster_privileges_form.test.tsx
@@ -0,0 +1,182 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiButtonIcon } from '@elastic/eui';
+import type { EuiComboBoxProps } from '@elastic/eui';
+import React from 'react';
+
+import '@kbn/code-editor-mock/jest_helper';
+import { mountWithIntl, shallowWithIntl } from '@kbn/test-jest-helpers';
+
+import { RemoteClusterPrivilegesForm } from './remote_cluster_privileges_form';
+import { RoleValidator } from '../../validate_role';
+
+test('it renders without crashing', () => {
+  const wrapper = shallowWithIntl(
+    <RemoteClusterPrivilegesForm
+      remoteClusterPrivilege={{
+        clusters: ['cluster1'],
+        privileges: ['monitor_enrich'],
+      }}
+      formIndex={0}
+      availableRemoteClusterPrivileges={['monitor_enrich']}
+      isRoleReadOnly={false}
+      validator={new RoleValidator()}
+      onChange={jest.fn()}
+      onDelete={jest.fn()}
+    />
+  );
+  expect(wrapper).toMatchSnapshot();
+});
+
+test('it allows for custom remote cluster input', () => {
+  const onChange = jest.fn();
+  const wrapper = mountWithIntl(
+    <RemoteClusterPrivilegesForm
+      remoteClusterPrivilege={{
+        clusters: ['cluster1'],
+        privileges: ['monitor_enrich'],
+      }}
+      formIndex={0}
+      availableRemoteClusterPrivileges={['monitor_enrich']}
+      isRoleReadOnly={false}
+      validator={new RoleValidator()}
+      onChange={onChange}
+      onDelete={jest.fn()}
+    />
+  );
+
+  const privilegesSelect = wrapper.find(
+    'EuiComboBox[data-test-subj="remoteClusterClustersInput0"]'
+  );
+
+  (privilegesSelect.props() as any).onCreateOption('custom-cluster');
+
+  expect(onChange).toHaveBeenCalledWith(
+    expect.objectContaining({ clusters: ['cluster1', 'custom-cluster'] })
+  );
+});
+
+test('it does not allow for custom remote cluster privileges', () => {
+  const onChange = jest.fn();
+  const wrapper = mountWithIntl(
+    <RemoteClusterPrivilegesForm
+      remoteClusterPrivilege={{
+        clusters: ['cluster1'],
+        privileges: ['monitor_enrich'],
+      }}
+      formIndex={0}
+      availableRemoteClusterPrivileges={['monitor_enrich']}
+      isRoleReadOnly={false}
+      validator={new RoleValidator()}
+      onChange={onChange}
+      onDelete={jest.fn()}
+    />
+  );
+
+  const privilegesSelect = wrapper.find(
+    'EuiComboBox[data-test-subj="remoteClusterPrivilegesInput0"]'
+  );
+
+  expect((privilegesSelect.props() as EuiComboBoxProps<unknown>).onCreateOption).toBe(undefined);
+});
+
+test('it allows for custom remote cluster clusters input', () => {
+  const onChange = jest.fn();
+  const wrapper = mountWithIntl(
+    <RemoteClusterPrivilegesForm
+      remoteClusterPrivilege={{
+        clusters: ['cluster1'],
+        privileges: ['monitor_enrich'],
+      }}
+      formIndex={0}
+      availableRemoteClusterPrivileges={['monitor_enrich']}
+      isRoleReadOnly={false}
+      validator={new RoleValidator()}
+      onChange={onChange}
+      onDelete={jest.fn()}
+    />
+  );
+
+  const clustersSelect = wrapper.find('EuiComboBox[data-test-subj="remoteClusterClustersInput0"]');
+
+  (clustersSelect.props() as any).onCreateOption('cluster2');
+
+  expect(onChange).toHaveBeenCalledWith(
+    expect.objectContaining({ clusters: ['cluster1', 'cluster2'] })
+  );
+});
+
+test('it renders fields as disabled when isRoleReadOnly is true', () => {
+  const onChange = jest.fn();
+  const wrapper = mountWithIntl(
+    <RemoteClusterPrivilegesForm
+      remoteClusterPrivilege={{
+        clusters: ['cluster1'],
+        privileges: ['monitor_enrich'],
+      }}
+      formIndex={0}
+      availableRemoteClusterPrivileges={['monitor_enrich']}
+      isRoleReadOnly={true}
+      validator={new RoleValidator()}
+      onChange={onChange}
+      onDelete={jest.fn()}
+    />
+  );
+
+  const privilegesSelect = wrapper.find(
+    'EuiComboBox[data-test-subj="remoteClusterPrivilegesInput0"]'
+  );
+  expect(privilegesSelect.prop('isDisabled')).toBe(true);
+
+  const clustersSelect = wrapper.find('EuiComboBox[data-test-subj="remoteClusterClustersInput0"]');
+  expect(clustersSelect.prop('isDisabled')).toBe(true);
+});
+
+describe('delete button', () => {
+  const props = {
+    remoteClusterPrivilege: {
+      clusters: ['cluster1'],
+      privileges: ['monitor_enrich'],
+    },
+    formIndex: 0,
+    availableRemoteClusterPrivileges: ['monitor_enrich'],
+    isRoleReadOnly: false,
+    validator: new RoleValidator(),
+    onChange: jest.fn(),
+    onDelete: jest.fn(),
+    intl: {} as any,
+  };
+
+  test('it is hidden when isRoleReadOnly is true', () => {
+    const testProps = {
+      ...props,
+      isRoleReadOnly: true,
+    };
+    const wrapper = mountWithIntl(<RemoteClusterPrivilegesForm {...testProps} />);
+    expect(wrapper.find(EuiButtonIcon)).toHaveLength(0);
+  });
+
+  test('it is shown when isRoleReadOnly is false', () => {
+    const testProps = {
+      ...props,
+      isRoleReadOnly: false,
+    };
+    const wrapper = mountWithIntl(<RemoteClusterPrivilegesForm {...testProps} />);
+    expect(wrapper.find(EuiButtonIcon)).toHaveLength(1);
+  });
+
+  test('it invokes onDelete when clicked', () => {
+    const testProps = {
+      ...props,
+      isRoleReadOnly: false,
+    };
+    const wrapper = mountWithIntl(<RemoteClusterPrivilegesForm {...testProps} />);
+    wrapper.find(EuiButtonIcon).simulate('click');
+    expect(testProps.onDelete).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/remote_cluster_privileges_form.tsx b/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/remote_cluster_privileges_form.tsx
new file mode 100644
index 00000000000000..5e55ebaf1d2812
--- /dev/null
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/remote_cluster_privileges_form.tsx
@@ -0,0 +1,170 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { EuiComboBoxOptionOption } from '@elastic/eui';
+import {
+  EuiButtonIcon,
+  EuiComboBox,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiFormRow,
+  EuiPanel,
+  EuiSpacer,
+} from '@elastic/eui';
+import React, { Fragment, useCallback } from 'react';
+
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n-react';
+import type { Cluster } from '@kbn/remote-clusters-plugin/public';
+
+import { RemoteClusterComboBox } from './remote_clusters_combo_box';
+import type { RoleRemoteClusterPrivilege } from '../../../../../../common';
+import type { RoleValidator } from '../../validate_role';
+
+const fromOption = (option: EuiComboBoxOptionOption) => option.label;
+const toOption = (value: string): EuiComboBoxOptionOption => ({ label: value });
+
+interface Props {
+  formIndex: number;
+  remoteClusterPrivilege: RoleRemoteClusterPrivilege;
+  remoteClusters?: Cluster[];
+  availableRemoteClusterPrivileges: string[];
+  onChange: (remoteClusterPrivilege: RoleRemoteClusterPrivilege) => void;
+  onDelete: () => void;
+  isRoleReadOnly: boolean;
+  validator: RoleValidator;
+}
+
+export const RemoteClusterPrivilegesForm: React.FunctionComponent<Props> = ({
+  isRoleReadOnly,
+  remoteClusters = [],
+  formIndex,
+  validator,
+  remoteClusterPrivilege,
+  availableRemoteClusterPrivileges,
+  onChange,
+  onDelete,
+}) => {
+  const onCreateClusterOption = useCallback(
+    (option: string) => {
+      const nextClusters = (remoteClusterPrivilege.clusters ?? []).concat([option]);
+
+      onChange({
+        ...remoteClusterPrivilege,
+        clusters: nextClusters,
+      });
+    },
+    [remoteClusterPrivilege, onChange]
+  );
+
+  const onClustersChange = useCallback(
+    (nextOptions: EuiComboBoxOptionOption[]) => {
+      const clusters = nextOptions.map(fromOption);
+      onChange({
+        ...remoteClusterPrivilege,
+        clusters,
+      });
+    },
+    [onChange, remoteClusterPrivilege]
+  );
+
+  const onPrivilegeChange = useCallback(
+    (newPrivileges: EuiComboBoxOptionOption[]) => {
+      onChange({
+        ...remoteClusterPrivilege,
+        privileges: newPrivileges.map(fromOption),
+      });
+    },
+    [remoteClusterPrivilege, onChange]
+  );
+
+  return (
+    <Fragment>
+      <EuiSpacer size="m" />
+      <EuiFlexGroup
+        alignItems="center"
+        responsive={false}
+        className="remote-cluster-privilege-form"
+      >
+        <EuiFlexItem>
+          <EuiPanel color="subdued">
+            <EuiFlexGroup>
+              <EuiFlexItem>
+                <EuiFormRow
+                  label={
+                    <FormattedMessage
+                      id="xpack.security.management.editRole.remoteClusterPrivilegeForm.clustersFormRowLabel"
+                      defaultMessage="Remote clusters"
+                    />
+                  }
+                  fullWidth
+                  {...validator.validateRemoteClusterPrivilegeClusterField(remoteClusterPrivilege)}
+                >
+                  <RemoteClusterComboBox
+                    data-test-subj={`remoteClusterClustersInput${formIndex}`}
+                    selectedOptions={(remoteClusterPrivilege.clusters ?? []).map(toOption)}
+                    onCreateOption={onCreateClusterOption}
+                    onChange={onClustersChange}
+                    isDisabled={isRoleReadOnly}
+                    placeholder={i18n.translate(
+                      'xpack.security.management.editRole.remoteClusterPrivilegeForm.clustersPlaceholder',
+                      { defaultMessage: 'Add a remote cluster…' }
+                    )}
+                    remoteClusters={remoteClusters}
+                    type="remote_cluster"
+                    fullWidth
+                  />
+                </EuiFormRow>
+              </EuiFlexItem>
+              <EuiFlexItem>
+                <EuiFormRow
+                  label={
+                    <FormattedMessage
+                      id="xpack.security.management.editRole.remoteClusterPrivilegeForm.privilegesFormRowLabel"
+                      defaultMessage="Privileges"
+                    />
+                  }
+                  fullWidth
+                  {...validator.validateRemoteClusterPrivilegePrivilegesField(
+                    remoteClusterPrivilege
+                  )}
+                >
+                  <EuiComboBox
+                    data-test-subj={`remoteClusterPrivilegesInput${formIndex}`}
+                    options={availableRemoteClusterPrivileges.map(toOption)}
+                    selectedOptions={remoteClusterPrivilege.privileges.map(toOption)}
+                    onChange={onPrivilegeChange}
+                    isDisabled={isRoleReadOnly}
+                    placeholder={i18n.translate(
+                      'xpack.security.management.editRole.remoteClusterPrivilegeForm.privilegesPlaceholder',
+                      { defaultMessage: 'Add an action…' }
+                    )}
+                    fullWidth
+                  />
+                </EuiFormRow>
+              </EuiFlexItem>
+            </EuiFlexGroup>
+          </EuiPanel>
+        </EuiFlexItem>
+        {!isRoleReadOnly && (
+          <EuiFlexItem grow={false}>
+            <EuiButtonIcon
+              aria-label={i18n.translate(
+                'xpack.security.management.editRole.remoteClusterPrivilegeForm.deleteRemoteClusterPrivilegeAriaLabel',
+                { defaultMessage: 'Delete remote cluster privilege' }
+              )}
+              color="danger"
+              onClick={onDelete}
+              iconType="trash"
+              data-test-subj={`deleteRemoteClusterPrivilegesButton${formIndex}`}
+            />
+          </EuiFlexItem>
+        )}
+      </EuiFlexGroup>
+    </Fragment>
+  );
+};
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/remote_clusters_combo_box.test.tsx b/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/remote_clusters_combo_box.test.tsx
new file mode 100644
index 00000000000000..4cf918d4c8c1c2
--- /dev/null
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/remote_clusters_combo_box.test.tsx
@@ -0,0 +1,106 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+
+import '@kbn/code-editor-mock/jest_helper';
+import { shallowWithIntl } from '@kbn/test-jest-helpers';
+
+import { RemoteClusterComboBox } from './remote_clusters_combo_box';
+
+test('it renders without crashing', () => {
+  const wrapper = shallowWithIntl(
+    <RemoteClusterComboBox
+      type="remote_cluster"
+      dat-test-subj="remoteClusterClustersInput0"
+      remoteClusters={[
+        {
+          name: 'test1',
+          mode: 'proxy',
+          isConnected: false,
+          initialConnectTimeout: '30s',
+          skipUnavailable: false,
+          proxyAddress: 'localhost:9400',
+          proxySocketConnections: 18,
+          connectedSocketsCount: 0,
+          serverName: 'localhost',
+          securityModel: 'certificate',
+        },
+        {
+          name: 'test2',
+          mode: 'proxy',
+          isConnected: false,
+          initialConnectTimeout: '30s',
+          skipUnavailable: false,
+          proxyAddress: 'localhost:9400',
+          proxySocketConnections: 18,
+          connectedSocketsCount: 0,
+          serverName: 'localhost',
+          securityModel: 'api_key',
+        },
+        {
+          name: 'test3',
+          mode: 'proxy',
+          isConnected: false,
+          initialConnectTimeout: '30s',
+          skipUnavailable: false,
+          proxyAddress: 'localhost:9400',
+          proxySocketConnections: 18,
+          connectedSocketsCount: 0,
+          serverName: 'localhost',
+          securityModel: 'api_key',
+        },
+      ]}
+    />
+  );
+  expect(wrapper).toMatchSnapshot();
+});
+
+test('should render clusters field', () => {
+  const wrapper = shallowWithIntl(
+    <RemoteClusterComboBox
+      onChange={jest.fn()}
+      type="remote_cluster"
+      remoteClusters={[
+        {
+          name: 'test1',
+          mode: 'proxy',
+          isConnected: false,
+          initialConnectTimeout: '30s',
+          skipUnavailable: false,
+          proxyAddress: 'localhost:9400',
+          proxySocketConnections: 18,
+          connectedSocketsCount: 0,
+          serverName: 'localhost',
+          securityModel: 'certificate',
+        },
+        {
+          name: 'test2',
+          mode: 'proxy',
+          isConnected: false,
+          initialConnectTimeout: '30s',
+          skipUnavailable: false,
+          proxyAddress: 'localhost:9400',
+          proxySocketConnections: 18,
+          connectedSocketsCount: 0,
+          serverName: 'localhost',
+          securityModel: 'api_key',
+        },
+      ]}
+    />
+  );
+  const clustersInput = wrapper.find('EuiComboBox');
+  expect(clustersInput.prop('options')).toEqual([
+    { label: 'test2' },
+    { label: expect.anything(), isGroupLabelOption: true },
+    {
+      label: 'test1',
+      disabled: true,
+      append: expect.anything(),
+    },
+  ]);
+});
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/remote_clusters_combo_box.tsx b/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/remote_clusters_combo_box.tsx
new file mode 100644
index 00000000000000..30efc78f0aaf1f
--- /dev/null
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/remote_clusters_combo_box.tsx
@@ -0,0 +1,87 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { EuiComboBoxOptionOption, EuiComboBoxProps } from '@elastic/eui';
+import { EuiComboBox, EuiIconTip } from '@elastic/eui';
+import React, { useMemo } from 'react';
+
+import { FormattedMessage } from '@kbn/i18n-react';
+import type { Cluster } from '@kbn/remote-clusters-plugin/public';
+
+const API_KEY_SECURITY_MODEL = 'api_key';
+
+interface Props extends Omit<EuiComboBoxProps<string | number | string[] | undefined>, 'options'> {
+  remoteClusters: Cluster[];
+  type: 'remote_cluster' | 'remote_indexes';
+}
+
+export const RemoteClusterComboBox: React.FunctionComponent<Props> = ({
+  remoteClusters,
+  type,
+  ...restProps
+}) => {
+  const remoteClusterOptions = useMemo<EuiComboBoxOptionOption[]>(() => {
+    const { incompatible, remote } = remoteClusters.reduce<{
+      remote: EuiComboBoxOptionOption[];
+      incompatible: EuiComboBoxOptionOption[];
+    }>(
+      (data, item) => {
+        const disabled = item.securityModel !== API_KEY_SECURITY_MODEL;
+
+        if (!disabled) {
+          data.remote.push({ label: item.name });
+
+          return data;
+        }
+
+        data.incompatible.push({
+          label: item.name,
+          disabled,
+          append: disabled ? (
+            <EuiIconTip
+              type="warning"
+              color="inherit"
+              content={
+                type === 'remote_cluster' ? (
+                  <FormattedMessage
+                    id="xpack.security.management.editRole.remoteClusterPrivilegeForm.remoteClusterSecurityModelWarning"
+                    defaultMessage="This cluster is configured with the certificate based security model and does not support remote cluster privileges. Connect this cluster with the API key based security model instead to use remote cluster privileges."
+                  />
+                ) : (
+                  <FormattedMessage
+                    id="xpack.security.management.editRole.indexPrivilegeForm.remoteIndicesSecurityModelWarning"
+                    defaultMessage="This cluster is configured with the certificate based security model and does not support remote index privileges. Connect this cluster with the API key based security model instead to use remote index privileges."
+                  />
+                )
+              }
+            />
+          ) : undefined,
+        });
+
+        return data;
+      },
+      {
+        incompatible: [],
+        remote: [],
+      }
+    );
+
+    if (incompatible.length) {
+      remote.push(
+        {
+          label: 'Incompatible clusters',
+          isGroupLabelOption: true,
+        },
+        ...incompatible
+      );
+    }
+
+    return remote;
+  }, [remoteClusters, type]);
+
+  return <EuiComboBox {...restProps} options={remoteClusterOptions} />;
+};
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/validate_role.ts b/x-pack/plugins/security/public/management/roles/edit_role/validate_role.ts
index 18728994a5e4e2..bf85f80df1fc1f 100644
--- a/x-pack/plugins/security/public/management/roles/edit_role/validate_role.ts
+++ b/x-pack/plugins/security/public/management/roles/edit_role/validate_role.ts
@@ -7,7 +7,12 @@
 
 import { i18n } from '@kbn/i18n';
 
-import type { Role, RoleIndexPrivilege, RoleRemoteIndexPrivilege } from '../../../../common';
+import type {
+  Role,
+  RoleIndexPrivilege,
+  RoleRemoteClusterPrivilege,
+  RoleRemoteIndexPrivilege,
+} from '../../../../common';
 import { MAX_NAME_LENGTH, NAME_REGEX } from '../../../../common/constants';
 
 interface RoleValidatorOptions {
@@ -81,6 +86,27 @@ export class RoleValidator {
     return valid();
   }
 
+  public validateRemoteClusterPrivileges(role: Role): RoleValidationResult {
+    if (!this.shouldValidate) {
+      return valid();
+    }
+
+    const areRemoteClustersInvalid = role.elasticsearch.remote_cluster?.some(
+      (remoteClusterPrivilege) => {
+        return (
+          this.validateRemoteClusterPrivilegeClusterField(remoteClusterPrivilege).isInvalid ||
+          this.validateRemoteClusterPrivilegePrivilegesField(remoteClusterPrivilege).isInvalid
+        );
+      }
+    );
+
+    if (areRemoteClustersInvalid) {
+      return invalid();
+    }
+
+    return valid();
+  }
+
   public validateIndexPrivileges(role: Role): RoleValidationResult {
     if (!this.shouldValidate) {
       return valid();
@@ -239,6 +265,58 @@ export class RoleValidator {
     return valid();
   }
 
+  public validateRemoteClusterPrivilegeClusterField(
+    remoteClusterPrivilege: RoleRemoteClusterPrivilege
+  ): RoleValidationResult {
+    if (!this.shouldValidate) {
+      return valid();
+    }
+
+    // Ignore if all other fields are empty
+    if (!remoteClusterPrivilege.privileges.length) {
+      return valid();
+    }
+
+    if (!remoteClusterPrivilege.clusters.length) {
+      return invalid(
+        i18n.translate(
+          'xpack.security.management.editRole.validateRole.oneClusterRequiredWarningMessage',
+          {
+            defaultMessage: 'Enter or select at least one cluster',
+          }
+        )
+      );
+    }
+
+    return valid();
+  }
+
+  public validateRemoteClusterPrivilegePrivilegesField(
+    remoteClusterPrivilege: RoleRemoteClusterPrivilege
+  ): RoleValidationResult {
+    if (!this.shouldValidate) {
+      return valid();
+    }
+
+    // Ignore if all other fields are empty
+    if (!remoteClusterPrivilege.clusters.length) {
+      return valid();
+    }
+
+    if (!remoteClusterPrivilege.privileges.length) {
+      return invalid(
+        i18n.translate(
+          'xpack.security.management.editRole.validateRole.oneRemoteClusterPrivilegeRequiredWarningMessage',
+          {
+            defaultMessage: 'Enter or select at least one privilege',
+          }
+        )
+      );
+    }
+
+    return valid();
+  }
+
   public validateSelectedSpaces(
     spaceIds: string[],
     privilege: string | null
@@ -313,12 +391,15 @@ export class RoleValidator {
     const { isInvalid: areIndicesInvalid } = this.validateIndexPrivileges(role);
     const { isInvalid: areRemoteIndicesInvalid } = this.validateRemoteIndexPrivileges(role);
     const { isInvalid: areSpacePrivilegesInvalid } = this.validateSpacePrivileges(role);
+    const { isInvalid: areRemoteClusterPrivilegesInvalid } =
+      this.validateRemoteClusterPrivileges(role);
 
     if (
       isNameInvalid ||
       areIndicesInvalid ||
       areRemoteIndicesInvalid ||
-      areSpacePrivilegesInvalid
+      areSpacePrivilegesInvalid ||
+      areRemoteClusterPrivilegesInvalid
     ) {
       return invalid();
     }
diff --git a/x-pack/plugins/security/server/audit/audit_service.test.ts b/x-pack/plugins/security/server/audit/audit_service.test.ts
index 773d5cdf1b8fd4..8df7450317df47 100644
--- a/x-pack/plugins/security/server/audit/audit_service.test.ts
+++ b/x-pack/plugins/security/server/audit/audit_service.test.ts
@@ -582,6 +582,7 @@ describe('#filterEvent', () => {
     expect(filterEvent(event, [{ types: ['NO_MATCH', 'access'] }])).toBeFalsy();
     expect(filterEvent(event, [{ outcomes: ['NO_MATCH', 'success'] }])).toBeFalsy();
     expect(filterEvent(event, [{ spaces: ['NO_MATCH', 'default'] }])).toBeFalsy();
+    expect(filterEvent(event, [{ users: ['NO_MATCH', 'jdoe'] }])).toBeFalsy();
   });
 
   test('keeps event when one criteria per rule does not match', () => {
@@ -593,6 +594,7 @@ describe('#filterEvent', () => {
           types: ['access'],
           outcomes: ['success'],
           spaces: ['default'],
+          users: ['jdoe'],
         },
         {
           actions: ['http_request'],
@@ -600,6 +602,7 @@ describe('#filterEvent', () => {
           types: ['access'],
           outcomes: ['success'],
           spaces: ['default'],
+          users: ['jdoe'],
         },
         {
           actions: ['http_request'],
@@ -607,6 +610,7 @@ describe('#filterEvent', () => {
           types: ['NO_MATCH'],
           outcomes: ['success'],
           spaces: ['default'],
+          users: ['jdoe'],
         },
         {
           actions: ['http_request'],
@@ -614,6 +618,7 @@ describe('#filterEvent', () => {
           types: ['access'],
           outcomes: ['NO_MATCH'],
           spaces: ['default'],
+          users: ['jdoe'],
         },
         {
           actions: ['http_request'],
@@ -621,6 +626,15 @@ describe('#filterEvent', () => {
           types: ['access'],
           outcomes: ['success'],
           spaces: ['NO_MATCH'],
+          users: ['jdoe'],
+        },
+        {
+          actions: ['http_request'],
+          categories: ['web'],
+          types: ['access'],
+          outcomes: ['success'],
+          spaces: ['default'],
+          users: ['NO_MATCH'],
         },
       ])
     ).toBeTruthy();
@@ -651,6 +665,7 @@ describe('#filterEvent', () => {
           types: ['access'],
           outcomes: ['success'],
           spaces: ['default'],
+          users: ['jdoe'],
         },
       ])
     ).toBeTruthy();
@@ -681,6 +696,7 @@ describe('#filterEvent', () => {
           types: ['access', 'NO_MATCH'],
           outcomes: ['success'],
           spaces: ['default'],
+          users: ['jdoe'],
         },
       ])
     ).toBeTruthy();
@@ -695,6 +711,7 @@ describe('#filterEvent', () => {
           types: ['NO_MATCH'],
           outcomes: ['NO_MATCH'],
           spaces: ['NO_MATCH'],
+          users: ['NO_MATCH'],
         },
         {
           actions: ['http_request'],
@@ -702,6 +719,7 @@ describe('#filterEvent', () => {
           types: ['access'],
           outcomes: ['success'],
           spaces: ['default'],
+          users: ['jdoe'],
         },
       ])
     ).toBeFalsy();
@@ -732,6 +750,7 @@ describe('#filterEvent', () => {
           types: ['access'],
           outcomes: ['success'],
           spaces: ['default'],
+          users: ['jdoe'],
         },
       ])
     ).toBeFalsy();
diff --git a/x-pack/plugins/security/server/audit/audit_service.ts b/x-pack/plugins/security/server/audit/audit_service.ts
index 6539b8208c3de7..3bebc32d2dc80f 100644
--- a/x-pack/plugins/security/server/audit/audit_service.ts
+++ b/x-pack/plugins/security/server/audit/audit_service.ts
@@ -201,7 +201,8 @@ export function filterEvent(
         (!rule.types ||
           normalize(event.event?.type)?.every((t) => rule.types?.includes(t || ''))) &&
         (!rule.outcomes || rule.outcomes.includes(event.event?.outcome!)) &&
-        (!rule.spaces || rule.spaces.includes(event.kibana?.space_id!))
+        (!rule.spaces || rule.spaces.includes(event.kibana?.space_id!)) &&
+        (!rule.users || !event.user?.name || rule.users.includes(event.user.name))
     );
   }
   return true;
diff --git a/x-pack/plugins/security/server/authorization/roles/elasticsearch_role.test.ts b/x-pack/plugins/security/server/authorization/roles/elasticsearch_role.test.ts
index 47947d2fb2adc2..bb8b43c45f2727 100644
--- a/x-pack/plugins/security/server/authorization/roles/elasticsearch_role.test.ts
+++ b/x-pack/plugins/security/server/authorization/roles/elasticsearch_role.test.ts
@@ -16,6 +16,7 @@ const roles = [
   {
     name: 'global-base-all',
     cluster: [],
+    remote_cluster: [],
     indices: [],
     applications: [
       {
@@ -33,6 +34,7 @@ const roles = [
   {
     name: 'global-base-read',
     cluster: [],
+    remote_cluster: [],
     indices: [],
     applications: [
       {
@@ -50,6 +52,7 @@ const roles = [
   {
     name: 'global-foo-all',
     cluster: [],
+    remote_cluster: [],
     indices: [],
     applications: [
       {
@@ -67,6 +70,7 @@ const roles = [
   {
     name: 'global-foo-read',
     cluster: [],
+    remote_cluster: [],
     indices: [],
     applications: [
       {
@@ -84,6 +88,7 @@ const roles = [
   {
     name: 'global-malformed',
     cluster: [],
+    remote_cluster: [],
     indices: [],
     applications: [
       {
@@ -101,6 +106,7 @@ const roles = [
   {
     name: 'default-base-all',
     cluster: [],
+    remote_cluster: [],
     indices: [],
     applications: [
       {
@@ -118,6 +124,7 @@ const roles = [
   {
     name: 'default-base-read',
     cluster: [],
+    remote_cluster: [],
     indices: [],
     applications: [
       {
@@ -135,6 +142,7 @@ const roles = [
   {
     name: 'default-foo-all',
     cluster: [],
+    remote_cluster: [],
     indices: [],
     applications: [
       {
@@ -152,6 +160,7 @@ const roles = [
   {
     name: 'default-foo-read',
     cluster: [],
+    remote_cluster: [],
     indices: [],
     applications: [
       {
@@ -169,6 +178,7 @@ const roles = [
   {
     name: 'default-malformed',
     cluster: [],
+    remote_cluster: [],
     indices: [],
     applications: [
       {
@@ -294,6 +304,7 @@ describe('#transformElasticsearchRoleToRole', () => {
     const role = {
       name: 'global-all',
       cluster: [],
+      remote_cluster: [],
       indices: [],
       applications: [
         {
diff --git a/x-pack/plugins/security/server/authorization/roles/elasticsearch_role.ts b/x-pack/plugins/security/server/authorization/roles/elasticsearch_role.ts
index 9477fa8be90847..e06c9938b078f3 100644
--- a/x-pack/plugins/security/server/authorization/roles/elasticsearch_role.ts
+++ b/x-pack/plugins/security/server/authorization/roles/elasticsearch_role.ts
@@ -28,6 +28,7 @@ export type ElasticsearchRole = Pick<
     resources: string[];
   }>;
   cluster: Role['elasticsearch']['cluster'];
+  remote_cluster: Role['elasticsearch']['remote_cluster'];
   indices: Role['elasticsearch']['indices'];
   remote_indices?: Role['elasticsearch']['remote_indices'];
   run_as: Role['elasticsearch']['run_as'];
@@ -56,6 +57,7 @@ export function transformElasticsearchRoleToRole(
     transient_metadata: elasticsearchRole.transient_metadata,
     elasticsearch: {
       cluster: elasticsearchRole.cluster,
+      remote_cluster: elasticsearchRole.remote_cluster,
       indices: elasticsearchRole.indices,
       remote_indices: elasticsearchRole.remote_indices,
       run_as: elasticsearchRole.run_as,
diff --git a/x-pack/plugins/security/server/config.test.ts b/x-pack/plugins/security/server/config.test.ts
index 7a87b2d655d52a..3a6ccc619fdb92 100644
--- a/x-pack/plugins/security/server/config.test.ts
+++ b/x-pack/plugins/security/server/config.test.ts
@@ -2004,6 +2004,57 @@ describe('createConfig()', () => {
     ).toThrow('[audit.appender.1.layout]: expected at least one defined value but got [undefined]');
   });
 
+  it('allows filtering audit events', () => {
+    expect(
+      ConfigSchema.validate({
+        audit: {
+          enabled: true,
+          appender: {
+            type: 'file',
+            fileName: '/path/to/file.txt',
+            layout: {
+              type: 'json',
+            },
+          },
+          ignore_filters: [
+            {
+              actions: ['authentication_success', 'authorization_failure'],
+              categories: ['database'],
+              outcomes: ['unknown'],
+              spaces: ['default'],
+              types: ['index'],
+              users: ['elastic'],
+            },
+          ],
+        },
+      }).audit.ignore_filters
+    ).toMatchInlineSnapshot(`
+      Array [
+        Object {
+          "actions": Array [
+            "authentication_success",
+            "authorization_failure",
+          ],
+          "categories": Array [
+            "database",
+          ],
+          "outcomes": Array [
+            "unknown",
+          ],
+          "spaces": Array [
+            "default",
+          ],
+          "types": Array [
+            "index",
+          ],
+          "users": Array [
+            "elastic",
+          ],
+        },
+      ]
+    `);
+  });
+
   describe('#getExpirationTimeouts', () => {
     function createMockConfig(config: Record<string, any> = {}) {
       return createConfig(ConfigSchema.validate(config), loggingSystemMock.createLogger(), {
diff --git a/x-pack/plugins/security/server/config.ts b/x-pack/plugins/security/server/config.ts
index 6e254ad763eee8..1ea1c87d31d5d5 100644
--- a/x-pack/plugins/security/server/config.ts
+++ b/x-pack/plugins/security/server/config.ts
@@ -294,9 +294,10 @@ export const ConfigSchema = schema.object({
         schema.object({
           actions: schema.maybe(schema.arrayOf(schema.string(), { minSize: 1 })),
           categories: schema.maybe(schema.arrayOf(schema.string(), { minSize: 1 })),
-          types: schema.maybe(schema.arrayOf(schema.string(), { minSize: 1 })),
           outcomes: schema.maybe(schema.arrayOf(schema.string(), { minSize: 1 })),
           spaces: schema.maybe(schema.arrayOf(schema.string(), { minSize: 1 })),
+          types: schema.maybe(schema.arrayOf(schema.string(), { minSize: 1 })),
+          users: schema.maybe(schema.arrayOf(schema.string(), { minSize: 1 })),
         })
       )
     ),
diff --git a/x-pack/plugins/security/server/deprecations/privilege_deprecations.test.ts b/x-pack/plugins/security/server/deprecations/privilege_deprecations.test.ts
index 2ab306ce82108a..f62bdc52e6d4c4 100644
--- a/x-pack/plugins/security/server/deprecations/privilege_deprecations.test.ts
+++ b/x-pack/plugins/security/server/deprecations/privilege_deprecations.test.ts
@@ -66,6 +66,7 @@ describe('#getPrivilegeDeprecationsService', () => {
               "elasticsearch": Object {
                 "cluster": Array [],
                 "indices": Array [],
+                "remote_cluster": undefined,
                 "remote_indices": undefined,
                 "run_as": Array [],
               },
@@ -139,6 +140,7 @@ describe('#getPrivilegeDeprecationsService', () => {
               "elasticsearch": Object {
                 "cluster": Array [],
                 "indices": Array [],
+                "remote_cluster": undefined,
                 "remote_indices": undefined,
                 "run_as": Array [],
               },
diff --git a/x-pack/plugins/security/server/routes/authorization/privileges/get_builtin.ts b/x-pack/plugins/security/server/routes/authorization/privileges/get_builtin.ts
index e51e8e1d5ae514..98b1f33bd5b385 100644
--- a/x-pack/plugins/security/server/routes/authorization/privileges/get_builtin.ts
+++ b/x-pack/plugins/security/server/routes/authorization/privileges/get_builtin.ts
@@ -21,7 +21,10 @@ export function defineGetBuiltinPrivilegesRoutes({ router }: RouteDefinitionPara
         : [privileges.index];
       privileges.index = indexPriviledges.filter((privilege) => privilege !== 'none');
 
-      return response.ok({ body: privileges });
+      // TODO: remove hardcoded value once ES returns built-in privileges for remote_cluster
+      const remoteClusterPrivileges = ['monitor_enrich'];
+
+      return response.ok({ body: { ...privileges, remote_cluster: remoteClusterPrivileges } });
     }
   );
 }
diff --git a/x-pack/plugins/security/server/routes/authorization/roles/model/put_payload.test.ts b/x-pack/plugins/security/server/routes/authorization/roles/model/put_payload.test.ts
index 717170567a550a..b9e772e6451db5 100644
--- a/x-pack/plugins/security/server/routes/authorization/roles/model/put_payload.test.ts
+++ b/x-pack/plugins/security/server/routes/authorization/roles/model/put_payload.test.ts
@@ -108,10 +108,10 @@ describe('Put payload schema', () => {
           kibana: [{ spaces: ['foo-*'] }],
         })
       ).toThrowErrorMatchingInlineSnapshot(`
-"[kibana.0.spaces]: types that failed validation:
-- [kibana.0.spaces.0.0]: expected value to equal [*]
-- [kibana.0.spaces.1.0]: must be lower case, a-z, 0-9, '_', and '-' are allowed"
-`);
+        "[kibana.0.spaces]: types that failed validation:
+        - [kibana.0.spaces.0.0]: expected value to equal [*]
+        - [kibana.0.spaces.1.0]: must be lower case, a-z, 0-9, '_', and '-' are allowed"
+      `);
     });
 
     test(`can't assign space and global in same entry`, () => {
@@ -120,10 +120,10 @@ describe('Put payload schema', () => {
           kibana: [{ spaces: ['*', 'foo-space'] }],
         })
       ).toThrowErrorMatchingInlineSnapshot(`
-"[kibana.0.spaces]: types that failed validation:
-- [kibana.0.spaces.0.1]: expected value to equal [*]
-- [kibana.0.spaces.1.0]: must be lower case, a-z, 0-9, '_', and '-' are allowed"
-`);
+        "[kibana.0.spaces]: types that failed validation:
+        - [kibana.0.spaces.0.1]: expected value to equal [*]
+        - [kibana.0.spaces.1.0]: must be lower case, a-z, 0-9, '_', and '-' are allowed"
+      `);
     });
 
     test(`only allows known Kibana space base privileges`, () => {
@@ -424,8 +424,72 @@ describe('Put payload schema', () => {
     `);
   });
 
+  test('passes through remote_cluster when specified', () => {
+    expect(
+      getPutPayloadSchema(() => basePrivilegeNamesMap).validate({
+        elasticsearch: {
+          remote_cluster: [
+            {
+              privileges: ['monitor_enrich'],
+              clusters: ['my_remote*'],
+            },
+          ],
+        },
+      })
+    ).toMatchInlineSnapshot(`
+      Object {
+        "elasticsearch": Object {
+          "remote_cluster": Array [
+            Object {
+              "clusters": Array [
+                "my_remote*",
+              ],
+              "privileges": Array [
+                "monitor_enrich",
+              ],
+            },
+          ],
+        },
+      }
+    `);
+  });
+
+  test(`doesn't allow empty privilege for remote_cluster`, () => {
+    expect(() =>
+      getPutPayloadSchema(() => basePrivilegeNamesMap).validate({
+        elasticsearch: {
+          remote_cluster: [
+            {
+              privileges: [],
+              clusters: ['cluster1'],
+            },
+          ],
+        },
+      })
+    ).toThrowErrorMatchingInlineSnapshot(
+      `"[elasticsearch.remote_cluster.0.privileges]: array size is [0], but cannot be smaller than [1]"`
+    );
+  });
+
+  test(`doesn't allow empty clusters for remote_cluster`, () => {
+    expect(() =>
+      getPutPayloadSchema(() => basePrivilegeNamesMap).validate({
+        elasticsearch: {
+          remote_cluster: [
+            {
+              privileges: ['enrich_monitor'],
+              clusters: [],
+            },
+          ],
+        },
+      })
+    ).toThrowErrorMatchingInlineSnapshot(
+      `"[elasticsearch.remote_cluster.0.clusters]: array size is [0], but cannot be smaller than [1]"`
+    );
+  });
+
   // This is important for backwards compatibility
-  test('does not set default value for remote_indices when not specified', () => {
+  test('does not set default value for remote_indices/remote_cluster when not specified', () => {
     expect(getPutPayloadSchema(() => basePrivilegeNamesMap).validate({})).toMatchInlineSnapshot(`
       Object {
         "elasticsearch": Object {},
diff --git a/x-pack/plugins/security/server/routes/authorization/roles/model/put_payload.ts b/x-pack/plugins/security/server/routes/authorization/roles/model/put_payload.ts
index 9d0a82c1e6ac89..52c8178a651a7b 100644
--- a/x-pack/plugins/security/server/routes/authorization/roles/model/put_payload.ts
+++ b/x-pack/plugins/security/server/routes/authorization/roles/model/put_payload.ts
@@ -19,6 +19,7 @@ export const transformPutPayloadToElasticsearchRole = (
 ) => {
   const {
     elasticsearch = {
+      remote_cluster: undefined,
       cluster: undefined,
       indices: undefined,
       remote_indices: undefined,
@@ -34,6 +35,7 @@ export const transformPutPayloadToElasticsearchRole = (
     ...(rolePayload.description && { description: rolePayload.description }),
     metadata: rolePayload.metadata,
     cluster: elasticsearch.cluster || [],
+    remote_cluster: elasticsearch.remote_cluster,
     indices: elasticsearch.indices || [],
     remote_indices: elasticsearch.remote_indices,
     run_as: elasticsearch.run_as || [],
diff --git a/x-pack/plugins/security/server/routes/authorization/roles/put.test.ts b/x-pack/plugins/security/server/routes/authorization/roles/put.test.ts
index 4591bfaaea4aa5..642aec90c47484 100644
--- a/x-pack/plugins/security/server/routes/authorization/roles/put.test.ts
+++ b/x-pack/plugins/security/server/routes/authorization/roles/put.test.ts
@@ -325,6 +325,7 @@ describe('PUT role', () => {
               body: {
                 cluster: [],
                 indices: [],
+                remote_cluster: undefined,
                 remote_indices: undefined,
                 run_as: [],
                 applications: [],
@@ -936,5 +937,59 @@ describe('PUT role', () => {
         result: undefined,
       },
     });
+
+    putRoleTest(`creates role with remote_cluster privileges`, {
+      name: 'foo-role-remote-cluster',
+      payload: {
+        kibana: [],
+        elasticsearch: {
+          remote_cluster: [
+            {
+              clusters: ['cluster1', 'cluster2'],
+              privileges: ['monitor_enrich'],
+            },
+            {
+              clusters: ['cluster3', 'cluster4'],
+              privileges: ['monitor_enrich'],
+            },
+          ],
+        },
+      },
+      apiResponses: {
+        get: () => ({}),
+        put: () => {},
+      },
+      asserts: {
+        recordSubFeaturePrivilegeUsage: false,
+        apiArguments: {
+          get: [{ name: 'foo-role-remote-cluster' }, { ignore: [404] }],
+          put: [
+            {
+              name: 'foo-role-remote-cluster',
+              body: {
+                applications: [],
+                cluster: [],
+                indices: [],
+                remote_indices: undefined,
+                run_as: [],
+                remote_cluster: [
+                  {
+                    clusters: ['cluster1', 'cluster2'],
+                    privileges: ['monitor_enrich'],
+                  },
+                  {
+                    clusters: ['cluster3', 'cluster4'],
+                    privileges: ['monitor_enrich'],
+                  },
+                ],
+                metadata: undefined,
+              },
+            },
+          ],
+        },
+        statusCode: 204,
+        result: undefined,
+      },
+    });
   });
 });
diff --git a/x-pack/plugins/security/server/routes/role_mapping/feature_check.test.ts b/x-pack/plugins/security/server/routes/role_mapping/feature_check.test.ts
index d18fd1ff1d314d..c0bf0041ed0ac7 100644
--- a/x-pack/plugins/security/server/routes/role_mapping/feature_check.test.ts
+++ b/x-pack/plugins/security/server/routes/role_mapping/feature_check.test.ts
@@ -98,6 +98,7 @@ describe('GET role mappings feature check', () => {
         canUseStoredScripts: true,
         hasCompatibleRealms: true,
         canUseRemoteIndices: true,
+        canUseRemoteClusters: true,
       },
     },
   });
@@ -122,6 +123,7 @@ describe('GET role mappings feature check', () => {
         canUseStoredScripts: true,
         hasCompatibleRealms: true,
         canUseRemoteIndices: true,
+        canUseRemoteClusters: true,
       },
     },
   });
@@ -141,6 +143,7 @@ describe('GET role mappings feature check', () => {
           canUseStoredScripts: true,
           hasCompatibleRealms: true,
           canUseRemoteIndices: false,
+          canUseRemoteClusters: false,
         },
       },
     }
@@ -166,6 +169,7 @@ describe('GET role mappings feature check', () => {
         canUseStoredScripts: false,
         hasCompatibleRealms: true,
         canUseRemoteIndices: true,
+        canUseRemoteClusters: true,
       },
     },
   });
@@ -190,6 +194,7 @@ describe('GET role mappings feature check', () => {
         canUseStoredScripts: true,
         hasCompatibleRealms: true,
         canUseRemoteIndices: true,
+        canUseRemoteClusters: true,
       },
     },
   });
@@ -218,6 +223,7 @@ describe('GET role mappings feature check', () => {
         canUseStoredScripts: true,
         hasCompatibleRealms: false,
         canUseRemoteIndices: true,
+        canUseRemoteClusters: true,
       },
     },
   });
@@ -249,6 +255,7 @@ describe('GET role mappings feature check', () => {
           canUseStoredScripts: true,
           hasCompatibleRealms: false,
           canUseRemoteIndices: false,
+          canUseRemoteClusters: false,
         },
       },
     }
diff --git a/x-pack/plugins/security/server/routes/role_mapping/feature_check.ts b/x-pack/plugins/security/server/routes/role_mapping/feature_check.ts
index 309cdfbeab4562..6aca083dab1e20 100644
--- a/x-pack/plugins/security/server/routes/role_mapping/feature_check.ts
+++ b/x-pack/plugins/security/server/routes/role_mapping/feature_check.ts
@@ -131,7 +131,8 @@ async function getEnabledRoleMappingsFeatures(esClient: ElasticsearchClient, log
     hasCompatibleRealms,
     canUseStoredScripts,
     canUseInlineScripts,
-    canUseRemoteIndices: !!xpackUsage.remote_clusters,
+    canUseRemoteIndices: Boolean(xpackUsage.remote_clusters),
+    canUseRemoteClusters: Boolean(xpackUsage.remote_clusters),
   };
 }
 
diff --git a/x-pack/plugins/security/server/routes/views/login.test.ts b/x-pack/plugins/security/server/routes/views/login.test.ts
index 086c0c785e6bc3..87e9bf9e4495b7 100644
--- a/x-pack/plugins/security/server/routes/views/login.test.ts
+++ b/x-pack/plugins/security/server/routes/views/login.test.ts
@@ -167,6 +167,7 @@ describe('Login view routes', () => {
         allowRoleDocumentLevelSecurity: true,
         allowRoleFieldLevelSecurity: false,
         allowRoleRemoteIndexPrivileges: false,
+        allowRemoteClusterPrivileges: false,
         layout: 'error-es-unavailable',
         showLinks: false,
         showRoleMappingsManagement: true,
diff --git a/x-pack/plugins/security_solution/common/api/entity_analytics/asset_criticality/common.gen.ts b/x-pack/plugins/security_solution/common/api/entity_analytics/asset_criticality/common.gen.ts
index 3da400bdef9e06..141991327fb2df 100644
--- a/x-pack/plugins/security_solution/common/api/entity_analytics/asset_criticality/common.gen.ts
+++ b/x-pack/plugins/security_solution/common/api/entity_analytics/asset_criticality/common.gen.ts
@@ -40,6 +40,20 @@ export const CreateAssetCriticalityRecord = AssetCriticalityRecordIdParts.merge(
      * The criticality level of the asset.
      */
     criticality_level: z.enum(['low_impact', 'medium_impact', 'high_impact', 'extreme_impact']),
+    /**
+     * If 'wait_for' the request will wait for the index refresh.
+     */
+    refresh: z.literal('wait_for').optional(),
+  })
+);
+
+export type DeleteAssetCriticalityRecord = z.infer<typeof DeleteAssetCriticalityRecord>;
+export const DeleteAssetCriticalityRecord = AssetCriticalityRecordIdParts.merge(
+  z.object({
+    /**
+     * If 'wait_for' the request will wait for the index refresh.
+     */
+    refresh: z.literal('wait_for').optional(),
   })
 );
 
diff --git a/x-pack/plugins/security_solution/common/api/entity_analytics/asset_criticality/common.schema.yaml b/x-pack/plugins/security_solution/common/api/entity_analytics/asset_criticality/common.schema.yaml
index 9fa0c7bcfce188..3d3e82524109dc 100644
--- a/x-pack/plugins/security_solution/common/api/entity_analytics/asset_criticality/common.schema.yaml
+++ b/x-pack/plugins/security_solution/common/api/entity_analytics/asset_criticality/common.schema.yaml
@@ -50,8 +50,21 @@ components:
               type: string
               enum: [low_impact, medium_impact, high_impact, extreme_impact]
               description: The criticality level of the asset.
+            refresh:
+                type: string
+                enum: [wait_for]
+                description: If 'wait_for' the request will wait for the index refresh.
           required:
             - criticality_level
+    DeleteAssetCriticalityRecord:
+      allOf:
+        - $ref: '#/components/schemas/AssetCriticalityRecordIdParts'
+        - type: object
+          properties:
+            refresh:
+                type: string
+                enum: [wait_for]
+                description: If 'wait_for' the request will wait for the index refresh.
     AssetCriticalityRecord:
       allOf:
         - $ref: '#/components/schemas/CreateAssetCriticalityRecord'
diff --git a/x-pack/plugins/security_solution/common/api/entity_analytics/risk_engine/engine_settings_route.schema.yaml b/x-pack/plugins/security_solution/common/api/entity_analytics/risk_engine/engine_settings_route.schema.yaml
index aad2d490328568..cb67a3686822b8 100644
--- a/x-pack/plugins/security_solution/common/api/entity_analytics/risk_engine/engine_settings_route.schema.yaml
+++ b/x-pack/plugins/security_solution/common/api/entity_analytics/risk_engine/engine_settings_route.schema.yaml
@@ -13,6 +13,7 @@ servers:
 
 paths:
   /engine/settings:
+    x-internal: true
     get:
       operationId: RiskEngineSettingsGet
       summary: Get the settings of the Risk Engine
@@ -23,11 +24,11 @@ paths:
             application/json:
               schema:
                 $ref: '#/components/schemas/RiskEngineSettingsResponse'
-                
+
 components:
   schemas:
     RiskEngineSettingsResponse:
       type: object
       properties:
         range:
-          $ref: '../common/common.schema.yaml#/components/schemas/DateRange'
\ No newline at end of file
+          $ref: '../common/common.schema.yaml#/components/schemas/DateRange'
diff --git a/x-pack/plugins/security_solution/common/api/entity_analytics/risk_engine/entity_calculation_route.gen.ts b/x-pack/plugins/security_solution/common/api/entity_analytics/risk_engine/entity_calculation_route.gen.ts
index c5836161983131..f4d7c393f6e7fe 100644
--- a/x-pack/plugins/security_solution/common/api/entity_analytics/risk_engine/entity_calculation_route.gen.ts
+++ b/x-pack/plugins/security_solution/common/api/entity_analytics/risk_engine/entity_calculation_route.gen.ts
@@ -28,6 +28,10 @@ export const RiskScoresEntityCalculationRequest = z.object({
    * Used to define the type of entity.
    */
   identifier_type: IdentifierType,
+  /**
+   * If 'wait_for' the request will wait for the index refresh.
+   */
+  refresh: z.literal('wait_for').optional(),
 });
 
 export type RiskScoresEntityCalculationResponse = z.infer<
diff --git a/x-pack/plugins/security_solution/common/api/entity_analytics/risk_engine/entity_calculation_route.schema.yaml b/x-pack/plugins/security_solution/common/api/entity_analytics/risk_engine/entity_calculation_route.schema.yaml
index de5f01f8501877..d776f6363a01e4 100644
--- a/x-pack/plugins/security_solution/common/api/entity_analytics/risk_engine/entity_calculation_route.schema.yaml
+++ b/x-pack/plugins/security_solution/common/api/entity_analytics/risk_engine/entity_calculation_route.schema.yaml
@@ -15,6 +15,7 @@ servers:
 
 paths:
   /api/risk_scores/calculation/entity:
+    x-internal: true
     post:
       summary: Trigger calculation of Risk Scores for an entity
       description: Calculates and persists Risk Scores for an entity, returning the calculated risk score.
@@ -44,19 +45,23 @@ components:
         - identifier_type
       properties:
         identifier:
-          description: Used to identify the entity.                      
+          description: Used to identify the entity.
           type: string
           example: 'my.host'
         identifier_type:
           description: Used to define the type of entity.
           $ref: './common.schema.yaml#/components/schemas/IdentifierType'
+        refresh:
+            type: string
+            enum: [wait_for]
+            description: If 'wait_for' the request will wait for the index refresh.
 
     RiskScoresEntityCalculationResponse:
-        type: object
-        required:
-          - success
-        properties:
-          success: 
-            type: boolean
-          score:
-            $ref: './common.schema.yaml#/components/schemas/RiskScore'
+      type: object
+      required:
+        - success
+      properties:
+        success:
+          type: boolean
+        score:
+          $ref: './common.schema.yaml#/components/schemas/RiskScore'
diff --git a/x-pack/plugins/security_solution/common/constants.ts b/x-pack/plugins/security_solution/common/constants.ts
index ceff046d8c6789..5be5462a805f91 100644
--- a/x-pack/plugins/security_solution/common/constants.ts
+++ b/x-pack/plugins/security_solution/common/constants.ts
@@ -428,6 +428,7 @@ export const NEW_FEATURES_TOUR_STORAGE_KEYS = {
   TIMELINES: 'securitySolution.security.timelineFlyoutHeader.saveTimelineTour',
   TIMELINE: 'securitySolution.timeline.newFeaturesTour.v8.12',
   FLYOUT: 'securitySolution.documentDetails.newFeaturesTour.v8.14',
+  ATTACK_DISCOVERY: 'securitySolution.attackDiscovery.newFeaturesTour.v8.14',
 };
 
 export const RULE_DETAILS_EXECUTION_LOG_TABLE_SHOW_METRIC_COLUMNS_STORAGE_KEY =
diff --git a/x-pack/plugins/security_solution/common/endpoint/data_generators/sentinelone_data_generator.ts b/x-pack/plugins/security_solution/common/endpoint/data_generators/sentinelone_data_generator.ts
index 43384ec5bc9473..19aedd173abbfc 100644
--- a/x-pack/plugins/security_solution/common/endpoint/data_generators/sentinelone_data_generator.ts
+++ b/x-pack/plugins/security_solution/common/endpoint/data_generators/sentinelone_data_generator.ts
@@ -5,9 +5,16 @@
  * 2.0.
  */
 
-import type { DeepPartial } from 'utility-types';
+/* eslint-disable @typescript-eslint/no-explicit-any */
+
+import type { DeepPartial, Mutable } from 'utility-types';
 import { merge } from 'lodash';
 import type { SearchResponse, SearchHit } from '@elastic/elasticsearch/lib/api/types';
+import type {
+  SentinelOneGetActivitiesResponse,
+  SentinelOneGetAgentsResponse,
+  SentinelOneActivityRecord,
+} from '@kbn/stack-connectors-plugin/common/sentinelone/types';
 import { EndpointActionGenerator } from './endpoint_action_generator';
 import { SENTINEL_ONE_ACTIVITY_INDEX_PATTERN } from '../..';
 import type {
@@ -79,4 +86,783 @@ export class SentinelOneDataGenerator extends EndpointActionGenerator {
   ): SearchResponse<SentinelOneActivityEsDoc> {
     return this.toEsSearchResponse<SentinelOneActivityEsDoc>(docs);
   }
+
+  generateSentinelOneApiActivityResponse(
+    activityRecordOverrides: DeepPartial<Mutable<SentinelOneActivityRecord>> = {}
+  ): SentinelOneGetActivitiesResponse {
+    const today = new Date();
+    today.setMinutes(today.getMinutes() - 5);
+    const activityType = activityRecordOverrides.activityType ?? this.randomActivityType();
+    const activity: SentinelOneActivityRecord = {
+      accountId: this.randomString(10),
+      accountName: 'Elastic',
+      activityType,
+      activityUuid: this.seededUUIDv4(),
+      agentId: this.seededUUIDv4(),
+      agentUpdatedVersion: null,
+      comments: null,
+      createdAt: today.toISOString(),
+      data: this.generateActivityDataForType(activityType),
+      description: null,
+      groupId: '1392053568591146999',
+      groupName: 'Default Group',
+      hash: null,
+      id: this.seededUUIDv4(),
+      osFamily: null,
+      primaryDescription: sentinelOneActivityTypes[activityType.toString()],
+      secondaryDescription: 'IP address: 108.77.84.191',
+      siteId: '1392053568582758390',
+      siteName: 'Default site',
+      threatId: null,
+      updatedAt: today.toISOString(),
+      userId: this.randomUser(),
+    };
+
+    return {
+      data: [merge(activity, activityRecordOverrides)],
+      pagination: {
+        nextCursor: 'eyJpZF9jb2x9',
+        totalItems: 1,
+      },
+    };
+  }
+
+  randomActivityType(): number {
+    return Number(this.randomChoice(Object.keys(sentinelOneActivityTypes)));
+  }
+
+  generateActivityDataForType<TData extends Record<string, any> = {}>(
+    activityType: number,
+    overrides: Record<string, any> = {}
+  ): SentinelOneActivityRecord<TData>['data'] {
+    let activityData: Record<string, any> = {
+      accountName: 'elastic',
+      groupName: 'Default Group',
+    };
+
+    switch (activityType) {
+      // File fetch requested
+      case 81:
+        {
+          const ip = this.randomIP();
+          activityData = {
+            accountName: 'Elastic',
+            commandBatchUuid: this.seededUUIDv4(),
+            computerName: this.randomHostname(),
+            externalIp: ip,
+            fullScopeDetails: 'Group Default Group in Site Default site of Account Elastic',
+            fullScopeDetailsPath: 'Global / Elastic / Default site / Default Group',
+            groupName: 'Default Group',
+            groupType: 'Manual',
+            ipAddress: ip,
+            scopeLevel: 'Group',
+            scopeName: 'Default Group',
+            siteName: 'Default site',
+            username: 'Defend Workflows Automation',
+            uuid: this.seededUUIDv4(),
+          };
+        }
+        break;
+
+      // File was successful retrieved from host (uploaded by host to sentinelone)
+      case 80:
+        activityData = {
+          accountName: 'Elastic',
+          commandBatchUuid: this.seededUUIDv4(),
+          commandId: this.seededUUIDv4(),
+          computerName: this.randomHostname(),
+          downloadUrl: '/agents/1889978925339985309/uploads/1891428432577857502',
+          externalIp: this.randomIP(),
+          externalServiceId: null,
+          filePath: '/agents/1889978925339985309/uploads/1891428432577857502',
+          filename: 'file_9665_2024-02-23_16_10_39.663.zip',
+          fullScopeDetails: 'Group Default Group in Site Default site of Account Elastic',
+          fullScopeDetailsPath: 'Global / Elastic / Default site / Default Group',
+          groupName: 'Default Group',
+          ipAddress: null,
+          realUser: null,
+          scopeLevel: 'Group',
+          scopeName: 'Default Group',
+          siteName: 'Default site',
+          sourceType: 'API',
+          uploadedFilename: 'file_fetch_23-02-24_11_10_39.zip',
+        };
+        break;
+
+      // Host was isolated (disconnected from network)
+      case 1001:
+        activityData = {
+          accountName: 'Elastic',
+          computerName: this.randomHostname(),
+          fullScopeDetails: 'Group Default Group in Site Default site of Account Elastic',
+          fullScopeDetailsPath: 'Global / Elastic / Default site / Default Group',
+          groupName: 'Default Group',
+          ipAddress: null,
+          realUser: null,
+          scopeLevel: 'Group',
+          scopeName: 'Default Group',
+          siteName: 'Default site',
+          sourceType: 'API',
+        };
+        break;
+
+      // Host was release (re-connected to the network)
+      case 1002:
+        activityData = {
+          accountName: 'Elastic',
+          computerName: this.randomHostname(),
+          fullScopeDetails: 'Group Default Group in Site Default site of Account Elastic',
+          fullScopeDetailsPath: 'Global / Elastic / Default site / Default Group',
+          groupName: 'Default Group',
+          ipAddress: null,
+          realUser: null,
+          scopeLevel: 'Group',
+          scopeName: 'Default Group',
+          siteName: 'Default site',
+          sourceType: 'API',
+        };
+        break;
+    }
+
+    return activityData as SentinelOneActivityRecord<TData>['data'];
+  }
+
+  generateSentinelOneApiAgentsResponse(
+    agentDetailsOverrides: DeepPartial<SentinelOneGetAgentsResponse['data'][number]> = {}
+  ): SentinelOneGetAgentsResponse {
+    const id = agentDetailsOverrides.id || agentDetailsOverrides.uuid || this.seededUUIDv4();
+
+    const agent: SentinelOneGetAgentsResponse['data'][number] = {
+      accountId: this.seededUUIDv4(),
+      accountName: 'Elastic',
+      activeDirectory: {
+        computerDistinguishedName: null,
+        computerMemberOf: [],
+        lastUserDistinguishedName: null,
+        lastUserMemberOf: [],
+        mail: null,
+        userPrincipalName: null,
+      },
+      activeThreats: 0,
+      agentVersion: '23.4.2.14',
+      allowRemoteShell: true,
+      appsVulnerabilityStatus: 'not_applicable',
+      cloudProviders: {},
+      computerName: this.randomHostname(),
+      consoleMigrationStatus: 'N/A',
+      coreCount: 1,
+      cpuCount: 1,
+      cpuId: 'ARM Cortex-A72',
+      createdAt: this.randomPastDate(),
+      detectionState: null,
+      domain: 'unknown',
+      encryptedApplications: false,
+      externalId: '',
+      externalIp: this.randomIP(),
+      firewallEnabled: false,
+      firstFullModeTime: null,
+      fullDiskScanLastUpdatedAt: this.randomPastDate(),
+      groupId: '1392053568591146999',
+      groupIp: '108.77.84.x',
+      groupName: 'Default Group',
+      id,
+      inRemoteShellSession: false,
+      infected: false,
+      installerType: '.deb',
+      isActive: true,
+      isDecommissioned: false,
+      isPendingUninstall: false,
+      isUninstalled: false,
+      isUpToDate: true,
+      lastActiveDate: this.randomPastDate(),
+      lastIpToMgmt: this.randomIP(),
+      lastLoggedInUserName: '',
+      licenseKey: '',
+      locationEnabled: false,
+      locationType: 'not_supported',
+      locations: null,
+      machineType: 'server',
+      mitigationMode: 'detect',
+      mitigationModeSuspicious: 'detect',
+      modelName: 'QEMU QEMU Virtual Machine',
+      policyUpdatedAt: null,
+      groupUpdatedAt: null,
+      networkInterfaces: [
+        {
+          gatewayIp: '192.168.64.1',
+          gatewayMacAddress: 'be:d0:74:50:d8:64',
+          id: '1913920934593053818',
+          inet: ['192.168.64.2'],
+          inet6: ['fdf4:f033:b1d4:8c51:5054:ff:fe5b:15e7'],
+          name: 'enp0s1',
+          physical: '52:54:00:5B:15:E7',
+        },
+      ],
+      networkQuarantineEnabled: false,
+      networkStatus: 'connected',
+      operationalState: 'na',
+      operationalStateExpiration: null,
+      osArch: '64 bit',
+      osName: 'Linux',
+      osRevision: 'Ubuntu 22.04.4 LTS 5.15.0-102-generic',
+      osStartTime: '2024-04-16T22:48:33Z',
+      osType: 'linux',
+      osUsername: 'root',
+      rangerStatus: 'Enabled',
+      rangerVersion: '23.4.1.1',
+      registeredAt: '2024-03-25T16:59:14.860010Z',
+      remoteProfilingState: 'disabled',
+      remoteProfilingStateExpiration: null,
+      scanAbortedAt: null,
+      scanFinishedAt: '2024-03-25T17:21:43.371381Z',
+      scanStartedAt: '2024-03-25T17:00:19.774123Z',
+      scanStatus: 'finished',
+      serialNumber: null,
+      showAlertIcon: false,
+      siteId: '1392053568582758390',
+      siteName: 'Default site',
+      storageName: null,
+      storageType: null,
+      tags: { sentinelone: [] },
+      threatRebootRequired: false,
+      totalMemory: 1966,
+      updatedAt: this.randomPastDate(),
+      userActionsNeeded: [],
+      uuid: id,
+    };
+
+    return {
+      pagination: { totalItems: 1, nextCursor: null },
+      data: [merge(agent, agentDetailsOverrides)],
+      errors: null,
+    };
+  }
 }
+
+// Activity types from SentinelOne. Values can be retrieved from the SentineOne API at:
+//  `/web/api/v2.1/activities/types`
+const sentinelOneActivityTypes: Record<string, string> = {
+  '2': 'Hash Defined as Malicious By Cloud',
+  '5': 'Agent Software Update Downloaded',
+  '6': '',
+  '7': '',
+  '8': '',
+  '15': 'User Marked Agent As Up To Date',
+  '16': 'Agent software updated',
+  '17': 'Agent subscribed',
+  '18': 'New Threat Mitigated',
+  '19': 'New Malicious Threat Not Mitigated',
+  '20': 'New Threat Preemptive Block',
+  '21': 'Threat Resolved',
+  '22': 'Threat Benign',
+  '23': 'User Added',
+  '24': 'User Modified',
+  '25': 'User Deleted',
+  '26': 'Management Updated',
+  '27': 'User Logged In',
+  '28': 'Activity Marked As Resolved By Cloud',
+  '29': 'Activity Marked As Unresolved By Cloud',
+  '30': '',
+  '31': '',
+  '32': '',
+  '33': 'User Logged Out',
+  '34': 'Threat Unresolved',
+  '35': 'Verification email',
+  '36': 'Verification complete',
+  '37': 'User modified',
+  '38': 'Immune Settings Modified',
+  '39': 'Research Settings Modified',
+  '40': 'Cloud Intelligence Settings Modified',
+  '41': 'Learning Mode Settings Modified',
+  '42': 'Global 2FA modified',
+  '43': 'Agent updated',
+  '44': 'Auto decommission On',
+  '45': 'Auto decommission Off',
+  '46': 'Auto Decommission Period Modified',
+  '47': 'Agent Decommissioned',
+  '48': 'Agent Recommissioned',
+  '49': 'Agent Request Uninstall',
+  '50': 'Uninstall Agent',
+  '51': 'Agent Uninstalled',
+  '52': 'User Approved Agent Uninstall Request',
+  '53': 'User Rejected Agent Uninstall Request',
+  '54': 'User Decommissioned Agent',
+  '55': 'User Recommissioned Agent',
+  '56': 'Auto Mitigation Actions Modified',
+  '57': 'Quarantine Network Settings Modified',
+  '58': 'Notification Option Level Modified',
+  '59': 'Event Severity Level Modified',
+  '60': 'Notification - Recipients Configuration Modified',
+  '61': 'User Disconnected Agent From Network',
+  '62': 'User Reconnected Agent to Network',
+  '63': 'User Shutdown Agent',
+  '64': 'User Requested Passphrase',
+  '65': 'User Requested Full Log Report',
+  '66': 'Agent Uploaded Full Log Report',
+  '67': 'User 2FA Modified',
+  '68': 'Engine Modified In Policy',
+  '69': 'Mitigation Policy Modified',
+  '70': 'Policy Setting - Agent Notification On Suspicious Modified',
+  '71': 'Scan Initiated',
+  '72': 'Scan Aborted',
+  '73': 'Scan New Agents Changed',
+  '74': 'Machine Restart',
+  '75': 'On Access Modified',
+  '76': 'Anti Tampering Modified',
+  '77': 'Agent UI Settings Modified',
+  '78': 'Snapshots Settings Modified',
+  '79': 'Agent Logging Modified',
+  '80': 'Agent Uploaded Fetched Files',
+  '81': 'User Requested Fetch Files',
+  '82': 'Monitor On Execute',
+  '83': 'Monitor On Write',
+  '84': 'Deep Visibility Settings Modified',
+  '85': 'User Requested Fetch Threat File',
+  '86': 'Agent Uploaded Threat File',
+  '87': 'Remote Shell Settings Modified',
+  '88': 'User Remote Shell Modified',
+  '89': 'User Requested Randomized Agent UUID',
+  '90': 'Agent Started Full Disk Scan',
+  '91': 'Agent Aborted Full Disk Scan',
+  '92': 'Agent Completed Full Disk Scan',
+  '93': "User Reset Agent's Local Config",
+  '94': 'User Moved Agent To Another Site',
+  '95': 'User Moved Agent to Group',
+  '96': 'User Moved Agent from Site',
+  '97': 'User Commanded Agent To Move To Another Console',
+  '98': 'Agent Was Not Moved To Another Console',
+  '99': 'Agent Successfully Moved To Another Console',
+  '101': "User Changed Agent's Customer Identifier",
+  '102': 'User Deleted',
+  '103': 'User Deleted',
+  '104': 'Global licenses modified',
+  '105': 'Deep Visibility Settings Modified',
+  '106': 'User Commanded Agents To Move To Another Console',
+  '107': 'User Created RBAC Role',
+  '108': 'User Edited RBAC Role',
+  '109': 'User Deleted RBAC Role',
+  '110': 'Enable API Token Generation',
+  '111': 'Disable API Token Generation',
+  '112': 'API token Generated',
+  '113': 'API Token Revoked',
+  '114': 'API Token Revoked',
+  '115': 'Windows Event Log Collection Modified',
+  '116': 'Policy Settings Modified',
+  '117': 'User Disabled Agent',
+  '118': 'User Enabled Agent',
+  '119': 'Agent Disabled',
+  '120': 'Agent Enabled',
+  '121': 'User Started Remote Profiling',
+  '122': 'User Stopped Remote Profiling',
+  '123': 'Remote Profiler Enabled',
+  '124': 'Remote Profiler Disabled',
+  '125': 'Disable Agent Error',
+  '126': 'Agent Disabled',
+  '127': 'Agent Disabled',
+  '128': 'Agent Disabled Because of Database Corruption',
+  '129': 'Allowed Domains Settings Changed',
+  '130': 'Opt-in To EA program',
+  '131': 'Opt-out From EA Program',
+  '132': 'EA Platform Settings Changed',
+  '133': 'Existing User Login Failure',
+  '134': 'Unknown User Login',
+  '135': 'Remote Profiler Completed',
+  '136': 'Remote Profiler Failure',
+  '137': 'Remote Profiler Upload Failure',
+  '138': 'User Started an Unrestricted Session',
+  '139': 'User Failed to Start an Unrestricted Session',
+  '140': 'Service User creation',
+  '141': 'Service User modification',
+  '142': 'Service User deletion',
+  '143': 'User Locked from Unrestricted Session',
+  '144': 'User Temporarily Locked',
+  '145': '2FA - Enroll',
+  '146': '2FA - Reset',
+  '147': '2FA - Configured',
+  '148': '2FA - Delete',
+  '150': 'Live Updates Policy Modified',
+  '151': 'Live Updates Policy Inheritance Setting Changed',
+  '160': 'Agent Update Pending User Action',
+  '161': 'Agent Update Canceled',
+  '162': 'Agent Update Failed',
+  '163': '',
+  '200': 'File Upload Settings Modified',
+  '201': 'File Upload Enabled/Disabled',
+  '203': 'User Downloaded File',
+  '204': 'Scheduled Report Removed',
+  '221': 'Threat Automatically Resolved',
+  '701': 'User Created Policy Override',
+  '702': 'User Updated Policy Override',
+  '703': 'User Deleted Policy Override',
+  '1001': 'Agent Disconnected From Network',
+  '1002': 'Agent Reconnected To Network',
+  '1023': 'SSO User Added',
+  '1024': 'SSO User Modified',
+  '1100': 'User Network Quarantine Container',
+  '1101': 'User Network Unquarantine Container',
+  '1102': 'User Network Quarantine Container',
+  '1103': 'User Network Unquarantine Container',
+  '1104': 'User Network Unquarantine Container',
+  '1105': 'User Network Quarantine Container',
+  '1501': 'Location Created',
+  '1502': 'Location Copied',
+  '1503': 'Location Modified',
+  '1504': 'Location Deleted',
+  '2001': 'Threat Mitigation Report Kill Success',
+  '2002': 'Threat Mitigation Report Remediate Success',
+  '2003': 'Threat Mitigation Report Rollback Success',
+  '2004': 'Threat Mitigation Report Quarantine Success',
+  '2005': '',
+  '2006': 'Threat Mitigation Report Kill Failed',
+  '2007': 'Threat Mitigation Report Remediate Failed',
+  '2008': 'Threat Mitigation Report Rollback Failed',
+  '2009': 'Threat Mitigation Report Quarantine Failed',
+  '2010': 'Agent Mitigation Report Quarantine Network Failed',
+  '2011': 'User Issued Kill Command',
+  '2012': 'User Issued Remediate Command',
+  '2013': 'User Issued Rollback Command',
+  '2014': 'User Issued Quarantine Command',
+  '2015': 'User Issued Unquarantine Command',
+  '2016': 'User Marked Application As Threat',
+  '2017': 'User Issued Remove Macros Command',
+  '2018': 'User Issued Restore Macros Command',
+  '2021': 'Threat Killed By Policy',
+  '2022': 'Threat Remediated By Policy',
+  '2023': 'Threat Rolled Back By Policy',
+  '2024': 'Threat Quarantined By Policy',
+  '2025': 'Agent Disconnected From Network Due to Threat Mitigation By Policy',
+  '2026': 'Threat Mitigation Report Unquarantine Success',
+  '2027': 'Threat Mitigation Report Unquarantine Failed',
+  '2028': 'Threat Incident Status Changed',
+  '2029': 'Ticket Number Changes',
+  '2030': 'Analyst Verdict Changes',
+  '2031': 'Threat Mitigation Report Kill Pending Reboot',
+  '2032': 'Threat Mitigation Report Remediate Pending Reboot',
+  '2033': 'Threat Mitigation Report Rollback Pending Reboot',
+  '2034': 'Threat Mitigation Report Quarantine Pending Reboot',
+  '2035': 'Threat Mitigation Report Unquarantine Pending Reboot',
+  '2036': 'Threat Confidence Level Changed By Agent',
+  '2037': 'Threat Confidence Level Changed By Cloud',
+  '2038': 'Threat Mitigation Report Remove Macros Success',
+  '2039': 'Threat Mitigation Report Remove Macros Failed',
+  '2040': 'Threat Mitigation Report Restore Macros Success',
+  '2041': 'Threat Mitigation Report Restore Macros Failed',
+  '2042': 'Threat Mitigation Report Remove Macros Pending Reboot',
+  '2043': 'Threat Mitigation Report Restore Macros Pending Reboot',
+  '2100': 'Upgrade Policy - Concurrency Limit Changed',
+  '2101': 'Upgrade Policy - Concurrency Limit Inheritance Changed',
+  '2110': 'Upgrade Policy - Maintenance Window Time Changed',
+  '2111': 'Upgrade Policy - Maintenance Window Time Inheritance Changed',
+  '3001': 'User Added Hash Exclusion',
+  '3002': 'User Added Blocklist Hash',
+  '3003': '',
+  '3004': '',
+  '3005': 'Cloud Added Hash Exclusion',
+  '3006': 'Cloud Added Blocklist Hash',
+  '3007': '',
+  '3008': 'New Path Exclusion',
+  '3009': 'New Signer Identity Exclusion',
+  '3010': 'New File Type Exclusion',
+  '3011': 'New Browser Type Exclusion',
+  '3012': 'Path Exclusion Modified',
+  '3013': 'Signer Identity Exclusion Modified',
+  '3014': 'File Type Exclusion Modified',
+  '3015': 'Browser Type Exclusion Modified',
+  '3016': 'Path Exclusion Deleted',
+  '3017': 'Signer Identity Exclusion Deleted',
+  '3018': 'File Type Exclusion Deleted',
+  '3019': 'Browser Type Exclusion Deleted',
+  '3020': 'User Deleted Hash From Blocklist',
+  '3021': 'User Deleted Hash Exclusion',
+  '3022': 'Cloud Deleted Hash Exclusion',
+  '3023': 'Cloud Deleted Blocklist Hash',
+  '3050': 'Identity Exclusion Created',
+  '3051': 'Identity Exclusion Updated',
+  '3052': 'Identity Exclusion Updated',
+  '3100': 'User Added Package',
+  '3101': 'User Modified Package',
+  '3102': 'User Deleted Package',
+  '3103': 'Package Deleted By System - Too Many Packages',
+  '3200': 'User Started Remote Shell',
+  '3201': 'Remote Shell Created',
+  '3202': 'Remote Shell Failed',
+  '3203': 'Remote Shell Terminated',
+  '3204': 'Remote Shell Terminated By User',
+  '3400': 'Agent Uploaded Remote Shell history',
+  '3500': 'User Toggled Ranger Status',
+  '3501': 'Ranger Settings Modified',
+  '3502': 'Ranger Network Settings Modified',
+  '3503': 'Ranger - Inventory Scan Completed',
+  '3505': 'Ranger - Devices Discovered',
+  '3506': 'Ranger - Device Review Modified',
+  '3507': 'Ranger - Device Tag Modified On Host',
+  '3520': 'Ranger Deploy - Master passphrase',
+  '3521': 'Ranger Deploy Initiated',
+  '3522': 'Ranger Deploy - Credential Group Created',
+  '3523': 'Ranger Deploy -Credential Group Edited',
+  '3524': 'Ranger Deploy - Credential Group Deleted',
+  '3525': 'Ranger Deploy - Credential Created',
+  '3526': 'Ranger Deploy - Credential Deleted',
+  '3527': 'Ranger Deploy - Credential Overridden',
+  '3530': 'Ranger Labels Updated',
+  '3531': 'Ranger labels reverted',
+  '3532': 'Ranger Deploy - Trusted Hosts',
+  '3533': 'Ranger Deploy - Linux Enforcement',
+  '3534': 'Ranger Deploy - PsDrive WMI Session',
+  '3600': 'Custom Rules - User Created A Rule',
+  '3601': 'Custom Rules - User Changed A Rule',
+  '3602': 'Custom Rules - User Deleted A Rule',
+  '3603': 'Custom Rules - Rule Status Changed',
+  '3604': 'Custom Rules - Rule Status Change Failed',
+  '3605': 'Custom Rules - Rule Will Expire Soon',
+  '3606': 'Custom Rules - Rule Expired',
+  '3607': 'Custom Rules - Rule Reached Alert Limit',
+  '3608': 'Custom Rules - New Alert',
+  '3610': 'Account Uninstall Password Viewed',
+  '3611': 'Account Uninstall Password Generated',
+  '3612': 'Account Uninstall Password Regenerated',
+  '3613': 'Account Uninstall Password Revoked',
+  '3614': 'Agent Started On-Demand Disk Scan',
+  '3615': 'Agent Aborted On-Demand Scan',
+  '3616': 'New Script Created',
+  '3617': 'Agent Completed On-Demand Scan',
+  '3618': 'Script Action Initiated',
+  '3620': 'Manual CIS Scan Initiated',
+  '3621': 'Manual CIS scan Completed',
+  '3622': 'Script Deleted',
+  '3623': 'Script Updated',
+  '3624': 'User 2FA Verification Success',
+  '3625': 'User 2FA Verification Failed',
+  '3626': 'User 2FA Email Verification Changed',
+  '3627': 'User 2FA Verification Sent',
+  '3628': '2FA Code Verification',
+  '3629': 'Login Using Saved 2FA Recovery Code',
+  '3630': 'Live Update Sent To Agent',
+  '3631': 'Live Update Merged To Agent',
+  '3632': 'Live Update Not Merged To Agent',
+  '3633': 'Marketplace - App Installed',
+  '3634': 'Marketplace - App Deleted',
+  '3635': 'Marketplace - App Disabled',
+  '3636': 'Marketplace - App Enabled',
+  '3637': 'Marketplace - App Edit',
+  '3638': 'Marketplace - App Disabled Error',
+  '3639': 'Marketplace - App Disabled Error',
+  '3640': 'Ranger Self Provisioning',
+  '3641': 'Ranger self Provisioning Default Features Modified',
+  '3642': 'Ranger Self Provisioning Site Features Change',
+  '3650': 'Tag Manager - User Created New Tag',
+  '3651': 'Tag Manager - User Modified Tag',
+  '3652': 'Tag Manager - User Deleted Tag',
+  '3653': 'Tag Manager - User Attached Tag',
+  '3654': 'Tag Manager - User Detached Tag',
+  '3655': 'Tag Detached Because Tag Deleted',
+  '3656': 'Tag Manager - Tag Detached Because Scope Changed',
+  '3660': 'Vulnerability scan triggered',
+  '3661': 'User Add Missing CVE To Application',
+  '3662': 'User Marked CVE as False Positive on Application',
+  '3663': 'User created a vulnerability ticket',
+  '3664': 'User Enabled Extensive Scan',
+  '3665': 'User Disabled Extensive Scan',
+  '3666': 'User Enabled Linux Extensive Scan',
+  '3667': 'User Disabled Linux Extensive Scan',
+  '3668': 'User Enabled Vulnerability Scan',
+  '3669': 'User Disabled Vulnerability Scan',
+  '3670': 'User Modified Inheritance',
+  '3701': 'XDR - User Initiated Action',
+  '3702': 'XDR - Application Action Response',
+  '3710': 'User Reset Password with Forgot Password from the Login',
+  '3711': 'User Changed Their Password',
+  '3712': 'Prompt Reset Password',
+  '3714': 'User Changed Their Password Due To Expiration',
+  '3715': 'User Reset Password by Admin Request',
+  '3720': 'CIS Skip Created',
+  '3721': 'CIS Skip Deleted',
+  '3730': 'User Requested Set Password On Next Login',
+  '3750': 'Auto-Upgrade Policy Created',
+  '3751': 'Auto-Upgrade Policy Disabled',
+  '3752': 'Auto-Upgrade Policy Activated',
+  '3753': 'Auto-Upgrade Policy Deleted',
+  '3754': 'Auto-Upgrade Policy Reordered',
+  '3755': 'Upgrade Policy Inheritance Setting Changed',
+  '3756': 'Auto-Upgrade Policy Edited',
+  '3757': 'Custom Rules - New Alert',
+  '3767': 'Local Upgrade Authorized',
+  '3768': 'Local Upgrade Authorized',
+  '3769': 'Local Upgrade Authorized',
+  '3770': 'Local Upgrade Authorization Expiry Date Changed',
+  '3771': 'Local Upgrade Authorization Expiry Date Changed',
+  '3772': 'Local Upgrade Unauthorized',
+  '3773': 'Local Upgrade Authorization Inherits from Site Level',
+  '3774': 'Local Upgrade Authorization Inherits from Site Level',
+  '3775': 'Downloaded list of authorized agents',
+  '4001': 'Suspicious Threat Was Marked As Threat',
+  '4002': 'Suspicious Threat Was Resolved',
+  '4003': 'New Suspicious Threat Not Mitigated',
+  '4004': 'Policy Setting - Show Suspicious Activities Configuration Enabled',
+  '4005': 'Policy Setting - Show Suspicious Activities Configuration Disabled',
+  '4006': 'Session Timeout Timeout Modified',
+  '4007': 'Suspicious Threat Was Marked As Benign',
+  '4008': 'Threat Mitigation Status Changed',
+  '4009': 'Process Was Marked As Threat',
+  '4010': '',
+  '4011': 'Suspicious Threat Was Unresolved',
+  '4012': 'UI Inactivity Timeout Modified',
+  '4013': 'Password Expiration Modified',
+  '4020': 'New Threat Note Added',
+  '4021': 'Threat Note Updated',
+  '4022': 'Threat Note Deleted',
+  '4100': 'User Marked Deep Visibility Event As Threat',
+  '4101': 'User Marked Deep Visibility Event As Suspicious',
+  '4102': 'Agent Failed To Mark Deep Visibility Event As Threat',
+  '4103': 'Agent Failed To Mark Deep Visibility Event As Suspicious',
+  '4104': 'STAR Manual Response Marked Event As Malicious',
+  '4105': 'STAR Manual Response Marked Event As Suspicious',
+  '4106': 'STAR Active Response Marked Event As Malicious',
+  '4107': 'STAR Active Response Marked Event As Suspicious',
+  '4108': 'New Malicious Threat Not Mitigated',
+  '4109': 'New Suspicious Threat Not Mitigated',
+  '4110': 'Singularity Threat Intelligence Engine Marked Event As Malicious',
+  '4111': 'Watchtower Cloud Detection Engine Marked Event As Threat',
+  '4112': 'Watchtower Cloud Detection Engine Marked Event As Suspicious',
+  '4113': 'Singularity Threat Intelligence Engine Marked Event As Suspicious',
+  '5000': 'AD Sync Started',
+  '5001': 'AD Sync Finished',
+  '5002': 'Dynamic Group Creation Started',
+  '5003': 'Dynamic Group Creation Finished',
+  '5004': 'Dynamic Group Update Started',
+  '5005': 'Dynamic Group Update Finished',
+  '5006': 'Group Deleted',
+  '5007': 'Group Info Changed',
+  '5008': 'User created a Manual or Pinned Group',
+  '5009': 'Agent Moved To A Different Group',
+  '5010': 'Group Ranking Changed',
+  '5011': 'Group Policy Reverted',
+  '5012': 'Group Token Regenerated',
+  '5013': 'Group Deleted Because Site Deleted',
+  '5020': 'Site Created',
+  '5021': 'Site Modified',
+  '5022': 'Site Deleted',
+  '5023': 'Site Expired',
+  '5024': 'Site Policy Reverted',
+  '5025': 'Site Marked As Expired',
+  '5026': 'Site Duplicated',
+  '5027': 'Site Token Regenerated',
+  '5028': 'Site Expired Because Account Expired',
+  '5029': 'Site Deleted Because Account Deleted',
+  '5040': 'Account Created',
+  '5041': 'Account Modified',
+  '5042': 'Account Deleted',
+  '5043': 'Account Expired',
+  '5044': 'Account Policy Reverted',
+  '5045': 'Account Marked As Expired',
+  '5120': 'Device Rule Created',
+  '5121': 'Device Rule Modified',
+  '5122': 'Device Rule Deleted',
+  '5123': 'Device Rules Reordered',
+  '5124': 'Device Rules Settings Modified',
+  '5125': 'Device Control Blocked Event',
+  '5126': 'Device Control Approved Event',
+  '5127': 'Device Rule Moved From Scope',
+  '5128': 'Device Rule Moved To Scope',
+  '5129': 'Device Rule Copied To Scope',
+  '5220': 'Firewall Rule Created',
+  '5221': 'Firewall Rule Modified',
+  '5222': 'Firewall Rule Deleted',
+  '5225': 'Firewall Control Settings Modified',
+  '5226': 'Firewall Rules Reordered',
+  '5227': 'User Initiated Fetch Firewall Rules From Agent',
+  '5228': 'Agent Uploaded Firewall Rules',
+  '5229': 'Firewall Rule Moved From Scope',
+  '5230': 'Firewall Rule Moved To Scope',
+  '5231': 'Firewall Rule Copied To Scope',
+  '5232': 'Firewall Control Blocked Event',
+  '5233': 'User Requested Firewall Logging',
+  '5234': 'Network Quarantine Rule Created',
+  '5235': 'Network Quarantine Rule Modified',
+  '5236': 'Network Quarantine Rule Deleted',
+  '5237': 'Network Quarantine Control Settings Modified',
+  '5238': 'Network Quarantine Rules Reordered',
+  '5239': 'Network Quarantine Rule Moved From Scope',
+  '5240': 'Network Quarantine Rule Moved To Scope',
+  '5241': 'Network Quarantine Rule Copied To Scope',
+  '5242': 'Ranger - Device Tag Created',
+  '5243': 'Ranger - Device Tag Updated',
+  '5244': 'Ranger - Device Tag Deleted',
+  '5250': 'Firewall Control Tag Created',
+  '5251': 'Firewall Control Tag Updated',
+  '5252': 'Firewall Control Tag Updated',
+  '5253': 'Network Quarantine Control Tag Created',
+  '5254': 'Network Quarantine Control Tag Updated',
+  '5255': 'Network Quarantine Control Tag Deleted',
+  '5256': 'Firewall Control Tag Added/Removed From Rule',
+  '5257': 'Firewall Control Tag Inherited',
+  '5258': 'Network Quarantine Control Tag Added/Removed From Rule',
+  '5259': 'Network Quarantine Control Tag Inherited',
+  '6000': 'Mobile Policy updated',
+  '6001': 'Mobile Policy created',
+  '6002': 'Mobile Policy removed',
+  '6010': 'UEM Connection created',
+  '6011': 'UEM Connection updated',
+  '6012': 'UEM Connection Removed',
+  '6013': 'UEM Connection Synced',
+  '6030': 'Mobile Device Updated',
+  '6031': 'Mobile Device Created',
+  '6032': 'Mobile Device Removed',
+  '6050': 'Mobile Incident Detected',
+  '6051': 'Mobile Incident Mitigated',
+  '6052': 'Mobile Incident Automatically Resolved',
+  '6053': 'Mobile Incident Resolved',
+  '6054': 'Mobile Incident Status Changed',
+  '6055': 'Mobile Incident Analyst Verdict Changed',
+  '6999': 'Unknown mobile activity',
+  '7100': 'Exclusion import',
+  '7101': 'Blacklist import',
+  '7200': 'Add cloud account',
+  '7201': 'Disable cloud Account',
+  '7202': 'Enable cloud Account',
+  '7203': 'Disable and Purge cloud (AKA Delete)',
+  '7210': 'Add cloud policy',
+  '7211': 'Update cloud policy',
+  '7212': 'Delete cloud policy',
+  '7500': 'Remote Ops Password Configured',
+  '7501': 'Remote Ops Password Deleted',
+  '7502': 'Forensics Profile Executed',
+  '7503': 'Forensics Profile Created',
+  '7504': 'Forensics Profile Modified',
+  '7505': 'Forensics Profile Deleted',
+  '7600': 'User Submitted Script Execution For Review',
+  '7601': 'User Approved Script Execution',
+  '7602': 'User Edited Run Script Guardrails',
+  '7603': 'User Enabled Run Script Guardrails',
+  '7604': 'User Disabled Run Script Guardrails',
+  '7700': 'User Added New AD configuration',
+  '7701': 'User Updated AD configuration',
+  '7702': 'User Deleted AD configuration',
+  '7800': 'User Deployed AD Connector',
+  '7801': 'User Updated AD Connector',
+  '7802': 'User Deleted AD Connector',
+  '7830': 'Ranger AD Scan Completed',
+  '7831': 'AD Assessment Detected New Exposure',
+  '7853': 'User Triggered AD Exposure Assessment',
+  '7854': 'User Exported AD Exposure',
+  '7855': 'User Performed AD Exposure Skip',
+  '7856': 'User Performed AD Exposure Unskip',
+  '7857': 'User Performed AD Exposure Ack',
+  '7858': 'User Performed AD Exposure Unack',
+  '7860': 'User Created Mitigation Task',
+  '7861': 'User Created Mitigation Task',
+  '7862': 'User Downloaded Mitigation Script',
+  '7863': 'User Ran Mitigation Script',
+  '7870': 'User updated application status',
+  '7871': 'User updated application with spesific version status',
+  '7872': 'User updated application status',
+  '7900': 'Vigilance Response Policy Modified',
+  '7901': 'Vigilance Response Policy Inheritance Modified',
+  '7902': 'Vigilance Escalation Contacts Modified',
+  '7903': 'Vigilance Escalation Contacts Inheritance Modified',
+  '8001': 'Sign SAML Request - Enabled / Disabled',
+  '8002': 'Accessing Protected Actions Configuration',
+  '9001': 'User Added Deep Visibility Exclusion',
+  '9002': 'User Deleted Deep Visibility Exclusion',
+  '10000': 'Agent Failed To Move To Another Console',
+};
diff --git a/x-pack/plugins/security_solution/common/endpoint/service/authz/authz.test.ts b/x-pack/plugins/security_solution/common/endpoint/service/authz/authz.test.ts
index a3b3ebaf261421..b5e4e874c75372 100644
--- a/x-pack/plugins/security_solution/common/endpoint/service/authz/authz.test.ts
+++ b/x-pack/plugins/security_solution/common/endpoint/service/authz/authz.test.ts
@@ -98,6 +98,27 @@ describe('Endpoint Authz service', () => {
       );
     });
 
+    it('should not give canReadFleetAgents if `fleet.readAgents` is false', () => {
+      fleetAuthz.fleet.readAgents = false;
+      expect(calculateEndpointAuthz(licenseService, fleetAuthz, userRoles).canReadFleetAgents).toBe(
+        false
+      );
+    });
+
+    it('should not give canWriteFleetAgents if `fleet.allAgents` is false', () => {
+      fleetAuthz.fleet.allAgents = false;
+      expect(
+        calculateEndpointAuthz(licenseService, fleetAuthz, userRoles).canWriteFleetAgents
+      ).toBe(false);
+    });
+
+    it('should not give canReadFleetAgentPolicies if `fleet.readAgentPolicies` is false', () => {
+      fleetAuthz.fleet.readAgentPolicies = false;
+      expect(
+        calculateEndpointAuthz(licenseService, fleetAuthz, userRoles).canReadFleetAgentPolicies
+      ).toBe(false);
+    });
+
     it('should not give canAccessEndpointManagement if not superuser', () => {
       userRoles = [];
       expect(
@@ -276,6 +297,9 @@ describe('Endpoint Authz service', () => {
         canWriteSecuritySolution: false,
         canReadSecuritySolution: false,
         canAccessFleet: false,
+        canReadFleetAgentPolicies: false,
+        canReadFleetAgents: false,
+        canWriteFleetAgents: false,
         canAccessEndpointActionsLogManagement: false,
         canAccessEndpointManagement: false,
         canCreateArtifactsByPolicy: false,
diff --git a/x-pack/plugins/security_solution/common/endpoint/service/authz/authz.ts b/x-pack/plugins/security_solution/common/endpoint/service/authz/authz.ts
index f38a636b782116..95430a6df82fb4 100644
--- a/x-pack/plugins/security_solution/common/endpoint/service/authz/authz.ts
+++ b/x-pack/plugins/security_solution/common/endpoint/service/authz/authz.ts
@@ -98,6 +98,9 @@ export const calculateEndpointAuthz = (
     canWriteSecuritySolution,
     canReadSecuritySolution,
     canAccessFleet: fleetAuthz?.fleet.all ?? false,
+    canReadFleetAgentPolicies: fleetAuthz?.fleet.readAgentPolicies ?? false,
+    canWriteFleetAgents: fleetAuthz?.fleet.allAgents ?? false,
+    canReadFleetAgents: fleetAuthz?.fleet.readAgents ?? false,
     canAccessEndpointManagement: hasEndpointManagementAccess, // TODO: is this one deprecated? it is the only place we need to check for superuser.
     canCreateArtifactsByPolicy: isPlatinumPlusLicense,
     canWriteEndpointList,
@@ -157,6 +160,9 @@ export const getEndpointAuthzInitialState = (): EndpointAuthz => {
     canWriteSecuritySolution: false,
     canReadSecuritySolution: false,
     canAccessFleet: false,
+    canReadFleetAgentPolicies: false,
+    canReadFleetAgents: false,
+    canWriteFleetAgents: false,
     canAccessEndpointActionsLogManagement: false,
     canAccessEndpointManagement: false,
     canCreateArtifactsByPolicy: false,
diff --git a/x-pack/plugins/security_solution/common/endpoint/types/authz.ts b/x-pack/plugins/security_solution/common/endpoint/types/authz.ts
index 1ec8f84a870736..0ccefaa686f721 100644
--- a/x-pack/plugins/security_solution/common/endpoint/types/authz.ts
+++ b/x-pack/plugins/security_solution/common/endpoint/types/authz.ts
@@ -16,6 +16,12 @@ export interface EndpointAuthz {
   canReadSecuritySolution: boolean;
   /** If the user has permissions to access Fleet */
   canAccessFleet: boolean;
+  /** If the user has permissions to access Fleet Agent policies */
+  canReadFleetAgentPolicies: boolean;
+  /** If the user has permissions to read Fleet Agents */
+  canReadFleetAgents: boolean;
+  /** If the user has permissions to write Fleet Agents */
+  canWriteFleetAgents: boolean;
   /** If the user has permissions to access Endpoint management (includes check to ensure they also have access to fleet) */
   canAccessEndpointManagement: boolean;
   /** If the user has permissions to access Actions Log management and also has a platinum license (used for endpoint details flyout) */
diff --git a/x-pack/plugins/security_solution/common/experimental_features.ts b/x-pack/plugins/security_solution/common/experimental_features.ts
index 175a40288b9d8b..66d9cedd249331 100644
--- a/x-pack/plugins/security_solution/common/experimental_features.ts
+++ b/x-pack/plugins/security_solution/common/experimental_features.ts
@@ -133,11 +133,6 @@ export const allowedExperimentalValues = Object.freeze({
    */
   alertsPageFiltersEnabled: true,
 
-  /**
-   * Enables the Attack discovery feature and API endpoint
-   */
-  attackDiscoveryEnabled: false,
-
   /**
    * Enables the Assistant Model Evaluation advanced setting and API endpoint, introduced in `8.11.0`.
    */
@@ -208,6 +203,11 @@ export const allowedExperimentalValues = Object.freeze({
    */
   crowdstrikeDataInAnalyzerEnabled: false,
 
+  /**
+   * Enables experimental JAMF integration data to be available in Analyzer
+   */
+  jamfDataInAnalyzerEnabled: false,
+
   /**
    * Enables experimental "Updates" tab in the prebuilt rule upgrade flyout.
    * This tab shows the JSON diff between the installed prebuilt rule
@@ -255,7 +255,7 @@ export const allowedExperimentalValues = Object.freeze({
   /**
    *  Enables Security AI Assistant's Flyout mode
    */
-  aiAssistantFlyoutMode: false,
+  aiAssistantFlyoutMode: true,
 
   /**
    * Enables the new modal for the value list items
diff --git a/x-pack/plugins/security_solution/kibana.jsonc b/x-pack/plugins/security_solution/kibana.jsonc
index c9f4b85b8c3d89..14741ec4c37e05 100644
--- a/x-pack/plugins/security_solution/kibana.jsonc
+++ b/x-pack/plugins/security_solution/kibana.jsonc
@@ -53,6 +53,7 @@
       "notifications",
       "savedSearch",
       "unifiedDocViewer",
+      "charts"
     ],
     "optionalPlugins": [
       "cloudExperiments",
diff --git a/x-pack/plugins/security_solution/public/actions/jest.config.js b/x-pack/plugins/security_solution/public/actions/jest.config.js
deleted file mode 100644
index 0c09f187ec9837..00000000000000
--- a/x-pack/plugins/security_solution/public/actions/jest.config.js
+++ /dev/null
@@ -1,24 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-module.exports = {
-  preset: '@kbn/test',
-  rootDir: '../../../../..',
-  roots: ['<rootDir>/x-pack/plugins/security_solution/public/actions'],
-  coverageDirectory:
-    '<rootDir>/target/kibana-coverage/jest/x-pack/plugins/security_solution/public/actions',
-  coverageReporters: ['text', 'html'],
-  collectCoverageFrom: ['<rootDir>/x-pack/plugins/security_solution/public/actions/**/*.{ts,tsx}'],
-  // See: https://github.com/elastic/kibana/issues/117255, the moduleNameMapper creates mocks to avoid memory leaks from kibana core.
-  moduleNameMapper: {
-    'core/server$': '<rootDir>/x-pack/plugins/security_solution/server/__mocks__/core.mock.ts',
-    'task_manager/server$':
-      '<rootDir>/x-pack/plugins/security_solution/server/__mocks__/task_manager.mock.ts',
-    'alerting/server$': '<rootDir>/x-pack/plugins/security_solution/server/__mocks__/alert.mock.ts',
-    'actions/server$': '<rootDir>/x-pack/plugins/security_solution/server/__mocks__/action.mock.ts',
-  },
-};
diff --git a/x-pack/plugins/security_solution/public/actions/add_to_timeline/cell_action/add_to_timeline.test.ts b/x-pack/plugins/security_solution/public/app/actions/add_to_timeline/cell_action/add_to_timeline.test.ts
similarity index 95%
rename from x-pack/plugins/security_solution/public/actions/add_to_timeline/cell_action/add_to_timeline.test.ts
rename to x-pack/plugins/security_solution/public/app/actions/add_to_timeline/cell_action/add_to_timeline.test.ts
index 3a47134531d37a..dfdc2a5ede83fd 100644
--- a/x-pack/plugins/security_solution/public/actions/add_to_timeline/cell_action/add_to_timeline.test.ts
+++ b/x-pack/plugins/security_solution/public/app/actions/add_to_timeline/cell_action/add_to_timeline.test.ts
@@ -5,13 +5,13 @@
  * 2.0.
  */
 
-import type { SecurityAppStore } from '../../../common/store/types';
-import { TimelineId } from '../../../../common/types';
-import { addProvider } from '../../../timelines/store/actions';
+import type { SecurityAppStore } from '../../../../common/store/types';
+import { TimelineId } from '../../../../../common/types';
+import { addProvider } from '../../../../timelines/store/actions';
 import { createAddToTimelineCellActionFactory } from './add_to_timeline';
 import type { CellActionExecutionContext } from '@kbn/cell-actions';
-import { GEO_FIELD_TYPE } from '../../../timelines/components/timeline/body/renderers/constants';
-import { createStartServicesMock } from '../../../common/lib/kibana/kibana_react.mock';
+import { GEO_FIELD_TYPE } from '../../../../timelines/components/timeline/body/renderers/constants';
+import { createStartServicesMock } from '../../../../common/lib/kibana/kibana_react.mock';
 import { set } from 'lodash/fp';
 import { KBN_FIELD_TYPES } from '@kbn/field-types';
 
diff --git a/x-pack/plugins/security_solution/public/actions/add_to_timeline/cell_action/add_to_timeline.ts b/x-pack/plugins/security_solution/public/app/actions/add_to_timeline/cell_action/add_to_timeline.ts
similarity index 89%
rename from x-pack/plugins/security_solution/public/actions/add_to_timeline/cell_action/add_to_timeline.ts
rename to x-pack/plugins/security_solution/public/app/actions/add_to_timeline/cell_action/add_to_timeline.ts
index 1b40784dcec4d6..695569e98ee97b 100644
--- a/x-pack/plugins/security_solution/public/actions/add_to_timeline/cell_action/add_to_timeline.ts
+++ b/x-pack/plugins/security_solution/public/app/actions/add_to_timeline/cell_action/add_to_timeline.ts
@@ -5,19 +5,18 @@
  * 2.0.
  */
 
-import { createCellActionFactory } from '@kbn/cell-actions';
-import type { CellActionTemplate } from '@kbn/cell-actions';
+import { createCellActionFactory, type CellActionTemplate } from '@kbn/cell-actions/actions';
 import {
   isTypeSupportedByDefaultActions,
   isValueSupportedByDefaultActions,
   filterOutNullableValues,
   valueToArray,
-} from '@kbn/cell-actions/src/actions/utils';
+} from '@kbn/cell-actions/actions/utils';
 import { ACTION_INCOMPATIBLE_VALUE_WARNING } from '@kbn/cell-actions/src/actions/translations';
 import type { KBN_FIELD_TYPES } from '@kbn/field-types';
-import { addProvider } from '../../../timelines/store/actions';
-import { TimelineId } from '../../../../common/types';
-import type { SecurityAppStore } from '../../../common/store';
+import { addProvider } from '../../../../timelines/store/actions';
+import { TimelineId } from '../../../../../common/types';
+import type { SecurityAppStore } from '../../../../common/store';
 import { fieldHasCellActions } from '../../utils';
 import {
   ADD_TO_TIMELINE,
@@ -28,7 +27,7 @@ import {
 } from '../constants';
 import { createDataProviders, isValidDataProviderField } from '../data_provider';
 import { SecurityCellActionType } from '../../constants';
-import type { StartServices } from '../../../types';
+import type { StartServices } from '../../../../types';
 import type { SecurityCellAction } from '../../types';
 
 export const createAddToTimelineCellActionFactory = createCellActionFactory(
diff --git a/x-pack/plugins/security_solution/public/actions/add_to_timeline/cell_action/investigate_in_new_timeline.test.ts b/x-pack/plugins/security_solution/public/app/actions/add_to_timeline/cell_action/investigate_in_new_timeline.test.ts
similarity index 93%
rename from x-pack/plugins/security_solution/public/actions/add_to_timeline/cell_action/investigate_in_new_timeline.test.ts
rename to x-pack/plugins/security_solution/public/app/actions/add_to_timeline/cell_action/investigate_in_new_timeline.test.ts
index ee1d1ec579f12d..d7750dd1cd4cd4 100644
--- a/x-pack/plugins/security_solution/public/actions/add_to_timeline/cell_action/investigate_in_new_timeline.test.ts
+++ b/x-pack/plugins/security_solution/public/app/actions/add_to_timeline/cell_action/investigate_in_new_timeline.test.ts
@@ -5,14 +5,14 @@
  * 2.0.
  */
 
-import type { SecurityAppStore } from '../../../common/store/types';
-import { TimelineId } from '../../../../common/types';
-import { addProvider, showTimeline } from '../../../timelines/store/actions';
+import type { SecurityAppStore } from '../../../../common/store/types';
+import { TimelineId } from '../../../../../common/types';
+import { addProvider, showTimeline } from '../../../../timelines/store/actions';
 import { createInvestigateInNewTimelineCellActionFactory } from './investigate_in_new_timeline';
 import type { CellActionExecutionContext } from '@kbn/cell-actions';
-import { GEO_FIELD_TYPE } from '../../../timelines/components/timeline/body/renderers/constants';
-import { createStartServicesMock } from '../../../common/lib/kibana/kibana_react.mock';
-import { timelineActions } from '../../../timelines/store';
+import { GEO_FIELD_TYPE } from '../../../../timelines/components/timeline/body/renderers/constants';
+import { createStartServicesMock } from '../../../../common/lib/kibana/kibana_react.mock';
+import { timelineActions } from '../../../../timelines/store';
 import { KBN_FIELD_TYPES } from '@kbn/field-types';
 
 const services = createStartServicesMock();
diff --git a/x-pack/plugins/security_solution/public/actions/add_to_timeline/cell_action/investigate_in_new_timeline.ts b/x-pack/plugins/security_solution/public/app/actions/add_to_timeline/cell_action/investigate_in_new_timeline.ts
similarity index 88%
rename from x-pack/plugins/security_solution/public/actions/add_to_timeline/cell_action/investigate_in_new_timeline.ts
rename to x-pack/plugins/security_solution/public/app/actions/add_to_timeline/cell_action/investigate_in_new_timeline.ts
index 2c9dd401d415af..ac0be8ea9eb15c 100644
--- a/x-pack/plugins/security_solution/public/actions/add_to_timeline/cell_action/investigate_in_new_timeline.ts
+++ b/x-pack/plugins/security_solution/public/app/actions/add_to_timeline/cell_action/investigate_in_new_timeline.ts
@@ -5,19 +5,19 @@
  * 2.0.
  */
 
-import { createCellActionFactory, type CellActionTemplate } from '@kbn/cell-actions';
 import type { KBN_FIELD_TYPES } from '@kbn/field-types';
+import { createCellActionFactory, type CellActionTemplate } from '@kbn/cell-actions/actions';
 import {
   isTypeSupportedByDefaultActions,
   isValueSupportedByDefaultActions,
-  valueToArray,
   filterOutNullableValues,
-} from '@kbn/cell-actions/src/actions/utils';
+  valueToArray,
+} from '@kbn/cell-actions/actions/utils';
 import { ACTION_INCOMPATIBLE_VALUE_WARNING } from '@kbn/cell-actions/src/actions/translations';
-import { timelineActions } from '../../../timelines/store';
-import { addProvider, showTimeline } from '../../../timelines/store/actions';
-import { TimelineId } from '../../../../common/types';
-import type { SecurityAppStore } from '../../../common/store';
+import { timelineActions } from '../../../../timelines/store';
+import { addProvider, showTimeline } from '../../../../timelines/store/actions';
+import { TimelineId } from '../../../../../common/types';
+import type { SecurityAppStore } from '../../../../common/store';
 import { fieldHasCellActions } from '../../utils';
 import {
   ADD_TO_TIMELINE_FAILED_TEXT,
@@ -27,9 +27,9 @@ import {
 } from '../constants';
 import { createDataProviders, isValidDataProviderField } from '../data_provider';
 import { SecurityCellActionType } from '../../constants';
-import type { StartServices } from '../../../types';
+import type { StartServices } from '../../../../types';
 import type { SecurityCellAction } from '../../types';
-import { timelineDefaults } from '../../../timelines/store/defaults';
+import { timelineDefaults } from '../../../../timelines/store/defaults';
 
 export const createInvestigateInNewTimelineCellActionFactory = createCellActionFactory(
   ({
diff --git a/x-pack/plugins/security_solution/public/actions/add_to_timeline/constants.ts b/x-pack/plugins/security_solution/public/app/actions/add_to_timeline/constants.ts
similarity index 100%
rename from x-pack/plugins/security_solution/public/actions/add_to_timeline/constants.ts
rename to x-pack/plugins/security_solution/public/app/actions/add_to_timeline/constants.ts
diff --git a/x-pack/plugins/security_solution/public/actions/add_to_timeline/data_provider.ts b/x-pack/plugins/security_solution/public/app/actions/add_to_timeline/data_provider.ts
similarity index 88%
rename from x-pack/plugins/security_solution/public/actions/add_to_timeline/data_provider.ts
rename to x-pack/plugins/security_solution/public/app/actions/add_to_timeline/data_provider.ts
index ac50c5de28ef56..ee1d32bd4b6f63 100644
--- a/x-pack/plugins/security_solution/public/actions/add_to_timeline/data_provider.ts
+++ b/x-pack/plugins/security_solution/public/app/actions/add_to_timeline/data_provider.ts
@@ -9,13 +9,13 @@ import { escapeDataProviderId } from '@kbn/securitysolution-t-grid';
 import type { Serializable } from '@kbn/utility-types';
 
 import { isArray, isString, isEmpty } from 'lodash/fp';
-import { INDICATOR_REFERENCE } from '../../../common/cti/constants';
-import type { DataProvider, QueryOperator } from '../../../common/types';
-import { EXISTS_OPERATOR, IS_OPERATOR } from '../../../common/types';
-import { IP_FIELD_TYPE } from '../../explore/network/components/ip';
-import { PORT_NAMES } from '../../explore/network/components/port/helpers';
-import { EVENT_DURATION_FIELD_NAME } from '../../timelines/components/duration';
-import { BYTES_FORMAT } from '../../timelines/components/timeline/body/renderers/bytes';
+import { INDICATOR_REFERENCE } from '../../../../common/cti/constants';
+import type { DataProvider, QueryOperator } from '../../../../common/types';
+import { EXISTS_OPERATOR, IS_OPERATOR } from '../../../../common/types';
+import { IP_FIELD_TYPE } from '../../../explore/network/components/ip';
+import { PORT_NAMES } from '../../../explore/network/components/port/helpers';
+import { EVENT_DURATION_FIELD_NAME } from '../../../timelines/components/duration';
+import { BYTES_FORMAT } from '../../../timelines/components/timeline/body/renderers/bytes';
 import {
   GEO_FIELD_TYPE,
   MESSAGE_FIELD_NAME,
@@ -25,7 +25,7 @@ import {
   RULE_REFERENCE_FIELD_NAME,
   REFERENCE_URL_FIELD_NAME,
   EVENT_URL_FIELD_NAME,
-} from '../../timelines/components/timeline/body/renderers/constants';
+} from '../../../timelines/components/timeline/body/renderers/constants';
 import { isCountField } from '../utils';
 
 export const getDataProvider = ({
diff --git a/x-pack/plugins/security_solution/public/actions/add_to_timeline/discover/add_to_timeline.test.ts b/x-pack/plugins/security_solution/public/app/actions/add_to_timeline/discover/add_to_timeline.test.ts
similarity index 88%
rename from x-pack/plugins/security_solution/public/actions/add_to_timeline/discover/add_to_timeline.test.ts
rename to x-pack/plugins/security_solution/public/app/actions/add_to_timeline/discover/add_to_timeline.test.ts
index 4374bf70b19bc4..b79017aa322bb6 100644
--- a/x-pack/plugins/security_solution/public/actions/add_to_timeline/discover/add_to_timeline.test.ts
+++ b/x-pack/plugins/security_solution/public/app/actions/add_to_timeline/discover/add_to_timeline.test.ts
@@ -5,14 +5,14 @@
  * 2.0.
  */
 
-import type { SecurityAppStore } from '../../../common/store/types';
-import { TimelineId } from '../../../../common/types';
-import { addProvider } from '../../../timelines/store/actions';
+import type { SecurityAppStore } from '../../../../common/store/types';
+import { TimelineId } from '../../../../../common/types';
+import { addProvider } from '../../../../timelines/store/actions';
 import { createAddToTimelineDiscoverCellActionFactory } from './add_to_timeline';
 import type { CellActionExecutionContext } from '@kbn/cell-actions';
-import { GEO_FIELD_TYPE } from '../../../timelines/components/timeline/body/renderers/constants';
-import { createStartServicesMock } from '../../../common/lib/kibana/kibana_react.mock';
-import { APP_UI_ID } from '../../../../common';
+import { GEO_FIELD_TYPE } from '../../../../timelines/components/timeline/body/renderers/constants';
+import { createStartServicesMock } from '../../../../common/lib/kibana/kibana_react.mock';
+import { APP_UI_ID } from '../../../../../common';
 import { BehaviorSubject } from 'rxjs';
 
 const services = createStartServicesMock();
diff --git a/x-pack/plugins/security_solution/public/actions/add_to_timeline/discover/add_to_timeline.ts b/x-pack/plugins/security_solution/public/app/actions/add_to_timeline/discover/add_to_timeline.ts
similarity index 89%
rename from x-pack/plugins/security_solution/public/actions/add_to_timeline/discover/add_to_timeline.ts
rename to x-pack/plugins/security_solution/public/app/actions/add_to_timeline/discover/add_to_timeline.ts
index 859f14652810b1..429d1e1f9db2a4 100644
--- a/x-pack/plugins/security_solution/public/actions/add_to_timeline/discover/add_to_timeline.ts
+++ b/x-pack/plugins/security_solution/public/app/actions/add_to_timeline/discover/add_to_timeline.ts
@@ -6,9 +6,9 @@
  */
 
 import type { CellAction, CellActionFactory } from '@kbn/cell-actions';
-import type { SecurityAppStore } from '../../../common/store';
+import type { SecurityAppStore } from '../../../../common/store';
 import { isInSecurityApp } from '../../utils';
-import type { StartServices } from '../../../types';
+import type { StartServices } from '../../../../types';
 import { createAddToTimelineCellActionFactory } from '../cell_action/add_to_timeline';
 
 export const createAddToTimelineDiscoverCellActionFactory = ({
diff --git a/x-pack/plugins/security_solution/public/actions/add_to_timeline/index.ts b/x-pack/plugins/security_solution/public/app/actions/add_to_timeline/index.ts
similarity index 100%
rename from x-pack/plugins/security_solution/public/actions/add_to_timeline/index.ts
rename to x-pack/plugins/security_solution/public/app/actions/add_to_timeline/index.ts
diff --git a/x-pack/plugins/security_solution/public/actions/add_to_timeline/lens/add_to_timeline.test.ts b/x-pack/plugins/security_solution/public/app/actions/add_to_timeline/lens/add_to_timeline.test.ts
similarity index 95%
rename from x-pack/plugins/security_solution/public/actions/add_to_timeline/lens/add_to_timeline.test.ts
rename to x-pack/plugins/security_solution/public/app/actions/add_to_timeline/lens/add_to_timeline.test.ts
index 976d0f13efab04..b1a272de4d37ed 100644
--- a/x-pack/plugins/security_solution/public/actions/add_to_timeline/lens/add_to_timeline.test.ts
+++ b/x-pack/plugins/security_solution/public/app/actions/add_to_timeline/lens/add_to_timeline.test.ts
@@ -8,16 +8,16 @@ import { Subject } from 'rxjs';
 import type { CellValueContext, EmbeddableInput, IEmbeddable } from '@kbn/embeddable-plugin/public';
 import { ErrorEmbeddable } from '@kbn/embeddable-plugin/public';
 import { LENS_EMBEDDABLE_TYPE } from '@kbn/lens-plugin/public';
-import type { SecurityAppStore } from '../../../common/store/types';
+import type { SecurityAppStore } from '../../../../common/store/types';
 import { createAddToTimelineLensAction, getInvestigatedValue } from './add_to_timeline';
-import { KibanaServices } from '../../../common/lib/kibana';
-import { APP_UI_ID } from '../../../../common/constants';
-import type { DataProvider } from '../../../../common/types';
-import { TimelineId, EXISTS_OPERATOR } from '../../../../common/types';
-import { addProvider } from '../../../timelines/store/actions';
+import { KibanaServices } from '../../../../common/lib/kibana';
+import { APP_UI_ID } from '../../../../../common/constants';
+import type { DataProvider } from '../../../../../common/types';
+import { TimelineId, EXISTS_OPERATOR } from '../../../../../common/types';
+import { addProvider } from '../../../../timelines/store/actions';
 import type { ActionExecutionContext } from '@kbn/ui-actions-plugin/public';
 
-jest.mock('../../../common/lib/kibana');
+jest.mock('../../../../common/lib/kibana');
 const currentAppId$ = new Subject<string | undefined>();
 KibanaServices.get().application.currentAppId$ = currentAppId$.asObservable();
 const mockWarningToast = jest.fn();
diff --git a/x-pack/plugins/security_solution/public/actions/add_to_timeline/lens/add_to_timeline.ts b/x-pack/plugins/security_solution/public/app/actions/add_to_timeline/lens/add_to_timeline.ts
similarity index 91%
rename from x-pack/plugins/security_solution/public/actions/add_to_timeline/lens/add_to_timeline.ts
rename to x-pack/plugins/security_solution/public/app/actions/add_to_timeline/lens/add_to_timeline.ts
index 7646b3fba68146..84c95fd659fba2 100644
--- a/x-pack/plugins/security_solution/public/actions/add_to_timeline/lens/add_to_timeline.ts
+++ b/x-pack/plugins/security_solution/public/app/actions/add_to_timeline/lens/add_to_timeline.ts
@@ -8,11 +8,11 @@
 import type { CellValueContext, IEmbeddable } from '@kbn/embeddable-plugin/public';
 import { isErrorEmbeddable, isFilterableEmbeddable } from '@kbn/embeddable-plugin/public';
 import { createAction } from '@kbn/ui-actions-plugin/public';
-import { KibanaServices } from '../../../common/lib/kibana';
-import type { SecurityAppStore } from '../../../common/store/types';
-import { addProvider } from '../../../timelines/store/actions';
-import type { DataProvider } from '../../../../common/types';
-import { EXISTS_OPERATOR, TimelineId } from '../../../../common/types';
+import { KibanaServices } from '../../../../common/lib/kibana';
+import type { SecurityAppStore } from '../../../../common/store/types';
+import { addProvider } from '../../../../timelines/store/actions';
+import type { DataProvider } from '../../../../../common/types';
+import { EXISTS_OPERATOR, TimelineId } from '../../../../../common/types';
 import { fieldHasCellActions, isInSecurityApp, isLensEmbeddable } from '../../utils';
 import {
   ADD_TO_TIMELINE,
diff --git a/x-pack/plugins/security_solution/public/actions/constants.ts b/x-pack/plugins/security_solution/public/app/actions/constants.ts
similarity index 100%
rename from x-pack/plugins/security_solution/public/actions/constants.ts
rename to x-pack/plugins/security_solution/public/app/actions/constants.ts
diff --git a/x-pack/plugins/security_solution/public/actions/copy_to_clipboard/cell_action/copy_to_clipboard.test.ts b/x-pack/plugins/security_solution/public/app/actions/copy_to_clipboard/cell_action/copy_to_clipboard.test.ts
similarity index 95%
rename from x-pack/plugins/security_solution/public/actions/copy_to_clipboard/cell_action/copy_to_clipboard.test.ts
rename to x-pack/plugins/security_solution/public/app/actions/copy_to_clipboard/cell_action/copy_to_clipboard.test.ts
index ce4655bd6afe2c..a7a72fdd967ee5 100644
--- a/x-pack/plugins/security_solution/public/actions/copy_to_clipboard/cell_action/copy_to_clipboard.test.ts
+++ b/x-pack/plugins/security_solution/public/app/actions/copy_to_clipboard/cell_action/copy_to_clipboard.test.ts
@@ -6,7 +6,7 @@
  */
 
 import { createCopyToClipboardCellActionFactory } from './copy_to_clipboard';
-import { createStartServicesMock } from '../../../common/lib/kibana/kibana_react.mock';
+import { createStartServicesMock } from '../../../../common/lib/kibana/kibana_react.mock';
 import type { CellActionExecutionContext } from '@kbn/cell-actions';
 
 const services = createStartServicesMock();
diff --git a/x-pack/plugins/security_solution/public/actions/copy_to_clipboard/cell_action/copy_to_clipboard.ts b/x-pack/plugins/security_solution/public/app/actions/copy_to_clipboard/cell_action/copy_to_clipboard.ts
similarity index 89%
rename from x-pack/plugins/security_solution/public/actions/copy_to_clipboard/cell_action/copy_to_clipboard.ts
rename to x-pack/plugins/security_solution/public/app/actions/copy_to_clipboard/cell_action/copy_to_clipboard.ts
index e4e30a0576cbb9..6b766d735f8dd8 100644
--- a/x-pack/plugins/security_solution/public/actions/copy_to_clipboard/cell_action/copy_to_clipboard.ts
+++ b/x-pack/plugins/security_solution/public/app/actions/copy_to_clipboard/cell_action/copy_to_clipboard.ts
@@ -5,9 +5,9 @@
  * 2.0.
  */
 
-import { createCopyToClipboardActionFactory as genericCreateCopyToClipboardActionFactory } from '@kbn/cell-actions';
+import { createCopyToClipboardActionFactory as genericCreateCopyToClipboardActionFactory } from '@kbn/cell-actions/actions';
 import { fieldHasCellActions } from '../../utils';
-import type { StartServices } from '../../../types';
+import type { StartServices } from '../../../../types';
 import type { SecurityCellAction } from '../../types';
 import { SecurityCellActionType } from '../../constants';
 
diff --git a/x-pack/plugins/security_solution/public/actions/copy_to_clipboard/constants.ts b/x-pack/plugins/security_solution/public/app/actions/copy_to_clipboard/constants.ts
similarity index 100%
rename from x-pack/plugins/security_solution/public/actions/copy_to_clipboard/constants.ts
rename to x-pack/plugins/security_solution/public/app/actions/copy_to_clipboard/constants.ts
diff --git a/x-pack/plugins/security_solution/public/actions/copy_to_clipboard/discover/copy_to_clipboard.test.ts b/x-pack/plugins/security_solution/public/app/actions/copy_to_clipboard/discover/copy_to_clipboard.test.ts
similarity index 94%
rename from x-pack/plugins/security_solution/public/actions/copy_to_clipboard/discover/copy_to_clipboard.test.ts
rename to x-pack/plugins/security_solution/public/app/actions/copy_to_clipboard/discover/copy_to_clipboard.test.ts
index 0a4032e9b0136a..6e939c8fff5f42 100644
--- a/x-pack/plugins/security_solution/public/actions/copy_to_clipboard/discover/copy_to_clipboard.test.ts
+++ b/x-pack/plugins/security_solution/public/app/actions/copy_to_clipboard/discover/copy_to_clipboard.test.ts
@@ -6,10 +6,10 @@
  */
 
 import { createCopyToClipboardDiscoverCellActionFactory } from './copy_to_clipboard';
-import { createStartServicesMock } from '../../../common/lib/kibana/kibana_react.mock';
+import { createStartServicesMock } from '../../../../common/lib/kibana/kibana_react.mock';
 import type { CellActionExecutionContext } from '@kbn/cell-actions';
 import { BehaviorSubject } from 'rxjs';
-import { APP_UI_ID } from '../../../../common';
+import { APP_UI_ID } from '../../../../../common';
 
 const services = createStartServicesMock();
 const mockSuccessToast = services.notifications.toasts.addSuccess;
diff --git a/x-pack/plugins/security_solution/public/actions/copy_to_clipboard/discover/copy_to_clipboard.ts b/x-pack/plugins/security_solution/public/app/actions/copy_to_clipboard/discover/copy_to_clipboard.ts
similarity index 94%
rename from x-pack/plugins/security_solution/public/actions/copy_to_clipboard/discover/copy_to_clipboard.ts
rename to x-pack/plugins/security_solution/public/app/actions/copy_to_clipboard/discover/copy_to_clipboard.ts
index ac3e077597afdf..7a2c39717b3422 100644
--- a/x-pack/plugins/security_solution/public/actions/copy_to_clipboard/discover/copy_to_clipboard.ts
+++ b/x-pack/plugins/security_solution/public/app/actions/copy_to_clipboard/discover/copy_to_clipboard.ts
@@ -7,7 +7,7 @@
 
 import type { CellAction, CellActionFactory } from '@kbn/cell-actions';
 import { isInSecurityApp } from '../../utils';
-import type { StartServices } from '../../../types';
+import type { StartServices } from '../../../../types';
 import { createCopyToClipboardCellActionFactory } from '../cell_action/copy_to_clipboard';
 
 export const createCopyToClipboardDiscoverCellActionFactory = ({
diff --git a/x-pack/plugins/security_solution/public/actions/copy_to_clipboard/index.ts b/x-pack/plugins/security_solution/public/app/actions/copy_to_clipboard/index.ts
similarity index 100%
rename from x-pack/plugins/security_solution/public/actions/copy_to_clipboard/index.ts
rename to x-pack/plugins/security_solution/public/app/actions/copy_to_clipboard/index.ts
diff --git a/x-pack/plugins/security_solution/public/actions/copy_to_clipboard/lens/copy_to_clipboard.test.ts b/x-pack/plugins/security_solution/public/app/actions/copy_to_clipboard/lens/copy_to_clipboard.test.ts
similarity index 97%
rename from x-pack/plugins/security_solution/public/actions/copy_to_clipboard/lens/copy_to_clipboard.test.ts
rename to x-pack/plugins/security_solution/public/app/actions/copy_to_clipboard/lens/copy_to_clipboard.test.ts
index 5e80ab4b004092..bb036e3f12e071 100644
--- a/x-pack/plugins/security_solution/public/actions/copy_to_clipboard/lens/copy_to_clipboard.test.ts
+++ b/x-pack/plugins/security_solution/public/app/actions/copy_to_clipboard/lens/copy_to_clipboard.test.ts
@@ -9,12 +9,12 @@ import type { CellValueContext, EmbeddableInput, IEmbeddable } from '@kbn/embedd
 import { ErrorEmbeddable } from '@kbn/embeddable-plugin/public';
 import { LENS_EMBEDDABLE_TYPE } from '@kbn/lens-plugin/public';
 import { createCopyToClipboardLensAction } from './copy_to_clipboard';
-import { KibanaServices } from '../../../common/lib/kibana';
-import { APP_UI_ID } from '../../../../common/constants';
+import { KibanaServices } from '../../../../common/lib/kibana';
+import { APP_UI_ID } from '../../../../../common/constants';
 import { Subject } from 'rxjs';
 import type { ActionExecutionContext } from '@kbn/ui-actions-plugin/public';
 
-jest.mock('../../../common/lib/kibana');
+jest.mock('../../../../common/lib/kibana');
 const currentAppId$ = new Subject<string | undefined>();
 KibanaServices.get().application.currentAppId$ = currentAppId$.asObservable();
 const mockSuccessToast = jest.fn();
diff --git a/x-pack/plugins/security_solution/public/actions/copy_to_clipboard/lens/copy_to_clipboard.ts b/x-pack/plugins/security_solution/public/app/actions/copy_to_clipboard/lens/copy_to_clipboard.ts
similarity index 97%
rename from x-pack/plugins/security_solution/public/actions/copy_to_clipboard/lens/copy_to_clipboard.ts
rename to x-pack/plugins/security_solution/public/app/actions/copy_to_clipboard/lens/copy_to_clipboard.ts
index 1daa5bc2db0616..8546f0c3260cc4 100644
--- a/x-pack/plugins/security_solution/public/actions/copy_to_clipboard/lens/copy_to_clipboard.ts
+++ b/x-pack/plugins/security_solution/public/app/actions/copy_to_clipboard/lens/copy_to_clipboard.ts
@@ -9,7 +9,7 @@ import type { CellValueContext, IEmbeddable } from '@kbn/embeddable-plugin/publi
 import { isErrorEmbeddable } from '@kbn/embeddable-plugin/public';
 import { createAction } from '@kbn/ui-actions-plugin/public';
 import copy from 'copy-to-clipboard';
-import { KibanaServices } from '../../../common/lib/kibana';
+import { KibanaServices } from '../../../../common/lib/kibana';
 import { fieldHasCellActions, isCountField, isInSecurityApp, isLensEmbeddable } from '../../utils';
 import { COPY_TO_CLIPBOARD, COPY_TO_CLIPBOARD_ICON, COPY_TO_CLIPBOARD_SUCCESS } from '../constants';
 
diff --git a/x-pack/plugins/security_solution/public/actions/filter/cell_action/filter_in.test.ts b/x-pack/plugins/security_solution/public/app/actions/filter/cell_action/filter_in.test.ts
similarity index 90%
rename from x-pack/plugins/security_solution/public/actions/filter/cell_action/filter_in.test.ts
rename to x-pack/plugins/security_solution/public/app/actions/filter/cell_action/filter_in.test.ts
index 178757d835785e..65894133828fd8 100644
--- a/x-pack/plugins/security_solution/public/actions/filter/cell_action/filter_in.test.ts
+++ b/x-pack/plugins/security_solution/public/app/actions/filter/cell_action/filter_in.test.ts
@@ -8,11 +8,11 @@
 import { KBN_FIELD_TYPES } from '@kbn/field-types';
 import { TableId } from '@kbn/securitysolution-data-table';
 
-import { createMockStore, mockGlobalState } from '../../../common/mock';
+import { createMockStore, mockGlobalState } from '../../../../common/mock';
 import { createFilterInCellActionFactory } from './filter_in';
 import type { SecurityCellActionExecutionContext } from '../../types';
-import { TimelineId } from '../../../../common/types';
-import { createStartServicesMock } from '../../../common/lib/kibana/kibana_react.mock';
+import { TimelineId } from '../../../../../common/types';
+import { createStartServicesMock } from '../../../../common/lib/kibana/kibana_react.mock';
 
 const services = createStartServicesMock();
 const mockGlobalFilterManager = services.data.query.filterManager;
@@ -108,7 +108,7 @@ describe('createFilterInCellActionFactory', () => {
       it('should execute using generic filterManager', async () => {
         await filterInAction.execute(dataTableContext);
         expect(mockGlobalFilterManager.addFilters).toHaveBeenCalled();
-        expect(services.timelineFilterManager.addFilters).not.toHaveBeenCalled();
+        expect(services.timelineDataService.query.filterManager.addFilters).not.toHaveBeenCalled();
       });
 
       it('should show warning if value type is unsupported', async () => {
@@ -122,7 +122,7 @@ describe('createFilterInCellActionFactory', () => {
           ],
         });
         expect(mockGlobalFilterManager.addFilters).not.toHaveBeenCalled();
-        expect(services.timelineFilterManager.addFilters).not.toHaveBeenCalled();
+        expect(services.timelineDataService.query.filterManager.addFilters).not.toHaveBeenCalled();
         expect(mockWarningToast).toHaveBeenCalled();
       });
     });
@@ -135,7 +135,7 @@ describe('createFilterInCellActionFactory', () => {
 
       it('should execute using timeline filterManager', async () => {
         await filterInAction.execute(timelineContext);
-        expect(services.timelineFilterManager.addFilters).toHaveBeenCalled();
+        expect(services.timelineDataService.query.filterManager.addFilters).toHaveBeenCalled();
         expect(mockGlobalFilterManager.addFilters).not.toHaveBeenCalled();
       });
     });
diff --git a/x-pack/plugins/security_solution/public/actions/filter/cell_action/filter_in.ts b/x-pack/plugins/security_solution/public/app/actions/filter/cell_action/filter_in.ts
similarity index 84%
rename from x-pack/plugins/security_solution/public/actions/filter/cell_action/filter_in.ts
rename to x-pack/plugins/security_solution/public/app/actions/filter/cell_action/filter_in.ts
index fb85c32963d015..2c5f7bd62cd633 100644
--- a/x-pack/plugins/security_solution/public/actions/filter/cell_action/filter_in.ts
+++ b/x-pack/plugins/security_solution/public/app/actions/filter/cell_action/filter_in.ts
@@ -5,20 +5,20 @@
  * 2.0.
  */
 
-import { addFilterIn, addFilterOut, createFilterInActionFactory } from '@kbn/cell-actions';
+import { addFilterIn, addFilterOut, createFilterInActionFactory } from '@kbn/cell-actions/actions';
 import {
   isTypeSupportedByDefaultActions,
   isValueSupportedByDefaultActions,
-  valueToArray,
   filterOutNullableValues,
-} from '@kbn/cell-actions/src/actions/utils';
+  valueToArray,
+} from '@kbn/cell-actions/actions/utils';
 import type { KBN_FIELD_TYPES } from '@kbn/field-types';
 import { ACTION_INCOMPATIBLE_VALUE_WARNING } from '@kbn/cell-actions/src/actions/translations';
-import type { SecurityAppStore } from '../../../common/store';
+import type { SecurityAppStore } from '../../../../common/store';
 import { fieldHasCellActions } from '../../utils';
-import { isTimelineScope } from '../../../helpers';
+import { isTimelineScope } from '../../../../helpers';
 import { SecurityCellActionType } from '../../constants';
-import type { StartServices } from '../../../types';
+import type { StartServices } from '../../../../types';
 import type { SecurityCellAction } from '../../types';
 
 export const createFilterInCellActionFactory = ({
@@ -29,6 +29,9 @@ export const createFilterInCellActionFactory = ({
 }) => {
   const { filterManager } = services.data.query;
   const { notifications } = services;
+  const {
+    query: { filterManager: timelineFilterManager },
+  } = services.timelineDataService;
   const genericFilterInActionFactory = createFilterInActionFactory({
     filterManager,
     notifications,
@@ -65,7 +68,7 @@ export const createFilterInCellActionFactory = ({
       const addFilter = metadata?.negateFilters === true ? addFilterOut : addFilterIn;
 
       if (metadata?.scopeId && isTimelineScope(metadata.scopeId)) {
-        addFilter({ filterManager: services.timelineFilterManager, fieldName, value, dataViewId });
+        addFilter({ filterManager: timelineFilterManager, fieldName, value, dataViewId });
       } else {
         addFilter({ filterManager, fieldName, value, dataViewId });
       }
diff --git a/x-pack/plugins/security_solution/public/actions/filter/cell_action/filter_out.test.ts b/x-pack/plugins/security_solution/public/app/actions/filter/cell_action/filter_out.test.ts
similarity index 89%
rename from x-pack/plugins/security_solution/public/actions/filter/cell_action/filter_out.test.ts
rename to x-pack/plugins/security_solution/public/app/actions/filter/cell_action/filter_out.test.ts
index 23e7fb7e3f6622..f4ba4527a2ca13 100644
--- a/x-pack/plugins/security_solution/public/actions/filter/cell_action/filter_out.test.ts
+++ b/x-pack/plugins/security_solution/public/app/actions/filter/cell_action/filter_out.test.ts
@@ -5,14 +5,14 @@
  * 2.0.
  */
 
-import { createMockStore, mockGlobalState } from '../../../common/mock';
+import { createMockStore, mockGlobalState } from '../../../../common/mock';
 import { createFilterOutCellActionFactory } from './filter_out';
 import type { SecurityCellActionExecutionContext } from '../../types';
-import { TimelineId } from '../../../../common/types';
+import { TimelineId } from '../../../../../common/types';
 import { TableId } from '@kbn/securitysolution-data-table';
 import { KBN_FIELD_TYPES } from '@kbn/field-types';
 
-import { createStartServicesMock } from '../../../common/lib/kibana/kibana_react.mock';
+import { createStartServicesMock } from '../../../../common/lib/kibana/kibana_react.mock';
 
 const mockServices = createStartServicesMock();
 
@@ -105,7 +105,9 @@ describe('createFilterOutCellActionFactory', () => {
       it('should execute using generic filterManager', async () => {
         await filterOutAction.execute(dataTableContext);
         expect(mockGlobalFilterManager.addFilters).toHaveBeenCalled();
-        expect(mockServices.timelineFilterManager.addFilters).not.toHaveBeenCalled();
+        expect(
+          mockServices.timelineDataService.query.filterManager.addFilters
+        ).not.toHaveBeenCalled();
       });
 
       it('should show warning if value type is unsupported', async () => {
@@ -119,7 +121,9 @@ describe('createFilterOutCellActionFactory', () => {
           ],
         });
         expect(mockGlobalFilterManager.addFilters).not.toHaveBeenCalled();
-        expect(mockServices.timelineFilterManager.addFilters).not.toHaveBeenCalled();
+        expect(
+          mockServices.timelineDataService.query.filterManager.addFilters
+        ).not.toHaveBeenCalled();
         expect(mockWarningToast).toHaveBeenCalled();
       });
     });
@@ -132,7 +136,7 @@ describe('createFilterOutCellActionFactory', () => {
 
       it('should execute using timeline filterManager', async () => {
         await filterOutAction.execute(timelineContext);
-        expect(mockServices.timelineFilterManager.addFilters).toHaveBeenCalled();
+        expect(mockServices.timelineDataService.query.filterManager.addFilters).toHaveBeenCalled();
         expect(mockGlobalFilterManager.addFilters).not.toHaveBeenCalled();
       });
     });
diff --git a/x-pack/plugins/security_solution/public/actions/filter/cell_action/filter_out.ts b/x-pack/plugins/security_solution/public/app/actions/filter/cell_action/filter_out.ts
similarity index 84%
rename from x-pack/plugins/security_solution/public/actions/filter/cell_action/filter_out.ts
rename to x-pack/plugins/security_solution/public/app/actions/filter/cell_action/filter_out.ts
index bbc433e94256b4..b6ffd15a5784df 100644
--- a/x-pack/plugins/security_solution/public/actions/filter/cell_action/filter_out.ts
+++ b/x-pack/plugins/security_solution/public/app/actions/filter/cell_action/filter_out.ts
@@ -5,19 +5,19 @@
  * 2.0.
  */
 
-import { addFilterIn, addFilterOut, createFilterOutActionFactory } from '@kbn/cell-actions';
+import { addFilterIn, addFilterOut, createFilterOutActionFactory } from '@kbn/cell-actions/actions';
 import {
   isTypeSupportedByDefaultActions,
   isValueSupportedByDefaultActions,
-  valueToArray,
   filterOutNullableValues,
-} from '@kbn/cell-actions/src/actions/utils';
+  valueToArray,
+} from '@kbn/cell-actions/actions/utils';
 import { ACTION_INCOMPATIBLE_VALUE_WARNING } from '@kbn/cell-actions/src/actions/translations';
 import type { KBN_FIELD_TYPES } from '@kbn/field-types';
 import { fieldHasCellActions } from '../../utils';
-import type { SecurityAppStore } from '../../../common/store';
-import type { StartServices } from '../../../types';
-import { isTimelineScope } from '../../../helpers';
+import type { SecurityAppStore } from '../../../../common/store';
+import type { StartServices } from '../../../../types';
+import { isTimelineScope } from '../../../../helpers';
 import type { SecurityCellAction } from '../../types';
 import { SecurityCellActionType } from '../../constants';
 
@@ -29,6 +29,9 @@ export const createFilterOutCellActionFactory = ({
 }) => {
   const { filterManager } = services.data.query;
   const { notifications } = services;
+  const {
+    query: { filterManager: timelineFilterManager },
+  } = services.timelineDataService;
 
   const genericFilterOutActionFactory = createFilterOutActionFactory({
     filterManager,
@@ -65,7 +68,7 @@ export const createFilterOutCellActionFactory = ({
       const addFilter = metadata?.negateFilters === true ? addFilterIn : addFilterOut;
 
       if (metadata?.scopeId && isTimelineScope(metadata.scopeId)) {
-        addFilter({ filterManager: services.timelineFilterManager, fieldName, value, dataViewId });
+        addFilter({ filterManager: timelineFilterManager, fieldName, value, dataViewId });
       } else {
         addFilter({ filterManager, fieldName, value, dataViewId });
       }
diff --git a/x-pack/plugins/security_solution/public/actions/filter/discover/filter_in.test.ts b/x-pack/plugins/security_solution/public/app/actions/filter/discover/filter_in.test.ts
similarity index 92%
rename from x-pack/plugins/security_solution/public/actions/filter/discover/filter_in.test.ts
rename to x-pack/plugins/security_solution/public/app/actions/filter/discover/filter_in.test.ts
index c7136f87e05b94..08c04bceeda75d 100644
--- a/x-pack/plugins/security_solution/public/actions/filter/discover/filter_in.test.ts
+++ b/x-pack/plugins/security_solution/public/app/actions/filter/discover/filter_in.test.ts
@@ -5,12 +5,12 @@
  * 2.0.
  */
 
-import { createMockStore } from '../../../common/mock';
+import { createMockStore } from '../../../../common/mock';
 import { createFilterInDiscoverCellActionFactory } from './filter_in';
 import type { SecurityCellActionExecutionContext } from '../../types';
-import { createStartServicesMock } from '../../../common/lib/kibana/kibana_react.mock';
+import { createStartServicesMock } from '../../../../common/lib/kibana/kibana_react.mock';
 import { BehaviorSubject } from 'rxjs';
-import { APP_UI_ID } from '../../../../common';
+import { APP_UI_ID } from '../../../../../common';
 
 const services = createStartServicesMock();
 const mockGlobalFilterManager = services.data.query.filterManager;
diff --git a/x-pack/plugins/security_solution/public/actions/filter/discover/filter_in.ts b/x-pack/plugins/security_solution/public/app/actions/filter/discover/filter_in.ts
similarity index 89%
rename from x-pack/plugins/security_solution/public/actions/filter/discover/filter_in.ts
rename to x-pack/plugins/security_solution/public/app/actions/filter/discover/filter_in.ts
index d9d575ef5cbd6e..d0cdaed61f8a2e 100644
--- a/x-pack/plugins/security_solution/public/actions/filter/discover/filter_in.ts
+++ b/x-pack/plugins/security_solution/public/app/actions/filter/discover/filter_in.ts
@@ -6,9 +6,9 @@
  */
 
 import type { CellAction, CellActionFactory } from '@kbn/cell-actions';
-import type { SecurityAppStore } from '../../../common/store';
+import type { SecurityAppStore } from '../../../../common/store';
 import { isInSecurityApp } from '../../utils';
-import type { StartServices } from '../../../types';
+import type { StartServices } from '../../../../types';
 import { createFilterInCellActionFactory } from '../cell_action/filter_in';
 
 export const createFilterInDiscoverCellActionFactory = ({
diff --git a/x-pack/plugins/security_solution/public/actions/filter/discover/filter_out.test.ts b/x-pack/plugins/security_solution/public/app/actions/filter/discover/filter_out.test.ts
similarity index 92%
rename from x-pack/plugins/security_solution/public/actions/filter/discover/filter_out.test.ts
rename to x-pack/plugins/security_solution/public/app/actions/filter/discover/filter_out.test.ts
index fa028bce4ecd9a..271619f24cf9f5 100644
--- a/x-pack/plugins/security_solution/public/actions/filter/discover/filter_out.test.ts
+++ b/x-pack/plugins/security_solution/public/app/actions/filter/discover/filter_out.test.ts
@@ -5,12 +5,12 @@
  * 2.0.
  */
 
-import { createMockStore } from '../../../common/mock';
+import { createMockStore } from '../../../../common/mock';
 import { createFilterOutDiscoverCellActionFactory } from './filter_out';
 import type { SecurityCellActionExecutionContext } from '../../types';
-import { createStartServicesMock } from '../../../common/lib/kibana/kibana_react.mock';
+import { createStartServicesMock } from '../../../../common/lib/kibana/kibana_react.mock';
 import { BehaviorSubject } from 'rxjs';
-import { APP_UI_ID } from '../../../../common';
+import { APP_UI_ID } from '../../../../../common';
 
 const services = createStartServicesMock();
 const mockGlobalFilterManager = services.data.query.filterManager;
diff --git a/x-pack/plugins/security_solution/public/actions/filter/discover/filter_out.ts b/x-pack/plugins/security_solution/public/app/actions/filter/discover/filter_out.ts
similarity index 89%
rename from x-pack/plugins/security_solution/public/actions/filter/discover/filter_out.ts
rename to x-pack/plugins/security_solution/public/app/actions/filter/discover/filter_out.ts
index 07b8d1e61b37af..757b2f41d99b58 100644
--- a/x-pack/plugins/security_solution/public/actions/filter/discover/filter_out.ts
+++ b/x-pack/plugins/security_solution/public/app/actions/filter/discover/filter_out.ts
@@ -7,8 +7,8 @@
 
 import type { CellActionFactory, CellAction } from '@kbn/cell-actions';
 import { isInSecurityApp } from '../../utils';
-import type { SecurityAppStore } from '../../../common/store';
-import type { StartServices } from '../../../types';
+import type { SecurityAppStore } from '../../../../common/store';
+import type { StartServices } from '../../../../types';
 import { createFilterOutCellActionFactory } from '../cell_action/filter_out';
 
 export const createFilterOutDiscoverCellActionFactory = ({
diff --git a/x-pack/plugins/security_solution/public/actions/filter/index.ts b/x-pack/plugins/security_solution/public/app/actions/filter/index.ts
similarity index 100%
rename from x-pack/plugins/security_solution/public/actions/filter/index.ts
rename to x-pack/plugins/security_solution/public/app/actions/filter/index.ts
diff --git a/x-pack/plugins/security_solution/public/actions/filter/lens/create_action.test.ts b/x-pack/plugins/security_solution/public/app/actions/filter/lens/create_action.test.ts
similarity index 96%
rename from x-pack/plugins/security_solution/public/actions/filter/lens/create_action.test.ts
rename to x-pack/plugins/security_solution/public/app/actions/filter/lens/create_action.test.ts
index 1efbbc99601466..b0e61e81cf3b29 100644
--- a/x-pack/plugins/security_solution/public/actions/filter/lens/create_action.test.ts
+++ b/x-pack/plugins/security_solution/public/app/actions/filter/lens/create_action.test.ts
@@ -5,20 +5,20 @@
  * 2.0.
  */
 
-import { addExistsFilter, addFilterIn, addFilterOut } from '@kbn/cell-actions';
+import { addExistsFilter, addFilterIn, addFilterOut } from '@kbn/cell-actions/actions';
 import { of } from 'rxjs';
 import type { CellValueContext } from '@kbn/embeddable-plugin/public';
 import type { CreateFilterLensActionParams } from './create_action';
 import { createFilterLensAction } from './create_action';
 import type { Trigger } from '@kbn/ui-actions-plugin/public';
 
-jest.mock('@kbn/cell-actions', () => ({
+jest.mock('@kbn/cell-actions/actions', () => ({
   addFilterIn: jest.fn(),
   addFilterOut: jest.fn(),
   addExistsFilter: jest.fn(),
 }));
 
-jest.mock('../../../timelines/store', () => ({
+jest.mock('../../../../timelines/store', () => ({
   timelineSelectors: {
     getTimelineByIdSelector: jest.fn().mockReturnValue(() => ({})),
   },
@@ -26,7 +26,7 @@ jest.mock('../../../timelines/store', () => ({
 
 describe('createFilterLensAction', () => {
   const mockServices = {
-    timelineFilterManager: 'mockTimelineFilterManager',
+    timelineDataService: { query: { filterManager: 'mockTimelineFilterManager' } },
     data: { query: { filterManager: 'mockFilterManager' } },
     application: { currentAppId$: of('appId') },
     topValuesPopover: {
diff --git a/x-pack/plugins/security_solution/public/actions/filter/lens/create_action.ts b/x-pack/plugins/security_solution/public/app/actions/filter/lens/create_action.ts
similarity index 86%
rename from x-pack/plugins/security_solution/public/actions/filter/lens/create_action.ts
rename to x-pack/plugins/security_solution/public/app/actions/filter/lens/create_action.ts
index ecfe71bc3a1125..966efe9590ecc6 100644
--- a/x-pack/plugins/security_solution/public/actions/filter/lens/create_action.ts
+++ b/x-pack/plugins/security_solution/public/app/actions/filter/lens/create_action.ts
@@ -5,23 +5,23 @@
  * 2.0.
  */
 
-import { addExistsFilter, addFilterIn, addFilterOut } from '@kbn/cell-actions';
+import { addExistsFilter, addFilterIn, addFilterOut } from '@kbn/cell-actions/actions';
 import {
   isValueSupportedByDefaultActions,
-  valueToArray,
   filterOutNullableValues,
-} from '@kbn/cell-actions/src/actions/utils';
+  valueToArray,
+} from '@kbn/cell-actions/actions/utils';
 import { isErrorEmbeddable } from '@kbn/embeddable-plugin/public';
 import type { CellValueContext, IEmbeddable } from '@kbn/embeddable-plugin/public';
 import { createAction } from '@kbn/ui-actions-plugin/public';
 import { ACTION_INCOMPATIBLE_VALUE_WARNING } from '@kbn/cell-actions/src/actions/translations';
 import { i18n } from '@kbn/i18n';
-import { timelineSelectors } from '../../../timelines/store';
+import { timelineSelectors } from '../../../../timelines/store';
 import { fieldHasCellActions, isInSecurityApp, isLensEmbeddable } from '../../utils';
-import { TimelineId } from '../../../../common/types';
+import { TimelineId } from '../../../../../common/types';
 import { DefaultCellActionTypes } from '../../constants';
-import type { SecurityAppStore } from '../../../common/store';
-import type { StartServices } from '../../../types';
+import type { SecurityAppStore } from '../../../../common/store';
+import type { StartServices } from '../../../../types';
 
 function isDataColumnsValid(data?: CellValueContext['data']): boolean {
   return (
@@ -46,7 +46,16 @@ export const createFilterLensAction = ({
   services,
   negate,
 }: CreateFilterLensActionParams) => {
-  const { application, notifications, data: dataService, topValuesPopover } = services;
+  const {
+    application,
+    notifications,
+    data: dataService,
+    topValuesPopover,
+    timelineDataService,
+  } = services;
+  const {
+    query: { filterManager: timelineFilterManager },
+  } = timelineDataService;
 
   let currentAppId: string | undefined;
   application.currentAppId$.subscribe((appId) => {
@@ -93,7 +102,7 @@ export const createFilterLensAction = ({
       const timeline = getTimelineById(store.getState(), TimelineId.active);
       // timeline is open add the filter to timeline, otherwise add filter to global filters
       const filterManager = timeline?.show
-        ? services.timelineFilterManager
+        ? timelineFilterManager
         : dataService.query.filterManager;
 
       // If value type is value_count, we want to filter an `Exists` filter instead of a `Term` filter
diff --git a/x-pack/plugins/security_solution/public/actions/filter/lens/filter_in.ts b/x-pack/plugins/security_solution/public/app/actions/filter/lens/filter_in.ts
similarity index 83%
rename from x-pack/plugins/security_solution/public/actions/filter/lens/filter_in.ts
rename to x-pack/plugins/security_solution/public/app/actions/filter/lens/filter_in.ts
index fae9175879c9f3..5c54312814f7fc 100644
--- a/x-pack/plugins/security_solution/public/actions/filter/lens/filter_in.ts
+++ b/x-pack/plugins/security_solution/public/app/actions/filter/lens/filter_in.ts
@@ -5,9 +5,9 @@
  * 2.0.
  */
 
-import type { SecurityAppStore } from '../../../common/store';
+import type { SecurityAppStore } from '../../../../common/store';
 
-import type { StartServices } from '../../../types';
+import type { StartServices } from '../../../../types';
 import { createFilterLensAction } from './create_action';
 
 export const ACTION_ID = 'embeddable_filterIn';
diff --git a/x-pack/plugins/security_solution/public/actions/filter/lens/filter_out.ts b/x-pack/plugins/security_solution/public/app/actions/filter/lens/filter_out.ts
similarity index 83%
rename from x-pack/plugins/security_solution/public/actions/filter/lens/filter_out.ts
rename to x-pack/plugins/security_solution/public/app/actions/filter/lens/filter_out.ts
index 2b629ac1be8618..69560bfbd1513e 100644
--- a/x-pack/plugins/security_solution/public/actions/filter/lens/filter_out.ts
+++ b/x-pack/plugins/security_solution/public/app/actions/filter/lens/filter_out.ts
@@ -5,9 +5,9 @@
  * 2.0.
  */
 
-import type { SecurityAppStore } from '../../../common/store';
+import type { SecurityAppStore } from '../../../../common/store';
 
-import type { StartServices } from '../../../types';
+import type { StartServices } from '../../../../types';
 import { createFilterLensAction } from './create_action';
 
 export const ACTION_ID = 'embeddable_filterOut';
diff --git a/x-pack/plugins/security_solution/public/actions/index.ts b/x-pack/plugins/security_solution/public/app/actions/index.ts
similarity index 100%
rename from x-pack/plugins/security_solution/public/actions/index.ts
rename to x-pack/plugins/security_solution/public/app/actions/index.ts
diff --git a/x-pack/plugins/security_solution/public/actions/register.ts b/x-pack/plugins/security_solution/public/app/actions/register.ts
similarity index 98%
rename from x-pack/plugins/security_solution/public/actions/register.ts
rename to x-pack/plugins/security_solution/public/app/actions/register.ts
index 620df75c73d277..6267539f406256 100644
--- a/x-pack/plugins/security_solution/public/actions/register.ts
+++ b/x-pack/plugins/security_solution/public/app/actions/register.ts
@@ -9,8 +9,8 @@ import { CELL_VALUE_TRIGGER } from '@kbn/embeddable-plugin/public';
 import type { History } from 'history';
 import { SEARCH_EMBEDDABLE_CELL_ACTIONS_TRIGGER_ID } from '@kbn/discover-plugin/public';
 import type { CoreSetup } from '@kbn/core/public';
-import type { SecurityAppStore } from '../common/store/types';
-import type { StartServices } from '../types';
+import type { SecurityAppStore } from '../../common/store/types';
+import type { StartServices } from '../../types';
 import {
   createFilterInCellActionFactory,
   createFilterInDiscoverCellActionFactory,
diff --git a/x-pack/plugins/security_solution/public/actions/register_discover_histogram_actions.ts b/x-pack/plugins/security_solution/public/app/actions/register_discover_histogram_actions.ts
similarity index 93%
rename from x-pack/plugins/security_solution/public/actions/register_discover_histogram_actions.ts
rename to x-pack/plugins/security_solution/public/app/actions/register_discover_histogram_actions.ts
index 4a737ba9011071..796550bba63ae1 100644
--- a/x-pack/plugins/security_solution/public/actions/register_discover_histogram_actions.ts
+++ b/x-pack/plugins/security_solution/public/app/actions/register_discover_histogram_actions.ts
@@ -8,8 +8,8 @@
 import { createFilterAction } from '@kbn/unified-search-plugin/public';
 import type { History } from 'history';
 import type { CoreSetup } from '@kbn/core/public';
-import type { SecurityAppStore } from '../common/store';
-import type { StartServices } from '../types';
+import type { SecurityAppStore } from '../../common/store';
+import type { StartServices } from '../../types';
 import { EsqlInTimelineTrigger, EsqlInTimelineAction } from './constants';
 
 const createDiscoverHistogramCustomFilterAction = (
diff --git a/x-pack/plugins/security_solution/public/actions/show_top_n/cell_action/show_top_n.test.tsx b/x-pack/plugins/security_solution/public/app/actions/show_top_n/cell_action/show_top_n.test.tsx
similarity index 94%
rename from x-pack/plugins/security_solution/public/actions/show_top_n/cell_action/show_top_n.test.tsx
rename to x-pack/plugins/security_solution/public/app/actions/show_top_n/cell_action/show_top_n.test.tsx
index 0fb5552eb1e54b..3a073935dea857 100644
--- a/x-pack/plugins/security_solution/public/actions/show_top_n/cell_action/show_top_n.test.tsx
+++ b/x-pack/plugins/security_solution/public/app/actions/show_top_n/cell_action/show_top_n.test.tsx
@@ -8,11 +8,11 @@
 import type { CellActionExecutionContext } from '@kbn/cell-actions';
 
 import { createShowTopNCellActionFactory } from './show_top_n';
-import { createStartServicesMock } from '../../../common/lib/kibana/kibana_react.mock';
+import { createStartServicesMock } from '../../../../common/lib/kibana/kibana_react.mock';
 import { KBN_FIELD_TYPES } from '@kbn/field-types';
-import type { StartServices } from '../../../types';
+import type { StartServices } from '../../../../types';
 
-jest.mock('../../../common/lib/kibana');
+jest.mock('../../../../common/lib/kibana');
 
 const mockServices = {
   ...createStartServicesMock(),
diff --git a/x-pack/plugins/security_solution/public/actions/show_top_n/cell_action/show_top_n.tsx b/x-pack/plugins/security_solution/public/app/actions/show_top_n/cell_action/show_top_n.tsx
similarity index 92%
rename from x-pack/plugins/security_solution/public/actions/show_top_n/cell_action/show_top_n.tsx
rename to x-pack/plugins/security_solution/public/app/actions/show_top_n/cell_action/show_top_n.tsx
index 16916fc6ac00a7..1355da98118269 100644
--- a/x-pack/plugins/security_solution/public/actions/show_top_n/cell_action/show_top_n.tsx
+++ b/x-pack/plugins/security_solution/public/app/actions/show_top_n/cell_action/show_top_n.tsx
@@ -5,14 +5,14 @@
  * 2.0.
  */
 import { i18n } from '@kbn/i18n';
-import { createCellActionFactory, type CellActionTemplate } from '@kbn/cell-actions';
+import { createCellActionFactory, type CellActionTemplate } from '@kbn/cell-actions/actions';
 import { isDataViewFieldSubtypeNested } from '@kbn/es-query';
 import { first } from 'lodash/fp';
 import { fieldHasCellActions } from '../../utils';
-import type { StartServices } from '../../../types';
+import type { StartServices } from '../../../../types';
 import type { SecurityCellAction } from '../../types';
 import { SecurityCellActionType } from '../../constants';
-import { isLensSupportedType } from '../../../common/utils/lens';
+import { isLensSupportedType } from '../../../../common/utils/lens';
 
 const SHOW_TOP = (fieldName: string) =>
   i18n.translate('xpack.securitySolution.actions.showTopTooltip', {
diff --git a/x-pack/plugins/security_solution/public/actions/show_top_n/index.ts b/x-pack/plugins/security_solution/public/app/actions/show_top_n/index.ts
similarity index 100%
rename from x-pack/plugins/security_solution/public/actions/show_top_n/index.ts
rename to x-pack/plugins/security_solution/public/app/actions/show_top_n/index.ts
diff --git a/x-pack/plugins/security_solution/public/actions/telemetry.test.ts b/x-pack/plugins/security_solution/public/app/actions/telemetry.test.ts
similarity index 96%
rename from x-pack/plugins/security_solution/public/actions/telemetry.test.ts
rename to x-pack/plugins/security_solution/public/app/actions/telemetry.test.ts
index 2cfdf603b4998d..9b22aa03fbeaf1 100644
--- a/x-pack/plugins/security_solution/public/actions/telemetry.test.ts
+++ b/x-pack/plugins/security_solution/public/app/actions/telemetry.test.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import type { StartServices } from '../types';
+import type { StartServices } from '../../types';
 import { enhanceActionWithTelemetry } from './telemetry';
 import { createAction } from '@kbn/ui-actions-plugin/public';
 import type { CellActionExecutionContext } from '@kbn/cell-actions';
diff --git a/x-pack/plugins/security_solution/public/actions/telemetry.ts b/x-pack/plugins/security_solution/public/app/actions/telemetry.ts
similarity index 95%
rename from x-pack/plugins/security_solution/public/actions/telemetry.ts
rename to x-pack/plugins/security_solution/public/app/actions/telemetry.ts
index 3179e5143a34f6..319194e57f81ac 100644
--- a/x-pack/plugins/security_solution/public/actions/telemetry.ts
+++ b/x-pack/plugins/security_solution/public/app/actions/telemetry.ts
@@ -7,7 +7,7 @@
 
 import type { CellAction, CellActionExecutionContext } from '@kbn/cell-actions';
 import type { ActionExecutionContext } from '@kbn/ui-actions-plugin/public';
-import type { StartServices } from '../types';
+import type { StartServices } from '../../types';
 import type { SecurityCellActionExecutionContext } from './types';
 
 export const enhanceActionWithTelemetry = (
diff --git a/x-pack/plugins/security_solution/public/actions/toggle_asset_column/cell_action/toggle_asset_column.test.ts b/x-pack/plugins/security_solution/public/app/actions/toggle_asset_column/cell_action/toggle_asset_column.test.ts
similarity index 93%
rename from x-pack/plugins/security_solution/public/actions/toggle_asset_column/cell_action/toggle_asset_column.test.ts
rename to x-pack/plugins/security_solution/public/app/actions/toggle_asset_column/cell_action/toggle_asset_column.test.ts
index 1350fed3b3df64..d4ec20efafa577 100644
--- a/x-pack/plugins/security_solution/public/actions/toggle_asset_column/cell_action/toggle_asset_column.test.ts
+++ b/x-pack/plugins/security_solution/public/app/actions/toggle_asset_column/cell_action/toggle_asset_column.test.ts
@@ -7,10 +7,10 @@
 
 import type { CellActionExecutionContext } from '@kbn/cell-actions';
 import { createToggleUserAssetFieldCellActionFactory } from './toggle_asset_column';
-import type { SecurityAppStore } from '../../../common/store/types';
-import { mockGlobalState } from '../../../common/mock';
-import { UserAssetTableType } from '../../../explore/users/store/model';
-import { usersActions } from '../../../explore/users/store';
+import type { SecurityAppStore } from '../../../../common/store/types';
+import { mockGlobalState } from '../../../../common/mock';
+import { UserAssetTableType } from '../../../../explore/users/store/model';
+import { usersActions } from '../../../../explore/users/store';
 
 const existingFieldName = 'existing.field';
 const fieldName = 'user.name';
diff --git a/x-pack/plugins/security_solution/public/actions/toggle_asset_column/cell_action/toggle_asset_column.ts b/x-pack/plugins/security_solution/public/app/actions/toggle_asset_column/cell_action/toggle_asset_column.ts
similarity index 89%
rename from x-pack/plugins/security_solution/public/actions/toggle_asset_column/cell_action/toggle_asset_column.ts
rename to x-pack/plugins/security_solution/public/app/actions/toggle_asset_column/cell_action/toggle_asset_column.ts
index 0905770c8edbd9..b38b27b3d6553d 100644
--- a/x-pack/plugins/security_solution/public/actions/toggle_asset_column/cell_action/toggle_asset_column.ts
+++ b/x-pack/plugins/security_solution/public/app/actions/toggle_asset_column/cell_action/toggle_asset_column.ts
@@ -6,11 +6,11 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { createCellActionFactory, type CellActionTemplate } from '@kbn/cell-actions';
-import { UserAssetTableType } from '../../../explore/users/store/model';
-import { usersActions, usersSelectors } from '../../../explore/users/store';
+import { createCellActionFactory, type CellActionTemplate } from '@kbn/cell-actions/actions';
+import { UserAssetTableType } from '../../../../explore/users/store/model';
+import { usersActions, usersSelectors } from '../../../../explore/users/store';
 import { fieldHasCellActions } from '../../utils';
-import type { SecurityAppStore } from '../../../common/store';
+import type { SecurityAppStore } from '../../../../common/store';
 import type { SecurityCellAction } from '../../types';
 import { SecurityCellActionType } from '../../constants';
 
diff --git a/x-pack/plugins/security_solution/public/actions/toggle_asset_column/index.tsx b/x-pack/plugins/security_solution/public/app/actions/toggle_asset_column/index.tsx
similarity index 100%
rename from x-pack/plugins/security_solution/public/actions/toggle_asset_column/index.tsx
rename to x-pack/plugins/security_solution/public/app/actions/toggle_asset_column/index.tsx
diff --git a/x-pack/plugins/security_solution/public/actions/toggle_column/cell_action/toggle_column.test.ts b/x-pack/plugins/security_solution/public/app/actions/toggle_column/cell_action/toggle_column.test.ts
similarity index 95%
rename from x-pack/plugins/security_solution/public/actions/toggle_column/cell_action/toggle_column.test.ts
rename to x-pack/plugins/security_solution/public/app/actions/toggle_column/cell_action/toggle_column.test.ts
index 1697d73fc86f1a..d6517cab313a44 100644
--- a/x-pack/plugins/security_solution/public/actions/toggle_column/cell_action/toggle_column.test.ts
+++ b/x-pack/plugins/security_solution/public/app/actions/toggle_column/cell_action/toggle_column.test.ts
@@ -5,13 +5,13 @@
  * 2.0.
  */
 
-import type { SecurityAppStore } from '../../../common/store/types';
+import type { SecurityAppStore } from '../../../../common/store/types';
 import { TableId, dataTableActions } from '@kbn/securitysolution-data-table';
 import type { CellActionExecutionContext } from '@kbn/cell-actions';
 
 import { createToggleColumnCellActionFactory } from './toggle_column';
-import { mockGlobalState } from '../../../common/mock';
-import { createStartServicesMock } from '../../../common/lib/kibana/kibana_react.mock';
+import { mockGlobalState } from '../../../../common/mock';
+import { createStartServicesMock } from '../../../../common/lib/kibana/kibana_react.mock';
 
 const services = createStartServicesMock();
 const mockAlertConfigGetActions = jest.fn();
diff --git a/x-pack/plugins/security_solution/public/actions/toggle_column/cell_action/toggle_column.ts b/x-pack/plugins/security_solution/public/app/actions/toggle_column/cell_action/toggle_column.ts
similarity index 86%
rename from x-pack/plugins/security_solution/public/actions/toggle_column/cell_action/toggle_column.ts
rename to x-pack/plugins/security_solution/public/app/actions/toggle_column/cell_action/toggle_column.ts
index c9409252277e04..2302374bef8c54 100644
--- a/x-pack/plugins/security_solution/public/actions/toggle_column/cell_action/toggle_column.ts
+++ b/x-pack/plugins/security_solution/public/app/actions/toggle_column/cell_action/toggle_column.ts
@@ -6,22 +6,22 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { createCellActionFactory, type CellActionTemplate } from '@kbn/cell-actions';
+import { createCellActionFactory, type CellActionTemplate } from '@kbn/cell-actions/actions';
 import {
   defaultColumnHeaderType,
   tableDefaults,
   dataTableSelectors,
 } from '@kbn/securitysolution-data-table';
 import { fieldHasCellActions } from '../../utils';
-import type { SecurityAppStore } from '../../../common/store';
-import { getScopedActions, isInTableScope, isTimelineScope } from '../../../helpers';
-import { timelineDefaults } from '../../../timelines/store/defaults';
-import { timelineSelectors } from '../../../timelines/store';
-import { DEFAULT_COLUMN_MIN_WIDTH } from '../../../timelines/components/timeline/body/constants';
+import type { SecurityAppStore } from '../../../../common/store';
+import { getScopedActions, isInTableScope, isTimelineScope } from '../../../../helpers';
+import { timelineDefaults } from '../../../../timelines/store/defaults';
+import { timelineSelectors } from '../../../../timelines/store';
+import { DEFAULT_COLUMN_MIN_WIDTH } from '../../../../timelines/components/timeline/body/constants';
 import type { SecurityCellAction } from '../../types';
 import { SecurityCellActionType } from '../../constants';
-import type { StartServices } from '../../../types';
-import { getAlertConfigIdByScopeId } from '../../../common/lib/triggers_actions_ui/alert_table_scope_config';
+import type { StartServices } from '../../../../types';
+import { getAlertConfigIdByScopeId } from '../../../../common/lib/triggers_actions_ui/alert_table_scope_config';
 
 const ICON = 'listAdd';
 const COLUMN_TOGGLE = i18n.translate('xpack.securitySolution.actions.toggleColumnToggle.label', {
diff --git a/x-pack/plugins/security_solution/public/actions/toggle_column/index.tsx b/x-pack/plugins/security_solution/public/app/actions/toggle_column/index.tsx
similarity index 100%
rename from x-pack/plugins/security_solution/public/actions/toggle_column/index.tsx
rename to x-pack/plugins/security_solution/public/app/actions/toggle_column/index.tsx
diff --git a/x-pack/plugins/security_solution/public/actions/types.ts b/x-pack/plugins/security_solution/public/app/actions/types.ts
similarity index 93%
rename from x-pack/plugins/security_solution/public/actions/types.ts
rename to x-pack/plugins/security_solution/public/app/actions/types.ts
index ca0ee9d8d9fa2e..999bc9ed99c0fa 100644
--- a/x-pack/plugins/security_solution/public/actions/types.ts
+++ b/x-pack/plugins/security_solution/public/app/actions/types.ts
@@ -6,7 +6,7 @@
  */
 
 import type { CellAction, CellActionExecutionContext, CellActionFactory } from '@kbn/cell-actions';
-import type { QueryOperator } from '../../common/types';
+import type { QueryOperator } from '../../../common/types';
 export { EsqlInTimelineTrigger, EsqlInTimelineAction } from './constants';
 export interface AndFilter {
   field: string;
@@ -14,7 +14,7 @@ export interface AndFilter {
   operator?: QueryOperator;
 }
 
-export interface SecurityMetadata extends Record<string, unknown> {
+export interface SecurityCellActionMetadata extends Record<string, unknown> {
   /**
    * `metadata.scopeId` is used by some actions (e.g. filterIn/Out) to discriminate the Timeline
    * and the DataTables scope (alerts, events, rules preview..) in the actions execution.
@@ -52,7 +52,7 @@ export interface SecurityMetadata extends Record<string, unknown> {
 }
 
 export interface SecurityCellActionExecutionContext extends CellActionExecutionContext {
-  metadata: SecurityMetadata | undefined;
+  metadata: SecurityCellActionMetadata | undefined;
 }
 export type SecurityCellAction = CellAction<SecurityCellActionExecutionContext>;
 
diff --git a/x-pack/plugins/security_solution/public/actions/utils.ts b/x-pack/plugins/security_solution/public/app/actions/utils.ts
similarity index 95%
rename from x-pack/plugins/security_solution/public/actions/utils.ts
rename to x-pack/plugins/security_solution/public/app/actions/utils.ts
index 74b40334284cf9..12c5400dbcf36e 100644
--- a/x-pack/plugins/security_solution/public/actions/utils.ts
+++ b/x-pack/plugins/security_solution/public/app/actions/utils.ts
@@ -7,7 +7,7 @@
 import type { IEmbeddable } from '@kbn/embeddable-plugin/public';
 import { LENS_EMBEDDABLE_TYPE, type Embeddable as LensEmbeddable } from '@kbn/lens-plugin/public';
 import type { Serializable } from '@kbn/utility-types';
-import { APP_UI_ID } from '../../common/constants';
+import { APP_UI_ID } from '../../../common/constants';
 
 // All cell actions are disabled for these fields in Security
 const FIELDS_WITHOUT_CELL_ACTIONS = [
diff --git a/x-pack/plugins/security_solution/public/app/home/template_wrapper/index.tsx b/x-pack/plugins/security_solution/public/app/home/template_wrapper/index.tsx
index 19e8d55aa2dd5c..b6492ef97cae79 100644
--- a/x-pack/plugins/security_solution/public/app/home/template_wrapper/index.tsx
+++ b/x-pack/plugins/security_solution/public/app/home/template_wrapper/index.tsx
@@ -5,13 +5,14 @@
  * 2.0.
  */
 
-import React, { type ReactNode, useMemo } from 'react';
+import React, { type ReactNode, useMemo, useState, useCallback } from 'react';
 import styled from 'styled-components';
 import { EuiThemeProvider, useEuiTheme, type EuiThemeComputed } from '@elastic/eui';
 import { IS_DRAGGING_CLASS_NAME } from '@kbn/securitysolution-t-grid';
 import { KibanaPageTemplate } from '@kbn/shared-ux-page-kibana-template';
 import type { KibanaPageTemplateProps } from '@kbn/shared-ux-page-kibana-template';
 import { ExpandableFlyoutProvider } from '@kbn/expandable-flyout';
+import { AttackDiscoveryTour } from '../../../attack_discovery/tour';
 import { URL_PARAM_KEY } from '../../../common/hooks/use_url_state';
 import { SecuritySolutionFlyout, TimelineFlyout } from '../../../flyout';
 import { useSecuritySolutionNavigation } from '../../../common/components/navigation/use_security_solution_navigation';
@@ -55,7 +56,11 @@ export type SecuritySolutionTemplateWrapperProps = Omit<KibanaPageTemplateProps,
 
 export const SecuritySolutionTemplateWrapper: React.FC<SecuritySolutionTemplateWrapperProps> =
   React.memo(({ children, ...rest }) => {
-    const solutionNavProps = useSecuritySolutionNavigation();
+    const [didMount, setDidMount] = useState(false);
+    const onMount = useCallback(() => {
+      setDidMount(true);
+    }, []);
+    const solutionNavProps = useSecuritySolutionNavigation(onMount);
     const [isTimelineBottomBarVisible] = useShowTimeline();
     const getTimelineShowStatus = useMemo(() => getTimelineShowStatusByIdSelector(), []);
     const { show: isShowingTimelineOverlay } = useDeepEqualSelector((state) =>
@@ -102,6 +107,8 @@ export const SecuritySolutionTemplateWrapper: React.FC<SecuritySolutionTemplateW
                 {children}
                 <SecuritySolutionFlyout />
               </ExpandableFlyoutProvider>
+
+              {didMount && <AttackDiscoveryTour />}
             </KibanaPageTemplate.Section>
             {isTimelineBottomBarVisible && (
               <KibanaPageTemplate.BottomBar data-test-subj="timeline-bottom-bar-container">
diff --git a/x-pack/plugins/security_solution/public/app/solution_navigation/categories.ts b/x-pack/plugins/security_solution/public/app/solution_navigation/categories.ts
index 01e2f54375c994..86324b9ce99241 100644
--- a/x-pack/plugins/security_solution/public/app/solution_navigation/categories.ts
+++ b/x-pack/plugins/security_solution/public/app/solution_navigation/categories.ts
@@ -24,6 +24,7 @@ export const CATEGORIES: Array<SeparatorLinkCategory<SolutionPageName>> = [
     linkIds: [
       SecurityPageName.rulesLanding,
       SecurityPageName.alerts,
+      SecurityPageName.attackDiscovery,
       SecurityPageName.cloudSecurityPostureFindings,
       SecurityPageName.case,
     ],
diff --git a/x-pack/plugins/security_solution/public/attack_discovery/attack/mini_attack_chain/translations.ts b/x-pack/plugins/security_solution/public/attack_discovery/attack/mini_attack_chain/translations.ts
index 2332ab5a0c5ef6..a5c2bb2cc815b2 100644
--- a/x-pack/plugins/security_solution/public/attack_discovery/attack/mini_attack_chain/translations.ts
+++ b/x-pack/plugins/security_solution/public/attack_discovery/attack/mini_attack_chain/translations.ts
@@ -10,6 +10,6 @@ import { i18n } from '@kbn/i18n';
 export const ATTACK_CHAIN_TOOLTIP = (tacticsCount: number) =>
   i18n.translate('xpack.securitySolution.attackDiscovery.miniAttackChain.attackChainTooltip', {
     defaultMessage:
-      '{tacticsCount} {tacticsCount, plural, one {tactic was} other {tactics were}} identified in the analysis, providing insight into the nature of the detected violations:',
+      '{tacticsCount} {tacticsCount, plural, one {tactic was} other {tactics were}} identified in the attack:',
     values: { tacticsCount },
   });
diff --git a/x-pack/plugins/security_solution/public/attack_discovery/hooks/use_attack_discovery_telemetry/index.test.tsx b/x-pack/plugins/security_solution/public/attack_discovery/hooks/use_attack_discovery_telemetry/index.test.tsx
index 4a94ac33a2366a..3c8d5c40ec5155 100644
--- a/x-pack/plugins/security_solution/public/attack_discovery/hooks/use_attack_discovery_telemetry/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/attack_discovery/hooks/use_attack_discovery_telemetry/index.test.tsx
@@ -44,6 +44,7 @@ describe('useAttackDiscoveryTelemetry', () => {
       model: 'gpt-4',
       durationMs: 8000,
       alertsCount: 20,
+      alertsContextCount: 25,
       configuredAlertsCount: 30,
     });
     expect(reportAttackDiscoveriesGenerated).toHaveBeenCalledWith({
@@ -51,6 +52,7 @@ describe('useAttackDiscoveryTelemetry', () => {
       model: 'gpt-4',
       durationMs: 8000,
       alertsCount: 20,
+      alertsContextCount: 25,
       configuredAlertsCount: 30,
     });
   });
diff --git a/x-pack/plugins/security_solution/public/attack_discovery/index.ts b/x-pack/plugins/security_solution/public/attack_discovery/index.ts
index fa7667f60dcfec..37a64f2052c8a3 100644
--- a/x-pack/plugins/security_solution/public/attack_discovery/index.ts
+++ b/x-pack/plugins/security_solution/public/attack_discovery/index.ts
@@ -11,9 +11,9 @@ import { routes } from './routes';
 export class AttackDiscovery {
   public setup() {}
 
-  public start(isEnabled = false): SecuritySubPlugin {
+  public start(): SecuritySubPlugin {
     return {
-      routes: isEnabled ? routes : [],
+      routes,
     };
   }
 }
diff --git a/x-pack/plugins/security_solution/public/attack_discovery/links.ts b/x-pack/plugins/security_solution/public/attack_discovery/links.ts
index e53fdc8fef0538..dd3e45dfefc8a1 100644
--- a/x-pack/plugins/security_solution/public/attack_discovery/links.ts
+++ b/x-pack/plugins/security_solution/public/attack_discovery/links.ts
@@ -13,7 +13,6 @@ import type { LinkItem } from '../common/links/types';
 
 export const links: LinkItem = {
   capabilities: [`${SERVER_APP_ID}.show`],
-  experimentalKey: 'attackDiscoveryEnabled',
   globalNavPosition: 4,
   globalSearchKeywords: [
     i18n.translate('xpack.securitySolution.appLinks.attackDiscovery', {
diff --git a/x-pack/plugins/security_solution/public/attack_discovery/mock/mock_use_attack_discovery.ts b/x-pack/plugins/security_solution/public/attack_discovery/mock/mock_use_attack_discovery.ts
index 639f66497583e7..e165fb2d83562e 100644
--- a/x-pack/plugins/security_solution/public/attack_discovery/mock/mock_use_attack_discovery.ts
+++ b/x-pack/plugins/security_solution/public/attack_discovery/mock/mock_use_attack_discovery.ts
@@ -10,6 +10,7 @@ import type { UseAttackDiscovery } from '../use_attack_discovery';
 export const getMockUseAttackDiscoveriesWithCachedAttackDiscoveries = (
   fetchAttackDiscoveries: () => Promise<void>
 ): UseAttackDiscovery => ({
+  alertsContextCount: 20,
   approximateFutureTime: null,
   cachedAttackDiscoveries: {
     claudeV3SonnetUsEast1: {
@@ -507,6 +508,7 @@ export const getMockUseAttackDiscoveriesWithCachedAttackDiscoveries = (
 export const getMockUseAttackDiscoveriesWithNoAttackDiscoveries = (
   fetchAttackDiscoveries: () => Promise<void>
 ): UseAttackDiscovery => ({
+  alertsContextCount: null,
   approximateFutureTime: null,
   cachedAttackDiscoveries: {},
   fetchAttackDiscoveries,
@@ -520,6 +522,7 @@ export const getMockUseAttackDiscoveriesWithNoAttackDiscoveries = (
 export const getMockUseAttackDiscoveriesWithNoAttackDiscoveriesLoading = (
   fetchAttackDiscoveries: () => Promise<void>
 ): UseAttackDiscovery => ({
+  alertsContextCount: null,
   approximateFutureTime: new Date('2024-04-15T17:13:29.470Z'), // <-- estimated generation completion time
   cachedAttackDiscoveries: {},
   fetchAttackDiscoveries,
diff --git a/x-pack/plugins/security_solution/public/attack_discovery/pages/empty_prompt/index.tsx b/x-pack/plugins/security_solution/public/attack_discovery/pages/empty_prompt/index.tsx
index d5e8c8cb2bf2e1..3a616c299ecc51 100644
--- a/x-pack/plugins/security_solution/public/attack_discovery/pages/empty_prompt/index.tsx
+++ b/x-pack/plugins/security_solution/public/attack_discovery/pages/empty_prompt/index.tsx
@@ -11,11 +11,14 @@ import {
   EuiEmptyPrompt,
   EuiFlexGroup,
   EuiFlexItem,
+  EuiIconTip,
   EuiLink,
   EuiSpacer,
   EuiText,
   EuiToolTip,
+  useEuiTheme,
 } from '@elastic/eui';
+import { css } from '@emotion/react';
 import React, { useMemo } from 'react';
 
 import { useAssistantAvailability } from '../../../assistant/use_assistant_availability';
@@ -35,6 +38,7 @@ const EmptyPromptComponent: React.FC<Props> = ({
   isDisabled = false,
   onGenerate,
 }) => {
+  const { euiTheme } = useEuiTheme();
   const { hasAssistantPrivilege } = useAssistantAvailability();
   const title = useMemo(
     () => (
@@ -51,6 +55,16 @@ const EmptyPromptComponent: React.FC<Props> = ({
 
         <EuiFlexItem grow={false}>
           <EuiFlexGroup alignItems="center" direction="row" gutterSize="none">
+            <EuiFlexItem
+              css={css`
+                margin-right: ${euiTheme.size.xs};
+              `}
+              data-test-subj="upTo"
+              grow={false}
+            >
+              <span>{i18n.UP_TO}</span>
+            </EuiFlexItem>
+
             <EuiFlexItem data-test-subj="emptyPromptAnimatedCounter" grow={false}>
               <AnimatedCounter count={alertsCount} />
             </EuiFlexItem>
@@ -58,11 +72,25 @@ const EmptyPromptComponent: React.FC<Props> = ({
             <EuiFlexItem data-test-subj="emptyPromptAlertsWillBeAnalyzed" grow={false}>
               <span>{i18n.ALERTS_WILL_BE_ANALYZED(alertsCount)}</span>
             </EuiFlexItem>
+
+            <EuiFlexItem
+              css={css`
+                margin-left: ${euiTheme.size.xs};
+              `}
+              grow={false}
+            >
+              <EuiIconTip
+                content={i18n.RESPONSES_FROM_AI_SYSTEMS}
+                data-test-subj="responsesFromAiSystemsTooltip"
+                position="right"
+                type="iInCircle"
+              />
+            </EuiFlexItem>
           </EuiFlexGroup>
         </EuiFlexItem>
       </EuiFlexGroup>
     ),
-    [alertsCount]
+    [alertsCount, euiTheme.size.xs]
   );
 
   const body = useMemo(
@@ -117,7 +145,7 @@ const EmptyPromptComponent: React.FC<Props> = ({
       <EuiFlexItem grow={false}>
         <EuiLink
           data-test-subj="learnMore"
-          href="https://www.elastic.co/guide/en/security/master/attack-discovery.html"
+          href="https://www.elastic.co/guide/en/security/current/attack-discovery.html"
           target="_blank"
         >
           {i18n.LEARN_MORE}
diff --git a/x-pack/plugins/security_solution/public/attack_discovery/pages/empty_prompt/translations.ts b/x-pack/plugins/security_solution/public/attack_discovery/pages/empty_prompt/translations.ts
index d71b47c3f099d2..33ffdbdf478f29 100644
--- a/x-pack/plugins/security_solution/public/attack_discovery/pages/empty_prompt/translations.ts
+++ b/x-pack/plugins/security_solution/public/attack_discovery/pages/empty_prompt/translations.ts
@@ -30,6 +30,14 @@ export const LEARN_MORE = i18n.translate(
   }
 );
 
+export const RESPONSES_FROM_AI_SYSTEMS = i18n.translate(
+  'xpack.securitySolution.attackDiscovery.pages.emptyPrompt.responsesFromAiSystemsTooltip',
+  {
+    defaultMessage:
+      'Responses from AI systems may not always be entirely accurate, although they can seem convincing. For more information on the Attack Discovery feature and its usage, please reference the documentation.',
+  }
+);
+
 export const SELECT_A_CONNECTOR = i18n.translate(
   'xpack.securitySolution.attackDiscovery.pages.emptyPrompt.selectAConnectorLabel',
   {
@@ -40,6 +48,13 @@ export const SELECT_A_CONNECTOR = i18n.translate(
 export const START_GENERATING_DISCOVERIES = i18n.translate(
   'xpack.securitySolution.attackDiscovery.pages.emptyPrompt.startGeneratingDiscoveriesLabel',
   {
-    defaultMessage: 'Start generating discoveries via Elastic AI Assistant.',
+    defaultMessage: 'Start discovering attacks with the power of AI and Elastic Security.',
+  }
+);
+
+export const UP_TO = i18n.translate(
+  'xpack.securitySolution.attackDiscovery.pages.emptyPrompt.upToTitle',
+  {
+    defaultMessage: 'Up to',
   }
 );
diff --git a/x-pack/plugins/security_solution/public/attack_discovery/pages/empty_states/index.test.tsx b/x-pack/plugins/security_solution/public/attack_discovery/pages/empty_states/index.test.tsx
new file mode 100644
index 00000000000000..406b9a4233d7c7
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/attack_discovery/pages/empty_states/index.test.tsx
@@ -0,0 +1,226 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { render, screen } from '@testing-library/react';
+import React from 'react';
+
+import { EmptyStates } from '.';
+import { TestProviders } from '../../../common/mock';
+
+describe('EmptyStates', () => {
+  describe('when the Welcome prompt should be shown', () => {
+    beforeEach(() => {
+      jest.clearAllMocks();
+
+      const aiConnectorsCount = 0; // <-- no connectors configured
+      const alertsContextCount = null;
+      const alertsCount = 0;
+      const attackDiscoveriesCount = 0;
+      const connectorId = undefined;
+      const isLoading = false;
+      const onGenerate = jest.fn();
+
+      render(
+        <TestProviders>
+          <EmptyStates
+            aiConnectorsCount={aiConnectorsCount}
+            alertsContextCount={alertsContextCount}
+            alertsCount={alertsCount}
+            attackDiscoveriesCount={attackDiscoveriesCount}
+            connectorId={connectorId}
+            isLoading={isLoading}
+            onGenerate={onGenerate}
+          />
+        </TestProviders>
+      );
+    });
+
+    it('renders the Welcome prompt', () => {
+      expect(screen.getByTestId('welcome')).toBeInTheDocument();
+    });
+
+    it('does NOT render the No Alerts prompt', () => {
+      expect(screen.queryByTestId('noAlerts')).not.toBeInTheDocument();
+    });
+
+    it('does NOT render the Empty prompt', () => {
+      expect(screen.queryByTestId('emptyPrompt')).not.toBeInTheDocument();
+    });
+  });
+
+  describe('when the No Alerts prompt should be shown', () => {
+    beforeEach(() => {
+      jest.clearAllMocks();
+
+      const aiConnectorsCount = 1;
+      const alertsContextCount = 0; // <-- no alerts to analyze
+      const alertsCount = 0;
+      const attackDiscoveriesCount = 0;
+      const connectorId = 'test-connector-id';
+      const isLoading = false;
+      const onGenerate = jest.fn();
+
+      render(
+        <TestProviders>
+          <EmptyStates
+            aiConnectorsCount={aiConnectorsCount}
+            alertsContextCount={alertsContextCount}
+            alertsCount={alertsCount}
+            attackDiscoveriesCount={attackDiscoveriesCount}
+            connectorId={connectorId}
+            isLoading={isLoading}
+            onGenerate={onGenerate}
+          />
+        </TestProviders>
+      );
+    });
+
+    it('does NOT render the Welcome prompt', () => {
+      expect(screen.queryByTestId('welcome')).not.toBeInTheDocument();
+    });
+
+    it('renders the No Alerts prompt', () => {
+      expect(screen.getByTestId('noAlerts')).toBeInTheDocument();
+    });
+
+    it('does NOT render the Empty prompt', () => {
+      expect(screen.queryByTestId('emptyPrompt')).not.toBeInTheDocument();
+    });
+  });
+
+  describe('when the Empty prompt should be shown', () => {
+    beforeEach(() => {
+      jest.clearAllMocks();
+
+      const aiConnectorsCount = 1;
+      const alertsContextCount = 20; // <-- alerts were sent as context to be analyzed
+      const alertsCount = 0; // <-- no alerts contributed to attack discoveries
+      const attackDiscoveriesCount = 0; // <-- no attack discoveries were generated from the alerts
+      const connectorId = 'test-connector-id';
+      const isLoading = false;
+      const onGenerate = jest.fn();
+
+      render(
+        <TestProviders>
+          <EmptyStates
+            aiConnectorsCount={aiConnectorsCount}
+            alertsContextCount={alertsContextCount}
+            alertsCount={alertsCount}
+            attackDiscoveriesCount={attackDiscoveriesCount}
+            connectorId={connectorId}
+            isLoading={isLoading}
+            onGenerate={onGenerate}
+          />
+        </TestProviders>
+      );
+    });
+
+    it('does NOT render the Welcome prompt', () => {
+      expect(screen.queryByTestId('welcome')).not.toBeInTheDocument();
+    });
+
+    it('does NOT render the No Alerts prompt', () => {
+      expect(screen.queryByTestId('noAlerts')).not.toBeInTheDocument();
+    });
+
+    it('renders the Empty prompt', () => {
+      expect(screen.getByTestId('emptyPrompt')).toBeInTheDocument();
+    });
+  });
+
+  describe('when loading', () => {
+    let result: ReturnType<typeof render>;
+
+    beforeEach(() => {
+      jest.clearAllMocks();
+
+      const aiConnectorsCount = 0; // <-- no connectors configured (welcome prompt should be shown if not loading)
+      const alertsContextCount = null;
+      const alertsCount = 0;
+      const attackDiscoveriesCount = 0;
+      const connectorId = undefined;
+      const isLoading = true; // <-- loading data
+      const onGenerate = jest.fn();
+
+      result = render(
+        <TestProviders>
+          <EmptyStates
+            aiConnectorsCount={aiConnectorsCount}
+            alertsContextCount={alertsContextCount}
+            alertsCount={alertsCount}
+            attackDiscoveriesCount={attackDiscoveriesCount}
+            connectorId={connectorId}
+            isLoading={isLoading}
+            onGenerate={onGenerate}
+          />
+        </TestProviders>
+      );
+    });
+
+    it('does NOT render the Welcome prompt', () => {
+      expect(screen.queryByTestId('welcome')).not.toBeInTheDocument();
+    });
+
+    it('does NOT render the No Alerts prompt', () => {
+      expect(screen.queryByTestId('noAlerts')).not.toBeInTheDocument();
+    });
+
+    it('does NOT render the Empty prompt', () => {
+      expect(screen.queryByTestId('emptyPrompt')).not.toBeInTheDocument();
+    });
+
+    it('returns null', () => {
+      expect(result.container).toBeEmptyDOMElement();
+    });
+  });
+
+  describe('when attack discoveries are present', () => {
+    let result: ReturnType<typeof render>;
+
+    beforeEach(() => {
+      jest.clearAllMocks();
+
+      const aiConnectorsCount = 1;
+      const alertsContextCount = 20; // <-- alerts were sent as context to be analyzed
+      const alertsCount = 10; // <-- alerts contributed to attack discoveries
+      const attackDiscoveriesCount = 3; // <-- attack discoveries were generated from the alerts
+      const connectorId = 'test-connector-id';
+      const isLoading = false;
+      const onGenerate = jest.fn();
+
+      result = render(
+        <TestProviders>
+          <EmptyStates
+            aiConnectorsCount={aiConnectorsCount}
+            alertsContextCount={alertsContextCount}
+            alertsCount={alertsCount}
+            attackDiscoveriesCount={attackDiscoveriesCount}
+            connectorId={connectorId}
+            isLoading={isLoading}
+            onGenerate={onGenerate}
+          />
+        </TestProviders>
+      );
+    });
+
+    it('does NOT render the Welcome prompt', () => {
+      expect(screen.queryByTestId('welcome')).not.toBeInTheDocument();
+    });
+
+    it('does NOT render the No Alerts prompt', () => {
+      expect(screen.queryByTestId('noAlerts')).not.toBeInTheDocument();
+    });
+
+    it('does NOT render the Empty prompt', () => {
+      expect(screen.queryByTestId('emptyPrompt')).not.toBeInTheDocument();
+    });
+
+    it('returns null', () => {
+      expect(result.container).toBeEmptyDOMElement();
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/attack_discovery/pages/empty_states/index.tsx b/x-pack/plugins/security_solution/public/attack_discovery/pages/empty_states/index.tsx
new file mode 100644
index 00000000000000..009db0eb6e326c
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/attack_discovery/pages/empty_states/index.tsx
@@ -0,0 +1,54 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+
+import { EmptyPrompt } from '../empty_prompt';
+import { showEmptyPrompt, showNoAlertsPrompt, showWelcomePrompt } from '../helpers';
+import { NoAlerts } from '../no_alerts';
+import { Welcome } from '../welcome';
+
+interface Props {
+  aiConnectorsCount: number | null;
+  alertsContextCount: number | null;
+  alertsCount: number;
+  attackDiscoveriesCount: number;
+  connectorId: string | undefined;
+  isLoading: boolean;
+  onGenerate: () => Promise<void>;
+}
+
+const EmptyStatesComponent: React.FC<Props> = ({
+  aiConnectorsCount,
+  alertsContextCount,
+  alertsCount,
+  attackDiscoveriesCount,
+  connectorId,
+  isLoading,
+  onGenerate,
+}) => {
+  if (showWelcomePrompt({ aiConnectorsCount, isLoading })) {
+    return <Welcome />;
+  } else if (showNoAlertsPrompt({ alertsContextCount, isLoading })) {
+    return <NoAlerts />;
+  } else if (showEmptyPrompt({ attackDiscoveriesCount, isLoading })) {
+    return (
+      <EmptyPrompt
+        alertsCount={alertsCount}
+        isDisabled={connectorId == null}
+        isLoading={isLoading}
+        onGenerate={onGenerate}
+      />
+    );
+  }
+
+  return null;
+};
+
+EmptyStatesComponent.displayName = 'EmptyStates';
+
+export const EmptyStates = React.memo(EmptyStatesComponent);
diff --git a/x-pack/plugins/security_solution/public/attack_discovery/pages/header/index.tsx b/x-pack/plugins/security_solution/public/attack_discovery/pages/header/index.tsx
index ba07122fbfb04b..650eff33fbd93e 100644
--- a/x-pack/plugins/security_solution/public/attack_discovery/pages/header/index.tsx
+++ b/x-pack/plugins/security_solution/public/attack_discovery/pages/header/index.tsx
@@ -16,6 +16,7 @@ import * as i18n from './translations';
 
 interface Props {
   connectorId: string | undefined;
+  connectorsAreConfigured: boolean;
   isLoading: boolean;
   onGenerate: () => void;
   onConnectorIdSelected: (connectorId: string) => void;
@@ -23,10 +24,12 @@ interface Props {
 
 const HeaderComponent: React.FC<Props> = ({
   connectorId,
+  connectorsAreConfigured,
   isLoading,
   onGenerate,
   onConnectorIdSelected,
 }) => {
+  const isFlyoutMode = false; // always false for attack discovery
   const { hasAssistantPrivilege } = useAssistantAvailability();
   const { euiTheme } = useEuiTheme();
   const disabled = !hasAssistantPrivilege || isLoading || connectorId == null;
@@ -41,14 +44,17 @@ const HeaderComponent: React.FC<Props> = ({
       data-test-subj="header"
       gutterSize="none"
     >
-      <EuiFlexItem grow={false}>
-        <ConnectorSelectorInline
-          isFlyoutMode={false}
-          onConnectorSelected={noop}
-          onConnectorIdSelected={onConnectorIdSelected}
-          selectedConnectorId={connectorId}
-        />
-      </EuiFlexItem>
+      {connectorsAreConfigured && (
+        <EuiFlexItem grow={false}>
+          <ConnectorSelectorInline
+            isFlyoutMode={isFlyoutMode}
+            onConnectorSelected={noop}
+            onConnectorIdSelected={onConnectorIdSelected}
+            selectedConnectorId={connectorId}
+          />
+        </EuiFlexItem>
+      )}
+
       <EuiFlexItem grow={false}>
         <EuiToolTip
           content={connectorId == null ? i18n.SELECT_A_CONNECTOR : null}
diff --git a/x-pack/plugins/security_solution/public/attack_discovery/pages/helpers.test.ts b/x-pack/plugins/security_solution/public/attack_discovery/pages/helpers.test.ts
new file mode 100644
index 00000000000000..ed6ec50ad908c3
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/attack_discovery/pages/helpers.test.ts
@@ -0,0 +1,115 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { showEmptyPrompt, showNoAlertsPrompt, showWelcomePrompt } from './helpers';
+
+describe('helpers', () => {
+  describe('showNoAlertsPrompt', () => {
+    it('returns true when isLoading is false and alertsContextCount is 0', () => {
+      const result = showNoAlertsPrompt({
+        alertsContextCount: 0,
+        isLoading: false,
+      });
+
+      expect(result).toBe(true);
+    });
+
+    it('returns false when isLoading is true', () => {
+      const result = showNoAlertsPrompt({
+        alertsContextCount: 0,
+        isLoading: true,
+      });
+
+      expect(result).toBe(false);
+    });
+
+    it('returns false when alertsContextCount is null', () => {
+      const result = showNoAlertsPrompt({
+        alertsContextCount: null,
+        isLoading: false,
+      });
+
+      expect(result).toBe(false);
+    });
+
+    it('returns false when alertsContextCount greater than 0', () => {
+      const result = showNoAlertsPrompt({
+        alertsContextCount: 20,
+        isLoading: false,
+      });
+
+      expect(result).toBe(false);
+    });
+  });
+
+  describe('showWelcomePrompt', () => {
+    it('returns true when isLoading is false and aiConnectorsCount is 0', () => {
+      const result = showWelcomePrompt({
+        aiConnectorsCount: 0,
+        isLoading: false,
+      });
+
+      expect(result).toBe(true);
+    });
+
+    it('returns false when isLoading is true', () => {
+      const result = showWelcomePrompt({
+        aiConnectorsCount: 0,
+        isLoading: true,
+      });
+
+      expect(result).toBe(false);
+    });
+
+    it('returns false when aiConnectorsCount is null', () => {
+      const result = showWelcomePrompt({
+        aiConnectorsCount: null,
+        isLoading: false,
+      });
+
+      expect(result).toBe(false);
+    });
+
+    it('returns false when aiConnectorsCount is greater than 0', () => {
+      const result = showWelcomePrompt({
+        aiConnectorsCount: 5,
+        isLoading: false,
+      });
+
+      expect(result).toBe(false);
+    });
+  });
+
+  describe('showEmptyPrompt', () => {
+    it('returns true when isLoading is false and attackDiscoveriesCount is 0', () => {
+      const result = showEmptyPrompt({
+        attackDiscoveriesCount: 0,
+        isLoading: false,
+      });
+
+      expect(result).toBe(true);
+    });
+
+    it('returns false when isLoading is true', () => {
+      const result = showEmptyPrompt({
+        attackDiscoveriesCount: 0,
+        isLoading: true,
+      });
+
+      expect(result).toBe(false);
+    });
+
+    it('returns false when attackDiscoveriesCount is greater than 0', () => {
+      const result = showEmptyPrompt({
+        attackDiscoveriesCount: 4,
+        isLoading: false,
+      });
+
+      expect(result).toBe(false);
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/attack_discovery/pages/helpers.ts b/x-pack/plugins/security_solution/public/attack_discovery/pages/helpers.ts
index 930fb372ca8db1..e14aa1a5a049fc 100644
--- a/x-pack/plugins/security_solution/public/attack_discovery/pages/helpers.ts
+++ b/x-pack/plugins/security_solution/public/attack_discovery/pages/helpers.ts
@@ -73,6 +73,22 @@ export const getErrorToastText = (
   }
 };
 
+export const showNoAlertsPrompt = ({
+  alertsContextCount,
+  isLoading,
+}: {
+  alertsContextCount: number | null;
+  isLoading: boolean;
+}): boolean => !isLoading && alertsContextCount != null && alertsContextCount === 0;
+
+export const showWelcomePrompt = ({
+  aiConnectorsCount,
+  isLoading,
+}: {
+  aiConnectorsCount: number | null;
+  isLoading: boolean;
+}): boolean => !isLoading && aiConnectorsCount != null && aiConnectorsCount === 0;
+
 export const showEmptyPrompt = ({
   attackDiscoveriesCount,
   isLoading,
diff --git a/x-pack/plugins/security_solution/public/attack_discovery/pages/index.test.tsx b/x-pack/plugins/security_solution/public/attack_discovery/pages/index.test.tsx
index b41b6f7f947aac..0777406ba66f7c 100644
--- a/x-pack/plugins/security_solution/public/attack_discovery/pages/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/attack_discovery/pages/index.test.tsx
@@ -50,7 +50,6 @@ jest.mock(
 jest.mock('../../common/links', () => ({
   useLinkInfo: jest.fn().mockReturnValue({
     capabilities: ['siem.show'],
-    experimentalKey: 'attackDiscoveryEnabled',
     globalNavPosition: 4,
     globalSearchKeywords: ['Attack discovery'],
     id: 'attack_discovery',
diff --git a/x-pack/plugins/security_solution/public/attack_discovery/pages/index.tsx b/x-pack/plugins/security_solution/public/attack_discovery/pages/index.tsx
index e0318f61995dfa..809a97c98c03cd 100644
--- a/x-pack/plugins/security_solution/public/attack_discovery/pages/index.tsx
+++ b/x-pack/plugins/security_solution/public/attack_discovery/pages/index.tsx
@@ -11,6 +11,7 @@ import {
   ATTACK_DISCOVERY_STORAGE_KEY,
   DEFAULT_ASSISTANT_NAMESPACE,
   useAssistantContext,
+  useLoadConnectors,
 } from '@kbn/elastic-assistant';
 import type { Replacements } from '@kbn/elastic-assistant-common';
 import { uniq } from 'lodash/fp';
@@ -22,16 +23,15 @@ import { SecurityPageName } from '../../../common/constants';
 import { HeaderPage } from '../../common/components/header_page';
 import { useSpaceId } from '../../common/hooks/use_space_id';
 import { SpyRoute } from '../../common/utils/route/spy_routes';
-import { EmptyPrompt } from './empty_prompt';
 import { Header } from './header';
 import {
   CONNECTOR_ID_LOCAL_STORAGE_KEY,
   getInitialIsOpen,
-  showEmptyPrompt,
   showLoading,
   showSummary,
 } from './helpers';
 import { AttackDiscoveryPanel } from '../attack_discovery_panel';
+import { EmptyStates } from './empty_states';
 import { LoadingCallout } from './loading_callout';
 import { PageTitle } from './page_title';
 import { Summary } from './summary';
@@ -44,8 +44,12 @@ const AttackDiscoveryPageComponent: React.FC = () => {
 
   const {
     assistantAvailability: { isAssistantEnabled },
+    http,
     knowledgeBase,
   } = useAssistantContext();
+  const { data: aiConnectors } = useLoadConnectors({
+    http,
+  });
 
   // for showing / hiding anonymized data:
   const [showAnonymized, setShowAnonymized] = useState<boolean>(false);
@@ -65,6 +69,7 @@ const AttackDiscoveryPageComponent: React.FC = () => {
   const [loadingConnectorId, setLoadingConnectorId] = useState<string | null>(null);
 
   const {
+    alertsContextCount,
     approximateFutureTime,
     attackDiscoveries,
     cachedAttackDiscoveries,
@@ -141,6 +146,13 @@ const AttackDiscoveryPageComponent: React.FC = () => {
     setSelectedConnectorLastUpdated(lastUpdated);
   }, [attackDiscoveries, lastUpdated, replacements]);
 
+  useEffect(() => {
+    // If there is only one connector, set it as the selected connector
+    if (aiConnectors != null && aiConnectors.length === 1) {
+      setConnectorId(aiConnectors[0].id);
+    }
+  }, [aiConnectors, setConnectorId]);
+
   const attackDiscoveriesCount = selectedConnectorAttackDiscoveries.length;
 
   if (!isAssistantEnabled) {
@@ -168,6 +180,7 @@ const AttackDiscoveryPageComponent: React.FC = () => {
         <HeaderPage border title={pageTitle}>
           <Header
             connectorId={connectorId}
+            connectorsAreConfigured={aiConnectors != null && aiConnectors.length > 0}
             isLoading={isLoading}
             onConnectorIdSelected={onConnectorIdSelected}
             onGenerate={onGenerate}
@@ -224,19 +237,17 @@ const AttackDiscoveryPageComponent: React.FC = () => {
           gutterSize="none"
         >
           <EuiSpacer size="xxl" />
-
           <EuiFlexItem grow={false}>
-            {showEmptyPrompt({ attackDiscoveriesCount, isLoading }) && (
-              <EmptyPrompt
-                alertsCount={knowledgeBase.latestAlerts}
-                isDisabled={connectorId == null}
-                isLoading={isLoading}
-                onGenerate={onGenerate}
-              />
-            )}
+            <EmptyStates
+              aiConnectorsCount={aiConnectors?.length ?? null}
+              alertsContextCount={alertsContextCount}
+              alertsCount={knowledgeBase.latestAlerts}
+              attackDiscoveriesCount={attackDiscoveriesCount}
+              connectorId={connectorId}
+              isLoading={isLoading}
+              onGenerate={onGenerate}
+            />
           </EuiFlexItem>
-
-          <EuiFlexItem grow={true} />
         </EuiFlexGroup>
         <SpyRoute pageName={SecurityPageName.attackDiscovery} />
       </SecurityRoutePageWrapper>
diff --git a/x-pack/plugins/security_solution/public/attack_discovery/pages/loading_callout/countdown/last_times_popover/translations.ts b/x-pack/plugins/security_solution/public/attack_discovery/pages/loading_callout/countdown/last_times_popover/translations.ts
index 502449d9256761..96cd82112fe71f 100644
--- a/x-pack/plugins/security_solution/public/attack_discovery/pages/loading_callout/countdown/last_times_popover/translations.ts
+++ b/x-pack/plugins/security_solution/public/attack_discovery/pages/loading_callout/countdown/last_times_popover/translations.ts
@@ -12,7 +12,7 @@ export const AVERAGE_TIME_IS_CALCULATED = (intervals: number) =>
     'xpack.securitySolution.attackDiscovery.loadingCallout.countdown.lastTimesPopover.aiIsCurrentlyAnalyzing',
     {
       defaultMessage:
-        'Average time is calculated over the last {intervals} {intervals, plural, =1 {generation} other {generations}} on the selected connector:',
+        'Remaining time is based on the average speed of the last {intervals} {intervals, plural, =1 {time} other {times}} the same connector generated results.',
       values: { intervals },
     }
   );
diff --git a/x-pack/plugins/security_solution/public/attack_discovery/pages/loading_callout/translations.ts b/x-pack/plugins/security_solution/public/attack_discovery/pages/loading_callout/translations.ts
index a63a419b147b5a..6c8f9b60c5ac69 100644
--- a/x-pack/plugins/security_solution/public/attack_discovery/pages/loading_callout/translations.ts
+++ b/x-pack/plugins/security_solution/public/attack_discovery/pages/loading_callout/translations.ts
@@ -11,7 +11,7 @@ export const AI_IS_CURRENTLY_ANALYZING = (alertsCount: number) =>
   i18n.translate(
     'xpack.securitySolution.attackDiscovery.pages.loadingCallout.aiIsCurrentlyAnalyzing',
     {
-      defaultMessage: `AI is currently analyzing up to {alertsCount} {alertsCount, plural, =1 {alert} other {alerts}} in the last 24 hours to generate discoveries.`,
+      defaultMessage: `AI is analyzing up to {alertsCount} {alertsCount, plural, =1 {alert} other {alerts}} in the last 24 hours to generate discoveries.`,
       values: { alertsCount },
     }
   );
diff --git a/x-pack/plugins/security_solution/public/attack_discovery/pages/no_alerts/index.test.tsx b/x-pack/plugins/security_solution/public/attack_discovery/pages/no_alerts/index.test.tsx
new file mode 100644
index 00000000000000..6c2640623e370f
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/attack_discovery/pages/no_alerts/index.test.tsx
@@ -0,0 +1,59 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { render, screen } from '@testing-library/react';
+import React from 'react';
+
+import { NoAlerts } from '.';
+import { ATTACK_DISCOVERY_ONLY, LEARN_MORE, NO_ALERTS_TO_ANALYZE } from './translations';
+
+describe('NoAlerts', () => {
+  beforeEach(() => {
+    render(<NoAlerts />);
+  });
+
+  it('renders the avatar', () => {
+    const avatar = screen.getByTestId('emptyPromptAvatar');
+
+    expect(avatar).toBeInTheDocument();
+  });
+
+  it('renders the expected title', () => {
+    const title = screen.getByTestId('noAlertsTitle');
+
+    expect(title).toHaveTextContent(NO_ALERTS_TO_ANALYZE);
+  });
+
+  it('renders the expected body text', () => {
+    const bodyText = screen.getByTestId('bodyText');
+
+    expect(bodyText).toHaveTextContent(ATTACK_DISCOVERY_ONLY);
+  });
+
+  describe('link', () => {
+    let learnMoreLink: HTMLElement;
+
+    beforeEach(() => {
+      learnMoreLink = screen.getByTestId('learnMoreLink');
+    });
+
+    it('links to the documentation', () => {
+      expect(learnMoreLink).toHaveAttribute(
+        'href',
+        'https://www.elastic.co/guide/en/security/current/attack-discovery.html'
+      );
+    });
+
+    it('opens in a new tab', () => {
+      expect(learnMoreLink).toHaveAttribute('target', '_blank');
+    });
+
+    it('has the expected text', () => {
+      expect(learnMoreLink).toHaveTextContent(LEARN_MORE);
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/attack_discovery/pages/no_alerts/index.tsx b/x-pack/plugins/security_solution/public/attack_discovery/pages/no_alerts/index.tsx
new file mode 100644
index 00000000000000..a7b0cd929336b1
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/attack_discovery/pages/no_alerts/index.tsx
@@ -0,0 +1,90 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { AssistantAvatar } from '@kbn/elastic-assistant';
+import {
+  EuiEmptyPrompt,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiLink,
+  EuiSpacer,
+  EuiText,
+} from '@elastic/eui';
+import React, { useMemo } from 'react';
+
+import * as i18n from './translations';
+
+const NoAlertsComponent: React.FC = () => {
+  const title = useMemo(
+    () => (
+      <EuiFlexGroup
+        alignItems="center"
+        data-test-subj="emptyPromptTitleContainer"
+        direction="column"
+        gutterSize="none"
+      >
+        <EuiFlexItem data-test-subj="emptyPromptAvatar" grow={false}>
+          <AssistantAvatar size="m" />
+          <EuiSpacer size="m" />
+        </EuiFlexItem>
+
+        <EuiFlexItem grow={false}>
+          <EuiFlexGroup alignItems="center" direction="row" gutterSize="none">
+            <EuiFlexItem data-test-subj="noAlertsTitle" grow={false}>
+              <span>{i18n.NO_ALERTS_TO_ANALYZE}</span>
+            </EuiFlexItem>
+          </EuiFlexGroup>
+        </EuiFlexItem>
+      </EuiFlexGroup>
+    ),
+    []
+  );
+
+  const body = useMemo(
+    () => (
+      <EuiFlexGroup
+        alignItems="center"
+        data-test-subj="bodyContainer"
+        direction="column"
+        gutterSize="none"
+      >
+        <EuiFlexItem grow={false}>
+          <EuiText color="subdued" data-test-subj="bodyText">
+            {i18n.ATTACK_DISCOVERY_ONLY}
+          </EuiText>
+        </EuiFlexItem>
+      </EuiFlexGroup>
+    ),
+    []
+  );
+
+  return (
+    <EuiFlexGroup
+      alignItems="center"
+      data-test-subj="noAlerts"
+      direction="column"
+      gutterSize="none"
+    >
+      <EuiFlexItem data-test-subj="emptyPromptContainer" grow={false}>
+        <EuiEmptyPrompt body={body} title={title} />
+      </EuiFlexItem>
+
+      <EuiFlexItem grow={false}>
+        <EuiLink
+          external={true}
+          data-test-subj="learnMoreLink"
+          href="https://www.elastic.co/guide/en/security/current/attack-discovery.html"
+          target="_blank"
+        >
+          {i18n.LEARN_MORE}
+        </EuiLink>
+      </EuiFlexItem>
+    </EuiFlexGroup>
+  );
+};
+
+export const NoAlerts = React.memo(NoAlertsComponent);
diff --git a/x-pack/plugins/security_solution/public/attack_discovery/pages/no_alerts/translations.ts b/x-pack/plugins/security_solution/public/attack_discovery/pages/no_alerts/translations.ts
new file mode 100644
index 00000000000000..76b4c7e298722f
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/attack_discovery/pages/no_alerts/translations.ts
@@ -0,0 +1,29 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const ATTACK_DISCOVERY_ONLY = i18n.translate(
+  'xpack.securitySolution.attackDiscovery.pages.noAlerts.attackDiscoveryOnlyLabel',
+  {
+    defaultMessage: 'Attack Discovery only analyzes alerts from the past 24 hours.',
+  }
+);
+
+export const LEARN_MORE = i18n.translate(
+  'xpack.securitySolution.attackDiscovery.pages.noAlerts.learnMoreLink',
+  {
+    defaultMessage: 'Learn more about Attack discovery',
+  }
+);
+
+export const NO_ALERTS_TO_ANALYZE = i18n.translate(
+  'xpack.securitySolution.attackDiscovery.pages.noAlerts.noAlertsToAnalyzeTitle',
+  {
+    defaultMessage: 'No alerts to analyze',
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/attack_discovery/pages/session_storage/index.ts b/x-pack/plugins/security_solution/public/attack_discovery/pages/session_storage/index.ts
index 2794660976bda8..c9593741675047 100644
--- a/x-pack/plugins/security_solution/public/attack_discovery/pages/session_storage/index.ts
+++ b/x-pack/plugins/security_solution/public/attack_discovery/pages/session_storage/index.ts
@@ -6,7 +6,9 @@
  */
 
 import type { Replacements } from '@kbn/elastic-assistant-common';
-import type { AttackDiscovery } from '../../types';
+import { isEmpty } from 'lodash/fp';
+
+import type { AttackDiscovery, GenerationInterval } from '../../types';
 
 export interface CachedAttackDiscoveries {
   connectorId: string;
@@ -19,7 +21,7 @@ export const encodeCachedAttackDiscoveries = (
   cachedAttackDiscoveries: Record<string, CachedAttackDiscoveries>
 ): string | null => {
   try {
-    return JSON.stringify(cachedAttackDiscoveries, null, 2);
+    return JSON.stringify(cachedAttackDiscoveries);
   } catch {
     return null;
   }
@@ -34,3 +36,75 @@ export const decodeCachedAttackDiscoveries = (
     return null;
   }
 };
+
+export const getSessionStorageCachedAttackDiscoveries = (
+  key: string
+): Record<string, CachedAttackDiscoveries> | null => {
+  if (!isEmpty(key)) {
+    return decodeCachedAttackDiscoveries(sessionStorage.getItem(key) ?? '');
+  }
+
+  return null;
+};
+
+export const setSessionStorageCachedAttackDiscoveries = ({
+  key,
+  cachedAttackDiscoveries,
+}: {
+  key: string;
+  cachedAttackDiscoveries: Record<string, CachedAttackDiscoveries>;
+}) => {
+  if (!isEmpty(key)) {
+    const encoded = encodeCachedAttackDiscoveries(cachedAttackDiscoveries);
+
+    if (encoded != null) {
+      sessionStorage.setItem(key, encoded);
+    }
+  }
+};
+
+export const encodeGenerationIntervals = (
+  generationIntervals: Record<string, GenerationInterval[]>
+): string | null => {
+  try {
+    return JSON.stringify(generationIntervals);
+  } catch {
+    return null;
+  }
+};
+
+export const decodeGenerationIntervals = (
+  generationIntervals: string
+): Record<string, GenerationInterval[]> | null => {
+  try {
+    return JSON.parse(generationIntervals);
+  } catch {
+    return null;
+  }
+};
+
+export const getLocalStorageGenerationIntervals = (
+  key: string
+): Record<string, GenerationInterval[]> | null => {
+  if (!isEmpty(key)) {
+    return decodeGenerationIntervals(sessionStorage.getItem(key) ?? '');
+  }
+
+  return null;
+};
+
+export const setLocalStorageGenerationIntervals = ({
+  key,
+  generationIntervals,
+}: {
+  key: string;
+  generationIntervals: Record<string, GenerationInterval[]>;
+}) => {
+  if (!isEmpty(key)) {
+    const encoded = encodeGenerationIntervals(generationIntervals);
+
+    if (encoded != null) {
+      localStorage.setItem(key, encoded);
+    }
+  }
+};
diff --git a/x-pack/plugins/security_solution/public/attack_discovery/pages/welcome/index.test.tsx b/x-pack/plugins/security_solution/public/attack_discovery/pages/welcome/index.test.tsx
new file mode 100644
index 00000000000000..7881b4b6d5d656
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/attack_discovery/pages/welcome/index.test.tsx
@@ -0,0 +1,47 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { render, screen } from '@testing-library/react';
+import React from 'react';
+
+import { Welcome } from '.';
+import { TestProviders } from '../../../common/mock';
+import { FIRST_SET_UP, WELCOME_TO_ATTACK_DISCOVERY } from './translations';
+
+describe('Welcome', () => {
+  beforeEach(() => {
+    render(
+      <TestProviders>
+        <Welcome />
+      </TestProviders>
+    );
+  });
+
+  it('renders the avatar', () => {
+    const avatar = screen.getByTestId('emptyPromptAvatar');
+
+    expect(avatar).toBeInTheDocument();
+  });
+
+  it('renders the expected title', () => {
+    const title = screen.getByTestId('welcomeTitle');
+
+    expect(title).toHaveTextContent(WELCOME_TO_ATTACK_DISCOVERY);
+  });
+
+  it('renders the expected body text', () => {
+    const bodyText = screen.getByTestId('bodyText');
+
+    expect(bodyText).toHaveTextContent(FIRST_SET_UP);
+  });
+
+  it('renders connector prompt', () => {
+    const connectorPrompt = screen.getByTestId('prompt');
+
+    expect(connectorPrompt).toBeInTheDocument();
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/attack_discovery/pages/welcome/index.tsx b/x-pack/plugins/security_solution/public/attack_discovery/pages/welcome/index.tsx
new file mode 100644
index 00000000000000..3f8488f6f64b42
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/attack_discovery/pages/welcome/index.tsx
@@ -0,0 +1,80 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { AssistantAvatar } from '@kbn/elastic-assistant';
+import { useConnectorSetup } from '@kbn/elastic-assistant/impl/connectorland/connector_setup';
+import { EuiEmptyPrompt, EuiFlexGroup, EuiFlexItem, EuiSpacer, EuiText } from '@elastic/eui';
+import React, { useMemo } from 'react';
+import { noop } from 'lodash/fp';
+
+import * as i18n from './translations';
+
+const WelcomeComponent: React.FC = () => {
+  const { prompt: connectorPrompt } = useConnectorSetup({
+    isFlyoutMode: true, // prevents the "Click to skip" button from showing
+    onConversationUpdate: async () => {},
+    onSetupComplete: noop, // this callback cannot be used to select a connector, so it's not used
+    updateConversationsOnSaveConnector: false, // no conversation to update
+  });
+
+  const title = useMemo(
+    () => (
+      <EuiFlexGroup
+        alignItems="center"
+        data-test-subj="emptyPromptTitleContainer"
+        direction="column"
+        gutterSize="none"
+      >
+        <EuiFlexItem data-test-subj="emptyPromptAvatar" grow={false}>
+          <AssistantAvatar size="m" />
+          <EuiSpacer size="m" />
+        </EuiFlexItem>
+
+        <EuiFlexItem grow={false}>
+          <EuiFlexGroup alignItems="center" direction="row" gutterSize="none">
+            <EuiFlexItem data-test-subj="welcomeTitle" grow={false}>
+              <span>{i18n.WELCOME_TO_ATTACK_DISCOVERY}</span>
+            </EuiFlexItem>
+          </EuiFlexGroup>
+        </EuiFlexItem>
+      </EuiFlexGroup>
+    ),
+    []
+  );
+
+  const body = useMemo(
+    () => (
+      <EuiFlexGroup
+        alignItems="center"
+        data-test-subj="bodyContainer"
+        direction="column"
+        gutterSize="none"
+      >
+        <EuiFlexItem grow={false}>
+          <EuiText color="subdued" data-test-subj="bodyText">
+            {i18n.FIRST_SET_UP}
+          </EuiText>
+        </EuiFlexItem>
+      </EuiFlexGroup>
+    ),
+    []
+  );
+
+  return (
+    <EuiFlexGroup alignItems="center" data-test-subj="welcome" direction="column" gutterSize="none">
+      <EuiFlexItem data-test-subj="emptyPromptContainer" grow={false}>
+        <EuiEmptyPrompt body={body} title={title} />
+      </EuiFlexItem>
+
+      <EuiFlexItem grow={false}>{connectorPrompt}</EuiFlexItem>
+    </EuiFlexGroup>
+  );
+};
+
+WelcomeComponent.displayName = 'Welcome';
+
+export const Welcome = React.memo(WelcomeComponent);
diff --git a/x-pack/plugins/security_solution/public/attack_discovery/pages/welcome/translations.ts b/x-pack/plugins/security_solution/public/attack_discovery/pages/welcome/translations.ts
new file mode 100644
index 00000000000000..bad72022e0a16e
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/attack_discovery/pages/welcome/translations.ts
@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const FIRST_SET_UP = i18n.translate(
+  'xpack.securitySolution.attackDiscovery.pages.welcome.firstSetUpLabel',
+  {
+    defaultMessage: 'First, set up a Generative AI Connector.',
+  }
+);
+
+export const WELCOME_TO_ATTACK_DISCOVERY = i18n.translate(
+  'xpack.securitySolution.attackDiscovery.pages.welcome.welcomeToAttackDiscoveryLabel',
+  {
+    defaultMessage: 'Welcome to Attack Discovery!',
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/attack_discovery/tour/index.test.tsx b/x-pack/plugins/security_solution/public/attack_discovery/tour/index.test.tsx
new file mode 100644
index 00000000000000..fc3f2a2344a140
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/attack_discovery/tour/index.test.tsx
@@ -0,0 +1,137 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+
+import { useIsElementMounted } from '../../detection_engine/rule_management_ui/components/rules_table/rules_table/guided_onboarding/use_is_element_mounted';
+import { render, screen } from '@testing-library/react';
+import {
+  createMockStore,
+  createSecuritySolutionStorageMock,
+  TestProviders,
+} from '../../common/mock';
+import { useKibana as mockUseKibana } from '../../common/lib/kibana/__mocks__';
+import { useKibana } from '../../common/lib/kibana';
+import { AttackDiscoveryTour } from '.';
+import { ATTACK_DISCOVERY_TOUR_CONFIG_ANCHORS } from './step_config';
+import { NEW_FEATURES_TOUR_STORAGE_KEYS, SecurityPageName } from '../../../common/constants';
+import type { RouteSpyState } from '../../common/utils/route/types';
+import { useRouteSpy } from '../../common/utils/route/use_route_spy';
+
+const mockRouteSpy: RouteSpyState = {
+  pageName: SecurityPageName.overview,
+  detailName: undefined,
+  tabName: undefined,
+  search: '',
+  pathName: '/',
+};
+jest.mock(
+  '../../detection_engine/rule_management_ui/components/rules_table/rules_table/guided_onboarding/use_is_element_mounted'
+);
+jest.mock('../../common/lib/kibana');
+jest.mock('../../common/utils/route/use_route_spy');
+jest.mock('@elastic/eui', () => {
+  const original = jest.requireActual('@elastic/eui');
+  return {
+    ...original,
+    EuiTourStep: () => <div data-test-subj="attackDiscovery-tour-step-1" />,
+  };
+});
+const mockedUseKibana = mockUseKibana();
+
+const { storage: storageMock } = createSecuritySolutionStorageMock();
+const mockStore = createMockStore(undefined, undefined, undefined, storageMock);
+
+const TestComponent = () => {
+  return (
+    <TestProviders store={mockStore}>
+      <div id={ATTACK_DISCOVERY_TOUR_CONFIG_ANCHORS.NAV_LINK} />
+      <AttackDiscoveryTour />
+    </TestProviders>
+  );
+};
+
+describe('Attack discovery tour', () => {
+  beforeAll(() => {
+    (useIsElementMounted as jest.Mock).mockReturnValue(true);
+    (useRouteSpy as jest.Mock).mockReturnValue([mockRouteSpy]);
+  });
+
+  beforeEach(() => {
+    (useKibana as jest.Mock).mockReturnValue({
+      ...mockedUseKibana,
+      services: {
+        ...mockedUseKibana.services,
+        storage: storageMock,
+      },
+    });
+
+    storageMock.clear();
+  });
+  afterEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('should not render tour step 1 when element is not mounted', () => {
+    (useIsElementMounted as jest.Mock).mockReturnValueOnce(false);
+    render(<TestComponent />);
+    expect(screen.queryByTestId('attackDiscovery-tour-step-1')).toBeNull();
+  });
+
+  it('should not render any tour steps when tour is not activated', () => {
+    storageMock.set(NEW_FEATURES_TOUR_STORAGE_KEYS.ATTACK_DISCOVERY, {
+      currentTourStep: 1,
+      isTourActive: false,
+    });
+    render(<TestComponent />);
+    expect(screen.queryByTestId('attackDiscovery-tour-step-1')).toBeNull();
+    expect(screen.queryByTestId('attackDiscovery-tour-step-2')).toBeNull();
+  });
+
+  it('should not render any tour steps when tour is on step 2 and page is not attack discovery', () => {
+    storageMock.set(NEW_FEATURES_TOUR_STORAGE_KEYS.ATTACK_DISCOVERY, {
+      currentTourStep: 2,
+      isTourActive: true,
+    });
+    const { debug } = render(<TestComponent />);
+    expect(screen.queryByTestId('attackDiscovery-tour-step-1')).toBeNull();
+    debug();
+  });
+
+  it('should  render tour step 1 when element is mounted', async () => {
+    const { getByTestId } = render(<TestComponent />);
+
+    expect(getByTestId('attackDiscovery-tour-step-1')).toBeInTheDocument();
+  });
+
+  it('should render tour video when tour is on step 2 and page is attack discovery', () => {
+    (useRouteSpy as jest.Mock).mockReturnValue([
+      { ...mockRouteSpy, pageName: SecurityPageName.attackDiscovery },
+    ]);
+    storageMock.set(NEW_FEATURES_TOUR_STORAGE_KEYS.ATTACK_DISCOVERY, {
+      currentTourStep: 2,
+      isTourActive: true,
+    });
+    const { getByTestId } = render(<TestComponent />);
+    expect(screen.queryByTestId('attackDiscovery-tour-step-1')).toBeNull();
+    expect(getByTestId('attackDiscovery-tour-step-2')).toBeInTheDocument();
+  });
+
+  it('should advance to tour step 2 when page is attack discovery', () => {
+    (useRouteSpy as jest.Mock).mockReturnValue([
+      { ...mockRouteSpy, pageName: SecurityPageName.attackDiscovery },
+    ]);
+    storageMock.set(NEW_FEATURES_TOUR_STORAGE_KEYS.ATTACK_DISCOVERY, {
+      currentTourStep: 1,
+      isTourActive: true,
+    });
+    render(<TestComponent />);
+    expect(
+      storageMock.get(NEW_FEATURES_TOUR_STORAGE_KEYS.ATTACK_DISCOVERY).currentTourStep
+    ).toEqual(2);
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/attack_discovery/tour/index.tsx b/x-pack/plugins/security_solution/public/attack_discovery/tour/index.tsx
new file mode 100644
index 00000000000000..ebddaca6d3f451
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/attack_discovery/tour/index.tsx
@@ -0,0 +1,133 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+/*
+ * The attack discovery tour for 8.14
+ *
+ * */
+
+import React, { useCallback, useEffect, useMemo, useState } from 'react';
+import { EuiButton, EuiButtonEmpty, EuiTourStep } from '@elastic/eui';
+import { useRouteSpy } from '../../common/utils/route/use_route_spy';
+import { VideoToast } from './video_toast';
+import { useIsElementMounted } from '../../detection_engine/rule_management_ui/components/rules_table/rules_table/guided_onboarding/use_is_element_mounted';
+import { NEW_FEATURES_TOUR_STORAGE_KEYS, SecurityPageName } from '../../../common/constants';
+import { useKibana, useNavigation } from '../../common/lib/kibana';
+import { attackDiscoveryTourStepOne, tourConfig } from './step_config';
+import * as i18n from './translations';
+
+interface TourState {
+  currentTourStep: number;
+  isTourActive: boolean;
+}
+
+const AttackDiscoveryTourComp = () => {
+  const {
+    services: { storage },
+  } = useKibana();
+
+  const { navigateTo } = useNavigation();
+  const [{ pageName }] = useRouteSpy();
+  const [tourState, setTourState] = useState<TourState>(
+    storage.get(NEW_FEATURES_TOUR_STORAGE_KEYS.ATTACK_DISCOVERY) ?? tourConfig
+  );
+
+  const advanceToVideoStep = useCallback(() => {
+    setTourState((prev) => {
+      storage.set(NEW_FEATURES_TOUR_STORAGE_KEYS.ATTACK_DISCOVERY, {
+        ...prev,
+        currentTourStep: 2,
+      });
+      return {
+        ...prev,
+        currentTourStep: 2,
+      };
+    });
+  }, [storage]);
+
+  useEffect(() => {
+    if (tourState.isTourActive && pageName === SecurityPageName.attackDiscovery) {
+      advanceToVideoStep();
+    }
+  }, [advanceToVideoStep, pageName, tourState.isTourActive]);
+
+  const finishTour = useCallback(() => {
+    setTourState((prev) => {
+      storage.set(NEW_FEATURES_TOUR_STORAGE_KEYS.ATTACK_DISCOVERY, {
+        ...prev,
+        isTourActive: false,
+      });
+      return {
+        ...prev,
+        isTourActive: false,
+      };
+    });
+  }, [storage]);
+
+  const navigateToAttackDiscovery = useCallback(() => {
+    navigateTo({
+      deepLinkId: SecurityPageName.attackDiscovery,
+    });
+  }, [navigateTo]);
+
+  const nextStep = useCallback(() => {
+    if (tourState.currentTourStep === 1) {
+      navigateToAttackDiscovery();
+      advanceToVideoStep();
+    }
+  }, [tourState.currentTourStep, navigateToAttackDiscovery, advanceToVideoStep]);
+
+  const footerAction = useMemo(
+    () => [
+      // if exit, set tour to the video step without navigating to the page
+      <EuiButtonEmpty size="s" color="text" onClick={advanceToVideoStep}>
+        {i18n.ATTACK_DISCOVERY_TOUR_EXIT}
+      </EuiButtonEmpty>,
+      // if next, set tour to the video step and navigate to the page
+      <EuiButton color="success" size="s" onClick={nextStep}>
+        {i18n.ATTACK_DISCOVERY_TRY_IT}
+      </EuiButton>,
+    ],
+    [advanceToVideoStep, nextStep]
+  );
+
+  const isElementAtCurrentStepMounted = useIsElementMounted(attackDiscoveryTourStepOne?.anchor);
+
+  const isTestAutomation =
+    window.Cypress != null || // TODO: temporary workaround to disable the tour when running in Cypress, because the tour breaks other projects Cypress tests
+    navigator.webdriver === true; // TODO: temporary workaround to disable the tour when running in the FTR, because the tour breaks other projects FTR tests
+
+  if (
+    isTestAutomation ||
+    !tourState.isTourActive ||
+    (tourState.currentTourStep === 1 && !isElementAtCurrentStepMounted)
+  ) {
+    return null;
+  }
+
+  return tourState.currentTourStep === 1 ? (
+    <EuiTourStep
+      anchor={`#${attackDiscoveryTourStepOne.anchor}`}
+      content={attackDiscoveryTourStepOne.content}
+      footerAction={footerAction}
+      isStepOpen
+      maxWidth={450}
+      onFinish={advanceToVideoStep}
+      panelProps={{
+        'data-test-subj': `attackDiscovery-tour-step-1`,
+      }}
+      repositionOnScroll
+      step={1}
+      stepsTotal={1}
+      title={attackDiscoveryTourStepOne.title}
+    />
+  ) : pageName === SecurityPageName.attackDiscovery ? (
+    <VideoToast onClose={finishTour} />
+  ) : null;
+};
+
+export const AttackDiscoveryTour = React.memo(AttackDiscoveryTourComp);
diff --git a/x-pack/plugins/security_solution/public/attack_discovery/tour/overview.gif b/x-pack/plugins/security_solution/public/attack_discovery/tour/overview.gif
new file mode 100644
index 00000000000000..4cf07dfecd6a98
Binary files /dev/null and b/x-pack/plugins/security_solution/public/attack_discovery/tour/overview.gif differ
diff --git a/x-pack/plugins/security_solution/public/attack_discovery/tour/step_config.tsx b/x-pack/plugins/security_solution/public/attack_discovery/tour/step_config.tsx
new file mode 100644
index 00000000000000..6984cbd8542dfa
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/attack_discovery/tour/step_config.tsx
@@ -0,0 +1,23 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import * as i18n from './translations';
+
+export const ATTACK_DISCOVERY_TOUR_CONFIG_ANCHORS = {
+  NAV_LINK: 'solutionSideNavItemLink-attack_discovery',
+};
+
+export const attackDiscoveryTourStepOne = {
+  title: i18n.ATTACK_DISCOVERY_TOUR_ATTACK_DISCOVERY_TITLE,
+  content: i18n.ATTACK_DISCOVERY_TOUR_ATTACK_DISCOVERY_DESC,
+  anchor: ATTACK_DISCOVERY_TOUR_CONFIG_ANCHORS.NAV_LINK,
+};
+
+export const tourConfig = {
+  currentTourStep: 1,
+  isTourActive: true,
+};
diff --git a/x-pack/plugins/security_solution/public/attack_discovery/tour/translations.ts b/x-pack/plugins/security_solution/public/attack_discovery/tour/translations.ts
new file mode 100644
index 00000000000000..eadfb384297c03
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/attack_discovery/tour/translations.ts
@@ -0,0 +1,59 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const ATTACK_DISCOVERY_TOUR_ATTACK_DISCOVERY_TITLE = i18n.translate(
+  'xpack.securitySolution.attackDiscovery.tour.navStep.title',
+  {
+    defaultMessage: 'Introducing attack discovery',
+  }
+);
+
+export const ATTACK_DISCOVERY_TOUR_ATTACK_DISCOVERY_DESC = i18n.translate(
+  'xpack.securitySolution.attackDiscovery.tour.navStep.desc',
+  {
+    defaultMessage:
+      'Leverage Generative AI to find relationships among your alerts and describe attack chains.',
+  }
+);
+
+export const ATTACK_DISCOVERY_TOUR_VIDEO_STEP_TITLE = i18n.translate(
+  'xpack.securitySolution.attackDiscovery.tour.videoStep.title',
+  {
+    defaultMessage: 'Start discovering attacks',
+  }
+);
+
+export const ATTACK_DISCOVERY_TOUR_VIDEO_STEP_DESC = i18n.translate(
+  'xpack.securitySolution.attackDiscovery.tour.videoStep.desc',
+  {
+    defaultMessage:
+      'Dive into data-driven attack discoveries and streamline your workflow with our intuitive AI technology, designed to elevate your productivity instantly.',
+  }
+);
+
+export const ATTACK_DISCOVERY_TOUR_EXIT = i18n.translate(
+  'xpack.securitySolution.attackDiscovery.tour.exit',
+  {
+    defaultMessage: 'Close',
+  }
+);
+
+export const ATTACK_DISCOVERY_TRY_IT = i18n.translate(
+  'xpack.securitySolution.attackDiscovery.tour.tryIt',
+  {
+    defaultMessage: 'Try it',
+  }
+);
+
+export const WATCH_OVERVIEW_VIDEO = i18n.translate(
+  'xpack.securitySolution.attackDiscovery.tour.video',
+  {
+    defaultMessage: 'Watch overview video',
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/attack_discovery/tour/video_toast.test.tsx b/x-pack/plugins/security_solution/public/attack_discovery/tour/video_toast.test.tsx
new file mode 100644
index 00000000000000..810577cdce5d43
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/attack_discovery/tour/video_toast.test.tsx
@@ -0,0 +1,55 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { VideoToast } from './video_toast';
+
+describe('VideoToast', () => {
+  const onCloseMock = jest.fn();
+  beforeEach(() => {
+    jest.spyOn(window, 'open').mockImplementation(() => null);
+    render(<VideoToast onClose={onCloseMock} />);
+  });
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+  it('should render the video toast', () => {
+    const videoToast = screen.getByTestId('attackDiscovery-tour-step-2');
+    expect(videoToast).toBeInTheDocument();
+  });
+
+  it('should render the video gif', () => {
+    const videoGif = screen.getByTestId('video-gif');
+    expect(videoGif).toBeInTheDocument();
+  });
+
+  it('should open the video in a new tab when the gif is clicked', () => {
+    const videoGif = screen.getByTestId('video-gif');
+    userEvent.click(videoGif);
+    expect(window.open).toHaveBeenCalledWith(
+      'https://videos.elastic.co/watch/BrDaDBAAvdygvemFKNAkBW',
+      '_blank'
+    );
+  });
+
+  it('should open the video in a new tab when the "Watch overview video" button is clicked', () => {
+    const watchVideoButton = screen.getByRole('button', { name: 'Watch overview video' });
+    userEvent.click(watchVideoButton);
+    expect(window.open).toHaveBeenCalledWith(
+      'https://videos.elastic.co/watch/BrDaDBAAvdygvemFKNAkBW',
+      '_blank'
+    );
+  });
+
+  it('should call the onClose callback when the close button is clicked', () => {
+    const closeButton = screen.getByTestId('toastCloseButton');
+    userEvent.click(closeButton);
+    expect(onCloseMock).toHaveBeenCalled();
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/attack_discovery/tour/video_toast.tsx b/x-pack/plugins/security_solution/public/attack_discovery/tour/video_toast.tsx
new file mode 100644
index 00000000000000..ae44027fa801df
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/attack_discovery/tour/video_toast.tsx
@@ -0,0 +1,59 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  EuiButton,
+  EuiIcon,
+  EuiImage,
+  EuiToast,
+  EuiPortal,
+  EuiText,
+  EuiSpacer,
+} from '@elastic/eui';
+import React, { useCallback } from 'react';
+import * as i18n from './translations';
+import theGif from './overview.gif';
+
+const VIDEO_CONTENT_WIDTH = 250;
+const VIDEO_PAGE = `https://videos.elastic.co/watch/BrDaDBAAvdygvemFKNAkBW`;
+
+const VideoComponent: React.FC<{ onClose: () => void }> = ({ onClose }) => {
+  const openVideoInNewTab = useCallback(() => {
+    window.open(VIDEO_PAGE, '_blank');
+  }, []);
+
+  return (
+    <EuiPortal>
+      <div
+        data-test-subj="attackDiscovery-tour-step-2"
+        css={{ position: 'fixed', bottom: 16, right: 16, zIndex: 9999 }}
+      >
+        <EuiToast onClose={onClose} css={{ maxWidth: VIDEO_CONTENT_WIDTH }}>
+          <EuiImage
+            onClick={openVideoInNewTab}
+            css={{ marginTop: 20, '&:hover': { cursor: 'pointer' } }}
+            src={theGif}
+            data-test-subj="video-gif"
+            alt={i18n.WATCH_OVERVIEW_VIDEO}
+          />
+          <EuiText size="s" grow={false} css={{ marginTop: 20 }}>
+            <h4>
+              <EuiIcon type="cheer" color="success" /> {i18n.ATTACK_DISCOVERY_TOUR_VIDEO_STEP_TITLE}
+            </h4>
+            <p>{i18n.ATTACK_DISCOVERY_TOUR_VIDEO_STEP_DESC}</p>
+          </EuiText>
+          <EuiSpacer size="m" />
+          <EuiButton color="success" onClick={openVideoInNewTab} fullWidth>
+            {i18n.WATCH_OVERVIEW_VIDEO}
+          </EuiButton>
+        </EuiToast>
+      </div>
+    </EuiPortal>
+  );
+};
+
+export const VideoToast = React.memo(VideoComponent);
diff --git a/x-pack/plugins/security_solution/public/attack_discovery/use_attack_discovery/helpers.ts b/x-pack/plugins/security_solution/public/attack_discovery/use_attack_discovery/helpers.ts
index b78750c583cbb9..34b3d9b8a4c20c 100644
--- a/x-pack/plugins/security_solution/public/attack_discovery/use_attack_discovery/helpers.ts
+++ b/x-pack/plugins/security_solution/public/attack_discovery/use_attack_discovery/helpers.ts
@@ -5,8 +5,14 @@
  * 2.0.
  */
 
+import type {
+  KnowledgeBaseConfig,
+  TraceOptions,
+} from '@kbn/elastic-assistant/impl/assistant/types';
+import type { AttackDiscoveryPostRequestBody } from '@kbn/elastic-assistant-common';
 import type { ActionConnector } from '@kbn/triggers-actions-ui-plugin/public';
 import type { ActionConnectorProps } from '@kbn/triggers-actions-ui-plugin/public/types';
+import { isEmpty } from 'lodash/fp';
 
 // aligns with OpenAiProviderType from '@kbn/stack-connectors-plugin/common/openai/types'
 enum OpenAiProviderType {
@@ -48,3 +54,49 @@ const getAzureApiVersionParameter = (url: string): string | undefined => {
   const urlSearchParams = new URLSearchParams(new URL(url).search);
   return urlSearchParams.get('api-version') ?? undefined;
 };
+
+export const getRequestBody = ({
+  actionTypeId,
+  alertsIndexPattern,
+  anonymizationFields,
+  connectorId,
+  knowledgeBase,
+  traceOptions,
+}: {
+  actionTypeId: string;
+  alertsIndexPattern: string | undefined;
+  anonymizationFields: {
+    page: number;
+    perPage: number;
+    total: number;
+    data: Array<{
+      id: string;
+      field: string;
+      timestamp?: string | undefined;
+      allowed?: boolean | undefined;
+      anonymized?: boolean | undefined;
+      updatedAt?: string | undefined;
+      updatedBy?: string | undefined;
+      createdAt?: string | undefined;
+      createdBy?: string | undefined;
+      namespace?: string | undefined;
+    }>;
+  };
+  connectorId: string | undefined;
+  knowledgeBase: KnowledgeBaseConfig;
+  traceOptions: TraceOptions;
+}): AttackDiscoveryPostRequestBody => ({
+  actionTypeId,
+  alertsIndexPattern: alertsIndexPattern ?? '',
+  anonymizationFields: anonymizationFields?.data ?? [],
+  connectorId: connectorId ?? '',
+  langSmithProject: isEmpty(traceOptions?.langSmithProject)
+    ? undefined
+    : traceOptions?.langSmithProject,
+  langSmithApiKey: isEmpty(traceOptions?.langSmithApiKey)
+    ? undefined
+    : traceOptions?.langSmithApiKey,
+  size: knowledgeBase.latestAlerts,
+  replacements: {}, // no need to re-use replacements in the current implementation
+  subAction: 'invokeAI', // non-streaming
+});
diff --git a/x-pack/plugins/security_solution/public/attack_discovery/use_attack_discovery/index.tsx b/x-pack/plugins/security_solution/public/attack_discovery/use_attack_discovery/index.tsx
index 144c098d237477..1a768d9d21b722 100644
--- a/x-pack/plugins/security_solution/public/attack_discovery/use_attack_discovery/index.tsx
+++ b/x-pack/plugins/security_solution/public/attack_discovery/use_attack_discovery/index.tsx
@@ -11,15 +11,14 @@ import {
   useAssistantContext,
   useLoadConnectors,
 } from '@kbn/elastic-assistant';
-import type { AttackDiscoveryPostRequestBody, Replacements } from '@kbn/elastic-assistant-common';
+import type { Replacements } from '@kbn/elastic-assistant-common';
 import {
   AttackDiscoveryPostResponse,
   ELASTIC_AI_ASSISTANT_INTERNAL_API_VERSION,
 } from '@kbn/elastic-assistant-common';
-import { isEmpty, uniq } from 'lodash/fp';
+import { uniq } from 'lodash/fp';
 import moment from 'moment';
-import React, { useCallback, useMemo, useState } from 'react';
-import { useLocalStorage, useSessionStorage } from 'react-use';
+import React, { useCallback, useEffect, useMemo, useState } from 'react';
 import * as uuid from 'uuid';
 import { useFetchAnonymizationFields } from '@kbn/elastic-assistant/impl/assistant/api/anonymization_fields/use_fetch_anonymization_fields';
 
@@ -36,16 +35,19 @@ import {
 import { getAverageIntervalSeconds } from '../pages/loading_callout/countdown/last_times_popover/helpers';
 import type { CachedAttackDiscoveries } from '../pages/session_storage';
 import {
-  encodeCachedAttackDiscoveries,
-  decodeCachedAttackDiscoveries,
+  getLocalStorageGenerationIntervals,
+  getSessionStorageCachedAttackDiscoveries,
+  setLocalStorageGenerationIntervals,
+  setSessionStorageCachedAttackDiscoveries,
 } from '../pages/session_storage';
 import { ERROR_GENERATING_ATTACK_DISCOVERIES } from '../pages/translations';
 import type { AttackDiscovery, GenerationInterval } from '../types';
-import { getGenAiConfig } from './helpers';
+import { getGenAiConfig, getRequestBody } from './helpers';
 
 const MAX_GENERATION_INTERVALS = 5;
 
 export interface UseAttackDiscovery {
+  alertsContextCount: number | null;
   approximateFutureTime: Date | null;
   attackDiscoveries: AttackDiscovery[];
   cachedAttackDiscoveries: Record<string, CachedAttackDiscoveries>;
@@ -66,7 +68,7 @@ export const useAttackDiscovery = ({
   setLoadingConnectorId?: (loadingConnectorId: string | null) => void;
 }): UseAttackDiscovery => {
   const { reportAttackDiscoveriesGenerated } = useAttackDiscoveryTelemetry();
-  const spaceId = useSpaceId() ?? 'default';
+  const spaceId: string | undefined = useSpaceId();
 
   // get Kibana services and connectors
   const {
@@ -85,24 +87,60 @@ export const useAttackDiscovery = ({
 
   const { data: anonymizationFields } = useFetchAnonymizationFields();
 
-  // get cached attack discoveries from session storage:
-  const [sessionStorageCachedAttackDiscoveries, setSessionStorageCachedAttackDiscoveries] =
-    useSessionStorage<string>(
-      `${DEFAULT_ASSISTANT_NAMESPACE}.${ATTACK_DISCOVERY_STORAGE_KEY}.${spaceId}.${CACHED_ATTACK_DISCOVERIES_SESSION_STORAGE_KEY}`
-    );
+  const sessionStorageKey = useMemo(
+    () =>
+      spaceId != null // spaceId is undefined while the useSpaceId hook is loading
+        ? `${DEFAULT_ASSISTANT_NAMESPACE}.${ATTACK_DISCOVERY_STORAGE_KEY}.${spaceId}.${CACHED_ATTACK_DISCOVERIES_SESSION_STORAGE_KEY}`
+        : '',
+    [spaceId]
+  );
+
   const [cachedAttackDiscoveries, setCachedAttackDiscoveries] = useState<
     Record<string, CachedAttackDiscoveries>
-  >(decodeCachedAttackDiscoveries(sessionStorageCachedAttackDiscoveries) ?? {});
+  >({});
+
+  useEffect(() => {
+    const decoded = getSessionStorageCachedAttackDiscoveries(sessionStorageKey);
+
+    if (decoded != null) {
+      setCachedAttackDiscoveries(decoded);
+
+      const decodedAttackDiscoveries = decoded[connectorId ?? '']?.attackDiscoveries;
+      if (decodedAttackDiscoveries != null) {
+        setAttackDiscoveries(decodedAttackDiscoveries);
+      }
+
+      const decodedReplacements = decoded[connectorId ?? '']?.replacements;
+      if (decodedReplacements != null) {
+        setReplacements(decodedReplacements);
+      }
 
-  // get generation intervals from local storage:
-  const [localStorageGenerationIntervals, setLocalStorageGenerationIntervals] = useLocalStorage<
-    Record<string, GenerationInterval[]>
-  >(
-    `${DEFAULT_ASSISTANT_NAMESPACE}.${ATTACK_DISCOVERY_STORAGE_KEY}.${spaceId}.${GENERATION_INTERVALS_LOCAL_STORAGE_KEY}`
+      const decodedLastUpdated = decoded[connectorId ?? '']?.updated;
+      if (decodedLastUpdated != null) {
+        setLastUpdated(decodedLastUpdated);
+      }
+    }
+  }, [connectorId, sessionStorageKey]);
+
+  const localStorageKey = useMemo(
+    () =>
+      spaceId != null // spaceId is undefined while the useSpaceId hook is loading
+        ? `${DEFAULT_ASSISTANT_NAMESPACE}.${ATTACK_DISCOVERY_STORAGE_KEY}.${spaceId}.${GENERATION_INTERVALS_LOCAL_STORAGE_KEY}`
+        : '',
+    [spaceId]
   );
+
   const [generationIntervals, setGenerationIntervals] = React.useState<
     Record<string, GenerationInterval[]> | undefined
-  >(localStorageGenerationIntervals);
+  >(undefined);
+
+  useEffect(() => {
+    const decoded = getLocalStorageGenerationIntervals(localStorageKey);
+
+    if (decoded != null) {
+      setGenerationIntervals(decoded);
+    }
+  }, [localStorageKey]);
 
   // get connector intervals from generation intervals:
   const connectorIntervals = useMemo(
@@ -128,26 +166,22 @@ export const useAttackDiscovery = ({
     cachedAttackDiscoveries[connectorId ?? '']?.updated ?? null
   );
 
+  // number of alerts sent as context to the LLM:
+  const [alertsContextCount, setAlertsContextCount] = useState<number | null>(null);
+
   /** The callback when users click the Generate button */
   const fetchAttackDiscoveries = useCallback(async () => {
     const selectedConnector = aiConnectors?.find((connector) => connector.id === connectorId);
     const actionTypeId = getFallbackActionTypeId(selectedConnector?.actionTypeId);
 
-    const body: AttackDiscoveryPostRequestBody = {
+    const body = getRequestBody({
       actionTypeId,
-      alertsIndexPattern: alertsIndexPattern ?? '',
-      anonymizationFields: anonymizationFields?.data ?? [],
-      connectorId: connectorId ?? '',
-      langSmithProject: isEmpty(traceOptions?.langSmithProject)
-        ? undefined
-        : traceOptions?.langSmithProject,
-      langSmithApiKey: isEmpty(traceOptions?.langSmithApiKey)
-        ? undefined
-        : traceOptions?.langSmithApiKey,
-      size: knowledgeBase.latestAlerts,
-      replacements: {}, // no need to re-use replacements in the current implementation
-      subAction: 'invokeAI', // non-streaming
-    };
+      alertsIndexPattern,
+      anonymizationFields,
+      connectorId,
+      knowledgeBase,
+      traceOptions,
+    });
 
     try {
       setLoadingConnectorId?.(connectorId ?? null);
@@ -202,9 +236,10 @@ export const useAttackDiscovery = ({
       };
 
       setCachedAttackDiscoveries(newCachedAttackDiscoveries);
-      setSessionStorageCachedAttackDiscoveries(
-        encodeCachedAttackDiscoveries(newCachedAttackDiscoveries) ?? ''
-      );
+      setSessionStorageCachedAttackDiscoveries({
+        key: sessionStorageKey,
+        cachedAttackDiscoveries: newCachedAttackDiscoveries,
+      });
 
       // update the generation intervals with the latest timing:
       const previousConnectorIntervals: GenerationInterval[] =
@@ -224,8 +259,17 @@ export const useAttackDiscovery = ({
         [connectorId ?? '']: newConnectorIntervals,
       };
 
-      setGenerationIntervals(newGenerationIntervals);
-      setLocalStorageGenerationIntervals(newGenerationIntervals);
+      const newAlertsContextCount = parsedResponse.data.alertsContextCount ?? null;
+      setAlertsContextCount(newAlertsContextCount);
+
+      // only update the generation intervals if alerts were sent as context to the LLM:
+      if (newAlertsContextCount != null && newAlertsContextCount > 0) {
+        setGenerationIntervals(newGenerationIntervals);
+        setLocalStorageGenerationIntervals({
+          key: localStorageKey,
+          generationIntervals: newGenerationIntervals,
+        });
+      }
 
       setReplacements(newReplacements);
       setAttackDiscoveries(newAttackDiscoveries);
@@ -235,6 +279,7 @@ export const useAttackDiscovery = ({
       reportAttackDiscoveriesGenerated({
         actionTypeId,
         durationMs,
+        alertsContextCount: newAlertsContextCount ?? 0,
         alertsCount: uniq(
           newAttackDiscoveries.flatMap((attackDiscovery) => attackDiscovery.alertIds)
         ).length,
@@ -255,25 +300,25 @@ export const useAttackDiscovery = ({
   }, [
     aiConnectors,
     alertsIndexPattern,
-    anonymizationFields?.data,
+    anonymizationFields,
     cachedAttackDiscoveries,
     connectorId,
     connectorIntervals,
     generationIntervals,
     http,
-    knowledgeBase.latestAlerts,
+    knowledgeBase,
+    localStorageKey,
     replacements,
     reportAttackDiscoveriesGenerated,
+    sessionStorageKey,
     setConnectorId,
     setLoadingConnectorId,
-    setLocalStorageGenerationIntervals,
-    setSessionStorageCachedAttackDiscoveries,
     toasts,
-    traceOptions?.langSmithApiKey,
-    traceOptions?.langSmithProject,
+    traceOptions,
   ]);
 
   return {
+    alertsContextCount,
     approximateFutureTime,
     attackDiscoveries,
     cachedAttackDiscoveries,
diff --git a/x-pack/plugins/security_solution/public/common/components/accessibility/index.ts b/x-pack/plugins/security_solution/public/common/components/accessibility/index.ts
index f05644c85e5364..f4f1b75eb29da5 100644
--- a/x-pack/plugins/security_solution/public/common/components/accessibility/index.ts
+++ b/x-pack/plugins/security_solution/public/common/components/accessibility/index.ts
@@ -6,3 +6,4 @@
  */
 
 export * from './tooltip_with_keyboard_shortcut';
+export * from './interval_abbr_screen_reader';
diff --git a/x-pack/plugins/security_solution/public/common/components/accessibility/interval_abbr_screen_reader/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/accessibility/interval_abbr_screen_reader/index.test.tsx
new file mode 100644
index 00000000000000..a0374bd750937f
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/accessibility/interval_abbr_screen_reader/index.test.tsx
@@ -0,0 +1,39 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import React from 'react';
+import { render, screen } from '@testing-library/react';
+import { TestProviders } from '../../../mock';
+import { IntervalAbbrScreenReader } from '.';
+
+describe('IntervalAbbrScreenReader', () => {
+  test('should add screen reader text for 35s', () => {
+    render(
+      <TestProviders>
+        <IntervalAbbrScreenReader interval="35s" />
+      </TestProviders>
+    );
+    expect(screen.getByText('35 seconds')).toBeDefined();
+  });
+
+  test('should add screen reader text for 1m', () => {
+    render(
+      <TestProviders>
+        <IntervalAbbrScreenReader interval="1m" />
+      </TestProviders>
+    );
+    expect(screen.getByText('1 minute')).toBeDefined();
+  });
+
+  test('should add screen reader text for 2h', () => {
+    render(
+      <TestProviders>
+        <IntervalAbbrScreenReader interval="2h" />
+      </TestProviders>
+    );
+    expect(screen.getByText('2 hours')).toBeDefined();
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/common/components/accessibility/interval_abbr_screen_reader/index.tsx b/x-pack/plugins/security_solution/public/common/components/accessibility/interval_abbr_screen_reader/index.tsx
new file mode 100644
index 00000000000000..8111aee5e4f3fe
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/accessibility/interval_abbr_screen_reader/index.tsx
@@ -0,0 +1,52 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import React, { useMemo } from 'react';
+import { EuiScreenReaderOnly } from '@elastic/eui';
+
+import * as i18n from './translations';
+
+interface IntervalAbbrScreenReaderProps {
+  interval: string;
+}
+
+export const IntervalAbbrScreenReader = ({ interval }: IntervalAbbrScreenReaderProps) => {
+  const screenReaderInterval: string | undefined = useMemo(() => {
+    if (interval) {
+      const number = parseInt(interval.slice(0, -1), 10);
+      const unit = interval.charAt(interval.length - 1);
+
+      if (Number.isFinite(number)) {
+        switch (unit) {
+          case 's': {
+            return i18n.SECONDS_SCREEN_READER(number);
+          }
+          case 'm': {
+            return i18n.MINUTES_SCREEN_READER(number);
+          }
+          case 'h': {
+            return i18n.HOURS_SCREEN_READER(number);
+          }
+        }
+      }
+    }
+
+    return undefined;
+  }, [interval]);
+
+  return (
+    <>
+      <span data-test-subj="interval-abbr-value" aria-hidden={Boolean(screenReaderInterval)}>
+        {interval}
+      </span>
+      {screenReaderInterval && (
+        <EuiScreenReaderOnly>
+          <p>{screenReaderInterval}</p>
+        </EuiScreenReaderOnly>
+      )}
+    </>
+  );
+};
diff --git a/x-pack/plugins/security_solution/public/common/components/accessibility/interval_abbr_screen_reader/translations.ts b/x-pack/plugins/security_solution/public/common/components/accessibility/interval_abbr_screen_reader/translations.ts
new file mode 100644
index 00000000000000..b3bb29a0099a00
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/accessibility/interval_abbr_screen_reader/translations.ts
@@ -0,0 +1,32 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const SECONDS_SCREEN_READER = (value: number) =>
+  i18n.translate('xpack.securitySolution.accessibility.intervalAbbrScreenReader.seconds', {
+    defaultMessage: '{value} {value, plural, one { second } other { seconds }}',
+    values: {
+      value,
+    },
+  });
+
+export const MINUTES_SCREEN_READER = (value: number) =>
+  i18n.translate('xpack.securitySolution.accessibility.intervalAbbrScreenReader.minutes', {
+    defaultMessage: '{value} {value, plural, one { minute } other { minutes }}',
+    values: {
+      value,
+    },
+  });
+
+export const HOURS_SCREEN_READER = (value: number) =>
+  i18n.translate('xpack.securitySolution.accessibility.intervalAbbrScreenReader.hours', {
+    defaultMessage: '{value} {value, plural, one { hour } other { hours }}',
+    values: {
+      value,
+    },
+  });
diff --git a/x-pack/plugins/security_solution/public/common/components/alerts_treemap/lib/legend/get_flattened_legend_items.test.ts b/x-pack/plugins/security_solution/public/common/components/alerts_treemap/lib/legend/get_flattened_legend_items.test.ts
index 325e2bab84d6fb..16599810b6a81d 100644
--- a/x-pack/plugins/security_solution/public/common/components/alerts_treemap/lib/legend/get_flattened_legend_items.test.ts
+++ b/x-pack/plugins/security_solution/public/common/components/alerts_treemap/lib/legend/get_flattened_legend_items.test.ts
@@ -12,10 +12,11 @@ import { getRiskScorePalette, RISK_SCORE_STEPS } from '../chart_palette';
 import { getFlattenedLegendItems } from './get_flattened_legend_items';
 import { bucketsWithStackByField1, maxRiskSubAggregations } from '../flatten/mocks/mock_buckets';
 import { flattenedBuckets } from '../flatten/mocks/mock_flattened_buckets';
+import { TableId } from '@kbn/securitysolution-data-table';
 
 describe('getFlattenedLegendItems', () => {
   it('returns the expected legend items', () => {
-    const expected: Array<Pick<LegendItem, 'color' | 'count' | 'field' | 'value'>> = [
+    const expected: Array<Pick<LegendItem, 'color' | 'count' | 'field' | 'value' | 'scopeId'>> = [
       {
         count: 34,
         field: 'kibana.alert.rule.name',
@@ -137,7 +138,7 @@ describe('getFlattenedLegendItems', () => {
         field: 'host.name',
         value: 'Host-r4y6xi92ob',
       },
-    ];
+    ].map((legend) => ({ ...legend, scopeId: TableId.alertsOnAlertsPage }));
 
     const legendItems = getFlattenedLegendItems({
       buckets: bucketsWithStackByField1,
diff --git a/x-pack/plugins/security_solution/public/common/components/alerts_treemap/lib/legend/index.test.ts b/x-pack/plugins/security_solution/public/common/components/alerts_treemap/lib/legend/index.test.ts
index 303cca251f4170..229dcafb0012a1 100644
--- a/x-pack/plugins/security_solution/public/common/components/alerts_treemap/lib/legend/index.test.ts
+++ b/x-pack/plugins/security_solution/public/common/components/alerts_treemap/lib/legend/index.test.ts
@@ -17,6 +17,7 @@ import {
   getLegendMap,
 } from '.';
 import type { FlattenedBucket, RawBucket } from '../../types';
+import { TableId } from '@kbn/securitysolution-data-table';
 
 describe('legend', () => {
   const colorPalette = getRiskScorePalette(RISK_SCORE_STEPS);
@@ -169,6 +170,7 @@ describe('legend', () => {
         count: 12,
         field: 'host.name',
         value: 'Host-k8iyfzraq9',
+        scopeId: TableId.alertsOnAlertsPage,
       });
     });
 
@@ -214,30 +216,35 @@ describe('legend', () => {
           count: 34,
           field: 'kibana.alert.rule.name',
           value: 'matches everything',
+          scopeId: TableId.alertsOnAlertsPage,
         },
         {
           color: '#da8b45',
           count: 28,
           field: 'kibana.alert.rule.name',
           value: 'EQL process sequence',
+          scopeId: TableId.alertsOnAlertsPage,
         },
         {
           color: '#d6bf57',
           count: 19,
           field: 'kibana.alert.rule.name',
           value: 'Endpoint Security',
+          scopeId: TableId.alertsOnAlertsPage,
         },
         {
           color: '#e7664c',
           count: 5,
           field: 'kibana.alert.rule.name',
           value: 'mimikatz process started',
+          scopeId: TableId.alertsOnAlertsPage,
         },
         {
           color: '#e7664c',
           count: 1,
           field: 'kibana.alert.rule.name',
           value: 'Threshold rule',
+          scopeId: TableId.alertsOnAlertsPage,
         },
       ]);
     });
@@ -264,7 +271,7 @@ describe('legend', () => {
     it('returns the expected legend item', () => {
       const expected: Record<
         string,
-        Array<Pick<LegendItem, 'color' | 'count' | 'field' | 'value'>>
+        Array<Pick<LegendItem, 'color' | 'count' | 'field' | 'value' | 'scopeId'>>
       > = {
         'matches everything': [
           {
@@ -272,6 +279,7 @@ describe('legend', () => {
             count: 34,
             field: 'kibana.alert.rule.name',
             value: 'matches everything',
+            scopeId: TableId.alertsOnAlertsPage,
           },
         ],
         'EQL process sequence': [
@@ -280,6 +288,7 @@ describe('legend', () => {
             count: 28,
             field: 'kibana.alert.rule.name',
             value: 'EQL process sequence',
+            scopeId: TableId.alertsOnAlertsPage,
           },
         ],
         'Endpoint Security': [
@@ -288,6 +297,7 @@ describe('legend', () => {
             count: 19,
             field: 'kibana.alert.rule.name',
             value: 'Endpoint Security',
+            scopeId: TableId.alertsOnAlertsPage,
           },
         ],
         'mimikatz process started': [
@@ -296,6 +306,7 @@ describe('legend', () => {
             count: 5,
             field: 'kibana.alert.rule.name',
             value: 'mimikatz process started',
+            scopeId: TableId.alertsOnAlertsPage,
           },
         ],
         'Threshold rule': [
@@ -304,6 +315,7 @@ describe('legend', () => {
             count: 1,
             field: 'kibana.alert.rule.name',
             value: 'Threshold rule',
+            scopeId: TableId.alertsOnAlertsPage,
           },
         ],
       };
diff --git a/x-pack/plugins/security_solution/public/common/components/alerts_treemap/lib/legend/index.ts b/x-pack/plugins/security_solution/public/common/components/alerts_treemap/lib/legend/index.ts
index 97369870032523..9409d4f1747301 100644
--- a/x-pack/plugins/security_solution/public/common/components/alerts_treemap/lib/legend/index.ts
+++ b/x-pack/plugins/security_solution/public/common/components/alerts_treemap/lib/legend/index.ts
@@ -7,6 +7,7 @@
 
 import { v4 as uuidv4 } from 'uuid';
 
+import { TableId } from '@kbn/securitysolution-data-table';
 import { firstNonNullValue } from '../../../../../../common/endpoint/models/ecs_safety_helpers';
 import type { LegendItem } from '../../../charts/draggable_legend_item';
 import { getFillColor } from '../chart_palette';
@@ -44,6 +45,7 @@ export const getLegendItemFromRawBucket = ({
     }),
   field: stackByField0,
   value: bucket.key_as_string ?? firstNonNullValue(bucket.key) ?? 0,
+  scopeId: TableId.alertsOnAlertsPage,
 });
 
 export const getLegendItemFromFlattenedBucket = ({
@@ -70,6 +72,7 @@ export const getLegendItemFromFlattenedBucket = ({
   render: () => `${stackByField1Key}`,
   field: `${stackByField1}`,
   value: `${stackByField1Key}`,
+  scopeId: TableId.alertsOnAlertsPage,
 });
 
 export const getFirstGroupLegendItems = ({
diff --git a/x-pack/plugins/security_solution/public/common/components/cell_actions/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/cell_actions/index.test.tsx
index 6e252bd11b4fa5..b056d4012df4c5 100644
--- a/x-pack/plugins/security_solution/public/common/components/cell_actions/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/cell_actions/index.test.tsx
@@ -7,7 +7,7 @@
 
 import React from 'react';
 import { render } from '@testing-library/react';
-import { SecurityCellActionsTrigger } from '../../../actions/constants';
+import { SecurityCellActionsTrigger } from '../../../app/actions/constants';
 import { CellActionsMode, SecurityCellActions } from '.';
 import { CellActions } from '@kbn/cell-actions';
 
diff --git a/x-pack/plugins/security_solution/public/common/components/cell_actions/index.tsx b/x-pack/plugins/security_solution/public/common/components/cell_actions/index.tsx
index 70aa80a97852ba..5edc5741775200 100644
--- a/x-pack/plugins/security_solution/public/common/components/cell_actions/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/cell_actions/index.tsx
@@ -13,14 +13,16 @@ import type {
 } from '@kbn/cell-actions';
 import React, { useMemo } from 'react';
 import type { CellActionFieldValue, CellActionsData } from '@kbn/cell-actions/src/types';
-import type { SecurityMetadata } from '../../../actions/types';
-import { SecurityCellActionsTrigger, SecurityCellActionType } from '../../../actions/constants';
+import type { SecurityCellActionMetadata } from '../../../app/actions/types';
+import { SecurityCellActionsTrigger, SecurityCellActionType } from '../../../app/actions/constants';
 import { SourcererScopeName } from '../../store/sourcerer/model';
 import { useGetFieldSpec } from '../../hooks/use_get_field_spec';
 import { useDataViewId } from '../../hooks/use_data_view_id';
 
 // bridge exports for convenience
 export * from '@kbn/cell-actions';
+export * from '@kbn/cell-actions/constants';
+
 export { SecurityCellActionsTrigger, SecurityCellActionType };
 
 export interface SecurityCellActionsData {
@@ -39,14 +41,14 @@ export interface SecurityCellActionsProps
   data: SecurityCellActionsData | SecurityCellActionsData[];
   triggerId: SecurityCellActionsTrigger;
   disabledActionTypes?: SecurityCellActionType[];
-  metadata?: SecurityMetadata;
+  metadata?: SecurityCellActionMetadata;
 }
 
 export interface UseDataGridColumnsSecurityCellActionsProps
   extends UseDataGridColumnsCellActionsProps {
   triggerId: SecurityCellActionsTrigger;
   disabledActionTypes?: SecurityCellActionType[];
-  metadata?: SecurityMetadata;
+  metadata?: SecurityCellActionMetadata;
 }
 
 export const useDataGridColumnsSecurityCellActions: UseDataGridColumnsCellActions<UseDataGridColumnsSecurityCellActionsProps> =
diff --git a/x-pack/plugins/security_solution/public/common/components/control_columns/row_action/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/control_columns/row_action/index.test.tsx
index 609279219c9d20..0dd60a0f9c2f8f 100644
--- a/x-pack/plugins/security_solution/public/common/components/control_columns/row_action/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/control_columns/row_action/index.test.tsx
@@ -6,18 +6,15 @@
  */
 
 import { TableId } from '@kbn/securitysolution-data-table';
-import { render } from '@testing-library/react';
+import { fireEvent, render } from '@testing-library/react';
 import React from 'react';
 import { RowAction } from '.';
 import { defaultHeaders, TestProviders } from '../../../mock';
 import { getDefaultControlColumn } from '../../../../timelines/components/timeline/body/control_columns';
-import { useIsExperimentalFeatureEnabled } from '../../../hooks/use_experimental_features';
-
-jest.mock('../../../hooks/use_experimental_features', () => ({
-  useIsExperimentalFeatureEnabled: jest.fn().mockReturnValue(false),
-}));
-const useIsExperimentalFeatureEnabledMock = useIsExperimentalFeatureEnabled as jest.Mock;
-useIsExperimentalFeatureEnabledMock.mockReturnValue(false);
+import { useRouteSpy } from '../../../utils/route/use_route_spy';
+import type { RouteSpyState } from '../../../utils/route/types';
+import { SecurityPageName } from '@kbn/deeplinks-security';
+import { createTelemetryServiceMock } from '../../../lib/telemetry/telemetry_service.mock';
 
 const mockDispatch = jest.fn();
 jest.mock('react-redux', () => {
@@ -28,7 +25,44 @@ jest.mock('react-redux', () => {
     useDispatch: () => mockDispatch,
   };
 });
+const mockOpenFlyout = jest.fn();
+
+jest.mock('../../../utils/route/use_route_spy');
+
+jest.mock('@kbn/expandable-flyout', () => {
+  return {
+    useExpandableFlyoutApi: () => ({ openFlyout: mockOpenFlyout }),
+  };
+});
+
+const mockedTelemetry = createTelemetryServiceMock();
+jest.mock('../../../lib/kibana', () => {
+  const original = jest.requireActual('../../../lib/kibana');
+  return {
+    ...original,
+    useKibana: () => ({
+      ...original.useKibana(),
+      services: {
+        ...original.useKibana().services,
+        telemetry: mockedTelemetry,
+      },
+    }),
+  };
+});
+jest.mock('@kbn/kibana-react-plugin/public', () => {
+  const original = jest.requireActual('@kbn/kibana-react-plugin/public');
+  return {
+    ...original,
+  };
+});
 
+const mockRouteSpy: RouteSpyState = {
+  pageName: SecurityPageName.overview,
+  detailName: undefined,
+  tabName: undefined,
+  search: '',
+  pathName: '/',
+};
 describe('RowAction', () => {
   const sampleData = {
     _id: '1',
@@ -63,6 +97,12 @@ describe('RowAction', () => {
     tabType: 'query',
     showCheckboxes: false,
   };
+
+  beforeEach(() => {
+    (useRouteSpy as jest.Mock).mockReturnValue([mockRouteSpy]);
+    jest.clearAllMocks();
+  });
+
   test('displays expand events button', () => {
     const wrapper = render(
       <TestProviders>
@@ -71,4 +111,29 @@ describe('RowAction', () => {
     );
     expect(wrapper.getAllByTestId('expand-event')).not.toBeNull();
   });
+
+  test('Uses the old flyout when the experimental feature returns false', () => {
+    const wrapper = render(
+      <TestProviders>
+        <RowAction {...defaultProps} />
+      </TestProviders>
+    );
+    fireEvent.click(wrapper.getByTestId('expand-event'));
+    expect(mockDispatch).toHaveBeenCalled();
+    expect(mockOpenFlyout).not.toHaveBeenCalled();
+  });
+
+  test('Uses the new flyout when the experimental feature returns false but the page is attackDiscovery', () => {
+    (useRouteSpy as jest.Mock).mockReturnValue([
+      { ...mockRouteSpy, pageName: SecurityPageName.attackDiscovery },
+    ]);
+    const wrapper = render(
+      <TestProviders>
+        <RowAction {...defaultProps} />
+      </TestProviders>
+    );
+    fireEvent.click(wrapper.getByTestId('expand-event'));
+    expect(mockDispatch).not.toHaveBeenCalled();
+    expect(mockOpenFlyout).toHaveBeenCalled();
+  });
 });
diff --git a/x-pack/plugins/security_solution/public/common/components/control_columns/row_action/index.tsx b/x-pack/plugins/security_solution/public/common/components/control_columns/row_action/index.tsx
index a9810a03960fda..bc9969d2a7e42f 100644
--- a/x-pack/plugins/security_solution/public/common/components/control_columns/row_action/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/control_columns/row_action/index.tsx
@@ -11,9 +11,13 @@ import { useDispatch } from 'react-redux';
 import { useExpandableFlyoutApi } from '@kbn/expandable-flyout';
 import { dataTableActions, TableId } from '@kbn/securitysolution-data-table';
 import { useUiSetting$ } from '@kbn/kibana-react-plugin/public';
+import { useRouteSpy } from '../../../utils/route/use_route_spy';
 import { useKibana } from '../../../lib/kibana';
 import { timelineActions } from '../../../../timelines/store';
-import { ENABLE_EXPANDABLE_FLYOUT_SETTING } from '../../../../../common/constants';
+import {
+  ENABLE_EXPANDABLE_FLYOUT_SETTING,
+  SecurityPageName,
+} from '../../../../../common/constants';
 import { DocumentDetailsRightPanelKey } from '../../../../flyout/document_details/shared/constants/panel_keys';
 import type {
   SetEventsDeleted,
@@ -74,6 +78,7 @@ const RowActionComponent = ({
   const { openFlyout } = useExpandableFlyoutApi();
 
   const dispatch = useDispatch();
+  const [{ pageName }] = useRouteSpy();
   const [isSecurityFlyoutEnabled] = useUiSetting$<boolean>(ENABLE_EXPANDABLE_FLYOUT_SETTING);
   const isExpandableFlyoutInCreateRuleEnabled = useIsExperimentalFeatureEnabled(
     'expandableFlyoutInCreateRuleEnabled'
@@ -95,7 +100,11 @@ const RowActionComponent = ({
   );
 
   let showExpandableFlyout: boolean;
-  if (tableId === TableId.rulePreview) {
+
+  // disable the old flyout on attack discovery page
+  if (pageName === SecurityPageName.attackDiscovery) {
+    showExpandableFlyout = true;
+  } else if (tableId === TableId.rulePreview) {
     showExpandableFlyout = isSecurityFlyoutEnabled && isExpandableFlyoutInCreateRuleEnabled;
   } else {
     showExpandableFlyout = isSecurityFlyoutEnabled;
diff --git a/x-pack/plugins/security_solution/public/common/components/discover_in_timeline/use_discover_in_timeline_actions.tsx b/x-pack/plugins/security_solution/public/common/components/discover_in_timeline/use_discover_in_timeline_actions.tsx
index 34e797c0b4be41..7a6756bfe80acb 100644
--- a/x-pack/plugins/security_solution/public/common/components/discover_in_timeline/use_discover_in_timeline_actions.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/discover_in_timeline/use_discover_in_timeline_actions.tsx
@@ -58,7 +58,7 @@ export const useDiscoverInTimelineActions = (
 
   const queryClient = useQueryClient();
 
-  const { mutateAsync: saveSavedSearch, status } = useMutation({
+  const { mutateAsync: saveSavedSearch, status: saveSavedSearchStatus } = useMutation({
     mutationFn: ({
       savedSearch,
       savedSearchOptions,
@@ -189,7 +189,7 @@ export const useDiscoverInTimelineActions = (
    *
    * */
   const updateSavedSearch = useCallback(
-    async (savedSearch: SavedSearch, timelineId: string) => {
+    async (savedSearch: SavedSearch, timelineId: string, onUpdate?: () => void) => {
       savedSearch.timeRestore = true;
       savedSearch.timeRange =
         savedSearch.timeRange ?? discoverDataService.query.timefilter.timefilter.getTime();
@@ -219,7 +219,7 @@ export const useDiscoverInTimelineActions = (
         // If no saved search exists. Create a new saved search instance and associate it with the timeline.
         try {
           // Make sure we're not creating a saved search while a previous creation call is in progress
-          if (status !== 'idle') {
+          if (saveSavedSearchStatus === 'loading') {
             return;
           }
           dispatch(
@@ -244,6 +244,7 @@ export const useDiscoverInTimelineActions = (
             );
             // Also save the timeline, this will only happen once, in case there is no saved search id yet
             dispatch(timelineActions.saveTimeline({ id: TimelineId.active, saveAsNew: false }));
+            onUpdate?.();
           }
         } catch (err) {
           dispatch(
@@ -254,7 +255,7 @@ export const useDiscoverInTimelineActions = (
         }
       }
     },
-    [persistSavedSearch, savedSearchId, dispatch, discoverDataService, status]
+    [persistSavedSearch, savedSearchId, dispatch, discoverDataService, saveSavedSearchStatus]
   );
 
   const initializeLocalSavedSearch = useCallback(
diff --git a/x-pack/plugins/security_solution/public/common/components/drag_and_drop/cell_actions_wrapper.test.tsx b/x-pack/plugins/security_solution/public/common/components/drag_and_drop/cell_actions_wrapper.test.tsx
new file mode 100644
index 00000000000000..8f438bb9289c4e
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/drag_and_drop/cell_actions_wrapper.test.tsx
@@ -0,0 +1,97 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { render } from '@testing-library/react';
+import { CellActionsWrapper } from './cell_actions_wrapper';
+import { CellActionsMode, SecurityCellActionType } from '../cell_actions';
+import { TimelineId, type DataProvider } from '../../../../common/types';
+
+const MockSecurityCellActions = jest.fn(({ children }: { children: React.ReactNode }) => (
+  <div data-test-subj="mockSecurityCellActions">{children}</div>
+));
+jest.mock('../cell_actions', () => ({
+  ...jest.requireActual('../cell_actions'),
+  SecurityCellActions: (params: { children: React.ReactNode }) => MockSecurityCellActions(params),
+}));
+
+const mockSourcererScopeId = 'testSourcererScopeId';
+jest.mock('../../../helpers', () => ({
+  getSourcererScopeId: jest.fn(() => mockSourcererScopeId),
+}));
+
+const dataProvider = { queryMatch: { field: 'host.name', value: '12345' } } as DataProvider;
+const data = { ...dataProvider.queryMatch };
+
+describe('CellActionsWrapper', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('should render cell actions with the content', () => {
+    const result = render(
+      <CellActionsWrapper dataProvider={dataProvider}>{'test children'}</CellActionsWrapper>
+    );
+    expect(result.queryByTestId('mockSecurityCellActions')).toBeInTheDocument();
+    expect(result.queryByText('test children')).toBeInTheDocument();
+  });
+
+  it('should call cell actions with the default props', () => {
+    render(<CellActionsWrapper dataProvider={dataProvider}>{'test children'}</CellActionsWrapper>);
+    expect(MockSecurityCellActions).toHaveBeenCalledWith(
+      expect.objectContaining({
+        data,
+        mode: CellActionsMode.HOVER_DOWN,
+        sourcererScopeId: mockSourcererScopeId,
+        disabledActionTypes: [],
+        metadata: { scopeId: TimelineId.active },
+      })
+    );
+  });
+
+  describe('when dataProvider value is empty', () => {
+    it('should set an empty array value to the SecurityCellActions component', () => {
+      const emptyValueDataProvider = {
+        queryMatch: { field: 'host.name', value: '' },
+      } as DataProvider;
+      render(
+        <CellActionsWrapper dataProvider={emptyValueDataProvider}>
+          {'test children'}
+        </CellActionsWrapper>
+      );
+      expect(MockSecurityCellActions).toHaveBeenCalledWith(
+        expect.objectContaining({ data: { ...data, value: [] } })
+      );
+    });
+  });
+
+  describe('when scopeId is defined', () => {
+    it('should set the scopeId to the SecurityCellActions component metadata', () => {
+      render(
+        <CellActionsWrapper dataProvider={dataProvider} scopeId="testScopeId">
+          {'test children'}
+        </CellActionsWrapper>
+      );
+      expect(MockSecurityCellActions).toHaveBeenCalledWith(
+        expect.objectContaining({ metadata: { scopeId: 'testScopeId' } })
+      );
+    });
+  });
+
+  describe('when hideTopN is true', () => {
+    it('should set the disabledActionTypes to the SecurityCellActions component', () => {
+      render(
+        <CellActionsWrapper dataProvider={dataProvider} hideTopN>
+          {'test children'}
+        </CellActionsWrapper>
+      );
+      expect(MockSecurityCellActions).toHaveBeenCalledWith(
+        expect.objectContaining({ disabledActionTypes: [SecurityCellActionType.SHOW_TOP_N] })
+      );
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/common/components/drag_and_drop/cell_actions_wrapper.tsx b/x-pack/plugins/security_solution/public/common/components/drag_and_drop/cell_actions_wrapper.tsx
new file mode 100644
index 00000000000000..d10cd5aaf19849
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/drag_and_drop/cell_actions_wrapper.tsx
@@ -0,0 +1,76 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { PropsWithChildren } from 'react';
+import React, { useContext, useMemo } from 'react';
+import { TimelineId, type DataProvider } from '../../../../common/types';
+import type { SecurityCellActionsData } from '../cell_actions';
+import {
+  CellActionsMode,
+  SecurityCellActions,
+  SecurityCellActionsTrigger,
+  SecurityCellActionType,
+} from '../cell_actions';
+import { getSourcererScopeId } from '../../../helpers';
+import { TimelineContext } from '../../../timelines/components/timeline';
+
+import { TableContext } from '../events_viewer/shared';
+
+type CellActionsWrapperProps = PropsWithChildren<{
+  /**
+   * The `dataProvider` is used to retrieve the `field` and `value` for the cell actions execution.
+   * */
+  dataProvider: DataProvider;
+  /**
+   * The `hideTopN` is used hide the show top N action. Defaults to `false`.
+   * */
+  hideTopN?: boolean;
+  /**
+   * The `scopeId` is used to determine the context of the cell actions execution.
+   * If not provided this component will try to retrieve the timeline id or the table id from the context, in that order.
+   * */
+  scopeId?: string;
+}>;
+
+export const CellActionsWrapper = React.memo<PropsWithChildren<CellActionsWrapperProps>>(
+  ({ dataProvider, scopeId = TimelineId.active, children, hideTopN = false }) => {
+    const { timelineId: timelineIdFind } = useContext(TimelineContext);
+    const { tableId: tableIdFind } = useContext(TableContext);
+
+    const sourcererScopeId = useMemo(
+      () => getSourcererScopeId(scopeId ?? timelineIdFind ?? tableIdFind),
+      [scopeId, tableIdFind, timelineIdFind]
+    );
+
+    const data = useMemo<SecurityCellActionsData>(() => {
+      const { value, field } = dataProvider.queryMatch;
+      return { value: value || [], field };
+    }, [dataProvider.queryMatch]);
+
+    const disabledActionTypes = useMemo(
+      () => (hideTopN ? [SecurityCellActionType.SHOW_TOP_N] : []),
+      [hideTopN]
+    );
+
+    return (
+      <SecurityCellActions
+        mode={CellActionsMode.HOVER_DOWN}
+        visibleCellActions={6}
+        showActionTooltips
+        triggerId={SecurityCellActionsTrigger.DEFAULT}
+        data={data}
+        disabledActionTypes={disabledActionTypes}
+        sourcererScopeId={sourcererScopeId}
+        metadata={{ scopeId }}
+      >
+        {children}
+      </SecurityCellActions>
+    );
+  }
+);
+
+CellActionsWrapper.displayName = 'CellActionsWrapper';
diff --git a/x-pack/plugins/security_solution/public/common/components/drag_and_drop/draggable_wrapper.test.tsx b/x-pack/plugins/security_solution/public/common/components/drag_and_drop/draggable_wrapper.test.tsx
index dca5ac2c063b41..cd89220c206208 100644
--- a/x-pack/plugins/security_solution/public/common/components/drag_and_drop/draggable_wrapper.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/drag_and_drop/draggable_wrapper.test.tsx
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { fireEvent, render, screen, waitFor } from '@testing-library/react';
+import { render } from '@testing-library/react';
 import { shallow } from 'enzyme';
 import React from 'react';
 import type { DraggableStateSnapshot, DraggingStyle } from '@hello-pangea/dnd';
@@ -35,6 +35,14 @@ jest.mock('@elastic/eui', () => {
   };
 });
 
+const MockSecurityCellActions = jest.fn(({ children }: { children: React.ReactNode }) => (
+  <div data-test-subj="cell-actions-mock">{children}</div>
+));
+jest.mock('../cell_actions', () => ({
+  ...jest.requireActual('../cell_actions'),
+  SecurityCellActions: (props: { children: React.ReactNode }) => MockSecurityCellActions(props),
+}));
+
 const scopeIdsWithHoverActions = [
   undefined,
   TimelineId.active,
@@ -105,46 +113,11 @@ describe('DraggableWrapper', () => {
       expect(wrapper.text()).toEqual(message);
     });
 
-    test('it does NOT render hover actions when the mouse is NOT over the draggable wrapper', () => {
-      const wrapper = mount(
-        <TestProviders>
-          <DragDropContextWrapper browserFields={mockBrowserFields}>
-            <DraggableWrapper
-              dataProvider={dataProvider}
-              isDraggable={true}
-              render={() => message}
-            />
-          </DragDropContextWrapper>
-        </TestProviders>
-      );
-
-      expect(wrapper.find('[data-test-subj="hover-actions-copy-button"]').exists()).toBe(false);
-    });
-
-    test('it renders hover actions when the mouse is over the text of draggable wrapper', async () => {
-      const wrapper = mount(
-        <TestProviders>
-          <DragDropContextWrapper browserFields={mockBrowserFields}>
-            <DraggableWrapper
-              dataProvider={dataProvider}
-              isDraggable={true}
-              render={() => message}
-            />
-          </DragDropContextWrapper>
-        </TestProviders>
-      );
-
-      await waitFor(() => {
-        wrapper.find('[data-test-subj="withHoverActionsButton"]').simulate('mouseenter');
-        expect(wrapper.find('[data-test-subj="hover-actions-copy-button"]').exists()).toBe(true);
-      });
-    });
-
     scopeIdsWithHoverActions.forEach((scopeId) => {
       test(`it renders hover actions (by default) when 'isDraggable' is false and timelineId is '${scopeId}'`, async () => {
         const isDraggable = false;
 
-        const { container } = render(
+        const { queryByTestId } = render(
           <TestProviders>
             <DragDropContextWrapper browserFields={mockBrowserFields}>
               <DraggableWrapper
@@ -157,11 +130,7 @@ describe('DraggableWrapper', () => {
           </TestProviders>
         );
 
-        fireEvent.mouseEnter(container.querySelector('[data-test-subj="withHoverActionsButton"]')!);
-
-        await waitFor(() => {
-          expect(screen.getByTestId('hover-actions-copy-button')).toBeInTheDocument();
-        });
+        expect(queryByTestId('cell-actions-mock')).toBeInTheDocument();
       });
     });
 
@@ -169,7 +138,7 @@ describe('DraggableWrapper', () => {
       test(`it does NOT render hover actions when 'isDraggable' is false and timelineId is '${scopeId}'`, async () => {
         const isDraggable = false;
 
-        const { container } = render(
+        const { queryByTestId } = render(
           <TestProviders>
             <DragDropContextWrapper browserFields={mockBrowserFields}>
               <DraggableWrapper
@@ -182,11 +151,7 @@ describe('DraggableWrapper', () => {
           </TestProviders>
         );
 
-        fireEvent.mouseEnter(container.querySelector('[data-test-subj="withHoverActionsButton"]')!);
-
-        await waitFor(() => {
-          expect(screen.queryByTestId('hover-actions-copy-button')).not.toBeInTheDocument();
-        });
+        expect(queryByTestId('cell-actions-mock')).not.toBeInTheDocument();
       });
     });
   });
diff --git a/x-pack/plugins/security_solution/public/common/components/drag_and_drop/draggable_wrapper.tsx b/x-pack/plugins/security_solution/public/common/components/drag_and_drop/draggable_wrapper.tsx
index 790a93b99e545f..9a8762cee2c079 100644
--- a/x-pack/plugins/security_solution/public/common/components/drag_and_drop/draggable_wrapper.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/drag_and_drop/draggable_wrapper.tsx
@@ -24,14 +24,12 @@ import type { DataProvider } from '../../../timelines/components/timeline/data_p
 import { ROW_RENDERER_BROWSER_EXAMPLE_TIMELINE_ID } from '../../../timelines/components/row_renderers_browser/constants';
 
 import { TruncatableText } from '../truncatable_text';
-import { WithHoverActions } from '../with_hover_actions';
+import { CellActionsWrapper } from './cell_actions_wrapper';
 
 import { getDraggableId, getDroppableId } from './helpers';
 import { ProviderContainer } from './provider_container';
 
 import * as i18n from './translations';
-import { useHoverActions } from '../hover_actions/use_hover_actions';
-import { useDraggableKeyboardWrapper } from './draggable_keyboard_wrapper_hook';
 
 // As right now, we do not know what we want there, we will keep it as a placeholder
 export const DragEffects = styled.div``;
@@ -99,14 +97,13 @@ type RenderFunctionProp = (
 
 interface Props {
   dataProvider: DataProvider;
+  fieldType?: string;
+  isAggregatable?: boolean;
   hideTopN?: boolean;
   isDraggable?: boolean;
   render: RenderFunctionProp;
-  isAggregatable?: boolean;
-  fieldType?: string;
   scopeId?: string;
   truncate?: boolean;
-  onFilterAdded?: () => void;
 }
 
 export const disableHoverActions = (timelineId: string | undefined): boolean =>
@@ -131,288 +128,202 @@ export const getStyle = (
   };
 };
 
-const DraggableOnWrapperComponent: React.FC<Props> = ({
-  dataProvider,
-  hideTopN = false,
-  onFilterAdded,
-  render,
-  fieldType = '',
-  isAggregatable = false,
-  scopeId,
-  truncate,
-}) => {
-  const [providerRegistered, setProviderRegistered] = useState(false);
-  const isDisabled = dataProvider.id.includes(`-${ROW_RENDERER_BROWSER_EXAMPLE_TIMELINE_ID}-`);
-  const dispatch = useDispatch();
-  const {
-    closePopOverTrigger,
-    handleClosePopOverTrigger,
-    hoverActionsOwnFocus,
-    hoverContent,
-    keyboardHandlerRef,
-    onCloseRequested,
-    openPopover,
-    onFocus,
-    setContainerRef,
-    isShowingTopN,
-  } = useHoverActions({
-    dataProvider,
-    hideTopN,
-    onFilterAdded,
-    render,
-    fieldType,
-    isAggregatable,
-    scopeId,
-    truncate,
-  });
-
-  const registerProvider = useCallback(() => {
-    if (!isDisabled) {
-      dispatch(dragAndDropActions.registerProvider({ provider: dataProvider }));
-      setProviderRegistered(true);
-    }
-  }, [isDisabled, dispatch, dataProvider]);
-
-  const unRegisterProvider = useCallback(
-    () =>
-      providerRegistered &&
-      dispatch(dragAndDropActions.unRegisterProvider({ id: dataProvider.id })),
-    [providerRegistered, dispatch, dataProvider.id]
-  );
-
-  useEffect(
-    () => () => {
-      unRegisterProvider();
-    },
-    [unRegisterProvider]
-  );
-
-  const RenderClone = useCallback(
-    (provided, snapshot) => (
-      <ConditionalPortal registerProvider={registerProvider}>
-        <div
+const DraggableOnWrapper: React.FC<Props> = React.memo(
+  ({ dataProvider, render, scopeId, truncate, hideTopN }) => {
+    const [providerRegistered, setProviderRegistered] = useState(false);
+    const isDisabled = dataProvider.id.includes(`-${ROW_RENDERER_BROWSER_EXAMPLE_TIMELINE_ID}-`);
+    const dispatch = useDispatch();
+
+    const registerProvider = useCallback(() => {
+      if (!isDisabled) {
+        dispatch(dragAndDropActions.registerProvider({ provider: dataProvider }));
+        setProviderRegistered(true);
+      }
+    }, [isDisabled, dispatch, dataProvider]);
+
+    const unRegisterProvider = useCallback(
+      () =>
+        providerRegistered &&
+        dispatch(dragAndDropActions.unRegisterProvider({ id: dataProvider.id })),
+      [providerRegistered, dispatch, dataProvider.id]
+    );
+
+    useEffect(
+      () => () => {
+        unRegisterProvider();
+      },
+      [unRegisterProvider]
+    );
+
+    const RenderClone = useCallback(
+      (provided, snapshot) => (
+        <ConditionalPortal registerProvider={registerProvider}>
+          <div
+            {...provided.draggableProps}
+            {...provided.dragHandleProps}
+            style={getStyle(provided.draggableProps.style, snapshot)}
+            ref={provided.innerRef}
+            data-test-subj="providerContainer"
+            tabIndex={-1}
+          >
+            <ProviderContentWrapper
+              data-test-subj={`draggable-content-${dataProvider.queryMatch.field}`}
+            >
+              {render(dataProvider, provided, snapshot)}
+            </ProviderContentWrapper>
+          </div>
+        </ConditionalPortal>
+      ),
+      [dataProvider, registerProvider, render]
+    );
+
+    const DraggableContent = useCallback(
+      (provided, snapshot) => (
+        <ProviderContainer
           {...provided.draggableProps}
           {...provided.dragHandleProps}
-          style={getStyle(provided.draggableProps.style, snapshot)}
-          ref={provided.innerRef}
+          ref={(e: HTMLDivElement) => {
+            provided.innerRef(e);
+          }}
           data-test-subj="providerContainer"
+          isDragging={snapshot.isDragging}
+          registerProvider={registerProvider}
           tabIndex={-1}
         >
-          <ProviderContentWrapper
-            data-test-subj={`draggable-content-${dataProvider.queryMatch.field}`}
-          >
-            {render(dataProvider, provided, snapshot)}
-          </ProviderContentWrapper>
-        </div>
-      </ConditionalPortal>
-    ),
-    [dataProvider, registerProvider, render]
-  );
-
-  const DraggableContent = useCallback(
-    (provided, snapshot) => (
-      <ProviderContainer
-        {...provided.draggableProps}
-        {...provided.dragHandleProps}
-        ref={(e: HTMLDivElement) => {
-          provided.innerRef(e);
-          setContainerRef(e);
-        }}
-        data-test-subj="providerContainer"
-        isDragging={snapshot.isDragging}
-        registerProvider={registerProvider}
-        tabIndex={-1}
-      >
-        <EuiScreenReaderOnly data-test-subj="screenReaderOnlyField">
-          <p>{dataProvider.queryMatch.field}</p>
-        </EuiScreenReaderOnly>
-        {truncate && !snapshot.isDragging ? (
-          <TruncatableText data-test-subj="draggable-truncatable-content">
-            {render(dataProvider, provided, snapshot)}
-          </TruncatableText>
-        ) : (
-          <ProviderContentWrapper
-            data-test-subj={`draggable-content-${dataProvider.queryMatch.field}`}
-          >
-            {render(dataProvider, provided, snapshot)}
-          </ProviderContentWrapper>
-        )}
-        {!snapshot.isDragging && (
-          <EuiScreenReaderOnly data-test-subj="draggableKeyboardInstructionsNotDragging">
-            <p>{i18n.DRAGGABLE_KEYBOARD_INSTRUCTIONS_NOT_DRAGGING_SCREEN_READER_ONLY}</p>
+          <EuiScreenReaderOnly data-test-subj="screenReaderOnlyField">
+            <p>{dataProvider.queryMatch.field}</p>
           </EuiScreenReaderOnly>
-        )}
-      </ProviderContainer>
-    ),
-    [dataProvider, registerProvider, render, setContainerRef, truncate]
-  );
-
-  const { onBlur, onKeyDown } = useDraggableKeyboardWrapper({
-    closePopover: handleClosePopOverTrigger,
-    draggableId: getDraggableId(dataProvider.id),
-    fieldName: dataProvider.queryMatch.field,
-    keyboardHandlerRef,
-    openPopover,
-  });
-
-  const DroppableContent = useCallback(
-    (droppableProvided) => (
-      <div ref={droppableProvided.innerRef} {...droppableProvided.droppableProps}>
-        <div
-          className={DRAGGABLE_KEYBOARD_WRAPPER_CLASS_NAME}
-          data-test-subj="draggableWrapperKeyboardHandler"
-          onClick={onFocus}
-          onBlur={onBlur}
-          onKeyDown={onKeyDown}
-          ref={keyboardHandlerRef}
-          role="button"
-          tabIndex={0}
-        >
-          <Draggable
-            draggableId={getDraggableId(dataProvider.id)}
-            index={0}
-            key={getDraggableId(dataProvider.id)}
-            isDragDisabled={isDisabled}
+          {truncate && !snapshot.isDragging ? (
+            <TruncatableText data-test-subj="draggable-truncatable-content">
+              {render(dataProvider, provided, snapshot)}
+            </TruncatableText>
+          ) : (
+            <ProviderContentWrapper
+              data-test-subj={`draggable-content-${dataProvider.queryMatch.field}`}
+            >
+              {render(dataProvider, provided, snapshot)}
+            </ProviderContentWrapper>
+          )}
+          {!snapshot.isDragging && (
+            <EuiScreenReaderOnly data-test-subj="draggableKeyboardInstructionsNotDragging">
+              <p>{i18n.DRAGGABLE_KEYBOARD_INSTRUCTIONS_NOT_DRAGGING_SCREEN_READER_ONLY}</p>
+            </EuiScreenReaderOnly>
+          )}
+        </ProviderContainer>
+      ),
+      [dataProvider, registerProvider, render, truncate]
+    );
+
+    const DroppableContent = useCallback(
+      (droppableProvided) => (
+        <div ref={droppableProvided.innerRef} {...droppableProvided.droppableProps}>
+          <div
+            className={DRAGGABLE_KEYBOARD_WRAPPER_CLASS_NAME}
+            data-test-subj="draggableWrapperKeyboardHandler"
+            role="button"
+            tabIndex={0}
           >
-            {DraggableContent}
-          </Draggable>
+            <Draggable
+              draggableId={getDraggableId(dataProvider.id)}
+              index={0}
+              key={getDraggableId(dataProvider.id)}
+              isDragDisabled={isDisabled}
+            >
+              {DraggableContent}
+            </Draggable>
+          </div>
+          {droppableProvided.placeholder}
         </div>
-        {droppableProvided.placeholder}
-      </div>
-    ),
-    [DraggableContent, dataProvider.id, isDisabled, keyboardHandlerRef, onBlur, onFocus, onKeyDown]
-  );
-
-  const content = useMemo(
-    () => (
-      <Wrapper data-test-subj="draggableWrapperDiv" disabled={isDisabled}>
-        <DragDropErrorBoundary>
-          <Droppable
-            isDropDisabled={true}
-            droppableId={getDroppableId(dataProvider.id)}
-            renderClone={RenderClone}
-          >
-            {DroppableContent}
-          </Droppable>
-        </DragDropErrorBoundary>
-      </Wrapper>
-    ),
-    [DroppableContent, RenderClone, dataProvider.id, isDisabled]
-  );
-
-  const renderContent = useCallback(() => content, [content]);
-
-  if (isDisabled) return <>{content}</>;
-
-  return (
-    <WithHoverActions
-      alwaysShow={isShowingTopN || hoverActionsOwnFocus}
-      closePopOverTrigger={closePopOverTrigger}
-      hoverContent={hoverContent}
-      onCloseRequested={onCloseRequested}
-      render={renderContent}
-    />
-  );
-};
+      ),
+      [DraggableContent, dataProvider.id, isDisabled]
+    );
 
-const DraggableWrapperComponent: React.FC<Props> = ({
-  dataProvider,
-  hideTopN = false,
-  isDraggable = false,
-  onFilterAdded,
-  render,
-  isAggregatable = false,
-  fieldType = '',
-  scopeId,
-  truncate,
-}) => {
-  const {
-    closePopOverTrigger,
-    hoverActionsOwnFocus,
-    hoverContent,
-    onCloseRequested,
-    setContainerRef,
-    isShowingTopN,
-  } = useHoverActions({
-    dataProvider,
-    hideTopN,
-    isDraggable,
-    isAggregatable,
-    fieldType,
-    onFilterAdded,
-    render,
-    scopeId,
-    truncate,
-  });
-  const renderContent = useCallback(
-    () => (
-      <div
-        ref={(e: HTMLDivElement) => {
-          setContainerRef(e);
-        }}
-        tabIndex={-1}
-        data-provider-id={getDraggableId(dataProvider.id)}
-      >
-        {truncate ? (
-          <TruncatableText data-test-subj="render-truncatable-content">
-            {render(dataProvider, null, {
-              isDragging: false,
-              isDropAnimating: false,
-              isClone: false,
-              dropAnimation: null,
-              draggingOver: null,
-              combineWith: null,
-              combineTargetFor: null,
-              mode: null,
-            })}
-          </TruncatableText>
-        ) : (
-          <ProviderContentWrapper
-            data-test-subj={`render-content-${dataProvider.queryMatch.field}`}
-          >
-            {render(dataProvider, null, {
-              isDragging: false,
-              isDropAnimating: false,
-              isClone: false,
-              dropAnimation: null,
-              draggingOver: null,
-              combineWith: null,
-              combineTargetFor: null,
-              mode: null,
-            })}
-          </ProviderContentWrapper>
-        )}
-      </div>
-    ),
-    [dataProvider, render, setContainerRef, truncate]
-  );
-  if (!isDraggable) {
+    const content = useMemo(
+      () => (
+        <Wrapper data-test-subj="draggableWrapperDiv" disabled={isDisabled}>
+          <DragDropErrorBoundary>
+            <Droppable
+              isDropDisabled={true}
+              droppableId={getDroppableId(dataProvider.id)}
+              renderClone={RenderClone}
+            >
+              {DroppableContent}
+            </Droppable>
+          </DragDropErrorBoundary>
+        </Wrapper>
+      ),
+      [DroppableContent, RenderClone, dataProvider.id, isDisabled]
+    );
+
+    if (isDisabled) return <>{content}</>;
     return (
-      <WithHoverActions
-        alwaysShow={isShowingTopN || hoverActionsOwnFocus}
-        closePopOverTrigger={closePopOverTrigger}
-        hoverContent={disableHoverActions(scopeId) ? undefined : hoverContent}
-        onCloseRequested={onCloseRequested}
-        render={renderContent}
-      />
+      <CellActionsWrapper dataProvider={dataProvider} scopeId={scopeId} hideTopN={hideTopN}>
+        {content}
+      </CellActionsWrapper>
     );
   }
-  return (
-    <DraggableOnWrapperComponent
-      dataProvider={dataProvider}
-      hideTopN={hideTopN}
-      onFilterAdded={onFilterAdded}
-      fieldType={fieldType}
-      isAggregatable={isAggregatable}
-      render={render}
-      scopeId={scopeId}
-      truncate={truncate}
-    />
-  );
-};
-
-export const DraggableWrapper = React.memo(DraggableWrapperComponent);
+);
+DraggableOnWrapper.displayName = 'DraggableOnWrapper';
+
+export const DraggableWrapper: React.FC<Props> = React.memo(
+  ({ dataProvider, isDraggable = false, render, scopeId, truncate, hideTopN }) => {
+    const content = useMemo(
+      () => (
+        <div tabIndex={-1} data-provider-id={getDraggableId(dataProvider.id)}>
+          {truncate ? (
+            <TruncatableText data-test-subj="render-truncatable-content">
+              {render(dataProvider, null, {
+                isDragging: false,
+                isDropAnimating: false,
+                isClone: false,
+                dropAnimation: null,
+                draggingOver: null,
+                combineWith: null,
+                combineTargetFor: null,
+                mode: null,
+              })}
+            </TruncatableText>
+          ) : (
+            <ProviderContentWrapper
+              data-test-subj={`render-content-${dataProvider.queryMatch.field}`}
+            >
+              {render(dataProvider, null, {
+                isDragging: false,
+                isDropAnimating: false,
+                isClone: false,
+                dropAnimation: null,
+                draggingOver: null,
+                combineWith: null,
+                combineTargetFor: null,
+                mode: null,
+              })}
+            </ProviderContentWrapper>
+          )}
+        </div>
+      ),
+      [dataProvider, render, truncate]
+    );
 
+    if (!isDraggable) {
+      if (disableHoverActions(scopeId)) {
+        return <>{content}</>;
+      }
+      return (
+        <CellActionsWrapper dataProvider={dataProvider} scopeId={scopeId} hideTopN={hideTopN}>
+          {content}
+        </CellActionsWrapper>
+      );
+    }
+    return (
+      <DraggableOnWrapper
+        dataProvider={dataProvider}
+        render={render}
+        scopeId={scopeId}
+        truncate={truncate}
+      />
+    );
+  }
+);
 DraggableWrapper.displayName = 'DraggableWrapper';
 /**
  * Conditionally wraps children in an EuiPortal to ensure drag offsets are correct when dragging
diff --git a/x-pack/plugins/security_solution/public/common/components/hover_actions/actions/show_top_n.test.tsx b/x-pack/plugins/security_solution/public/common/components/hover_actions/actions/show_top_n.test.tsx
deleted file mode 100644
index 8420d2164a2963..00000000000000
--- a/x-pack/plugins/security_solution/public/common/components/hover_actions/actions/show_top_n.test.tsx
+++ /dev/null
@@ -1,193 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-import { EuiButtonEmpty, EuiContextMenuItem } from '@elastic/eui';
-import { mount } from 'enzyme';
-import React from 'react';
-import { mockCasesContext } from '@kbn/cases-plugin/public/mocks/mock_cases_context';
-import { TestProviders } from '../../../mock';
-import { ShowTopNButton } from './show_top_n';
-import { TimelineId } from '../../../../../common/types';
-
-jest.mock('../../visualization_actions/actions');
-jest.mock('../../visualization_actions/visualization_embeddable');
-
-jest.mock('../../../lib/kibana', () => {
-  const original = jest.requireActual('../../../lib/kibana');
-
-  return {
-    ...original,
-    useKibana: () => ({
-      services: {
-        ...original.useKibana().services,
-        cases: {
-          ui: {
-            getCasesContext: jest.fn().mockReturnValue(mockCasesContext),
-          },
-        },
-      },
-    }),
-  };
-});
-
-jest.mock('react-router-dom', () => {
-  const original = jest.requireActual('react-router-dom');
-  return {
-    ...original,
-    useLocation: jest.fn().mockReturnValue({ pathname: '/test' }),
-  };
-});
-
-describe('show topN button', () => {
-  const defaultProps = {
-    field: 'signal.rule.name',
-    onClick: jest.fn(),
-    ownFocus: false,
-    showTopN: false,
-    scopeId: TimelineId.active,
-  };
-
-  describe('button', () => {
-    test('should show EuiButtonIcon by default', () => {
-      const wrapper = mount(
-        <TestProviders>
-          <ShowTopNButton {...defaultProps} />
-        </TestProviders>
-      );
-      expect(wrapper.find('EuiButtonIcon').exists()).toBeTruthy();
-      expect(wrapper.find('[data-test-subj="show-top-field"]').first().prop('iconType')).toEqual(
-        'visBarVertical'
-      );
-    });
-
-    test('should support EuiButtonEmpty', () => {
-      const testProps = {
-        ...defaultProps,
-        Component: EuiButtonEmpty,
-      };
-      const wrapper = mount(
-        <TestProviders>
-          <ShowTopNButton {...testProps} />
-        </TestProviders>
-      );
-      expect(wrapper.find('EuiButtonIcon').exists()).toBeFalsy();
-      expect(wrapper.find('EuiButtonEmpty').exists()).toBeTruthy();
-      expect(wrapper.find('[data-test-subj="show-top-field"]').first().prop('iconType')).toEqual(
-        'visBarVertical'
-      );
-    });
-
-    test('should support EuiContextMenuItem', () => {
-      const testProps = {
-        ...defaultProps,
-        Component: EuiContextMenuItem,
-      };
-      const wrapper = mount(
-        <TestProviders>
-          <ShowTopNButton {...testProps} />
-        </TestProviders>
-      );
-      expect(wrapper.find('EuiButtonIcon').exists()).toBeFalsy();
-      expect(wrapper.find('EuiContextMenuItem').exists()).toBeTruthy();
-      expect(wrapper.find('[data-test-subj="show-top-field"]').first().prop('icon')).toEqual(
-        'visBarVertical'
-      );
-    });
-  });
-
-  describe('tooltip', () => {
-    test('should show tooltip by default', () => {
-      const wrapper = mount(
-        <TestProviders>
-          <ShowTopNButton {...defaultProps} />
-        </TestProviders>
-      );
-      expect(wrapper.find('EuiToolTip').exists()).toBeTruthy();
-    });
-
-    test('should hide tooltip when topN is showed', () => {
-      const testProps = {
-        ...defaultProps,
-        showTopN: true,
-      };
-      const wrapper = mount(
-        <TestProviders>
-          <ShowTopNButton {...testProps} />
-        </TestProviders>
-      );
-      expect(wrapper.find('EuiToolTip').exists()).toBeFalsy();
-    });
-
-    test('should hide tooltip by setting showTooltip to false', () => {
-      const testProps = {
-        ...defaultProps,
-        showTooltip: false,
-      };
-      const wrapper = mount(
-        <TestProviders>
-          <ShowTopNButton {...testProps} />
-        </TestProviders>
-      );
-      expect(wrapper.find('EuiToolTip').exists()).toBeFalsy();
-    });
-  });
-
-  describe('popover', () => {
-    test('should be able to show topN without a popover', () => {
-      const testProps = {
-        ...defaultProps,
-        enablePopOver: false,
-        showTopN: true,
-      };
-      const wrapper = mount(
-        <TestProviders>
-          <ShowTopNButton {...testProps} />
-        </TestProviders>
-      );
-      expect(wrapper.find('[data-test-subj="top-n"]').exists()).toBeTruthy();
-      expect(wrapper.find('[data-test-subj="showTopNContainer"]').exists()).toBeFalsy();
-    });
-    test('should be able to show topN within a popover', () => {
-      const testProps = {
-        ...defaultProps,
-        enablePopOver: true,
-        showTopN: true,
-      };
-      const wrapper = mount(
-        <TestProviders>
-          <ShowTopNButton {...testProps} />
-        </TestProviders>
-      );
-      expect(wrapper.find('[data-test-subj="top-n"]').exists()).toBeTruthy();
-      expect(wrapper.find('[data-test-subj="showTopNContainer"]').exists()).toBeTruthy();
-    });
-  });
-
-  describe('topN', () => {
-    test('should render with correct props', () => {
-      const onFilterAdded = jest.fn();
-      const testProps = {
-        ...defaultProps,
-        enablePopOver: true,
-        showTopN: true,
-        onFilterAdded,
-      };
-      const wrapper = mount(
-        <TestProviders>
-          <ShowTopNButton {...testProps} />
-        </TestProviders>
-      );
-      expect(wrapper.find('[data-test-subj="top-n"]').prop('field')).toEqual(testProps.field);
-      expect(wrapper.find('[data-test-subj="top-n"]').prop('toggleTopN')).toEqual(
-        testProps.onClick
-      );
-      expect(wrapper.find('[data-test-subj="top-n"]').prop('scopeId')).toEqual(testProps.scopeId);
-      expect(wrapper.find('[data-test-subj="top-n"]').prop('onFilterAdded')).toEqual(
-        testProps.onFilterAdded
-      );
-    });
-  });
-});
diff --git a/x-pack/plugins/security_solution/public/common/components/hover_actions/actions/show_top_n.tsx b/x-pack/plugins/security_solution/public/common/components/hover_actions/actions/show_top_n.tsx
deleted file mode 100644
index 9d155ba92f1197..00000000000000
--- a/x-pack/plugins/security_solution/public/common/components/hover_actions/actions/show_top_n.tsx
+++ /dev/null
@@ -1,194 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React, { useMemo } from 'react';
-import type { EuiButtonEmpty, EuiContextMenuItem } from '@elastic/eui';
-import { EuiPopover, EuiButtonIcon, EuiToolTip } from '@elastic/eui';
-import { i18n } from '@kbn/i18n';
-import type { Filter } from '@kbn/es-query';
-import { isActiveTimeline } from '../../../../helpers';
-import { StatefulTopN } from '../../top_n';
-import { SourcererScopeName } from '../../../store/sourcerer/model';
-import { useSourcererDataView } from '../../../containers/sourcerer';
-import { TooltipWithKeyboardShortcut } from '../../accessibility';
-import { getAdditionalScreenReaderOnlyContext } from '../utils';
-import { SHOW_TOP_N_KEYBOARD_SHORTCUT } from '../keyboard_shortcut_constants';
-import { isDetectionsAlertsTable } from '../../top_n/helpers';
-
-const SHOW_TOP = (fieldName: string) =>
-  i18n.translate('xpack.securitySolution.hoverActions.showTopTooltip', {
-    values: { fieldName },
-    defaultMessage: `Show top {fieldName}`,
-  });
-
-interface Props {
-  className?: string;
-  /** When `Component` is used with `EuiDataGrid`; the grid keeps a reference to `Component` for show / hide functionality.
-   * When `Component` is used with `EuiContextMenu`, we pass EuiContextMenuItem to render the right style.
-   */
-  Component?: typeof EuiButtonEmpty | typeof EuiButtonIcon | typeof EuiContextMenuItem;
-  enablePopOver?: boolean;
-  field: string;
-  flush?: 'left' | 'right' | 'both';
-  globalFilters?: Filter[];
-  iconSide?: 'left' | 'right';
-  iconType?: string;
-  isExpandable?: boolean;
-  onClick: () => void;
-  onFilterAdded?: () => void;
-  ownFocus: boolean;
-  paddingSize?: 's' | 'm' | 'l' | 'none';
-  showTooltip?: boolean;
-  showTopN: boolean;
-  showLegend?: boolean;
-  scopeId?: string | null;
-  title?: string;
-  value?: string[] | string | null;
-}
-
-export const ShowTopNButton: React.FC<Props> = React.memo(
-  ({
-    className,
-    Component,
-    enablePopOver,
-    field,
-    flush,
-    iconSide,
-    iconType,
-    isExpandable,
-    onClick,
-    onFilterAdded,
-    ownFocus,
-    paddingSize,
-    showLegend,
-    showTooltip = true,
-    showTopN,
-    scopeId,
-    title,
-    value,
-    globalFilters,
-  }) => {
-    const activeScope: SourcererScopeName = isActiveTimeline(scopeId ?? '')
-      ? SourcererScopeName.timeline
-      : scopeId != null && isDetectionsAlertsTable(scopeId)
-      ? SourcererScopeName.detections
-      : SourcererScopeName.default;
-    const { browserFields, indexPattern } = useSourcererDataView(activeScope);
-
-    const icon = iconType ?? 'visBarVertical';
-    const side = iconSide ?? 'left';
-    const buttonTitle = title ?? SHOW_TOP(field);
-    const basicButton = useMemo(
-      () =>
-        Component ? (
-          <Component
-            aria-label={buttonTitle}
-            className={className}
-            data-test-subj="show-top-field"
-            icon={icon}
-            iconType={icon}
-            iconSide={side}
-            flush={flush}
-            onClick={onClick}
-            title={buttonTitle}
-          >
-            {buttonTitle}
-          </Component>
-        ) : (
-          <EuiButtonIcon
-            aria-label={buttonTitle}
-            className="securitySolution__hoverActionButton"
-            data-test-subj="show-top-field"
-            iconSize="s"
-            iconType={icon}
-            onClick={onClick}
-          />
-        ),
-      [Component, buttonTitle, className, flush, icon, onClick, side]
-    );
-
-    const button = useMemo(
-      () =>
-        showTooltip && !showTopN ? (
-          <EuiToolTip
-            content={
-              <TooltipWithKeyboardShortcut
-                additionalScreenReaderOnlyContext={getAdditionalScreenReaderOnlyContext({
-                  field,
-                  value,
-                })}
-                content={buttonTitle}
-                shortcut={SHOW_TOP_N_KEYBOARD_SHORTCUT}
-                showShortcut={ownFocus}
-              />
-            }
-          >
-            {basicButton}
-          </EuiToolTip>
-        ) : (
-          basicButton
-        ),
-      [basicButton, buttonTitle, field, ownFocus, showTooltip, showTopN, value]
-    );
-
-    const topNPannel = useMemo(
-      () => (
-        <StatefulTopN
-          browserFields={browserFields}
-          field={field}
-          indexPattern={indexPattern}
-          onFilterAdded={onFilterAdded}
-          paddingSize={paddingSize}
-          showLegend={showLegend}
-          scopeId={scopeId ?? undefined}
-          toggleTopN={onClick}
-          globalFilters={globalFilters}
-        />
-      ),
-      [
-        browserFields,
-        field,
-        indexPattern,
-        onFilterAdded,
-        paddingSize,
-        showLegend,
-        scopeId,
-        onClick,
-        globalFilters,
-      ]
-    );
-
-    if (isExpandable) {
-      return (
-        <>
-          {basicButton}
-          {showTopN && topNPannel}
-        </>
-      );
-    }
-
-    return showTopN ? (
-      enablePopOver ? (
-        <EuiPopover
-          button={basicButton}
-          isOpen={showTopN}
-          closePopover={onClick}
-          panelClassName="withHoverActions__popover"
-          data-test-subj="showTopNContainer"
-        >
-          {topNPannel}
-        </EuiPopover>
-      ) : (
-        topNPannel
-      )
-    ) : (
-      button
-    );
-  }
-);
-
-ShowTopNButton.displayName = 'ShowTopNButton';
diff --git a/x-pack/plugins/security_solution/public/common/components/hover_actions/index.tsx b/x-pack/plugins/security_solution/public/common/components/hover_actions/index.tsx
deleted file mode 100644
index 6aab4a0afbe681..00000000000000
--- a/x-pack/plugins/security_solution/public/common/components/hover_actions/index.tsx
+++ /dev/null
@@ -1,295 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { EuiFocusTrap, EuiScreenReaderOnly } from '@elastic/eui';
-import React, { useCallback, useEffect, useMemo, useRef, useState } from 'react';
-import type { DraggableId } from '@hello-pangea/dnd';
-import styled from 'styled-components';
-import { i18n } from '@kbn/i18n';
-
-import { stopPropagationAndPreventDefault } from '@kbn/timelines-plugin/public';
-import type { ColumnHeaderOptions, DataProvider } from '../../../../common/types/timeline';
-import { TimelineId } from '../../../../common/types/timeline';
-import { SHOW_TOP_N_KEYBOARD_SHORTCUT } from './keyboard_shortcut_constants';
-import { useHoverActionItems } from './use_hover_action_items';
-import { SecurityPageName } from '../../../app/types';
-
-export const YOU_ARE_IN_A_DIALOG_CONTAINING_OPTIONS = (fieldName: string) =>
-  i18n.translate(
-    'xpack.securitySolution.dragAndDrop.youAreInADialogContainingOptionsScreenReaderOnly',
-    {
-      values: { fieldName },
-      defaultMessage: `You are in a dialog, containing options for field {fieldName}. Press tab to navigate options. Press escape to exit.`,
-    }
-  );
-
-export const AdditionalContent = styled.div`
-  padding: 2px;
-`;
-
-AdditionalContent.displayName = 'AdditionalContent';
-
-const StyledHoverActionsContainer = styled.div<{
-  $showTopN: boolean;
-  $showOwnFocus: boolean;
-  $hiddenActionsCount: number;
-  $isActive: boolean;
-}>`
-  display: flex;
-
-  ${(props) =>
-    props.$isActive
-      ? `
-    .hoverActions-active {
-      .timelines__hoverActionButton,
-      .securitySolution__hoverActionButton {
-        opacity: 1;
-      }
-    }
-  `
-      : ''}
-
-  ${(props) =>
-    props.$showOwnFocus
-      ? `
-    &:focus-within {
-      .timelines__hoverActionButton,
-      .securitySolution__hoverActionButton {
-        opacity: 1;
-      }
-    }
-
-    &:hover {
-      .timelines__hoverActionButton,
-      .securitySolution__hoverActionButton {
-        opacity: 1;
-      }
-    }
-
-  .timelines__hoverActionButton,
-  .securitySolution__hoverActionButton {
-    opacity: ${props.$showTopN ? 1 : 0};
-
-      &:focus {
-        opacity: 1;
-      }
-    }
-  `
-      : ''}
-`;
-
-const StyledHoverActionsContainerWithPaddingsAndMinWidth = styled(StyledHoverActionsContainer)`
-  min-width: ${({ $hiddenActionsCount }) => `${138 - $hiddenActionsCount * 26}px`};
-  padding: ${(props) => `0 ${props.theme.eui.euiSizeS}`};
-  position: relative;
-`;
-
-interface Props {
-  additionalContent?: React.ReactNode;
-  applyWidthAndPadding?: boolean;
-  closeTopN?: () => void;
-  closePopOver?: () => void;
-  dataProvider?: DataProvider | DataProvider[];
-  dataType?: string;
-  draggableId?: DraggableId;
-  enableOverflowButton?: boolean;
-  field: string;
-  fieldType: string;
-  isAggregatable: boolean;
-  goGetTimelineId?: (args: boolean) => void;
-  hideAddToTimeline?: boolean;
-  hideTopN?: boolean;
-  isObjectArray: boolean;
-  onFilterAdded?: () => void;
-  ownFocus: boolean;
-  showOwnFocus?: boolean;
-  showTopN: boolean;
-  scopeId?: string | null;
-  toggleColumn?: (column: ColumnHeaderOptions) => void;
-  toggleTopN: () => void;
-  values?: string[] | string | null;
-}
-
-/** Returns a value for the `disabled` prop of `EuiFocusTrap` */
-const isFocusTrapDisabled = ({
-  ownFocus,
-  showTopN,
-}: {
-  ownFocus: boolean;
-  showTopN: boolean;
-}): boolean => {
-  if (showTopN) {
-    return false; // we *always* want to trap focus when showing Top N
-  }
-
-  return !ownFocus;
-};
-
-export const HoverActions: React.FC<Props> = React.memo(
-  ({
-    additionalContent = null,
-    closePopOver,
-    closeTopN,
-    dataProvider,
-    dataType,
-    draggableId,
-    enableOverflowButton = false,
-    applyWidthAndPadding = true,
-    field,
-    fieldType,
-    isAggregatable,
-    goGetTimelineId,
-    isObjectArray,
-    hideAddToTimeline = false,
-    hideTopN = false,
-    onFilterAdded,
-    ownFocus,
-    showOwnFocus = true,
-    showTopN,
-    scopeId,
-    toggleColumn,
-    toggleTopN,
-    values,
-  }) => {
-    const [stKeyboardEvent, setStKeyboardEvent] = useState<React.KeyboardEvent>();
-    const [isActive, setIsActive] = useState(false);
-    const [isOverflowPopoverOpen, setIsOverflowPopoverOpen] = useState(false);
-    const onOverflowButtonClick = useCallback(() => {
-      setIsActive((prev) => !prev);
-      setIsOverflowPopoverOpen(!isOverflowPopoverOpen);
-    }, [isOverflowPopoverOpen, setIsOverflowPopoverOpen]);
-    const handleHoverActionClicked = useCallback(() => {
-      if (closeTopN) {
-        closeTopN();
-      }
-
-      setIsActive(false);
-      setIsOverflowPopoverOpen(false);
-      if (closePopOver) {
-        closePopOver();
-      }
-    }, [closePopOver, closeTopN]);
-
-    const isInit = useRef(true);
-    const defaultFocusedButtonRef = useRef<HTMLButtonElement | null>(null);
-
-    useEffect(() => {
-      if (isInit.current && goGetTimelineId != null && scopeId == null) {
-        isInit.current = false;
-        goGetTimelineId(true);
-      }
-    }, [goGetTimelineId, scopeId]);
-
-    useEffect(() => {
-      if (ownFocus) {
-        setTimeout(() => {
-          defaultFocusedButtonRef.current?.focus();
-        }, 0);
-      }
-    }, [ownFocus]);
-
-    const onKeyDown = useCallback(
-      (keyboardEvent: React.KeyboardEvent) => {
-        if (!ownFocus) {
-          return;
-        }
-        switch (keyboardEvent.key) {
-          case SHOW_TOP_N_KEYBOARD_SHORTCUT:
-            stopPropagationAndPreventDefault(keyboardEvent);
-            toggleTopN();
-            break;
-          case 'Enter':
-            break;
-          case 'Escape':
-            stopPropagationAndPreventDefault(keyboardEvent);
-            break;
-          default:
-            setStKeyboardEvent(keyboardEvent);
-            break;
-        }
-      },
-      [ownFocus, toggleTopN]
-    );
-
-    const isCaseView = scopeId === TimelineId.casePage;
-    const isTimelineView = scopeId === TimelineId.active;
-    // TODO Provide a list of disabled/enabled actions as props
-    const isEntityAnalyticsPage = scopeId === SecurityPageName.entityAnalytics;
-
-    const hideFilters = useMemo(
-      () => isEntityAnalyticsPage && !isTimelineView,
-      [isTimelineView, isEntityAnalyticsPage]
-    );
-
-    const hiddenActionsCount = useMemo(() => {
-      const hiddenTopNActions = hideTopN ? 1 : 0; // hides the `Top N` button
-      const hiddenFilterActions = hideFilters ? 2 : 0; // hides both the `Filter In` and `Filter out` buttons
-
-      return hiddenTopNActions + hiddenFilterActions;
-    }, [hideFilters, hideTopN]);
-
-    const { overflowActionItems, allActionItems } = useHoverActionItems({
-      dataProvider,
-      dataType,
-      defaultFocusedButtonRef,
-      draggableId,
-      enableOverflowButton: enableOverflowButton && !isCaseView,
-      field,
-      fieldType,
-      hideFilters,
-      isAggregatable,
-      handleHoverActionClicked,
-      hideAddToTimeline,
-      hideTopN,
-      isCaseView,
-      isObjectArray,
-      isOverflowPopoverOpen,
-      onFilterAdded,
-      onOverflowButtonClick,
-      ownFocus,
-      showTopN,
-      stKeyboardEvent,
-      toggleColumn,
-      toggleTopN,
-      values,
-      scopeId,
-    });
-
-    const Container = applyWidthAndPadding
-      ? StyledHoverActionsContainerWithPaddingsAndMinWidth
-      : StyledHoverActionsContainer;
-
-    return (
-      <EuiFocusTrap
-        disabled={isFocusTrapDisabled({
-          ownFocus,
-          showTopN,
-        })}
-      >
-        <Container
-          data-test-subj="hover-actions-container"
-          onKeyDown={onKeyDown}
-          $showTopN={showTopN}
-          $showOwnFocus={showOwnFocus}
-          $hiddenActionsCount={hiddenActionsCount}
-          $isActive={isActive}
-          className={isActive ? 'hoverActions-active' : ''}
-        >
-          <EuiScreenReaderOnly>
-            <p>{YOU_ARE_IN_A_DIALOG_CONTAINING_OPTIONS(field)}</p>
-          </EuiScreenReaderOnly>
-
-          {additionalContent != null && <AdditionalContent>{additionalContent}</AdditionalContent>}
-
-          {enableOverflowButton && !isCaseView ? overflowActionItems : allActionItems}
-        </Container>
-      </EuiFocusTrap>
-    );
-  }
-);
-
-HoverActions.displayName = 'HoverActions';
diff --git a/x-pack/plugins/security_solution/public/common/components/hover_actions/use_hover_action_items.test.tsx b/x-pack/plugins/security_solution/public/common/components/hover_actions/use_hover_action_items.test.tsx
deleted file mode 100644
index 65014bb3762d68..00000000000000
--- a/x-pack/plugins/security_solution/public/common/components/hover_actions/use_hover_action_items.test.tsx
+++ /dev/null
@@ -1,318 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-import { useRef } from 'react';
-import { renderHook, act } from '@testing-library/react-hooks';
-import type { UseHoverActionItemsProps } from './use_hover_action_items';
-import { useHoverActionItems } from './use_hover_action_items';
-import { useDeepEqualSelector } from '../../hooks/use_selector';
-import type { DataProvider } from '../../../../common/types/timeline';
-
-jest.mock('../../lib/kibana');
-jest.mock('../../hooks/use_selector');
-const mockUseDataViewId = jest.fn();
-jest.mock('../../hooks/use_data_view_id', () => ({
-  useDataViewId: (scope: string) => mockUseDataViewId(scope),
-}));
-jest.mock('../../containers/sourcerer', () => ({
-  useSourcererDataView: jest.fn().mockReturnValue({ browserFields: {} }),
-}));
-const mockDispatch = jest.fn();
-jest.mock('react-redux', () => {
-  const original = jest.requireActual('react-redux');
-
-  return {
-    ...original,
-    useDispatch: () => mockDispatch,
-  };
-});
-
-describe('useHoverActionItems', () => {
-  const defaultProps: UseHoverActionItemsProps = {
-    dataProvider: [{} as DataProvider],
-    defaultFocusedButtonRef: null,
-    field: 'kibana.alert.rule.name',
-    scopeId: 'timeline-test',
-    handleHoverActionClicked: jest.fn(),
-    hideAddToTimeline: false,
-    hideTopN: false,
-    isCaseView: false,
-    isObjectArray: false,
-    ownFocus: false,
-    showTopN: false,
-    stKeyboardEvent: undefined,
-    toggleColumn: jest.fn(),
-    toggleTopN: jest.fn(),
-    values: ['rule name'],
-  } as unknown as UseHoverActionItemsProps;
-
-  beforeEach(() => {
-    (useDeepEqualSelector as jest.Mock).mockImplementation((cb) => {
-      return cb();
-    });
-  });
-  afterEach(() => {
-    (useDeepEqualSelector as jest.Mock).mockClear();
-  });
-
-  test('should return allActionItems', async () => {
-    await act(async () => {
-      const { result, waitForNextUpdate } = renderHook(() => {
-        const defaultFocusedButtonRef = useRef(null);
-        const testProps = {
-          ...defaultProps,
-          defaultFocusedButtonRef,
-        };
-        return useHoverActionItems(testProps);
-      });
-      await waitForNextUpdate();
-
-      expect(result.current.allActionItems).toHaveLength(6);
-      expect(result.current.allActionItems[0].props['data-test-subj']).toEqual(
-        'hover-actions-filter-for'
-      );
-      expect(result.current.allActionItems[1].props['data-test-subj']).toEqual(
-        'hover-actions-filter-out'
-      );
-      expect(result.current.allActionItems[2].props['data-test-subj']).toEqual(
-        'hover-actions-toggle-column'
-      );
-      expect(result.current.allActionItems[3].props['data-test-subj']).toEqual(
-        'hover-actions-add-timeline'
-      );
-      expect(result.current.allActionItems[4].props['data-test-subj']).toEqual(
-        'hover-actions-show-top-n'
-      );
-      expect(result.current.allActionItems[5].props['data-test-subj']).toEqual(
-        'hover-actions-copy-button'
-      );
-    });
-  });
-
-  test('should call getDataViewId with the correct scope', () => {
-    renderHook(() => {
-      const defaultFocusedButtonRef = useRef(null);
-      return useHoverActionItems({ ...defaultProps, defaultFocusedButtonRef });
-    });
-    expect(mockUseDataViewId).toHaveBeenCalledWith('timeline');
-  });
-
-  test('should return overflowActionItems', async () => {
-    await act(async () => {
-      const { result, waitForNextUpdate } = renderHook(() => {
-        const defaultFocusedButtonRef = useRef(null);
-        const testProps = {
-          ...defaultProps,
-          defaultFocusedButtonRef,
-          enableOverflowButton: true,
-        };
-        return useHoverActionItems(testProps);
-      });
-      await waitForNextUpdate();
-
-      expect(result.current.overflowActionItems).toHaveLength(3);
-      expect(result.current.overflowActionItems[0].props['data-test-subj']).toEqual(
-        'hover-actions-filter-for'
-      );
-      expect(result.current.overflowActionItems[1].props['data-test-subj']).toEqual(
-        'hover-actions-filter-out'
-      );
-      expect(result.current.overflowActionItems[2].props['data-test-subj']).toEqual(
-        'more-actions-kibana.alert.rule.name'
-      );
-      expect(result.current.overflowActionItems[2].props.items[0].props['data-test-subj']).toEqual(
-        'hover-actions-toggle-column'
-      );
-
-      expect(result.current.overflowActionItems[2].props.items[1].props['data-test-subj']).toEqual(
-        'hover-actions-add-timeline'
-      );
-      expect(result.current.overflowActionItems[2].props.items[2].props['data-test-subj']).toEqual(
-        'hover-actions-show-top-n'
-      );
-      expect(result.current.overflowActionItems[2].props.items[3].props['data-test-subj']).toEqual(
-        'hover-actions-copy-button'
-      );
-    });
-  });
-
-  test('it should hide the Top N action when hideTopN is true', async () => {
-    await act(async () => {
-      const { result, waitForNextUpdate } = renderHook(() => {
-        const testProps = {
-          ...defaultProps,
-          hideTopN: true, // <-- hide the Top N action
-        };
-        return useHoverActionItems(testProps);
-      });
-      await waitForNextUpdate();
-
-      result.current.allActionItems.forEach((item) => {
-        expect(item.props['data-test-subj']).not.toEqual('hover-actions-show-top-n');
-      });
-    });
-  });
-
-  test('should not have toggle column', async () => {
-    await act(async () => {
-      const { result, waitForNextUpdate } = renderHook(() => {
-        const defaultFocusedButtonRef = useRef(null);
-        const testProps = {
-          ...defaultProps,
-          isObjectArray: true,
-          defaultFocusedButtonRef,
-          enableOverflowButton: true,
-        };
-        return useHoverActionItems(testProps);
-      });
-      await waitForNextUpdate();
-
-      expect(result.current.overflowActionItems).toHaveLength(3);
-      expect(result.current.overflowActionItems[0].props['data-test-subj']).toEqual(
-        'hover-actions-filter-for'
-      );
-      expect(result.current.overflowActionItems[1].props['data-test-subj']).toEqual(
-        'hover-actions-filter-out'
-      );
-
-      result.current.overflowActionItems[2].props.items.forEach((item: JSX.Element) => {
-        expect(item.props['data-test-subj']).not.toEqual('hover-actions-toggle-column');
-      });
-    });
-  });
-
-  test('should not have filter in, filter out, or toggle column', async () => {
-    await act(async () => {
-      const { result, waitForNextUpdate } = renderHook(() => {
-        const testProps = {
-          ...defaultProps,
-          isCaseView: true,
-          enableOverflowButton: false,
-        };
-        return useHoverActionItems(testProps);
-      });
-      await waitForNextUpdate();
-
-      expect(result.current.allActionItems).toHaveLength(3);
-      expect(result.current.allActionItems[0].props['data-test-subj']).toEqual(
-        'hover-actions-add-timeline'
-      );
-      expect(result.current.allActionItems[1].props['data-test-subj']).toEqual(
-        'hover-actions-show-top-n'
-      );
-      expect(result.current.allActionItems[2].props['data-test-subj']).toEqual(
-        'hover-actions-copy-button'
-      );
-    });
-  });
-
-  test('if not on CaseView, overflow button is enabled, ShowTopNButton should disable popOver (e.g.: alerts flyout)', async () => {
-    await act(async () => {
-      const { result, waitForNextUpdate } = renderHook(() => {
-        const testProps = {
-          ...defaultProps,
-          enableOverflowButton: true,
-        };
-        return useHoverActionItems(testProps);
-      });
-      await waitForNextUpdate();
-      expect(result.current.allActionItems[4].props.enablePopOver).toEqual(false);
-    });
-  });
-
-  test('if not on CaseView, overflow button is disabled, ShowTopNButton should disable popOver (e.g.: alerts table - reason field)', async () => {
-    await act(async () => {
-      const { result, waitForNextUpdate } = renderHook(() => {
-        const testProps = {
-          ...defaultProps,
-          enableOverflowButton: false,
-        };
-        return useHoverActionItems(testProps);
-      });
-      await waitForNextUpdate();
-      expect(result.current.allActionItems[4].props.enablePopOver).toEqual(false);
-    });
-  });
-
-  test('if on CaseView, ShowTopNButton should enable popOver', async () => {
-    await act(async () => {
-      const { result, waitForNextUpdate } = renderHook(() => {
-        const testProps = {
-          ...defaultProps,
-          isCaseView: true,
-          enableOverflowButton: false,
-        };
-        return useHoverActionItems(testProps);
-      });
-      await waitForNextUpdate();
-
-      expect(result.current.allActionItems[1].props.enablePopOver).toEqual(true);
-    });
-  });
-
-  test('if on CaseView, it should show all items when shoTopN is true', async () => {
-    await act(async () => {
-      const { result, waitForNextUpdate } = renderHook(() => {
-        const testProps = {
-          ...defaultProps,
-          showTopN: true,
-          isCaseView: true,
-          enableOverflowButton: false,
-        };
-        return useHoverActionItems(testProps);
-      });
-      await waitForNextUpdate();
-
-      expect(result.current.allActionItems).toHaveLength(3);
-      expect(result.current.allActionItems[0].props['data-test-subj']).toEqual(
-        'hover-actions-add-timeline'
-      );
-      expect(result.current.allActionItems[1].props['data-test-subj']).toEqual(
-        'hover-actions-show-top-n'
-      );
-      expect(result.current.allActionItems[2].props['data-test-subj']).toEqual(
-        'hover-actions-copy-button'
-      );
-    });
-  });
-
-  test('when disable OverflowButton, it should show only "showTopNBtn" when shoTopN is true', async () => {
-    await act(async () => {
-      const { result, waitForNextUpdate } = renderHook(() => {
-        const testProps = {
-          ...defaultProps,
-          showTopN: true,
-          isCaseView: false,
-          enableOverflowButton: false,
-        };
-        return useHoverActionItems(testProps);
-      });
-      await waitForNextUpdate();
-
-      expect(result.current.allActionItems).toHaveLength(1);
-      expect(result.current.allActionItems[0].props['data-test-subj']).toEqual(
-        'hover-actions-show-top-n'
-      );
-    });
-  });
-
-  test('when timeline button is disabled, it should not show', async () => {
-    await act(async () => {
-      const { result, waitForNextUpdate } = renderHook(() => {
-        const testProps = {
-          ...defaultProps,
-          hideAddToTimeline: true,
-        };
-        return useHoverActionItems(testProps);
-      });
-      await waitForNextUpdate();
-
-      result.current.allActionItems.forEach((actionItem) => {
-        expect(actionItem.props['data-test-subj']).not.toEqual('hover-actions-add-timeline');
-      });
-    });
-  });
-});
diff --git a/x-pack/plugins/security_solution/public/common/components/hover_actions/use_hover_action_items.tsx b/x-pack/plugins/security_solution/public/common/components/hover_actions/use_hover_action_items.tsx
deleted file mode 100644
index 866acee43b6d51..00000000000000
--- a/x-pack/plugins/security_solution/public/common/components/hover_actions/use_hover_action_items.tsx
+++ /dev/null
@@ -1,344 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { EuiContextMenuItem } from '@elastic/eui';
-import React, { useCallback, useMemo } from 'react';
-import type { DraggableId } from '@hello-pangea/dnd';
-
-import { isEmpty } from 'lodash';
-
-import { useDispatch } from 'react-redux';
-import { getSourcererScopeId, isActiveTimeline } from '../../../helpers';
-import { useKibana } from '../../lib/kibana';
-import { allowTopN } from '../drag_and_drop/helpers';
-import type { ColumnHeaderOptions, DataProvider } from '../../../../common/types/timeline';
-import { TimelineId } from '../../../../common/types/timeline';
-import { ShowTopNButton } from './actions/show_top_n';
-import { addProvider } from '../../../timelines/store/actions';
-import { useDataViewId } from '../../hooks/use_data_view_id';
-export interface UseHoverActionItemsProps {
-  dataProvider?: DataProvider | DataProvider[];
-  dataType?: string;
-  defaultFocusedButtonRef: React.MutableRefObject<HTMLButtonElement | null>;
-  draggableId?: DraggableId;
-  enableOverflowButton?: boolean;
-  field: string;
-  fieldType: string;
-  isAggregatable: boolean;
-  handleHoverActionClicked: () => void;
-  hideAddToTimeline: boolean;
-  hideFilters?: boolean;
-  hideTopN: boolean;
-  isCaseView: boolean;
-  isObjectArray: boolean;
-  isOverflowPopoverOpen?: boolean;
-  itemsToShow?: number;
-  onFilterAdded?: () => void;
-  onOverflowButtonClick?: () => void;
-  ownFocus: boolean;
-  showTopN: boolean;
-  stKeyboardEvent: React.KeyboardEvent<Element> | undefined;
-  scopeId?: string | null;
-  toggleColumn?: (column: ColumnHeaderOptions) => void;
-  toggleTopN: () => void;
-  values?: string[] | string | null;
-}
-
-export interface UseHoverActionItems {
-  overflowActionItems: JSX.Element[];
-  allActionItems: JSX.Element[];
-}
-
-export const useHoverActionItems = ({
-  dataProvider,
-  dataType,
-  defaultFocusedButtonRef,
-  draggableId,
-  enableOverflowButton,
-  field,
-  fieldType,
-  isAggregatable,
-  handleHoverActionClicked,
-  hideFilters,
-  hideTopN,
-  hideAddToTimeline,
-  isCaseView,
-  isObjectArray,
-  isOverflowPopoverOpen,
-  itemsToShow = 2,
-  onFilterAdded,
-  onOverflowButtonClick,
-  ownFocus,
-  showTopN,
-  stKeyboardEvent,
-  scopeId,
-  toggleColumn,
-  toggleTopN,
-  values,
-}: UseHoverActionItemsProps): UseHoverActionItems => {
-  const kibana = useKibana();
-  const dispatch = useDispatch();
-  const { timelines, timelineFilterManager, analytics, i18n, theme } = kibana.services;
-  const dataViewId = useDataViewId(getSourcererScopeId(scopeId ?? ''));
-
-  // Common actions used by the alert table and alert flyout
-  const {
-    getAddToTimelineButton,
-    getColumnToggleButton,
-    getCopyButton,
-    getFilterForValueButton,
-    getFilterOutValueButton,
-    getOverflowButton,
-  } = timelines.getHoverActions();
-
-  const filterManager = useMemo(() => {
-    return isActiveTimeline(scopeId ?? '')
-      ? timelineFilterManager
-      : kibana.services.data.query.filterManager;
-  }, [scopeId, timelineFilterManager, kibana.services.data.query.filterManager]);
-
-  /*
-   *   Add to Timeline button, adds data to dataprovider but does not persists the Timeline
-   *   to the server because of following reasons.
-   *
-   *   1. Add to Timeline button performs actions in `timelines` plugin
-   *   2. `timelines` plugin does not have information on how to create/update the timelines in the server
-   *       as it is owned by Security Solution
-   * */
-  const OnAddToTimeline = useCallback(() => {
-    if (!dataProvider || isEmpty(dataProvider)) return;
-    dispatch(
-      addProvider({
-        id: TimelineId.active,
-        providers: dataProvider instanceof Array ? dataProvider : [dataProvider],
-      })
-    );
-  }, [dataProvider, dispatch]);
-
-  const onAddToTimelineClicked = useCallback(() => {
-    if (handleHoverActionClicked) handleHoverActionClicked();
-    OnAddToTimeline();
-  }, [handleHoverActionClicked, OnAddToTimeline]);
-
-  const showFilters = useMemo(() => {
-    if (hideFilters) return false;
-    /*
-     * In the case of `DisableOverflowButton`, we show filters only when topN is NOT opened. As after topN button is clicked, the chart panel replace current hover actions in the hover actions' popover, so we have to hide all the actions.
-     * in the case of `EnableOverflowButton`, we only need to hide all the items in the overflow popover as the chart's panel opens in the overflow popover, so non-overflowed actions are not affected.
-     */
-    return (
-      values != null &&
-      (enableOverflowButton || (!showTopN && !enableOverflowButton)) &&
-      !isCaseView
-    );
-  }, [enableOverflowButton, hideFilters, isCaseView, showTopN, values]);
-  const shouldDisableColumnToggle = (isObjectArray && field !== 'geo_point') || isCaseView;
-
-  const showTopNBtn = useMemo(
-    () => (
-      <ShowTopNButton
-        Component={enableOverflowButton ? EuiContextMenuItem : undefined}
-        data-test-subj="hover-actions-show-top-n"
-        enablePopOver={!enableOverflowButton && isCaseView}
-        field={field}
-        key="hover-actions-show-top-n"
-        onClick={toggleTopN}
-        onFilterAdded={onFilterAdded}
-        ownFocus={ownFocus}
-        showTopN={showTopN}
-        showTooltip={enableOverflowButton ? false : true}
-        scopeId={scopeId}
-        value={values}
-      />
-    ),
-    [
-      enableOverflowButton,
-      isCaseView,
-      field,
-      toggleTopN,
-      onFilterAdded,
-      ownFocus,
-      showTopN,
-      scopeId,
-      values,
-    ]
-  );
-
-  const allItems = useMemo(() => {
-    const startServices = { analytics, i18n, theme };
-    return [
-      showFilters ? (
-        <div data-test-subj="hover-actions-filter-for" key="hover-actions-filter-for">
-          {getFilterForValueButton({
-            defaultFocusedButtonRef,
-            field,
-            filterManager,
-            keyboardEvent: stKeyboardEvent,
-            onClick: handleHoverActionClicked,
-            onFilterAdded,
-            ownFocus,
-            showTooltip: enableOverflowButton ? false : true,
-            value: values,
-            dataViewId,
-          })}
-        </div>
-      ) : null,
-      showFilters ? (
-        <div data-test-subj="hover-actions-filter-out" key="hover-actions-filter-out">
-          {getFilterOutValueButton({
-            field,
-            filterManager,
-            keyboardEvent: stKeyboardEvent,
-            onFilterAdded,
-            ownFocus,
-            onClick: handleHoverActionClicked,
-            showTooltip: enableOverflowButton ? false : true,
-            value: values,
-            dataViewId,
-          })}
-        </div>
-      ) : null,
-      toggleColumn && !shouldDisableColumnToggle ? (
-        <div data-test-subj="hover-actions-toggle-column" key="hover-actions-toggle-column">
-          {getColumnToggleButton({
-            Component: enableOverflowButton ? EuiContextMenuItem : undefined,
-            field,
-            isDisabled: isObjectArray && dataType !== 'geo_point',
-            isObjectArray,
-            keyboardEvent: stKeyboardEvent,
-            ownFocus,
-            onClick: handleHoverActionClicked,
-            showTooltip: enableOverflowButton ? false : true,
-            toggleColumn,
-            value: values,
-          })}
-        </div>
-      ) : null,
-      values != null && (draggableId != null || !isEmpty(dataProvider)) && !hideAddToTimeline ? (
-        <div data-test-subj="hover-actions-add-timeline" key="hover-actions-add-timeline">
-          {getAddToTimelineButton({
-            Component: enableOverflowButton ? EuiContextMenuItem : undefined,
-            dataProvider,
-            draggableId,
-            field,
-            keyboardEvent: stKeyboardEvent,
-            ownFocus,
-            onClick: onAddToTimelineClicked,
-            showTooltip: enableOverflowButton ? false : true,
-            value: values,
-            startServices,
-          })}
-        </div>
-      ) : null,
-      allowTopN({
-        fieldType,
-        isAggregatable,
-        fieldName: field,
-        hideTopN,
-      })
-        ? showTopNBtn
-        : null,
-      field != null ? (
-        <div data-test-subj="hover-actions-copy-button" key="hover-actions-copy-button">
-          {getCopyButton({
-            Component: enableOverflowButton ? EuiContextMenuItem : undefined,
-            field,
-            isHoverAction: true,
-            keyboardEvent: stKeyboardEvent,
-            ownFocus,
-            onClick: handleHoverActionClicked,
-            showTooltip: enableOverflowButton ? false : true,
-            value: values,
-          })}
-        </div>
-      ) : null,
-    ].filter((item) => {
-      return item != null;
-    });
-  }, [
-    dataProvider,
-    dataType,
-    defaultFocusedButtonRef,
-    draggableId,
-    enableOverflowButton,
-    field,
-    fieldType,
-    isAggregatable,
-    filterManager,
-    getAddToTimelineButton,
-    getColumnToggleButton,
-    getCopyButton,
-    getFilterForValueButton,
-    getFilterOutValueButton,
-    handleHoverActionClicked,
-    onAddToTimelineClicked,
-    hideAddToTimeline,
-    hideTopN,
-    isObjectArray,
-    onFilterAdded,
-    ownFocus,
-    shouldDisableColumnToggle,
-    showFilters,
-    showTopNBtn,
-    stKeyboardEvent,
-    toggleColumn,
-    values,
-    dataViewId,
-    analytics,
-    i18n,
-    theme,
-  ]) as JSX.Element[];
-
-  const overflowActionItems = useMemo(
-    () =>
-      [
-        ...allItems.slice(0, itemsToShow),
-        ...(enableOverflowButton && itemsToShow > 0 && itemsToShow < allItems.length
-          ? [
-              getOverflowButton({
-                closePopOver: handleHoverActionClicked,
-                field,
-                keyboardEvent: stKeyboardEvent,
-                ownFocus,
-                onClick: onOverflowButtonClick,
-                showTooltip: enableOverflowButton ? false : true,
-                value: values,
-                items: showTopN ? [showTopNBtn] : allItems.slice(itemsToShow),
-                isOverflowPopoverOpen: !!isOverflowPopoverOpen,
-              }),
-            ]
-          : []),
-      ].filter((item) => {
-        return item != null;
-      }),
-    [
-      allItems,
-      enableOverflowButton,
-      field,
-      getOverflowButton,
-      handleHoverActionClicked,
-      isOverflowPopoverOpen,
-      itemsToShow,
-      onOverflowButtonClick,
-      showTopNBtn,
-      ownFocus,
-      showTopN,
-      stKeyboardEvent,
-      values,
-    ]
-  );
-
-  const allActionItems = useMemo(
-    () => (showTopN && !enableOverflowButton && !isCaseView ? [showTopNBtn] : allItems),
-    [showTopN, enableOverflowButton, isCaseView, showTopNBtn, allItems]
-  );
-
-  return {
-    overflowActionItems,
-    allActionItems,
-  };
-};
diff --git a/x-pack/plugins/security_solution/public/common/components/hover_actions/use_hover_actions.tsx b/x-pack/plugins/security_solution/public/common/components/hover_actions/use_hover_actions.tsx
deleted file mode 100644
index 324f5af4e16e74..00000000000000
--- a/x-pack/plugins/security_solution/public/common/components/hover_actions/use_hover_actions.tsx
+++ /dev/null
@@ -1,207 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React, { useCallback, useMemo, useState, useRef, useContext } from 'react';
-import type { DraggableProvided, DraggableStateSnapshot } from '@hello-pangea/dnd';
-import { TimelineContext } from '../../../timelines/components/timeline';
-import { HoverActions } from '.';
-
-import type { DataProvider } from '../../../../common/types';
-import { ProviderContentWrapper } from '../drag_and_drop/draggable_wrapper';
-import { getDraggableId } from '../drag_and_drop/helpers';
-import { TableContext } from '../events_viewer/shared';
-import { useTopNPopOver } from './utils';
-
-const draggableContainsLinks = (draggableElement: HTMLDivElement | null) => {
-  const links = draggableElement?.querySelectorAll('.euiLink') ?? [];
-  return links.length > 0;
-};
-
-type RenderFunctionProp = (
-  props: DataProvider,
-  provided: DraggableProvided | null,
-  state: DraggableStateSnapshot
-) => React.ReactNode;
-
-interface Props {
-  dataProvider: DataProvider;
-  isAggregatable: boolean;
-  fieldType: string;
-  disabled?: boolean;
-  hideTopN: boolean;
-  isDraggable?: boolean;
-  inline?: boolean;
-  render: RenderFunctionProp;
-  scopeId?: string;
-  truncate?: boolean;
-  onFilterAdded?: () => void;
-}
-
-export const useHoverActions = ({
-  dataProvider,
-  isAggregatable,
-  fieldType,
-  hideTopN,
-  isDraggable,
-  onFilterAdded,
-  render,
-  scopeId,
-}: Props) => {
-  const { timelineId: timelineIdFind } = useContext(TimelineContext);
-  const { tableId: tableIdFind } = useContext(TableContext);
-  const containerRef = useRef<HTMLDivElement | null>(null);
-  const keyboardHandlerRef = useRef<HTMLDivElement | null>(null);
-  const [closePopOverTrigger, setClosePopOverTrigger] = useState(false);
-  const [hoverActionsOwnFocus, setHoverActionsOwnFocus] = useState<boolean>(false);
-  const id = useMemo(
-    () => (!scopeId ? timelineIdFind ?? tableIdFind : scopeId),
-    [scopeId, tableIdFind, timelineIdFind]
-  );
-
-  const handleClosePopOverTrigger = useCallback(() => {
-    setClosePopOverTrigger((prevClosePopOverTrigger) => !prevClosePopOverTrigger);
-    setHoverActionsOwnFocus((prevHoverActionsOwnFocus) => {
-      if (prevHoverActionsOwnFocus) {
-        setTimeout(() => {
-          keyboardHandlerRef.current?.focus();
-        }, 0);
-      }
-      return false; // always give up ownership
-    });
-
-    setTimeout(() => {
-      setHoverActionsOwnFocus(false);
-    }, 0); // invoked on the next tick, because we want to restore focus first
-  }, [keyboardHandlerRef]);
-
-  const { closeTopN, toggleTopN, isShowingTopN } = useTopNPopOver(handleClosePopOverTrigger);
-
-  const values = useMemo(() => {
-    const val = dataProvider.queryMatch.value;
-
-    if (typeof val === 'number' || typeof val === 'boolean') {
-      return val.toString();
-    }
-
-    if (Array.isArray(val)) {
-      return val.map((item) => String(item));
-    }
-
-    return val;
-  }, [dataProvider.queryMatch.value]);
-
-  const hoverContent = useMemo(() => {
-    // display links as additional content in the hover menu to enable keyboard
-    // navigation of links (when the draggable contains them):
-    const additionalContent =
-      hoverActionsOwnFocus && !isShowingTopN && draggableContainsLinks(containerRef.current) ? (
-        <ProviderContentWrapper
-          data-test-subj={`draggable-link-content-${dataProvider.queryMatch.field}`}
-        >
-          {render(dataProvider, null, {
-            isDragging: false,
-            isDropAnimating: false,
-            isClone: false,
-            dropAnimation: null,
-            draggingOver: null,
-            combineWith: null,
-            combineTargetFor: null,
-            mode: null,
-          })}
-        </ProviderContentWrapper>
-      ) : null;
-
-    return (
-      <HoverActions
-        additionalContent={additionalContent}
-        closeTopN={closeTopN}
-        closePopOver={handleClosePopOverTrigger}
-        dataProvider={dataProvider}
-        draggableId={isDraggable ? getDraggableId(dataProvider.id) : undefined}
-        field={dataProvider.queryMatch.field}
-        isAggregatable={isAggregatable}
-        fieldType={fieldType}
-        hideTopN={hideTopN}
-        isObjectArray={false}
-        onFilterAdded={onFilterAdded}
-        ownFocus={hoverActionsOwnFocus}
-        showOwnFocus={false}
-        showTopN={isShowingTopN}
-        scopeId={id}
-        toggleTopN={toggleTopN}
-        values={values}
-      />
-    );
-  }, [
-    hoverActionsOwnFocus,
-    isShowingTopN,
-    dataProvider,
-    render,
-    closeTopN,
-    handleClosePopOverTrigger,
-    isDraggable,
-    isAggregatable,
-    fieldType,
-    hideTopN,
-    onFilterAdded,
-    id,
-    toggleTopN,
-    values,
-  ]);
-
-  const setContainerRef = useCallback((e: HTMLDivElement) => {
-    containerRef.current = e;
-  }, []);
-
-  const onFocus = useCallback(() => {
-    if (!hoverActionsOwnFocus) {
-      keyboardHandlerRef.current?.focus();
-    }
-  }, [hoverActionsOwnFocus, keyboardHandlerRef]);
-
-  const onCloseRequested = useCallback(() => {
-    closeTopN();
-
-    if (hoverActionsOwnFocus) {
-      setHoverActionsOwnFocus(false);
-
-      setTimeout(() => {
-        onFocus(); // return focus to this draggable on the next tick, because we owned focus
-      }, 0);
-    }
-  }, [onFocus, hoverActionsOwnFocus, closeTopN]);
-
-  const openPopover = useCallback(() => {
-    setHoverActionsOwnFocus(true);
-  }, []);
-
-  return useMemo(
-    () => ({
-      closePopOverTrigger,
-      handleClosePopOverTrigger,
-      hoverActionsOwnFocus,
-      hoverContent,
-      keyboardHandlerRef,
-      onCloseRequested,
-      onFocus,
-      openPopover,
-      setContainerRef,
-      isShowingTopN,
-    }),
-    [
-      closePopOverTrigger,
-      handleClosePopOverTrigger,
-      hoverActionsOwnFocus,
-      hoverContent,
-      onCloseRequested,
-      onFocus,
-      openPopover,
-      setContainerRef,
-      isShowingTopN,
-    ]
-  );
-};
diff --git a/x-pack/plugins/security_solution/public/common/components/hover_actions/utils.test.ts b/x-pack/plugins/security_solution/public/common/components/hover_actions/utils.test.ts
deleted file mode 100644
index 4adb83b26cddac..00000000000000
--- a/x-pack/plugins/security_solution/public/common/components/hover_actions/utils.test.ts
+++ /dev/null
@@ -1,65 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { act, renderHook } from '@testing-library/react-hooks';
-import { useTopNPopOver } from './utils';
-
-describe('useTopNPopOver', () => {
-  it('calls setIsPopoverVisible when toggling top N', () => {
-    const setIsPopoverVisible = jest.fn();
-    const {
-      result: {
-        current: { toggleTopN },
-      },
-    } = renderHook(() => useTopNPopOver(setIsPopoverVisible));
-
-    act(() => {
-      toggleTopN();
-    });
-
-    expect(setIsPopoverVisible).toHaveBeenCalled();
-  });
-
-  it('sets isShowingTopN to true when toggleTopN is called', () => {
-    const { result } = renderHook(() => useTopNPopOver());
-
-    expect(result.current.isShowingTopN).toBeFalsy();
-
-    act(() => {
-      result.current.toggleTopN();
-    });
-
-    expect(result.current.isShowingTopN).toBeTruthy();
-  });
-
-  it('sets isShowingTopN to false when toggleTopN is called for the second time', () => {
-    const { result } = renderHook(() => useTopNPopOver());
-
-    expect(result.current.isShowingTopN).toBeFalsy();
-
-    act(() => {
-      result.current.toggleTopN();
-      result.current.toggleTopN();
-    });
-
-    expect(result.current.isShowingTopN).toBeFalsy();
-  });
-
-  it('sets isShowingTopN to false when closeTopN is called', () => {
-    const { result } = renderHook(() => useTopNPopOver());
-    act(() => {
-      // First, make isShowingTopN truthy.
-      result.current.toggleTopN();
-    });
-    expect(result.current.isShowingTopN).toBeTruthy();
-
-    act(() => {
-      result.current.closeTopN();
-    });
-    expect(result.current.isShowingTopN).toBeFalsy();
-  });
-});
diff --git a/x-pack/plugins/security_solution/public/common/components/hover_actions/utils.ts b/x-pack/plugins/security_solution/public/common/components/hover_actions/utils.ts
deleted file mode 100644
index b3b8262d9f23ad..00000000000000
--- a/x-pack/plugins/security_solution/public/common/components/hover_actions/utils.ts
+++ /dev/null
@@ -1,39 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { useCallback, useState } from 'react';
-
-export const getAdditionalScreenReaderOnlyContext = ({
-  field,
-  value,
-}: {
-  field: string;
-  value?: string[] | string | null;
-}): string => {
-  if (value == null) {
-    return field;
-  }
-
-  return Array.isArray(value) ? `${field} ${value.join(' ')}` : `${field} ${value}`;
-};
-
-export const useTopNPopOver = (setIsPopoverVisible?: (isVisible: boolean) => void) => {
-  const [isShowingTopN, setShowTopN] = useState<boolean>(false);
-  const toggleTopN = useCallback(() => {
-    setShowTopN((prevShowTopN) => {
-      const newShowTopN = !prevShowTopN;
-      if (setIsPopoverVisible) setIsPopoverVisible(newShowTopN);
-      return newShowTopN;
-    });
-  }, [setIsPopoverVisible]);
-
-  const closeTopN = useCallback(() => {
-    setShowTopN(false);
-  }, []);
-
-  return { closeTopN, toggleTopN, isShowingTopN };
-};
diff --git a/x-pack/plugins/security_solution/public/common/components/hover_popover/hover_popover.test.tsx b/x-pack/plugins/security_solution/public/common/components/hover_popover/hover_popover.test.tsx
new file mode 100644
index 00000000000000..d378d217d550cd
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/hover_popover/hover_popover.test.tsx
@@ -0,0 +1,94 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { render, fireEvent, act, type RenderResult } from '@testing-library/react';
+import { HoverPopover } from './hover_popover';
+
+describe('HoverPopover', () => {
+  jest.useFakeTimers();
+
+  describe('when not hovering', () => {
+    let result: RenderResult;
+    beforeEach(() => {
+      result = render(
+        <HoverPopover hoverContent="test hover content" anchorPosition="downCenter">
+          {'test children'}
+        </HoverPopover>
+      );
+    });
+
+    it('should render the children', () => {
+      expect(result.queryByText('test children')).toBeInTheDocument();
+    });
+
+    it('should not render the hover content', () => {
+      expect(result.queryByText('test hover content')).not.toBeInTheDocument();
+    });
+  });
+
+  describe('when hovering', () => {
+    let result: RenderResult;
+    beforeEach(() => {
+      result = render(
+        <HoverPopover hoverContent="test hover content" anchorPosition="downCenter">
+          {'test children'}
+        </HoverPopover>
+      );
+
+      act(() => {
+        fireEvent.mouseEnter(result.getByTestId('HoverPopoverButton'));
+        jest.runAllTimers();
+      });
+    });
+
+    it('should render the children', () => {
+      expect(result.queryByText('test children')).toBeInTheDocument();
+    });
+
+    it('should render hoverContent', () => {
+      expect(result.queryByText('test hover content')).toBeInTheDocument();
+    });
+
+    describe('and then unhovering', () => {
+      beforeEach(() => {
+        act(() => {
+          fireEvent.mouseLeave(result.getByTestId('HoverPopoverButton'));
+          jest.runAllTimers();
+        });
+      });
+
+      it('should render the children', () => {
+        expect(result.queryByText('test children')).toBeInTheDocument();
+      });
+
+      it('should not render hoverContent', () => {
+        expect(result.queryByText('test hover content')).not.toBeInTheDocument();
+      });
+    });
+
+    describe('and then clicking ESC', () => {
+      beforeEach(() => {
+        act(() => {
+          fireEvent.keyDown(result.getByText('test hover content'), {
+            key: 'Escape',
+            code: 'Escape',
+          });
+          jest.runAllTimers();
+        });
+      });
+
+      it('should render the children', () => {
+        expect(result.queryByText('test children')).toBeInTheDocument();
+      });
+
+      it('should not render hoverContent', () => {
+        expect(result.queryByText('test hover content')).not.toBeInTheDocument();
+      });
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/common/components/with_hover_actions/index.tsx b/x-pack/plugins/security_solution/public/common/components/hover_popover/hover_popover.tsx
similarity index 53%
rename from x-pack/plugins/security_solution/public/common/components/with_hover_actions/index.tsx
rename to x-pack/plugins/security_solution/public/common/components/hover_popover/hover_popover.tsx
index 509d7610cb0fb2..827290565f2874 100644
--- a/x-pack/plugins/security_solution/public/common/components/with_hover_actions/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/hover_popover/hover_popover.tsx
@@ -5,12 +5,11 @@
  * 2.0.
  */
 
+import type { PopoverAnchorPosition } from '@elastic/eui';
 import { EuiPopover } from '@elastic/eui';
-import {
-  HOVER_ACTIONS_ALWAYS_SHOW_CLASS_NAME,
-  IS_DRAGGING_CLASS_NAME,
-} from '@kbn/securitysolution-t-grid';
-import React, { useCallback, useEffect, useMemo, useRef, useState } from 'react';
+import { IS_DRAGGING_CLASS_NAME } from '@kbn/securitysolution-t-grid';
+import type { PropsWithChildren } from 'react';
+import React, { useCallback, useEffect, useRef, useState } from 'react';
 
 /**
  * To avoid expensive changes to the DOM, delay showing the popover menu
@@ -18,39 +17,8 @@ import React, { useCallback, useEffect, useMemo, useRef, useState } from 'react'
 const HOVER_INTENT_DELAY = 100; // ms
 
 interface Props {
-  /**
-   * Always show the hover menu contents (default: false)
-   */
-  alwaysShow?: boolean;
-  /**
-   * The hover menu is closed whenever this prop changes
-   */
-  closePopOverTrigger?: boolean;
-  /**
-   * The contents of the hover menu. It is highly recommended you wrap this
-   * content in a `div` with `position: absolute` to prevent it from effecting
-   * layout, and to adjust it's position via `top` and `left`.
-   */
-  hoverContent?: JSX.Element;
-  /**
-   * The content that will be wrapped with hover actions. In addition to
-   * rendering the `hoverContent` when the user hovers, this render prop
-   * passes `showHoverContent` to provide a signal that it is in the hover
-   * state.
-   */
-  render: (showHoverContent: boolean) => JSX.Element;
-
-  /**
-   * This optional callback is invoked when a close is requested via user
-   * intent, i.e. by clicking outside of the popover, moving the mouse
-   * away, or pressing Escape. It's only a "request" to close, because
-   * the hover menu will NOT be closed if `alwaysShow` is `true`.
-   *
-   * Use this callback when you're managing the state of `alwaysShow`
-   * (outside of this component), and you want to be informed of a user's
-   * intent to close the hover menu.
-   */
-  onCloseRequested?: () => void;
+  hoverContent: React.ReactNode;
+  anchorPosition?: PopoverAnchorPosition;
 }
 
 /**
@@ -69,9 +37,9 @@ interface Props {
  * otherwise it will be difficult for keyboard-only and screen
  * reader users to navigate to and from your popover.
  */
-export const WithHoverActions = React.memo<Props>(
-  ({ alwaysShow = false, closePopOverTrigger, hoverContent, onCloseRequested, render }) => {
-    const [isOpen, setIsOpen] = useState(hoverContent != null && alwaysShow);
+export const HoverPopover = React.memo<PropsWithChildren<Props>>(
+  ({ hoverContent, anchorPosition = 'downCenter', children }) => {
+    const [isOpen, setIsOpen] = useState(hoverContent != null);
     const [showHoverContent, setShowHoverContent] = useState(false);
     const [, setHoverTimeout] = useState<number | undefined>(undefined);
     const popoverRef = useRef<EuiPopover>(null);
@@ -83,13 +51,7 @@ export const WithHoverActions = React.memo<Props>(
       });
 
       setShowHoverContent(false);
-
-      if (onCloseRequested != null) {
-        setTimeout(() => {
-          onCloseRequested();
-        });
-      }
-    }, [onCloseRequested]);
+    }, []);
 
     const onMouseEnter = useCallback(() => {
       setHoverTimeout(
@@ -107,10 +69,8 @@ export const WithHoverActions = React.memo<Props>(
     }, [setHoverTimeout, setShowHoverContent]);
 
     const onMouseLeave = useCallback(() => {
-      if (!alwaysShow) {
-        tryClosePopover();
-      }
-    }, [alwaysShow, tryClosePopover]);
+      tryClosePopover();
+    }, [tryClosePopover]);
 
     const onKeyDown = useCallback(
       (keyboardEvent: React.KeyboardEvent) => {
@@ -121,22 +81,9 @@ export const WithHoverActions = React.memo<Props>(
       [isOpen, onMouseLeave]
     );
 
-    const content = useMemo(
-      () => (
-        <div data-test-subj="withHoverActionsButton" onMouseEnter={onMouseEnter}>
-          {render(showHoverContent)}
-        </div>
-      ),
-      [onMouseEnter, render, showHoverContent]
-    );
-
     useEffect(() => {
-      setIsOpen(hoverContent != null && (showHoverContent || alwaysShow));
-    }, [hoverContent, showHoverContent, alwaysShow]);
-
-    useEffect(() => {
-      setShowHoverContent(false);
-    }, [closePopOverTrigger]); // NOTE: the `closePopOverTrigger` dependency here will close the hover menu whenever `closePopOverTrigger` changes
+      setIsOpen(hoverContent != null && showHoverContent);
+    }, [hoverContent, showHoverContent]);
 
     useEffect(() => {
       // in case of dynamic content i.e when the value of hoverContent changes,
@@ -145,20 +92,22 @@ export const WithHoverActions = React.memo<Props>(
     }, [hoverContent, isOpen]);
 
     return (
-      <div
-        className={alwaysShow ? HOVER_ACTIONS_ALWAYS_SHOW_CLASS_NAME : ''}
-        onMouseLeave={onMouseLeave}
-      >
+      <div onMouseLeave={onMouseLeave}>
         <EuiPopover
           ref={popoverRef}
-          anchorPosition={'downCenter'}
-          button={content}
+          anchorPosition={anchorPosition}
+          button={
+            <div data-test-subj="HoverPopoverButton" onMouseEnter={onMouseEnter}>
+              {children}
+            </div>
+          }
           closePopover={tryClosePopover}
           hasArrow={false}
           isOpen={isOpen}
           ownFocus={false}
           panelPaddingSize="none"
-          panelClassName="withHoverActions__popover"
+          panelStyle={{ minInlineSize: 'fit-content' }}
+          panelClassName="HoverPopover__popover"
           repositionOnScroll={true}
         >
           {isOpen ? <div onKeyDown={onKeyDown}>{hoverContent}</div> : null}
@@ -167,5 +116,4 @@ export const WithHoverActions = React.memo<Props>(
     );
   }
 );
-
-WithHoverActions.displayName = 'WithHoverActions';
+HoverPopover.displayName = 'HoverPopover';
diff --git a/x-pack/plugins/security_solution/public/common/components/hover_actions/keyboard_shortcut_constants.ts b/x-pack/plugins/security_solution/public/common/components/hover_popover/index.ts
similarity index 83%
rename from x-pack/plugins/security_solution/public/common/components/hover_actions/keyboard_shortcut_constants.ts
rename to x-pack/plugins/security_solution/public/common/components/hover_popover/index.ts
index cef4c896e39f2a..6f94a6103cd35f 100644
--- a/x-pack/plugins/security_solution/public/common/components/hover_actions/keyboard_shortcut_constants.ts
+++ b/x-pack/plugins/security_solution/public/common/components/hover_popover/index.ts
@@ -5,4 +5,4 @@
  * 2.0.
  */
 
-export const SHOW_TOP_N_KEYBOARD_SHORTCUT = 't';
+export { HoverPopover } from './hover_popover';
diff --git a/x-pack/plugins/security_solution/public/common/components/navigation/security_side_nav/security_side_nav.tsx b/x-pack/plugins/security_solution/public/common/components/navigation/security_side_nav/security_side_nav.tsx
index 47ff3e6e4fad14..6b327df2a847c4 100644
--- a/x-pack/plugins/security_solution/public/common/components/navigation/security_side_nav/security_side_nav.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/navigation/security_side_nav/security_side_nav.tsx
@@ -137,7 +137,7 @@ const usePanelBottomOffset = (): string | undefined => {
  * Main security navigation component.
  * It takes the links to render from the generic application `links` configs.
  */
-export const SecuritySideNav: React.FC = () => {
+export const SecuritySideNav: React.FC<{ onMount?: () => void }> = ({ onMount }) => {
   const items = useSolutionSideNavItems();
   const selectedId = useSelectedId();
   const panelTopOffset = usePanelTopOffset();
@@ -151,6 +151,7 @@ export const SecuritySideNav: React.FC = () => {
     <SolutionSideNav
       items={items}
       categories={CATEGORIES}
+      onMount={onMount}
       selectedId={selectedId}
       panelTopOffset={panelTopOffset}
       panelBottomOffset={panelBottomOffset}
diff --git a/x-pack/plugins/security_solution/public/common/components/navigation/use_security_solution_navigation/use_security_solution_navigation.tsx b/x-pack/plugins/security_solution/public/common/components/navigation/use_security_solution_navigation/use_security_solution_navigation.tsx
index 021b9275d176cb..30ebf658f00206 100644
--- a/x-pack/plugins/security_solution/public/common/components/navigation/use_security_solution_navigation/use_security_solution_navigation.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/navigation/use_security_solution_navigation/use_security_solution_navigation.tsx
@@ -23,7 +23,9 @@ const translatedNavTitle = i18n.translate('xpack.securitySolution.navigation.mai
   defaultMessage: 'Security',
 });
 
-export const useSecuritySolutionNavigation = (): KibanaPageTemplateProps['solutionNav'] => {
+export const useSecuritySolutionNavigation = (
+  onMount: () => void
+): KibanaPageTemplateProps['solutionNav'] => {
   const { chrome } = useKibana().services;
   const chromeStyle$ = useMemo(() => chrome.getChromeStyle$(), [chrome]);
   const chromeStyle = useObservable(chromeStyle$, 'classic');
@@ -39,7 +41,7 @@ export const useSecuritySolutionNavigation = (): KibanaPageTemplateProps['soluti
     canBeCollapsed: true,
     name: translatedNavTitle,
     icon: 'logoSecurity',
-    children: <SecuritySideNav />,
+    children: <SecuritySideNav onMount={onMount} />,
     closeFlyoutButtonPosition: 'inside',
   };
 };
diff --git a/x-pack/plugins/security_solution/public/common/containers/sourcerer/index.test.tsx b/x-pack/plugins/security_solution/public/common/containers/sourcerer/index.test.tsx
index eb218e626f1763..88b58e46adbf8e 100644
--- a/x-pack/plugins/security_solution/public/common/containers/sourcerer/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/containers/sourcerer/index.test.tsx
@@ -664,6 +664,34 @@ describe('Sourcerer Hooks', () => {
         expect(result.current.indexPattern).toHaveProperty('getName');
       });
     });
+
+    it('should update the title of the data view according to the selected patterns', async () => {
+      const { result, rerender } = renderHook<SourcererScopeName, SelectedDataView>(
+        () => useSourcererDataView(),
+        {
+          wrapper: ({ children }) => <Provider store={store}>{children}</Provider>,
+        }
+      );
+
+      expect(result.current.sourcererDataView?.title).toBe(
+        'apm-*-transaction*,auditbeat-*,endgame-*,filebeat-*,logs-*,packetbeat-*,traces-apm*,winlogbeat-*,-*elastic-cloud-logs-*'
+      );
+
+      const testPatterns = ['anotherTestPattern', 'justATestPattern'];
+      await act(async () => {
+        store.dispatch(
+          sourcererActions.setSelectedDataView({
+            id: SourcererScopeName.default,
+            selectedDataViewId: 'security-solution-default',
+            selectedPatterns: testPatterns,
+          })
+        );
+
+        await rerender();
+
+        expect(result.current.sourcererDataView?.title).toBe(testPatterns.join(','));
+      });
+    });
   });
 });
 
diff --git a/x-pack/plugins/security_solution/public/common/containers/sourcerer/index.tsx b/x-pack/plugins/security_solution/public/common/containers/sourcerer/index.tsx
index 0a8985d5bfb867..6ae176890291da 100644
--- a/x-pack/plugins/security_solution/public/common/containers/sourcerer/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/containers/sourcerer/index.tsx
@@ -445,11 +445,18 @@ export const useSourcererDataView = (
     }
   }, [missingPatterns, selectedDataView, selectedPatterns]);
 
-  const sourcererDataView = useMemo(
-    () =>
-      selectedDataView == null || missingPatterns.length > 0 ? legacyDataView : selectedDataView,
-    [legacyDataView, missingPatterns.length, selectedDataView]
-  );
+  const sourcererDataView = useMemo(() => {
+    const _dv =
+      selectedDataView == null || missingPatterns.length > 0 ? legacyDataView : selectedDataView;
+    // Make sure the title is up to date, so that the correct index patterns are used everywhere
+    return {
+      ..._dv,
+      dataView: {
+        ..._dv.dataView,
+        title: selectedPatterns.join(','),
+      },
+    };
+  }, [legacyDataView, missingPatterns.length, selectedDataView, selectedPatterns]);
 
   const indicesExist = useMemo(() => {
     if (loading || sourcererDataView.loading) {
diff --git a/x-pack/plugins/security_solution/public/common/hooks/esql/use_esql_availability.ts b/x-pack/plugins/security_solution/public/common/hooks/esql/use_esql_availability.ts
index 41fc7084b32bfd..3e9bdb658c3e11 100644
--- a/x-pack/plugins/security_solution/public/common/hooks/esql/use_esql_availability.ts
+++ b/x-pack/plugins/security_solution/public/common/hooks/esql/use_esql_availability.ts
@@ -18,17 +18,19 @@ import { useIsExperimentalFeatureEnabled } from '../use_experimental_features';
 export const useEsqlAvailability = () => {
   const { uiSettings } = useKibana().services;
   const isEsqlAdvancedSettingEnabled = uiSettings?.get(ENABLE_ESQL);
+
+  const isTimelineEsqlFeatureFlagDisabled =
+    useIsExperimentalFeatureEnabled('timelineEsqlTabDisabled');
+
   const isEsqlRuleTypeEnabled =
     !useIsExperimentalFeatureEnabled('esqlRulesDisabled') && isEsqlAdvancedSettingEnabled;
-  const isESQLTabInTimelineEnabled =
-    !useIsExperimentalFeatureEnabled('timelineEsqlTabDisabled') && isEsqlAdvancedSettingEnabled;
 
   return useMemo(
     () => ({
       isEsqlAdvancedSettingEnabled,
       isEsqlRuleTypeEnabled,
-      isESQLTabInTimelineEnabled,
+      isTimelineEsqlEnabledByFeatureFlag: !isTimelineEsqlFeatureFlagDisabled,
     }),
-    [isESQLTabInTimelineEnabled, isEsqlAdvancedSettingEnabled, isEsqlRuleTypeEnabled]
+    [isEsqlAdvancedSettingEnabled, isTimelineEsqlFeatureFlagDisabled, isEsqlRuleTypeEnabled]
   );
 };
diff --git a/x-pack/plugins/security_solution/public/common/hooks/use_inspect_query.test.tsx b/x-pack/plugins/security_solution/public/common/hooks/use_inspect_query.test.tsx
deleted file mode 100644
index 1bf2de3242ac71..00000000000000
--- a/x-pack/plugins/security_solution/public/common/hooks/use_inspect_query.test.tsx
+++ /dev/null
@@ -1,85 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-import { renderHook } from '@testing-library/react-hooks';
-import { useInspectQuery } from './use_inspect_query';
-
-import { useGlobalTime } from '../containers/use_global_time';
-
-jest.mock('../containers/use_global_time');
-
-const QUERY_ID = 'tes_query_id';
-
-const RESPONSE = {
-  inspect: { dsl: [], response: [] },
-  isPartial: false,
-  isRunning: false,
-  total: 0,
-  loaded: 0,
-  rawResponse: {
-    took: 0,
-    timed_out: false,
-    _shards: {
-      total: 0,
-      successful: 0,
-      failed: 0,
-      skipped: 0,
-    },
-    results: {
-      hits: {
-        total: 0,
-      },
-    },
-    hits: {
-      total: 0,
-      max_score: 0,
-      hits: [],
-    },
-  },
-  totalCount: 0,
-  enrichments: [],
-};
-
-describe('useInspectQuery', () => {
-  let deleteQuery: jest.Mock;
-  let setQuery: jest.Mock;
-
-  beforeEach(() => {
-    deleteQuery = jest.fn();
-    setQuery = jest.fn();
-    (useGlobalTime as jest.Mock).mockImplementation(() => ({
-      deleteQuery,
-      setQuery,
-      isInitializing: false,
-    }));
-  });
-
-  it('it calls setQuery', () => {
-    renderHook(() => useInspectQuery(QUERY_ID, false, RESPONSE));
-
-    expect(setQuery).toHaveBeenCalledTimes(1);
-    expect(setQuery.mock.calls[0][0].id).toBe(QUERY_ID);
-  });
-
-  it("doesn't call setQuery when response is undefined", () => {
-    renderHook(() => useInspectQuery(QUERY_ID, false, undefined));
-
-    expect(setQuery).not.toHaveBeenCalled();
-  });
-
-  it("doesn't call setQuery when loading", () => {
-    renderHook(() => useInspectQuery(QUERY_ID, true));
-
-    expect(setQuery).not.toHaveBeenCalled();
-  });
-
-  it('calls deleteQuery when unmouting', () => {
-    const result = renderHook(() => useInspectQuery(QUERY_ID, false, RESPONSE));
-    result.unmount();
-
-    expect(deleteQuery).toHaveBeenCalledWith({ id: QUERY_ID });
-  });
-});
diff --git a/x-pack/plugins/security_solution/public/common/hooks/use_inspect_query.ts b/x-pack/plugins/security_solution/public/common/hooks/use_inspect_query.ts
deleted file mode 100644
index 4c0cb1c4fcdca2..00000000000000
--- a/x-pack/plugins/security_solution/public/common/hooks/use_inspect_query.ts
+++ /dev/null
@@ -1,44 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-import { noop } from 'lodash';
-import { useEffect } from 'react';
-import type { FactoryQueryTypes, StrategyResponseType } from '../../../common/search_strategy';
-import { getInspectResponse } from '../../helpers';
-import { useGlobalTime } from '../containers/use_global_time';
-import type { Refetch, RefetchKql } from '../store/inputs/model';
-
-/**
- * Add and remove query response from global input store.
- */
-export const useInspectQuery = <T extends FactoryQueryTypes>(
-  id: string,
-  loading: boolean,
-  response?: StrategyResponseType<T>,
-  refetch: Refetch | RefetchKql = noop
-) => {
-  const { deleteQuery, setQuery, isInitializing } = useGlobalTime();
-
-  useEffect(() => {
-    if (!loading && !isInitializing && response?.inspect) {
-      setQuery({
-        id,
-        inspect: getInspectResponse(response, {
-          dsl: [],
-          response: [],
-        }),
-        loading,
-        refetch,
-      });
-    }
-
-    return () => {
-      if (deleteQuery) {
-        deleteQuery({ id });
-      }
-    };
-  }, [deleteQuery, setQuery, loading, response, isInitializing, id, refetch]);
-};
diff --git a/x-pack/plugins/security_solution/public/common/lib/kibana/kibana_react.mock.ts b/x-pack/plugins/security_solution/public/common/lib/kibana/kibana_react.mock.ts
index d3aa07d0f6cdac..f20679d68884c6 100644
--- a/x-pack/plugins/security_solution/public/common/lib/kibana/kibana_react.mock.ts
+++ b/x-pack/plugins/security_solution/public/common/lib/kibana/kibana_react.mock.ts
@@ -14,7 +14,6 @@ import { coreMock, themeServiceMock } from '@kbn/core/public/mocks';
 import { KibanaContextProvider } from '@kbn/kibana-react-plugin/public';
 import { dataPluginMock } from '@kbn/data-plugin/public/mocks';
 import { securityMock } from '@kbn/security-plugin/public/mocks';
-import { createFilterManagerMock } from '@kbn/data-plugin/public/query/filter_manager/filter_manager.mock';
 
 import {
   DEFAULT_APP_REFRESH_INTERVAL,
@@ -128,7 +127,7 @@ export const createStartServicesMock = (
   const guidedOnboarding = guidedOnboardingMock.createStart();
   const cloud = cloudMock.createStart();
   const mockSetHeaderActionMenu = jest.fn();
-  const mockTimelineFilterManager = createFilterManagerMock();
+  const timelineDataService = dataPluginMock.createStartContract();
   const alerting = alertingPluginMock.createStartContract();
 
   /*
@@ -136,17 +135,17 @@ export const createStartServicesMock = (
    * when data service is passed through as a prop
    *
    * */
-  data.query.timefilter.timefilter.getAbsoluteTime = jest.fn(() => ({
+  timelineDataService.query.timefilter.timefilter.getAbsoluteTime = jest.fn(() => ({
     from: '2021-08-31T22:00:00.000Z',
     to: '2022-09-01T09:16:29.553Z',
   }));
-  data.query.timefilter.timefilter.getTime = jest.fn(() => {
+  timelineDataService.query.timefilter.timefilter.getTime = jest.fn(() => {
     return { from: 'now-15m', to: 'now' };
   });
-  data.query.timefilter.timefilter.getRefreshInterval = jest.fn(() => {
+  timelineDataService.query.timefilter.timefilter.getRefreshInterval = jest.fn(() => {
     return { pause: true, value: 1000 };
   });
-  data.query.timefilter.timefilter.calculateBounds = jest.fn(calculateBounds);
+  timelineDataService.query.timefilter.timefilter.calculateBounds = jest.fn(calculateBounds);
   /** ************************************************* */
 
   return {
@@ -251,7 +250,7 @@ export const createStartServicesMock = (
     fieldFormats: fieldFormatsMock,
     dataViewFieldEditor: indexPatternFieldEditorPluginMock.createStartContract(),
     upselling: new UpsellingService(),
-    timelineFilterManager: mockTimelineFilterManager,
+    timelineDataService,
     alerting,
   } as unknown as StartServices;
 };
diff --git a/x-pack/plugins/security_solution/public/common/lib/kuery/index.ts b/x-pack/plugins/security_solution/public/common/lib/kuery/index.ts
index 487917f381b9b9..5018abe6bdf62a 100644
--- a/x-pack/plugins/security_solution/public/common/lib/kuery/index.ts
+++ b/x-pack/plugins/security_solution/public/common/lib/kuery/index.ts
@@ -231,6 +231,12 @@ export const convertToBuildEsQuery = ({
   }
 };
 
+export interface CombinedQuery {
+  filterQuery: string | undefined;
+  kqlError: Error | undefined;
+  baseKqlQuery: Query;
+}
+
 export const combineQueries = ({
   config,
   dataProviders = [],
@@ -239,7 +245,7 @@ export const combineQueries = ({
   filters = [],
   kqlQuery,
   kqlMode,
-}: CombineQueries): { filterQuery: string | undefined; kqlError: Error | undefined } | null => {
+}: CombineQueries): CombinedQuery | null => {
   const kuery: Query = { query: '', language: kqlQuery.language };
   if (isDataProviderEmpty(dataProviders) && isEmpty(kqlQuery.query) && isEmpty(filters)) {
     return null;
@@ -254,6 +260,7 @@ export const combineQueries = ({
     return {
       filterQuery,
       kqlError,
+      baseKqlQuery: kuery,
     };
   }
 
@@ -281,5 +288,6 @@ export const combineQueries = ({
   return {
     filterQuery,
     kqlError,
+    baseKqlQuery: kuery,
   };
 };
diff --git a/x-pack/plugins/security_solution/public/common/lib/telemetry/events/attack_discovery/index.ts b/x-pack/plugins/security_solution/public/common/lib/telemetry/events/attack_discovery/index.ts
index 69db25db913090..4305556923c99b 100644
--- a/x-pack/plugins/security_solution/public/common/lib/telemetry/events/attack_discovery/index.ts
+++ b/x-pack/plugins/security_solution/public/common/lib/telemetry/events/attack_discovery/index.ts
@@ -25,6 +25,13 @@ export const insightsGeneratedEvent: TelemetryEvent = {
         optional: false,
       },
     },
+    alertsContextCount: {
+      type: 'integer',
+      _meta: {
+        description: 'Number of alerts sent as context to the LLM',
+        optional: false,
+      },
+    },
     alertsCount: {
       type: 'integer',
       _meta: {
diff --git a/x-pack/plugins/security_solution/public/common/lib/telemetry/events/attack_discovery/types.ts b/x-pack/plugins/security_solution/public/common/lib/telemetry/events/attack_discovery/types.ts
index 7a57acbc4cb41e..e76813d280bc00 100644
--- a/x-pack/plugins/security_solution/public/common/lib/telemetry/events/attack_discovery/types.ts
+++ b/x-pack/plugins/security_solution/public/common/lib/telemetry/events/attack_discovery/types.ts
@@ -13,6 +13,7 @@ export interface ReportAttackDiscoveriesGeneratedParams {
   provider?: string;
   model?: string;
   durationMs: number;
+  alertsContextCount: number;
   alertsCount: number;
   configuredAlertsCount: number;
 }
diff --git a/x-pack/plugins/security_solution/public/common/lib/telemetry/types.ts b/x-pack/plugins/security_solution/public/common/lib/telemetry/types.ts
index 85c567121ac2d0..e42c2cd8ab23cc 100644
--- a/x-pack/plugins/security_solution/public/common/lib/telemetry/types.ts
+++ b/x-pack/plugins/security_solution/public/common/lib/telemetry/types.ts
@@ -12,7 +12,7 @@ import type {
   ReportAttackDiscoveriesGeneratedParams,
   ReportAttackDiscoveryTelemetryEventParams,
 } from './events/attack_discovery/types';
-import type { SecurityMetadata } from '../../../actions/types';
+import type { SecurityCellActionMetadata } from '../../../app/actions/types';
 import type { ML_JOB_TELEMETRY_STATUS, TelemetryEventTypes } from './constants';
 import type {
   AlertsGroupingTelemetryEvent,
@@ -91,7 +91,7 @@ export interface ReportMLJobUpdateParams {
 }
 
 export interface ReportCellActionClickedParams {
-  metadata: SecurityMetadata | undefined;
+  metadata: SecurityCellActionMetadata | undefined;
   displayName: string;
   actionId: string;
   fieldName: string;
diff --git a/x-pack/plugins/security_solution/public/common/translations.ts b/x-pack/plugins/security_solution/public/common/translations.ts
index ee0172e01b281f..126aa4eabe3b0b 100644
--- a/x-pack/plugins/security_solution/public/common/translations.ts
+++ b/x-pack/plugins/security_solution/public/common/translations.ts
@@ -15,6 +15,13 @@ export const SOLUTION_NAME = i18n.translate('xpack.securitySolution.pages.common
   defaultMessage: 'Security',
 });
 
+export const ASSISTANT_MANAGEMENT_TITLE = i18n.translate(
+  'xpack.securitySolution.securityAiAssistantManagement.app.title',
+  {
+    defaultMessage: 'AI Assistant for Security',
+  }
+);
+
 export const BETA = i18n.translate('xpack.securitySolution.pages.common.beta', {
   defaultMessage: 'Beta',
 });
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_creation/logic/esql_validator.ts b/x-pack/plugins/security_solution/public/detection_engine/rule_creation/logic/esql_validator.ts
index e7a6e523965b22..b7e9f1b033e31d 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_creation/logic/esql_validator.ts
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_creation/logic/esql_validator.ts
@@ -71,16 +71,16 @@ export const esqlValidator = async (
       };
     }
 
-    const data = await securitySolutionQueryClient.fetchQuery(
-      getEsqlQueryConfig({ esqlQuery: query, expressions: services.expressions })
+    const columns = await securitySolutionQueryClient.fetchQuery(
+      getEsqlQueryConfig({ esqlQuery: query, search: services.data.search.search })
     );
 
-    if (data && 'error' in data) {
-      return constructValidationError(data.error);
+    if (columns && 'error' in columns) {
+      return constructValidationError(columns.error);
     }
 
     // check whether _id field is present in response
-    const isIdFieldPresent = (data?.columns ?? []).find(({ id }) => '_id' === id);
+    const isIdFieldPresent = (columns ?? []).find(({ id }) => '_id' === id);
     // for non-aggregating query, we want to disable queries w/o _id property returned in response
     if (!isEsqlQueryAggregating && !isIdFieldPresent) {
       return {
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_creation/logic/get_esql_query_config.ts b/x-pack/plugins/security_solution/public/detection_engine/rule_creation/logic/get_esql_query_config.ts
index bb07b0438a49d0..c7d4f9184f1814 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_creation/logic/get_esql_query_config.ts
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_creation/logic/get_esql_query_config.ts
@@ -5,8 +5,8 @@
  * 2.0.
  */
 
-import { fetchFieldsFromESQL } from '@kbn/text-based-editor';
-import type { ExpressionsStart } from '@kbn/expressions-plugin/public';
+import { getESQLQueryColumns } from '@kbn/esql-utils';
+import type { ISearchGeneric } from '@kbn/search-types';
 
 /**
  * react-query configuration to be used to fetch ES|QL fields
@@ -14,12 +14,11 @@ import type { ExpressionsStart } from '@kbn/expressions-plugin/public';
  */
 export const getEsqlQueryConfig = ({
   esqlQuery,
-  expressions,
+  search,
 }: {
   esqlQuery: string | undefined;
-  expressions: ExpressionsStart;
+  search: ISearchGeneric;
 }) => {
-  const emptyResultsEsqlQuery = `${esqlQuery} | limit 0`;
   return {
     queryKey: [(esqlQuery ?? '').trim()],
     queryFn: async () => {
@@ -27,7 +26,10 @@ export const getEsqlQueryConfig = ({
         return null;
       }
       try {
-        const res = await fetchFieldsFromESQL({ esql: emptyResultsEsqlQuery }, expressions);
+        const res = await getESQLQueryColumns({
+          esqlQuery,
+          search,
+        });
         return res;
       } catch (e) {
         return { error: e };
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/components/description_step/helpers.tsx b/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/components/description_step/helpers.tsx
index 51d4a2882c82c1..aaf588edd3099e 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/components/description_step/helpers.tsx
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/components/description_step/helpers.tsx
@@ -27,6 +27,7 @@ import { FieldIcon } from '@kbn/react-field';
 
 import type { ThreatMapping, Type, Threats } from '@kbn/securitysolution-io-ts-alerting-types';
 import { FilterBadgeGroup } from '@kbn/unified-search-plugin/public';
+import { IntervalAbbrScreenReader } from '../../../../common/components/accessibility';
 import type {
   RequiredFieldArray,
   Threshold,
@@ -676,3 +677,12 @@ export const buildSetupDescription = (label: string, setup: string): ListItems[]
   }
   return [];
 };
+
+export const buildIntervalDescription = (label: string, value: string): ListItems[] => {
+  return [
+    {
+      title: label,
+      description: <IntervalAbbrScreenReader interval={value} />,
+    },
+  ];
+};
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/components/description_step/index.tsx b/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/components/description_step/index.tsx
index 7e00e90f391b08..4676f065f4af8d 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/components/description_step/index.tsx
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/components/description_step/index.tsx
@@ -49,6 +49,7 @@ import {
   buildHighlightedFieldsOverrideDescription,
   buildSetupDescription,
   getQueryLabel,
+  buildIntervalDescription,
 } from './helpers';
 import * as i18n from './translations';
 import { buildMlJobsDescription } from './build_ml_jobs_description';
@@ -342,6 +343,8 @@ export const getDescriptionItem = (
     return get('isBuildingBlock', data)
       ? [{ title: i18n.BUILDING_BLOCK_LABEL, description: i18n.BUILDING_BLOCK_DESCRIPTION }]
       : [];
+  } else if (['interval', 'from'].includes(field)) {
+    return buildIntervalDescription(label, get(field, data));
   } else if (field === 'maxSignals') {
     const value: number | undefined = get(field, data);
     return value ? [{ title: label, description: value }] : [];
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/components/esql_autocomplete/use_esql_fields_options.test.ts b/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/components/esql_autocomplete/use_esql_fields_options.test.ts
index d70d0c154b45e3..e6a6b3d4a3d789 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/components/esql_autocomplete/use_esql_fields_options.test.ts
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/components/esql_autocomplete/use_esql_fields_options.test.ts
@@ -19,17 +19,13 @@ describe('esqlToOptions', () => {
   });
   it('should transform all columns if fieldTYpe is not passed', () => {
     expect(
-      esqlToOptions({
-        type: 'datatable',
-        rows: [],
-        columns: [
-          { name: '@timestamp', id: '@timestamp', meta: { type: 'date' } },
-          { name: 'agent.build.original', id: 'agent.build.original', meta: { type: 'string' } },
-          { name: 'amqp.app-id', id: 'amqp.app-id', meta: { type: 'string' } },
-          { name: 'amqp.auto-delete', id: 'amqp.auto-delete', meta: { type: 'number' } },
-          { name: 'amqp.class-id', id: 'amqp.class-id', meta: { type: 'boolean' } },
-        ],
-      })
+      esqlToOptions([
+        { name: '@timestamp', id: '@timestamp', meta: { type: 'date' } },
+        { name: 'agent.build.original', id: 'agent.build.original', meta: { type: 'string' } },
+        { name: 'amqp.app-id', id: 'amqp.app-id', meta: { type: 'string' } },
+        { name: 'amqp.auto-delete', id: 'amqp.auto-delete', meta: { type: 'number' } },
+        { name: 'amqp.class-id', id: 'amqp.class-id', meta: { type: 'boolean' } },
+      ])
     ).toEqual([
       { label: '@timestamp' },
       { label: 'agent.build.original' },
@@ -41,17 +37,13 @@ describe('esqlToOptions', () => {
   it('should transform only columns of exact fieldType', () => {
     expect(
       esqlToOptions(
-        {
-          type: 'datatable',
-          rows: [],
-          columns: [
-            { name: '@timestamp', id: '@timestamp', meta: { type: 'date' } },
-            { name: 'agent.build.original', id: 'agent.build.original', meta: { type: 'string' } },
-            { name: 'amqp.app-id', id: 'amqp.app-id', meta: { type: 'string' } },
-            { name: 'amqp.auto-delete', id: 'amqp.auto-delete', meta: { type: 'number' } },
-            { name: 'amqp.class-id', id: 'amqp.class-id', meta: { type: 'boolean' } },
-          ],
-        },
+        [
+          { name: '@timestamp', id: '@timestamp', meta: { type: 'date' } },
+          { name: 'agent.build.original', id: 'agent.build.original', meta: { type: 'string' } },
+          { name: 'amqp.app-id', id: 'amqp.app-id', meta: { type: 'string' } },
+          { name: 'amqp.auto-delete', id: 'amqp.auto-delete', meta: { type: 'number' } },
+          { name: 'amqp.class-id', id: 'amqp.class-id', meta: { type: 'boolean' } },
+        ],
         'string'
       )
     ).toEqual([{ label: 'agent.build.original' }, { label: 'amqp.app-id' }]);
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/components/esql_autocomplete/use_esql_fields_options.ts b/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/components/esql_autocomplete/use_esql_fields_options.ts
index b8fc47c41c7983..b29d44c0b855fc 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/components/esql_autocomplete/use_esql_fields_options.ts
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/components/esql_autocomplete/use_esql_fields_options.ts
@@ -6,7 +6,8 @@
  */
 import { useMemo } from 'react';
 import type { EuiComboBoxOptionOption } from '@elastic/eui';
-import type { Datatable, ExpressionsStart } from '@kbn/expressions-plugin/public';
+import type { DatatableColumn } from '@kbn/expressions-plugin/public';
+import type { DataPublicPluginStart } from '@kbn/data-plugin/public';
 
 import { useQuery } from '@tanstack/react-query';
 
@@ -16,14 +17,14 @@ import { getEsqlQueryConfig } from '../../../rule_creation/logic/get_esql_query_
 import type { FieldType } from '../../../rule_creation/logic/esql_validator';
 
 export const esqlToOptions = (
-  data: { error: unknown } | Datatable | undefined | null,
+  columns: { error: unknown } | DatatableColumn[] | undefined | null,
   fieldType?: FieldType
 ) => {
-  if (data && 'error' in data) {
+  if (columns && 'error' in columns) {
     return [];
   }
 
-  const options = (data?.columns ?? []).reduce<Array<{ label: string }>>((acc, { id, meta }) => {
+  const options = (columns ?? []).reduce<Array<{ label: string }>>((acc, { id, meta }) => {
     // if fieldType absent, we do not filter columns by type
     if (!fieldType || fieldType === meta.type) {
       acc.push({ label: id });
@@ -46,11 +47,11 @@ type UseEsqlFieldOptions = (
  * fetches ES|QL fields and convert them to Combobox options
  */
 export const useEsqlFieldOptions: UseEsqlFieldOptions = (esqlQuery, fieldType) => {
-  const kibana = useKibana<{ expressions: ExpressionsStart }>();
+  const kibana = useKibana<{ data: DataPublicPluginStart }>();
 
-  const { expressions } = kibana.services;
+  const { data: dataService } = kibana.services;
 
-  const queryConfig = getEsqlQueryConfig({ esqlQuery, expressions });
+  const queryConfig = getEsqlQueryConfig({ esqlQuery, search: dataService.search.search });
   const { data, isLoading } = useQuery(queryConfig);
 
   const options = useMemo(() => {
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/hooks/use_investigation_fields.test.ts b/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/hooks/use_investigation_fields.test.ts
index 6a159f87d89d8b..597d44f47f0d92 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/hooks/use_investigation_fields.test.ts
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/hooks/use_investigation_fields.test.ts
@@ -13,18 +13,21 @@ import { useInvestigationFields } from './use_investigation_fields';
 import { createQueryWrapperMock } from '../../../common/__mocks__/query_wrapper';
 
 import { computeIsESQLQueryAggregating } from '@kbn/securitysolution-utils';
-import { fetchFieldsFromESQL } from '@kbn/text-based-editor';
+import { getESQLQueryColumns } from '@kbn/esql-utils';
 
 jest.mock('@kbn/securitysolution-utils', () => ({
   computeIsESQLQueryAggregating: jest.fn(),
 }));
 
-jest.mock('@kbn/text-based-editor', () => ({
-  fetchFieldsFromESQL: jest.fn(),
-}));
+jest.mock('@kbn/esql-utils', () => {
+  return {
+    getESQLQueryColumns: jest.fn(),
+    getIndexPatternFromESQLQuery: jest.fn().mockReturnValue('auditbeat*'),
+  };
+});
 
 const computeIsESQLQueryAggregatingMock = computeIsESQLQueryAggregating as jest.Mock;
-const fetchFieldsFromESQLMock = fetchFieldsFromESQL as jest.Mock;
+const getESQLQueryColumnsMock = getESQLQueryColumns as jest.Mock;
 
 const { wrapper } = createQueryWrapperMock();
 
@@ -48,7 +51,7 @@ const mockEsqlDatatable = {
 describe('useInvestigationFields', () => {
   beforeEach(() => {
     jest.clearAllMocks();
-    fetchFieldsFromESQLMock.mockResolvedValue(mockEsqlDatatable);
+    getESQLQueryColumnsMock.mockResolvedValue(mockEsqlDatatable.columns);
   });
 
   it('should return loading true when esql fields still loading', () => {
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/hooks/use_investigation_fields.ts b/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/hooks/use_investigation_fields.ts
index b9b5dc1a07713f..1627bddaa82be1 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/hooks/use_investigation_fields.ts
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/hooks/use_investigation_fields.ts
@@ -5,7 +5,8 @@
  * 2.0.
  */
 import { useMemo } from 'react';
-import type { Datatable, ExpressionsStart } from '@kbn/expressions-plugin/public';
+import type { DatatableColumn } from '@kbn/expressions-plugin/public';
+import type { DataPublicPluginStart } from '@kbn/data-plugin/public';
 import type { DataViewFieldBase } from '@kbn/es-query';
 import { computeIsESQLQueryAggregating } from '@kbn/securitysolution-utils';
 
@@ -16,13 +17,13 @@ import { useKibana } from '@kbn/kibana-react-plugin/public';
 import { getEsqlQueryConfig } from '../../rule_creation/logic/get_esql_query_config';
 
 const esqlToFields = (
-  data: { error: unknown } | Datatable | undefined | null
+  columns: { error: unknown } | DatatableColumn[] | undefined | null
 ): DataViewFieldBase[] => {
-  if (data && 'error' in data) {
+  if (columns && 'error' in columns) {
     return [];
   }
 
-  const fields = (data?.columns ?? []).map(({ id, meta }) => {
+  const fields = (columns ?? []).map(({ id, meta }) => {
     return {
       name: id,
       type: meta.type,
@@ -41,11 +42,11 @@ type UseEsqlFields = (esqlQuery: string | undefined) => {
  * fetches ES|QL fields and convert them to DataViewBase fields
  */
 const useEsqlFields: UseEsqlFields = (esqlQuery) => {
-  const kibana = useKibana<{ expressions: ExpressionsStart }>();
+  const kibana = useKibana<{ data: DataPublicPluginStart }>();
 
-  const { expressions } = kibana.services;
+  const { data: dataService } = kibana.services;
 
-  const queryConfig = getEsqlQueryConfig({ esqlQuery, expressions });
+  const queryConfig = getEsqlQueryConfig({ esqlQuery, search: dataService?.search?.search });
   const { data, isLoading } = useQuery(queryConfig);
 
   const fields = useMemo(() => {
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_management/components/rule_details/rule_schedule_section.tsx b/x-pack/plugins/security_solution/public/detection_engine/rule_management/components/rule_details/rule_schedule_section.tsx
index 0d77961a5206d2..7d7579521c82d7 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_management/components/rule_details/rule_schedule_section.tsx
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_management/components/rule_details/rule_schedule_section.tsx
@@ -8,6 +8,7 @@
 import React from 'react';
 import { EuiDescriptionList, EuiText } from '@elastic/eui';
 import type { EuiDescriptionListProps } from '@elastic/eui';
+import { IntervalAbbrScreenReader } from '../../../../common/components/accessibility';
 import type { RuleResponse } from '../../../../../common/api/detection_engine/model/rule_schema';
 import { getHumanizedDuration } from '../../../../detections/pages/detection_engine/rules/helpers';
 import { DEFAULT_DESCRIPTION_LIST_COLUMN_WIDTHS } from './constants';
@@ -19,7 +20,7 @@ interface IntervalProps {
 
 const Interval = ({ interval }: IntervalProps) => (
   <EuiText size="s" data-test-subj="intervalPropertyValue">
-    {interval}
+    <IntervalAbbrScreenReader interval={interval} />
   </EuiText>
 );
 
@@ -30,7 +31,7 @@ interface FromProps {
 
 const From = ({ from, interval }: FromProps) => (
   <EuiText size="s" data-test-subj={`fromPropertyValue-${from}`}>
-    {getHumanizedDuration(from, interval)}
+    <IntervalAbbrScreenReader interval={getHumanizedDuration(from, interval)} />
   </EuiText>
 );
 
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_by_type_panel/columns.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_by_type_panel/columns.tsx
index 150a11d8f98884..5266a51804168e 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_by_type_panel/columns.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_by_type_panel/columns.tsx
@@ -8,6 +8,7 @@ import React from 'react';
 import { EuiHealth, EuiText } from '@elastic/eui';
 import { ALERT_RULE_NAME } from '@kbn/rule-data-utils';
 import type { EuiBasicTableColumn } from '@elastic/eui';
+import { TableId } from '@kbn/securitysolution-data-table';
 import {
   SecurityCellActions,
   CellActionsMode,
@@ -41,6 +42,7 @@ export const getAlertsTypeTableColumns = (
           queryValue={rule}
           tooltipContent={null}
           truncate={true}
+          scopeId={TableId.alertsOnAlertsPage}
         />
       </EuiText>
     ),
@@ -66,7 +68,10 @@ export const getAlertsTypeTableColumns = (
                       field: 'event.type',
                     }}
                     sourcererScopeId={SourcererScopeName.detections}
-                    metadata={{ negateFilters: type === 'Detection' }} // Detection: event.type != denied
+                    metadata={{
+                      negateFilters: type === 'Detection', // Detection: event.type != denied
+                      scopeId: TableId.alertsOnAlertsPage,
+                    }}
                   >
                     {ALERT_TYPE_LABEL[type as AlertType]}
                   </SecurityCellActions>
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_count_panel/columns.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_count_panel/columns.tsx
index 7dfb3170e43e06..938afdbd97afb2 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_count_panel/columns.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_count_panel/columns.tsx
@@ -9,6 +9,7 @@ import React from 'react';
 import type { EuiBasicTableColumn } from '@elastic/eui';
 import numeral from '@elastic/numeral';
 
+import { TableId } from '@kbn/securitysolution-data-table';
 import type { FlattenedBucket } from '../../../../common/components/alerts_treemap/types';
 import { DefaultDraggable } from '../../../../common/components/draggables';
 import type { GenericBuckets } from '../../../../../common/search_strategy/common';
@@ -35,6 +36,7 @@ export const getSingleGroupByAlertsCountTableColumns = ({
           id={`alert-count-draggable-stackByField0-${stackByField0}-${value}`}
           value={value}
           tooltipContent={null}
+          scopeId={TableId.alertsOnAlertsPage}
         />
       );
     },
@@ -73,6 +75,7 @@ export const getMultiGroupAlertsCountTableColumns = ({
           id={`alert-count-draggable-stackByField0-${stackByField0}-${stackByField1}-${value}`}
           value={value}
           tooltipContent={null}
+          scopeId={TableId.alertsOnAlertsPage}
         />
       );
     },
@@ -91,6 +94,7 @@ export const getMultiGroupAlertsCountTableColumns = ({
           id={`alert-count-draggable-stackByField1-${stackByField0}-${stackByField1}-${value}`}
           value={value}
           tooltipContent={null}
+          scopeId={TableId.alertsOnAlertsPage}
         />
       );
     },
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_progress_bar_panel/alerts_progress_bar.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_progress_bar_panel/alerts_progress_bar.tsx
index ba4c7952147643..1776c9d5fc9ccf 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_progress_bar_panel/alerts_progress_bar.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_progress_bar_panel/alerts_progress_bar.tsx
@@ -18,6 +18,7 @@ import {
 } from '@elastic/eui';
 import React, { useState } from 'react';
 import styled from 'styled-components';
+import { TableId } from '@kbn/securitysolution-data-table';
 import type { AlertsProgressBarData, GroupBySelection } from './types';
 import type { AddFilterProps } from '../common/types';
 import { getAggregateData } from './helpers';
@@ -103,6 +104,7 @@ export const AlertsProgressBar: React.FC<AlertsProcessBarProps> = ({
         value={key}
         queryValue={key}
         tooltipContent={null}
+        scopeId={TableId.alertsOnAlertsPage}
       >
         <EuiText size="xs" className="eui-textTruncate">
           {key}
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/severity_level_panel/columns.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/severity_level_panel/columns.tsx
index 8593c12874206c..3e9f7eea4fbf83 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/severity_level_panel/columns.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/severity_level_panel/columns.tsx
@@ -10,6 +10,7 @@ import { capitalize } from 'lodash';
 import { ALERT_SEVERITY } from '@kbn/rule-data-utils';
 import type { EuiBasicTableColumn } from '@elastic/eui';
 import type { Severity } from '@kbn/securitysolution-io-ts-alerting-types';
+import { TableId } from '@kbn/securitysolution-data-table';
 import type { SeverityBuckets as SeverityData } from '../../../../overview/components/detection_response/alerts_by_status/types';
 import { DefaultDraggable } from '../../../../common/components/draggables';
 import { SEVERITY_COLOR } from '../../../../overview/components/detection_response/utils';
@@ -32,6 +33,7 @@ export const getSeverityTableColumns = (): Array<EuiBasicTableColumn<SeverityDat
           value={capitalize(severity)}
           queryValue={severity}
           tooltipContent={null}
+          scopeId={TableId.alertsOnAlertsPage}
         />
       </EuiHealth>
     ),
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/investigate_in_resolver.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/investigate_in_resolver.tsx
index 553abf36e2d5c8..f16a2c98311ffa 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/investigate_in_resolver.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/investigate_in_resolver.tsx
@@ -17,10 +17,12 @@ export const useIsInvestigateInResolverActionEnabled = (ecsData?: Ecs) => {
   const crowdstrikeDataInAnalyzerEnabled = useIsExperimentalFeatureEnabled(
     'crowdstrikeDataInAnalyzerEnabled'
   );
+  const jamfDataInAnalyzerEnabled = useIsExperimentalFeatureEnabled('jamfDataInAnalyzerEnabled');
   return useMemo(() => {
     const fileBeatModules = [
       ...(sentinelOneDataInAnalyzerEnabled ? ['sentinel_one_cloud_funnel', 'sentinel_one'] : []),
       ...(crowdstrikeDataInAnalyzerEnabled ? ['crowdstrike'] : []),
+      ...(jamfDataInAnalyzerEnabled ? ['jamf_protect'] : []),
     ] as const;
 
     const agentType = get(['agent', 'type', 0], ecsData);
@@ -40,5 +42,10 @@ export const useIsInvestigateInResolverActionEnabled = (ecsData?: Ecs) => {
       processEntityIds != null && processEntityIds.length === 1 && firstProcessEntityId !== '';
 
     return isAcceptedAgentType && hasProcessEntityId;
-  }, [crowdstrikeDataInAnalyzerEnabled, ecsData, sentinelOneDataInAnalyzerEnabled]);
+  }, [
+    crowdstrikeDataInAnalyzerEnabled,
+    ecsData,
+    sentinelOneDataInAnalyzerEnabled,
+    jamfDataInAnalyzerEnabled,
+  ]);
 };
diff --git a/x-pack/plugins/security_solution/public/detections/hooks/trigger_actions_alert_table/use_cell_actions.tsx b/x-pack/plugins/security_solution/public/detections/hooks/trigger_actions_alert_table/use_cell_actions.tsx
index f1d1de98a0ea3a..af9a21599ea0dc 100644
--- a/x-pack/plugins/security_solution/public/detections/hooks/trigger_actions_alert_table/use_cell_actions.tsx
+++ b/x-pack/plugins/security_solution/public/detections/hooks/trigger_actions_alert_table/use_cell_actions.tsx
@@ -11,7 +11,7 @@ import { useCallback, useMemo } from 'react';
 import { TableId, tableDefaults, dataTableSelectors } from '@kbn/securitysolution-data-table';
 import type { UseDataGridColumnsSecurityCellActionsProps } from '../../../common/components/cell_actions';
 import { useDataGridColumnsSecurityCellActions } from '../../../common/components/cell_actions';
-import { SecurityCellActionsTrigger, SecurityCellActionType } from '../../../actions/constants';
+import { SecurityCellActionsTrigger, SecurityCellActionType } from '../../../app/actions/constants';
 import { VIEW_SELECTION } from '../../../../common/constants';
 import { SourcererScopeName } from '../../../common/store/sourcerer/model';
 import { useShallowEqualSelector } from '../../../common/hooks/use_selector';
diff --git a/x-pack/plugins/security_solution/public/entity_analytics/api/api.ts b/x-pack/plugins/security_solution/public/entity_analytics/api/api.ts
index fb14efde91a267..225ae72c576160 100644
--- a/x-pack/plugins/security_solution/public/entity_analytics/api/api.ts
+++ b/x-pack/plugins/security_solution/public/entity_analytics/api/api.ts
@@ -6,6 +6,10 @@
  */
 
 import { useMemo } from 'react';
+import type {
+  RiskScoresEntityCalculationRequest,
+  RiskScoresEntityCalculationResponse,
+} from '../../../common/api/entity_analytics/risk_engine/entity_calculation_route.gen';
 import type { AssetCriticalityCsvUploadResponse } from '../../../common/entity_analytics/asset_criticality/types';
 import type { AssetCriticalityRecord } from '../../../common/api/entity_analytics/asset_criticality';
 import type { RiskScoreEntity } from '../../../common/search_strategy';
@@ -21,6 +25,7 @@ import {
   RISK_SCORE_INDEX_STATUS_API_URL,
   RISK_ENGINE_SETTINGS_URL,
   ASSET_CRITICALITY_CSV_UPLOAD_URL,
+  RISK_SCORE_ENTITY_CALCULATION_URL,
 } from '../../../common/constants';
 
 import type {
@@ -97,6 +102,17 @@ export const useEntityAnalyticsRoutes = () => {
         method: 'POST',
       });
 
+    /**
+     * Calculate and stores risk score for an entity
+     */
+    const calculateEntityRiskScore = (params: RiskScoresEntityCalculationRequest) => {
+      return http.fetch<RiskScoresEntityCalculationResponse>(RISK_SCORE_ENTITY_CALCULATION_URL, {
+        version: '1',
+        method: 'POST',
+        body: JSON.stringify(params),
+      });
+    };
+
     /**
      * Get risk engine privileges
      */
@@ -119,7 +135,9 @@ export const useEntityAnalyticsRoutes = () => {
      * Create asset criticality
      */
     const createAssetCriticality = async (
-      params: Pick<AssetCriticality, 'idField' | 'idValue' | 'criticalityLevel'>
+      params: Pick<AssetCriticality, 'idField' | 'idValue' | 'criticalityLevel'> & {
+        refresh?: 'wait_for';
+      }
     ): Promise<AssetCriticalityRecord> =>
       http.fetch<AssetCriticalityRecord>(ASSET_CRITICALITY_URL, {
         version: '1',
@@ -128,16 +146,17 @@ export const useEntityAnalyticsRoutes = () => {
           id_value: params.idValue,
           id_field: params.idField,
           criticality_level: params.criticalityLevel,
+          refresh: params.refresh,
         }),
       });
 
     const deleteAssetCriticality = async (
-      params: Pick<AssetCriticality, 'idField' | 'idValue'>
+      params: Pick<AssetCriticality, 'idField' | 'idValue'> & { refresh?: 'wait_for' }
     ): Promise<{ deleted: true }> => {
       await http.fetch(ASSET_CRITICALITY_URL, {
         version: '1',
         method: 'DELETE',
-        query: { id_value: params.idValue, id_field: params.idField },
+        query: { id_value: params.idValue, id_field: params.idField, refresh: params.refresh },
       });
 
       // spoof a response to allow us to better distnguish a delete from a create in use_asset_criticality.ts
@@ -219,6 +238,7 @@ export const useEntityAnalyticsRoutes = () => {
       uploadAssetCriticalityFile,
       getRiskScoreIndexStatus,
       fetchRiskEngineSettings,
+      calculateEntityRiskScore,
     };
   }, [http]);
 };
diff --git a/x-pack/plugins/security_solution/public/entity_analytics/api/hooks/use_calculate_entity_risk_score.test.ts b/x-pack/plugins/security_solution/public/entity_analytics/api/hooks/use_calculate_entity_risk_score.test.ts
new file mode 100644
index 00000000000000..106fb9404372d4
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/entity_analytics/api/hooks/use_calculate_entity_risk_score.test.ts
@@ -0,0 +1,103 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { act, renderHook } from '@testing-library/react-hooks';
+import { TestProviders } from '../../../common/mock';
+import { RiskScoreEntity } from '../../../../common/search_strategy';
+import { useCalculateEntityRiskScore } from './use_calculate_entity_risk_score';
+import { RiskEngineStatus } from '../../../../common/entity_analytics/risk_engine';
+import { waitFor } from '@testing-library/react';
+
+const enabledRiskEngineStatus = {
+  risk_engine_status: RiskEngineStatus.ENABLED,
+};
+const disabledRiskEngineStatus = {
+  risk_engine_status: RiskEngineStatus.DISABLED,
+};
+
+const mockUseRiskEngineStatus = jest.fn();
+jest.mock('./use_risk_engine_status', () => ({
+  useRiskEngineStatus: () => mockUseRiskEngineStatus(),
+}));
+
+const mockCalculateEntityRiskScore = jest.fn();
+jest.mock('../api', () => ({
+  useEntityAnalyticsRoutes: () => ({
+    calculateEntityRiskScore: mockCalculateEntityRiskScore,
+  }),
+}));
+
+const mockAddError = jest.fn();
+jest.mock('../../../common/hooks/use_app_toasts', () => ({
+  useAppToasts: jest.fn().mockReturnValue({
+    addError: () => mockAddError(),
+  }),
+}));
+
+const identifierType = RiskScoreEntity.user;
+const identifier = 'test-user';
+const options = {
+  onSuccess: jest.fn(),
+};
+
+describe('useRiskScoreData', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mockUseRiskEngineStatus.mockReturnValue({ data: enabledRiskEngineStatus });
+    mockCalculateEntityRiskScore.mockResolvedValue({});
+  });
+
+  it('should call calculateEntityRiskScore API when the callback function is called', async () => {
+    const { result } = renderHook(
+      () => useCalculateEntityRiskScore(identifierType, identifier, options),
+      { wrapper: TestProviders }
+    );
+
+    await act(async () => {
+      result.current.calculateEntityRiskScore();
+
+      await waitFor(() =>
+        expect(mockCalculateEntityRiskScore).toHaveBeenCalledWith(
+          expect.objectContaining({
+            identifier_type: identifierType,
+            identifier,
+          })
+        )
+      );
+    });
+  });
+
+  it('should NOT call calculateEntityRiskScore API when risk engine is disabled', async () => {
+    mockUseRiskEngineStatus.mockReturnValue({
+      data: disabledRiskEngineStatus,
+    });
+    const { result } = renderHook(
+      () => useCalculateEntityRiskScore(identifierType, identifier, options),
+      { wrapper: TestProviders }
+    );
+
+    await act(async () => {
+      result.current.calculateEntityRiskScore();
+
+      await waitFor(() => expect(mockCalculateEntityRiskScore).not.toHaveBeenCalled());
+    });
+  });
+
+  it('should display a toast error when the API returns an error', async () => {
+    mockCalculateEntityRiskScore.mockRejectedValue({});
+    const { result } = renderHook(
+      () => useCalculateEntityRiskScore(identifierType, identifier, options),
+      { wrapper: TestProviders }
+    );
+
+    await act(async () => {
+      result.current.calculateEntityRiskScore();
+
+      await waitFor(() => expect(mockAddError).toHaveBeenCalled());
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/entity_analytics/api/hooks/use_calculate_entity_risk_score.ts b/x-pack/plugins/security_solution/public/entity_analytics/api/hooks/use_calculate_entity_risk_score.ts
new file mode 100644
index 00000000000000..ff1eb5c46a7023
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/entity_analytics/api/hooks/use_calculate_entity_risk_score.ts
@@ -0,0 +1,58 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { useCallback } from 'react';
+
+import { i18n } from '@kbn/i18n';
+import { useMutation } from '@tanstack/react-query';
+import { useEntityAnalyticsRoutes } from '../api';
+import { useAppToasts } from '../../../common/hooks/use_app_toasts';
+import { useRiskEngineStatus } from './use_risk_engine_status';
+import { RiskScoreEntity, RiskEngineStatus } from '../../../../common/entity_analytics/risk_engine';
+
+export const useCalculateEntityRiskScore = (
+  identifierType: RiskScoreEntity,
+  identifier: string,
+  { onSuccess }: { onSuccess: () => void }
+) => {
+  const { addError } = useAppToasts();
+  const { data: riskEngineStatus } = useRiskEngineStatus();
+  const { calculateEntityRiskScore } = useEntityAnalyticsRoutes();
+
+  const onError = useCallback(
+    (error: unknown) => {
+      addError(error, {
+        title: i18n.translate('xpack.securitySolution.entityDetails.userPanel.error', {
+          defaultMessage: 'There was a problem calculating the {entity} risk score',
+          values: { entity: identifierType === RiskScoreEntity.host ? "host's" : "user's" },
+        }),
+      });
+    },
+    [addError, identifierType]
+  );
+
+  const { mutate, isLoading, data } = useMutation(calculateEntityRiskScore, {
+    onSuccess,
+    onError,
+  });
+
+  const calculateEntityRiskScoreCb = useCallback(async () => {
+    if (riskEngineStatus?.risk_engine_status === RiskEngineStatus.ENABLED) {
+      mutate({
+        identifier_type: identifierType,
+        identifier,
+        refresh: 'wait_for',
+      });
+    }
+  }, [riskEngineStatus?.risk_engine_status, mutate, identifierType, identifier]);
+
+  return {
+    isLoading,
+    calculateEntityRiskScore: calculateEntityRiskScoreCb,
+    data,
+  };
+};
diff --git a/x-pack/plugins/security_solution/public/entity_analytics/api/hooks/use_refetch_overview_page_risk_score.ts b/x-pack/plugins/security_solution/public/entity_analytics/api/hooks/use_refetch_overview_page_risk_score.ts
new file mode 100644
index 00000000000000..bf0c3db69b53c7
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/entity_analytics/api/hooks/use_refetch_overview_page_risk_score.ts
@@ -0,0 +1,27 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { TableId } from '@kbn/securitysolution-data-table';
+import { useCallback } from 'react';
+import type { Refetch } from '../../../common/types';
+import { useRefetchQueryById } from './use_refetch_query_by_id';
+
+export const useRefetchOverviewPageRiskScore = (overviewRiskScoreQueryId: string) => {
+  const refetchOverviewRiskScore = useRefetchQueryById(overviewRiskScoreQueryId);
+  const refetchAlertsRiskInputs = useRefetchQueryById(TableId.alertsRiskInputs);
+
+  const refetchRiskScore = useCallback(() => {
+    if (refetchOverviewRiskScore) {
+      (refetchOverviewRiskScore as Refetch)();
+    }
+
+    if (refetchAlertsRiskInputs) {
+      (refetchAlertsRiskInputs as Refetch)();
+    }
+  }, [refetchAlertsRiskInputs, refetchOverviewRiskScore]);
+  return refetchRiskScore;
+};
diff --git a/x-pack/plugins/security_solution/public/entity_analytics/api/hooks/use_refetch_query_by_id.ts b/x-pack/plugins/security_solution/public/entity_analytics/api/hooks/use_refetch_query_by_id.ts
new file mode 100644
index 00000000000000..331855560da7c9
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/entity_analytics/api/hooks/use_refetch_query_by_id.ts
@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { useMemo } from 'react';
+import { useDeepEqualSelector } from '../../../common/hooks/use_selector';
+import { inputsSelectors } from '../../../common/store';
+
+export const useRefetchQueryById = (QueryId: string) => {
+  const getGlobalQuery = useMemo(() => inputsSelectors.globalQueryByIdSelector(), []);
+  const { refetch } = useDeepEqualSelector((state) => getGlobalQuery(state, QueryId));
+  return refetch;
+};
diff --git a/x-pack/plugins/security_solution/public/entity_analytics/common/utils.ts b/x-pack/plugins/security_solution/public/entity_analytics/common/utils.ts
index 69080b13631e38..3756780e18ae6e 100644
--- a/x-pack/plugins/security_solution/public/entity_analytics/common/utils.ts
+++ b/x-pack/plugins/security_solution/public/entity_analytics/common/utils.ts
@@ -63,3 +63,8 @@ export enum HostRiskScoreQueryId {
  */
 export const formatRiskScore = (riskScore: number) =>
   (Math.round(riskScore * 100) / 100).toFixed(2);
+
+export const FIRST_RECORD_PAGINATION = {
+  cursorStart: 0,
+  querySize: 1,
+};
diff --git a/x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality/asset_criticality_selector.tsx b/x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality/asset_criticality_selector.tsx
index 587ef695ff94cd..e29dca9d48f3d2 100644
--- a/x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality/asset_criticality_selector.tsx
+++ b/x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality/asset_criticality_selector.tsx
@@ -39,10 +39,14 @@ import { PICK_ASSET_CRITICALITY } from './translations';
 import { AssetCriticalityBadge } from './asset_criticality_badge';
 import type { Entity, State } from './use_asset_criticality';
 import { useAssetCriticalityData, useAssetCriticalityPrivileges } from './use_asset_criticality';
-import type { CriticalityLevelWithUnassigned } from '../../../../common/entity_analytics/asset_criticality/types';
+import type {
+  CriticalityLevel,
+  CriticalityLevelWithUnassigned,
+} from '../../../../common/entity_analytics/asset_criticality/types';
 
 interface Props {
   entity: Entity;
+  onChange?: () => void;
 }
 const AssetCriticalitySelectorComponent: React.FC<{
   criticality: State;
@@ -52,6 +56,15 @@ const AssetCriticalitySelectorComponent: React.FC<{
   const [visible, toggleModal] = useToggle(false);
   const sFontSize = useEuiFontSize('s').fontSize;
 
+  const onSave = (value: CriticalityLevelWithUnassigned) => {
+    criticality.mutation.mutate({
+      criticalityLevel: value,
+      idField: `${entity.type}.name`,
+      idValue: entity.name,
+    });
+    toggleModal(false);
+  };
+
   return (
     <>
       {criticality.query.isLoading || criticality.mutation.isLoading ? (
@@ -121,7 +134,11 @@ const AssetCriticalitySelectorComponent: React.FC<{
         </EuiFlexGroup>
       )}
       {visible ? (
-        <AssetCriticalityModal entity={entity} criticality={criticality} toggle={toggleModal} />
+        <AssetCriticalityModal
+          onSave={onSave}
+          initialCriticalityLevel={criticality.query.data?.criticality_level}
+          toggle={toggleModal}
+        />
       ) : null}
     </>
   );
@@ -130,12 +147,13 @@ const AssetCriticalitySelectorComponent: React.FC<{
 export const AssetCriticalitySelector = React.memo(AssetCriticalitySelectorComponent);
 AssetCriticalitySelector.displayName = 'AssetCriticalitySelector';
 
-const AssetCriticalityAccordionComponent: React.FC<Props> = ({ entity }) => {
+const AssetCriticalityAccordionComponent: React.FC<Props> = ({ entity, onChange }) => {
   const { euiTheme } = useEuiTheme();
   const privileges = useAssetCriticalityPrivileges(entity.name);
   const criticality = useAssetCriticalityData({
     entity,
     enabled: !!privileges.data?.has_read_permissions,
+    onChange,
   });
 
   if (privileges.isLoading || !privileges.data?.has_read_permissions) {
@@ -191,15 +209,19 @@ export const AssetCriticalityTitle = () => (
 );
 
 interface ModalProps {
-  criticality: State;
+  initialCriticalityLevel: CriticalityLevel | undefined;
   toggle: (nextValue: boolean) => void;
-  entity: Entity;
+  onSave: (value: CriticalityLevelWithUnassigned) => void;
 }
 
-const AssetCriticalityModal: React.FC<ModalProps> = ({ criticality, entity, toggle }) => {
+const AssetCriticalityModal: React.FC<ModalProps> = ({
+  initialCriticalityLevel,
+  toggle,
+  onSave,
+}) => {
   const basicSelectId = useGeneratedHtmlId({ prefix: 'basicSelect' });
   const [value, setNewValue] = useState<CriticalityLevelWithUnassigned>(
-    criticality.query.data?.criticality_level ?? 'unassigned'
+    initialCriticalityLevel ?? 'unassigned'
   );
 
   return (
@@ -228,14 +250,7 @@ const AssetCriticalityModal: React.FC<ModalProps> = ({ criticality, entity, togg
         </EuiButtonEmpty>
 
         <EuiButton
-          onClick={() => {
-            criticality.mutation.mutate({
-              criticalityLevel: value,
-              idField: `${entity.type}.name`,
-              idValue: entity.name,
-            });
-            toggle(false);
-          }}
+          onClick={() => onSave(value)}
           fill
           data-test-subj="asset-criticality-modal-save-btn"
         >
diff --git a/x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality/use_asset_criticality.ts b/x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality/use_asset_criticality.ts
index 403ca5c656bf03..c56b394236326b 100644
--- a/x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality/use_asset_criticality.ts
+++ b/x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality/use_asset_criticality.ts
@@ -46,9 +46,11 @@ export const useAssetCriticalityPrivileges = (
 export const useAssetCriticalityData = ({
   entity,
   enabled = true,
+  onChange,
 }: {
   entity: Entity;
   enabled?: boolean;
+  onChange?: () => void;
 }): State => {
   const QC = useQueryClient();
   const QUERY_KEY = [ASSET_CRITICALITY_KEY, entity.name];
@@ -71,18 +73,24 @@ export const useAssetCriticalityData = ({
   >({
     mutationFn: (params: Params) => {
       if (params.criticalityLevel === 'unassigned') {
-        return deleteAssetCriticality({ idField: params.idField, idValue: params.idValue });
+        return deleteAssetCriticality({
+          idField: params.idField,
+          idValue: params.idValue,
+          refresh: 'wait_for',
+        });
       }
 
       return createAssetCriticality({
         idField: params.idField,
         idValue: params.idValue,
         criticalityLevel: params.criticalityLevel,
+        refresh: 'wait_for',
       });
     },
     onSuccess: (data) => {
       const queryData = 'deleted' in data ? null : data;
       QC.setQueryData(QUERY_KEY, queryData);
+      onChange?.();
     },
   });
 
diff --git a/x-pack/plugins/security_solution/public/entity_analytics/components/entity_analytics_risk_score/index.test.tsx b/x-pack/plugins/security_solution/public/entity_analytics/components/entity_analytics_risk_score/index.test.tsx
index 8f468f4c13e13a..5893fb803342cc 100644
--- a/x-pack/plugins/security_solution/public/entity_analytics/components/entity_analytics_risk_score/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/entity_analytics/components/entity_analytics_risk_score/index.test.tsx
@@ -69,8 +69,6 @@ jest.mock('../../../common/hooks/use_navigate_to_alerts_page_with_filters', () =
   };
 });
 
-jest.mock('../../../common/components/hover_actions', () => ({ HoverActions: () => null }));
-
 const mockOpenRightPanel = jest.fn();
 jest.mock('@kbn/expandable-flyout', () => {
   return {
diff --git a/x-pack/plugins/security_solution/public/entity_analytics/components/entity_details_flyout/tabs/risk_inputs/risk_inputs_tab.tsx b/x-pack/plugins/security_solution/public/entity_analytics/components/entity_details_flyout/tabs/risk_inputs/risk_inputs_tab.tsx
index 80b425bec15bba..48f004cbd70693 100644
--- a/x-pack/plugins/security_solution/public/entity_analytics/components/entity_details_flyout/tabs/risk_inputs/risk_inputs_tab.tsx
+++ b/x-pack/plugins/security_solution/public/entity_analytics/components/entity_details_flyout/tabs/risk_inputs/risk_inputs_tab.tsx
@@ -14,6 +14,8 @@ import { useUiSetting$ } from '@kbn/kibana-react-plugin/public';
 import { ALERT_RULE_NAME } from '@kbn/rule-data-utils';
 
 import { get } from 'lodash/fp';
+import { useGlobalTime } from '../../../../../common/containers/use_global_time';
+import { useQueryInspector } from '../../../../../common/components/page/manage_query';
 import { formatRiskScore } from '../../../../common';
 import type {
   InputAlert,
@@ -45,7 +47,10 @@ const FIRST_RECORD_PAGINATION = {
   querySize: 1,
 };
 
+export const RISK_INPUTS_TAB_QUERY_ID = 'RiskInputsTabQuery';
+
 export const RiskInputsTab = ({ entityType, entityName }: RiskInputsTabProps) => {
+  const { setQuery, deleteQuery } = useGlobalTime();
   const [selectedItems, setSelectedItems] = useState<InputAlert[]>([]);
 
   const nameFilterQuery = useMemo(() => {
@@ -60,6 +65,8 @@ export const RiskInputsTab = ({ entityType, entityName }: RiskInputsTabProps) =>
     data: riskScoreData,
     error: riskScoreError,
     loading: loadingRiskScore,
+    inspect: inspectRiskScore,
+    refetch,
   } = useRiskScore({
     riskEntity: entityType,
     filterQuery: nameFilterQuery,
@@ -68,6 +75,15 @@ export const RiskInputsTab = ({ entityType, entityName }: RiskInputsTabProps) =>
     skip: nameFilterQuery === undefined,
   });
 
+  useQueryInspector({
+    deleteQuery,
+    inspect: inspectRiskScore,
+    loading: loadingRiskScore,
+    queryId: RISK_INPUTS_TAB_QUERY_ID,
+    refetch,
+    setQuery,
+  });
+
   const riskScore = riskScoreData && riskScoreData.length > 0 ? riskScoreData[0] : undefined;
 
   const alerts = useRiskContributingAlerts({ riskScore });
diff --git a/x-pack/plugins/security_solution/public/entity_analytics/components/risk_summary_flyout/risk_summary.stories.tsx b/x-pack/plugins/security_solution/public/entity_analytics/components/risk_summary_flyout/risk_summary.stories.tsx
index cece761cd9d6fc..b48629cbbe26f6 100644
--- a/x-pack/plugins/security_solution/public/entity_analytics/components/risk_summary_flyout/risk_summary.stories.tsx
+++ b/x-pack/plugins/security_solution/public/entity_analytics/components/risk_summary_flyout/risk_summary.stories.tsx
@@ -26,6 +26,7 @@ export const Default: Story<void> = () => {
             openDetailsPanel={() => {}}
             riskScoreData={{ ...mockRiskScoreState, data: [] }}
             queryId={'testQuery'}
+            recalculatingScore={false}
           />
         </div>
       </TestProvider>
diff --git a/x-pack/plugins/security_solution/public/entity_analytics/components/risk_summary_flyout/risk_summary.test.tsx b/x-pack/plugins/security_solution/public/entity_analytics/components/risk_summary_flyout/risk_summary.test.tsx
index c7debcdbdc9656..56a84c340dee34 100644
--- a/x-pack/plugins/security_solution/public/entity_analytics/components/risk_summary_flyout/risk_summary.test.tsx
+++ b/x-pack/plugins/security_solution/public/entity_analytics/components/risk_summary_flyout/risk_summary.test.tsx
@@ -49,6 +49,7 @@ describe('RiskSummary', () => {
           riskScoreData={mockHostRiskScoreState}
           queryId={'testQuery'}
           openDetailsPanel={() => {}}
+          recalculatingScore={false}
         />
       </TestProviders>
     );
@@ -79,6 +80,7 @@ describe('RiskSummary', () => {
           riskScoreData={mockHostRiskScoreState}
           queryId={'testQuery'}
           openDetailsPanel={() => {}}
+          recalculatingScore={false}
         />
       </TestProviders>
     );
@@ -110,12 +112,28 @@ describe('RiskSummary', () => {
           riskScoreData={{ ...mockHostRiskScoreState, data: undefined }}
           queryId={'testQuery'}
           openDetailsPanel={() => {}}
+          recalculatingScore={false}
         />
       </TestProviders>
     );
     expect(getByTestId('risk-summary-table')).toBeInTheDocument();
   });
 
+  it('risk summary header does not render link when riskScoreData is loading', () => {
+    const { queryByTestId } = render(
+      <TestProviders>
+        <RiskSummary
+          riskScoreData={{ ...mockHostRiskScoreState, data: undefined, loading: true }}
+          queryId={'testQuery'}
+          openDetailsPanel={() => {}}
+          recalculatingScore={false}
+        />
+      </TestProviders>
+    );
+
+    expect(queryByTestId('riskInputsTitleLink')).not.toBeInTheDocument();
+  });
+
   it('renders visualization embeddable', () => {
     const { getByTestId } = render(
       <TestProviders>
@@ -123,6 +141,7 @@ describe('RiskSummary', () => {
           riskScoreData={mockHostRiskScoreState}
           queryId={'testQuery'}
           openDetailsPanel={() => {}}
+          recalculatingScore={false}
         />
       </TestProviders>
     );
@@ -137,6 +156,7 @@ describe('RiskSummary', () => {
           riskScoreData={mockHostRiskScoreState}
           queryId={'testQuery'}
           openDetailsPanel={() => {}}
+          recalculatingScore={false}
         />
       </TestProviders>
     );
@@ -151,6 +171,7 @@ describe('RiskSummary', () => {
           riskScoreData={mockHostRiskScoreState}
           queryId={'testQuery'}
           openDetailsPanel={() => {}}
+          recalculatingScore={false}
         />
       </TestProviders>
     );
@@ -177,6 +198,7 @@ describe('RiskSummary', () => {
           riskScoreData={mockHostRiskScoreState}
           queryId={'testQuery'}
           openDetailsPanel={() => {}}
+          recalculatingScore={false}
         />
       </TestProviders>
     );
@@ -198,6 +220,7 @@ describe('RiskSummary', () => {
           riskScoreData={mockUserRiskScoreState}
           queryId={'testQuery'}
           openDetailsPanel={() => {}}
+          recalculatingScore={false}
         />
       </TestProviders>
     );
@@ -219,6 +242,7 @@ describe('RiskSummary', () => {
           riskScoreData={mockUserRiskScoreState}
           queryId={'testQuery'}
           openDetailsPanel={() => {}}
+          recalculatingScore={false}
         />
       </TestProviders>
     );
diff --git a/x-pack/plugins/security_solution/public/entity_analytics/components/risk_summary_flyout/risk_summary.tsx b/x-pack/plugins/security_solution/public/entity_analytics/components/risk_summary_flyout/risk_summary.tsx
index dc3471d46254cf..b7a88353ddd4aa 100644
--- a/x-pack/plugins/security_solution/public/entity_analytics/components/risk_summary_flyout/risk_summary.tsx
+++ b/x-pack/plugins/security_solution/public/entity_analytics/components/risk_summary_flyout/risk_summary.tsx
@@ -49,12 +49,14 @@ import {
 
 export interface RiskSummaryProps<T extends RiskScoreEntity> {
   riskScoreData: RiskScoreState<T>;
+  recalculatingScore: boolean;
   queryId: string;
   openDetailsPanel: (tab: EntityDetailsLeftPanelTab) => void;
 }
 
 const RiskSummaryComponent = <T extends RiskScoreEntity>({
   riskScoreData,
+  recalculatingScore,
   queryId,
   openDetailsPanel,
 }: RiskSummaryProps<T>) => {
@@ -119,11 +121,13 @@ const RiskSummaryComponent = <T extends RiskScoreEntity>({
     [entityData?.name, riskData]
   );
 
+  const riskDataTimestamp = riskData?.['@timestamp'];
   const timerange = useMemo(() => {
     const from = dateMath.parse(LAST_30_DAYS.from)?.toISOString() ?? LAST_30_DAYS.from;
     const to = dateMath.parse(LAST_30_DAYS.to)?.toISOString() ?? LAST_30_DAYS.to;
     return { from, to };
-  }, []);
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [riskDataTimestamp]); // Update the timerange whenever the risk score timestamp changes to include new entries
 
   return (
     <EuiAccordion
@@ -182,15 +186,17 @@ const RiskSummaryComponent = <T extends RiskScoreEntity>({
               defaultMessage="View risk contributions"
             />
           ),
-          link: {
-            callback: () => openDetailsPanel(EntityDetailsLeftPanelTab.RISK_INPUTS),
-            tooltip: (
-              <FormattedMessage
-                id="xpack.securitySolution.flyout.entityDetails.showAllRiskInputs"
-                defaultMessage="Show all risk inputs"
-              />
-            ),
-          },
+          link: riskScoreData.loading
+            ? undefined
+            : {
+                callback: () => openDetailsPanel(EntityDetailsLeftPanelTab.RISK_INPUTS),
+                tooltip: (
+                  <FormattedMessage
+                    id="xpack.securitySolution.flyout.entityDetails.showAllRiskInputs"
+                    defaultMessage="Show all risk inputs"
+                  />
+                ),
+              },
           iconType: 'arrowStart',
         }}
         expand={{
@@ -265,6 +271,7 @@ const RiskSummaryComponent = <T extends RiskScoreEntity>({
                   columns={columns}
                   items={rows}
                   compressed
+                  loading={riskScoreData.loading || recalculatingScore}
                 />
               </div>
             </InspectButtonContainer>
diff --git a/x-pack/plugins/security_solution/public/entity_analytics/components/severity/common/index.tsx b/x-pack/plugins/security_solution/public/entity_analytics/components/severity/common/index.tsx
index 2b498fdca79ac4..e010c3bd421698 100644
--- a/x-pack/plugins/security_solution/public/entity_analytics/components/severity/common/index.tsx
+++ b/x-pack/plugins/security_solution/public/entity_analytics/components/severity/common/index.tsx
@@ -13,7 +13,7 @@ import styled, { css } from 'styled-components';
 import { euiLightVars } from '@kbn/ui-theme';
 
 import { RISK_SEVERITY_COLOUR } from '../../../common/utils';
-import { WithHoverActions } from '../../../../common/components/with_hover_actions';
+import { HoverPopover } from '../../../../common/components/hover_popover';
 import type { RiskSeverity } from '../../../../../common/search_strategy';
 
 const RiskBadge = styled.div<{ $severity: RiskSeverity; $hideBackgroundColor: boolean }>`
@@ -39,34 +39,47 @@ export const RiskScoreLevel: React.FC<{
   hideBackgroundColor?: boolean;
   toolTipContent?: JSX.Element;
   ['data-test-subj']?: string;
-}> = ({
-  severity,
-  hideBackgroundColor = false,
-  toolTipContent,
-  'data-test-subj': dataTestSubj,
-}) => {
-  const badge = (
-    <RiskBadge
-      color={euiLightVars.euiColorDanger}
-      $severity={severity}
-      $hideBackgroundColor={hideBackgroundColor}
-      data-test-subj={dataTestSubj ?? 'risk-score'}
-    >
-      <EuiTextColor color="default">
-        <EuiHealth className="eui-alignMiddle" color={RISK_SEVERITY_COLOUR[severity]}>
-          {severity}
-        </EuiHealth>
-      </EuiTextColor>
-    </RiskBadge>
-  );
+}> = React.memo(
+  ({ severity, hideBackgroundColor = false, toolTipContent, 'data-test-subj': dataTestSubj }) => {
+    if (toolTipContent != null) {
+      return (
+        <HoverPopover hoverContent={<TooltipContainer>{toolTipContent}</TooltipContainer>}>
+          <RiskScoreBadge
+            severity={severity}
+            hideBackgroundColor={hideBackgroundColor}
+            data-test-subj={dataTestSubj}
+          />
+        </HoverPopover>
+      );
+    }
 
-  if (toolTipContent != null) {
     return (
-      <WithHoverActions
-        hoverContent={<TooltipContainer>{toolTipContent}</TooltipContainer>}
-        render={() => badge}
+      <RiskScoreBadge
+        severity={severity}
+        hideBackgroundColor={hideBackgroundColor}
+        data-test-subj={dataTestSubj}
       />
     );
   }
-  return badge;
-};
+);
+RiskScoreLevel.displayName = 'RiskScoreLevel';
+
+const RiskScoreBadge: React.FC<{
+  severity: RiskSeverity;
+  hideBackgroundColor?: boolean;
+  ['data-test-subj']?: string;
+}> = React.memo(({ severity, hideBackgroundColor = false, 'data-test-subj': dataTestSubj }) => (
+  <RiskBadge
+    color={euiLightVars.euiColorDanger}
+    $severity={severity}
+    $hideBackgroundColor={hideBackgroundColor}
+    data-test-subj={dataTestSubj ?? 'risk-score'}
+  >
+    <EuiTextColor color="default">
+      <EuiHealth className="eui-alignMiddle" color={RISK_SEVERITY_COLOUR[severity]}>
+        {severity}
+      </EuiHealth>
+    </EuiTextColor>
+  </RiskBadge>
+));
+RiskScoreBadge.displayName = 'RiskScoreBadge';
diff --git a/x-pack/plugins/security_solution/public/explore/components/paginated_table/index.tsx b/x-pack/plugins/security_solution/public/explore/components/paginated_table/index.tsx
index 8c4888b9dba316..b6c1492f0dd705 100644
--- a/x-pack/plugins/security_solution/public/explore/components/paginated_table/index.tsx
+++ b/x-pack/plugins/security_solution/public/explore/components/paginated_table/index.tsx
@@ -397,6 +397,6 @@ export const PaginationEuiFlexItem = styled(EuiFlexItem)`
       right: ${({ theme }) => theme.eui.euiSizeL};
     }
   }
-`;
+` as typeof EuiFlexItem;
 
 PaginationEuiFlexItem.displayName = 'PaginationEuiFlexItem';
diff --git a/x-pack/plugins/security_solution/public/explore/hosts/pages/details/index.tsx b/x-pack/plugins/security_solution/public/explore/hosts/pages/details/index.tsx
index 08260caa4eb91b..dda6437ba783df 100644
--- a/x-pack/plugins/security_solution/public/explore/hosts/pages/details/index.tsx
+++ b/x-pack/plugins/security_solution/public/explore/hosts/pages/details/index.tsx
@@ -20,6 +20,7 @@ import type { Filter } from '@kbn/es-query';
 import { buildEsQuery } from '@kbn/es-query';
 import { getEsQueryConfig } from '@kbn/data-plugin/common';
 import { tableDefaults, dataTableSelectors, TableId } from '@kbn/securitysolution-data-table';
+import { useCalculateEntityRiskScore } from '../../../../entity_analytics/api/hooks/use_calculate_entity_risk_score';
 import {
   useAssetCriticalityData,
   useAssetCriticalityPrivileges,
@@ -33,7 +34,7 @@ import { useSignalIndex } from '../../../../detections/containers/detection_engi
 import { useAlertsPrivileges } from '../../../../detections/containers/detection_engine/alerts/use_alerts_privileges';
 import { InputsModelId } from '../../../../common/store/inputs/constants';
 import type { HostItem } from '../../../../../common/search_strategy';
-import { LastEventIndexKey } from '../../../../../common/search_strategy';
+import { LastEventIndexKey, RiskScoreEntity } from '../../../../../common/search_strategy';
 import { SecurityPageName } from '../../../../app/types';
 import { FiltersGlobal } from '../../../../common/components/filters_global';
 import { HeaderPage } from '../../../../common/components/header_page';
@@ -44,7 +45,10 @@ import { hasMlUserPermissions } from '../../../../../common/machine_learning/has
 import { useMlCapabilities } from '../../../../common/components/ml/hooks/use_ml_capabilities';
 import { scoreIntervalToDateTime } from '../../../../common/components/ml/score/score_interval_to_datetime';
 import { TabNavigation } from '../../../../common/components/navigation/tab_navigation';
-import { HostOverview } from '../../../../overview/components/host_overview';
+import {
+  HostOverview,
+  HOST_OVERVIEW_RISK_SCORE_QUERY_ID,
+} from '../../../../overview/components/host_overview';
 import { SiemSearchBar } from '../../../../common/components/search_bar';
 import { SecuritySolutionPageWrapper } from '../../../../common/components/page_wrapper';
 import { useGlobalTime } from '../../../../common/containers/use_global_time';
@@ -75,6 +79,7 @@ import { AlertCountByRuleByStatus } from '../../../../common/components/alert_co
 import { useLicense } from '../../../../common/hooks/use_license';
 import { ResponderActionButton } from '../../../../detections/components/endpoint_responder/responder_action_button';
 import { useHasSecurityCapability } from '../../../../helper_hooks';
+import { useRefetchOverviewPageRiskScore } from '../../../../entity_analytics/api/hooks/use_refetch_overview_page_risk_score';
 
 const ES_HOST_FIELD = 'host.name';
 const HostOverviewManage = manageQuery(HostOverview);
@@ -175,12 +180,26 @@ const HostDetailsComponent: React.FC<HostDetailsProps> = ({ detailName, hostDeta
     [detailName]
   );
 
+  const additionalFilters = useMemo(
+    () => (rawFilteredQuery ? [rawFilteredQuery] : []),
+    [rawFilteredQuery]
+  );
+
   const entity = useMemo(() => ({ type: 'host' as const, name: detailName }), [detailName]);
   const privileges = useAssetCriticalityPrivileges(entity.name);
+
+  const refetchRiskScore = useRefetchOverviewPageRiskScore(HOST_OVERVIEW_RISK_SCORE_QUERY_ID);
+  const { calculateEntityRiskScore } = useCalculateEntityRiskScore(
+    RiskScoreEntity.host,
+    detailName,
+    { onSuccess: refetchRiskScore }
+  );
+
   const canReadAssetCriticality = !!privileges.data?.has_read_permissions;
   const criticality = useAssetCriticalityData({
     entity,
     enabled: canReadAssetCriticality,
+    onChange: calculateEntityRiskScore,
   });
 
   return (
@@ -259,14 +278,14 @@ const HostDetailsComponent: React.FC<HostDetailsProps> = ({ detailName, hostDeta
                       <AlertsByStatus
                         signalIndexName={signalIndexName}
                         entityFilter={entityFilter}
-                        additionalFilters={rawFilteredQuery ? [rawFilteredQuery] : []}
+                        additionalFilters={additionalFilters}
                       />
                     </EuiFlexItem>
                     <EuiFlexItem>
                       <AlertCountByRuleByStatus
                         entityFilter={entityFilter}
                         signalIndexName={signalIndexName}
-                        additionalFilters={rawFilteredQuery ? [rawFilteredQuery] : []}
+                        additionalFilters={additionalFilters}
                       />
                     </EuiFlexItem>
                   </EuiFlexGroup>
diff --git a/x-pack/plugins/security_solution/public/explore/network/pages/details/index.tsx b/x-pack/plugins/security_solution/public/explore/network/pages/details/index.tsx
index f0356b9125dc3f..f7e30dd47bf931 100644
--- a/x-pack/plugins/security_solution/public/explore/network/pages/details/index.tsx
+++ b/x-pack/plugins/security_solution/public/explore/network/pages/details/index.tsx
@@ -124,6 +124,11 @@ const NetworkDetailsComponent: React.FC = () => {
     }
   }, [globalFilters, indexPattern, networkDetailsFilter, query, uiSettings]);
 
+  const additionalFilters = useMemo(
+    () => (rawFilteredQuery ? [rawFilteredQuery] : []),
+    [rawFilteredQuery]
+  );
+
   const stringifiedAdditionalFilters = JSON.stringify(rawFilteredQuery);
   useInvalidFilterQuery({
     id: ID,
@@ -226,14 +231,14 @@ const NetworkDetailsComponent: React.FC = () => {
                     <AlertsByStatus
                       signalIndexName={signalIndexName}
                       entityFilter={entityFilter}
-                      additionalFilters={rawFilteredQuery ? [rawFilteredQuery] : []}
+                      additionalFilters={additionalFilters}
                     />
                   </EuiFlexItem>
                   <EuiFlexItem>
                     <AlertCountByRuleByStatus
                       entityFilter={entityFilter}
                       signalIndexName={signalIndexName}
-                      additionalFilters={rawFilteredQuery ? [rawFilteredQuery] : []}
+                      additionalFilters={additionalFilters}
                     />
                   </EuiFlexItem>
                 </EuiFlexGroup>
diff --git a/x-pack/plugins/security_solution/public/explore/users/pages/details/index.tsx b/x-pack/plugins/security_solution/public/explore/users/pages/details/index.tsx
index 88d9b260c8d385..4e61c7083d038b 100644
--- a/x-pack/plugins/security_solution/public/explore/users/pages/details/index.tsx
+++ b/x-pack/plugins/security_solution/public/explore/users/pages/details/index.tsx
@@ -20,6 +20,7 @@ import { getEsQueryConfig } from '@kbn/data-plugin/common';
 import type { Filter } from '@kbn/es-query';
 import { buildEsQuery } from '@kbn/es-query';
 import { dataTableSelectors, TableId } from '@kbn/securitysolution-data-table';
+import { useCalculateEntityRiskScore } from '../../../../entity_analytics/api/hooks/use_calculate_entity_risk_score';
 import {
   useAssetCriticalityData,
   useAssetCriticalityPrivileges,
@@ -60,10 +61,13 @@ import {
 } from '../../../../common/hooks/use_selector';
 import { useInvalidFilterQuery } from '../../../../common/hooks/use_invalid_filter_query';
 import { LastEventTime } from '../../../../common/components/last_event_time';
-import { LastEventIndexKey } from '../../../../../common/search_strategy';
+import { LastEventIndexKey, RiskScoreEntity } from '../../../../../common/search_strategy';
 
 import { AnomalyTableProvider } from '../../../../common/components/ml/anomaly/anomaly_table_provider';
-import { UserOverview } from '../../../../overview/components/user_overview';
+import {
+  UserOverview,
+  USER_OVERVIEW_RISK_SCORE_QUERY_ID,
+} from '../../../../overview/components/user_overview';
 import { useObservedUserDetails } from '../../containers/users/observed_details';
 import { useQueryInspector } from '../../../../common/components/page/manage_query';
 import { scoreIntervalToDateTime } from '../../../../common/components/ml/score/score_interval_to_datetime';
@@ -73,6 +77,7 @@ import { hasMlUserPermissions } from '../../../../../common/machine_learning/has
 import { useMlCapabilities } from '../../../../common/components/ml/hooks/use_ml_capabilities';
 import { EmptyPrompt } from '../../../../common/components/empty_prompt';
 import { useHasSecurityCapability } from '../../../../helper_hooks';
+import { useRefetchOverviewPageRiskScore } from '../../../../entity_analytics/api/hooks/use_refetch_overview_page_risk_score';
 
 const QUERY_ID = 'UsersDetailsQueryId';
 const ES_USER_FIELD = 'user.name';
@@ -180,10 +185,24 @@ const UsersDetailsComponent: React.FC<UsersDetailsProps> = ({
 
   const entity = useMemo(() => ({ type: 'user' as const, name: detailName }), [detailName]);
   const privileges = useAssetCriticalityPrivileges(entity.name);
+
+  const refetchRiskScore = useRefetchOverviewPageRiskScore(USER_OVERVIEW_RISK_SCORE_QUERY_ID);
+  const { calculateEntityRiskScore } = useCalculateEntityRiskScore(
+    RiskScoreEntity.user,
+    detailName,
+    { onSuccess: refetchRiskScore }
+  );
+
+  const additionalFilters = useMemo(
+    () => (rawFilteredQuery ? [rawFilteredQuery] : []),
+    [rawFilteredQuery]
+  );
+
   const canReadAssetCriticality = !!privileges.data?.has_read_permissions;
   const criticality = useAssetCriticalityData({
     entity,
     enabled: canReadAssetCriticality,
+    onChange: calculateEntityRiskScore,
   });
 
   return (
@@ -250,14 +269,14 @@ const UsersDetailsComponent: React.FC<UsersDetailsProps> = ({
                     <AlertsByStatus
                       signalIndexName={signalIndexName}
                       entityFilter={entityFilter}
-                      additionalFilters={rawFilteredQuery ? [rawFilteredQuery] : []}
+                      additionalFilters={additionalFilters}
                     />
                   </EuiFlexItem>
                   <EuiFlexItem>
                     <AlertCountByRuleByStatus
                       entityFilter={entityFilter}
                       signalIndexName={signalIndexName}
-                      additionalFilters={rawFilteredQuery ? [rawFilteredQuery] : []}
+                      additionalFilters={additionalFilters}
                     />
                   </EuiFlexItem>
                 </EuiFlexGroup>
diff --git a/x-pack/plugins/security_solution/public/flyout/document_details/left/components/cell_actions.tsx b/x-pack/plugins/security_solution/public/flyout/document_details/left/components/cell_actions.tsx
index 214326b990f0f9..27fb6f752f71bd 100644
--- a/x-pack/plugins/security_solution/public/flyout/document_details/left/components/cell_actions.tsx
+++ b/x-pack/plugins/security_solution/public/flyout/document_details/left/components/cell_actions.tsx
@@ -10,7 +10,7 @@ import React, { useMemo } from 'react';
 import { useLeftPanelContext } from '../context';
 import { getSourcererScopeId } from '../../../../helpers';
 import { useBasicDataFromDetailsData } from '../../../../timelines/components/side_panel/event_details/helpers';
-import { SecurityCellActionType } from '../../../../actions/constants';
+import { SecurityCellActionType } from '../../../../app/actions/constants';
 import {
   CellActionsMode,
   SecurityCellActions,
diff --git a/x-pack/plugins/security_solution/public/flyout/document_details/left/components/host_details.tsx b/x-pack/plugins/security_solution/public/flyout/document_details/left/components/host_details.tsx
index 2084024c314e70..0ab96ccb7d7ac3 100644
--- a/x-pack/plugins/security_solution/public/flyout/document_details/left/components/host_details.tsx
+++ b/x-pack/plugins/security_solution/public/flyout/document_details/left/components/host_details.tsx
@@ -152,6 +152,7 @@ export const HostDetails: React.FC<HostDetailsProps> = ({ hostName, timestamp, s
               idPrefix={''}
               isDraggable={false}
               render={(ip) => (ip != null ? <NetworkDetailsLink ip={ip} /> : getEmptyTagValue())}
+              scopeId={scopeId}
             />
           );
         },
@@ -174,7 +175,7 @@ export const HostDetails: React.FC<HostDetailsProps> = ({ hostName, timestamp, s
           ]
         : []),
     ],
-    [isEntityAnalyticsAuthorized]
+    [isEntityAnalyticsAuthorized, scopeId]
   );
 
   const relatedUsersCount = useMemo(
diff --git a/x-pack/plugins/security_solution/public/flyout/document_details/left/components/user_details.tsx b/x-pack/plugins/security_solution/public/flyout/document_details/left/components/user_details.tsx
index c4841cc35f029b..557337afccb4ac 100644
--- a/x-pack/plugins/security_solution/public/flyout/document_details/left/components/user_details.tsx
+++ b/x-pack/plugins/security_solution/public/flyout/document_details/left/components/user_details.tsx
@@ -153,6 +153,7 @@ export const UserDetails: React.FC<UserDetailsProps> = ({ userName, timestamp, s
               idPrefix={''}
               isDraggable={false}
               render={(ip) => (ip != null ? <NetworkDetailsLink ip={ip} /> : getEmptyTagValue())}
+              scopeId={scopeId}
             />
           );
         },
@@ -175,7 +176,7 @@ export const UserDetails: React.FC<UserDetailsProps> = ({ userName, timestamp, s
           ]
         : []),
     ],
-    [isEntityAnalyticsAuthorized]
+    [isEntityAnalyticsAuthorized, scopeId]
   );
 
   const relatedHostsCount = useMemo(
diff --git a/x-pack/plugins/security_solution/public/flyout/document_details/preview/components/alert_reason_preview.test.tsx b/x-pack/plugins/security_solution/public/flyout/document_details/preview/components/alert_reason_preview.test.tsx
index 5e0194c7ec91a2..53e0e5547a5f7f 100644
--- a/x-pack/plugins/security_solution/public/flyout/document_details/preview/components/alert_reason_preview.test.tsx
+++ b/x-pack/plugins/security_solution/public/flyout/document_details/preview/components/alert_reason_preview.test.tsx
@@ -6,16 +6,12 @@
  */
 
 import React from 'react';
-import { __IntlProvider as IntlProvider } from '@kbn/i18n-react';
 import { render } from '@testing-library/react';
 import { PreviewPanelContext } from '../context';
 import { mockContextValue } from '../mocks/mock_context';
 import { ALERT_REASON_PREVIEW_BODY_TEST_ID } from './test_ids';
 import { AlertReasonPreview } from './alert_reason_preview';
-import { ThemeProvider } from 'styled-components';
-import { getMockTheme } from '../../../../common/lib/kibana/kibana_react.mock';
-
-const mockTheme = getMockTheme({ eui: { euiFontSizeXS: '' } });
+import { TestProviders } from '../../../../common/mock';
 
 const panelContextValue = {
   ...mockContextValue,
@@ -26,13 +22,10 @@ const NO_DATA_MESSAGE = 'There was an error displaying data.';
 describe('<AlertReasonPreview />', () => {
   it('should render alert reason preview', () => {
     const { getByTestId } = render(
-      <IntlProvider locale="en">
-        <PreviewPanelContext.Provider value={panelContextValue}>
-          <ThemeProvider theme={mockTheme}>
-            <AlertReasonPreview />
-          </ThemeProvider>
-        </PreviewPanelContext.Provider>
-      </IntlProvider>
+      <PreviewPanelContext.Provider value={panelContextValue}>
+        <AlertReasonPreview />
+      </PreviewPanelContext.Provider>,
+      { wrapper: TestProviders }
     );
     expect(getByTestId(ALERT_REASON_PREVIEW_BODY_TEST_ID)).toBeInTheDocument();
     expect(getByTestId(ALERT_REASON_PREVIEW_BODY_TEST_ID)).toHaveTextContent('Alert reason');
@@ -40,13 +33,10 @@ describe('<AlertReasonPreview />', () => {
 
   it('should render no data message if alert reason is not available', () => {
     const { getByText } = render(
-      <IntlProvider locale="en">
-        <PreviewPanelContext.Provider value={{} as unknown as PreviewPanelContext}>
-          <ThemeProvider theme={mockTheme}>
-            <AlertReasonPreview />
-          </ThemeProvider>
-        </PreviewPanelContext.Provider>
-      </IntlProvider>
+      <PreviewPanelContext.Provider value={{} as unknown as PreviewPanelContext}>
+        <AlertReasonPreview />
+      </PreviewPanelContext.Provider>,
+      { wrapper: TestProviders }
     );
     expect(getByText(NO_DATA_MESSAGE)).toBeInTheDocument();
   });
diff --git a/x-pack/plugins/security_solution/public/flyout/document_details/right/components/cell_actions.tsx b/x-pack/plugins/security_solution/public/flyout/document_details/right/components/cell_actions.tsx
index 23e4a4c01e823a..52c216517b9dea 100644
--- a/x-pack/plugins/security_solution/public/flyout/document_details/right/components/cell_actions.tsx
+++ b/x-pack/plugins/security_solution/public/flyout/document_details/right/components/cell_actions.tsx
@@ -9,7 +9,7 @@ import type { FC } from 'react';
 import React, { useMemo } from 'react';
 import { useRightPanelContext } from '../context';
 import { getSourcererScopeId } from '../../../../helpers';
-import { SecurityCellActionType } from '../../../../actions/constants';
+import { SecurityCellActionType } from '../../../../app/actions/constants';
 import {
   CellActionsMode,
   SecurityCellActions,
diff --git a/x-pack/plugins/security_solution/public/flyout/document_details/right/components/event_renderer.test.tsx b/x-pack/plugins/security_solution/public/flyout/document_details/right/components/event_renderer.test.tsx
index 578147cc08999a..f6e91cbe31756a 100644
--- a/x-pack/plugins/security_solution/public/flyout/document_details/right/components/event_renderer.test.tsx
+++ b/x-pack/plugins/security_solution/public/flyout/document_details/right/components/event_renderer.test.tsx
@@ -6,26 +6,20 @@
  */
 
 import React from 'react';
-import { __IntlProvider as IntlProvider } from '@kbn/i18n-react';
 import { render } from '@testing-library/react';
-import { ThemeProvider } from 'styled-components';
 import { EventRenderer } from './event_renderer';
 import { RightPanelContext } from '../context';
 import { EVENT_RENDERER_TEST_ID } from './test_ids';
 import { mockContextValue } from '../mocks/mock_context';
 import { mockDataAsNestedObject } from '../../shared/mocks/mock_data_as_nested_object';
-import { getMockTheme } from '../../../../common/lib/kibana/kibana_react.mock';
+import { TestProviders } from '../../../../common/mock';
 
-const mockTheme = getMockTheme({ eui: { euiFontSizeXS: '' } });
 const renderEventRenderer = (contextValue: RightPanelContext) =>
   render(
-    <IntlProvider locale="en">
-      <ThemeProvider theme={mockTheme}>
-        <RightPanelContext.Provider value={contextValue}>
-          <EventRenderer />
-        </RightPanelContext.Provider>
-      </ThemeProvider>
-    </IntlProvider>
+    <RightPanelContext.Provider value={contextValue}>
+      <EventRenderer />
+    </RightPanelContext.Provider>,
+    { wrapper: TestProviders }
   );
 
 describe('<EventRenderer />', () => {
diff --git a/x-pack/plugins/security_solution/public/flyout/entity_details/host_right/content.stories.tsx b/x-pack/plugins/security_solution/public/flyout/entity_details/host_right/content.stories.tsx
index 4d998153cda1bd..3bca4be245646e 100644
--- a/x-pack/plugins/security_solution/public/flyout/entity_details/host_right/content.stories.tsx
+++ b/x-pack/plugins/security_solution/public/flyout/entity_details/host_right/content.stories.tsx
@@ -35,6 +35,8 @@ storiesOf('Components/HostPanelContent', module)
       isDraggable={false}
       openDetailsPanel={() => {}}
       hostName={'test-host-name'}
+      onAssetCriticalityChange={() => {}}
+      recalculatingScore={false}
     />
   ))
   .add('no observed data', () => (
@@ -58,6 +60,8 @@ storiesOf('Components/HostPanelContent', module)
       isDraggable={false}
       openDetailsPanel={() => {}}
       hostName={'test-host-name'}
+      onAssetCriticalityChange={() => {}}
+      recalculatingScore={false}
     />
   ))
   .add('loading', () => (
@@ -81,5 +85,7 @@ storiesOf('Components/HostPanelContent', module)
       isDraggable={false}
       openDetailsPanel={() => {}}
       hostName={'test-host-name'}
+      onAssetCriticalityChange={() => {}}
+      recalculatingScore={false}
     />
   ));
diff --git a/x-pack/plugins/security_solution/public/flyout/entity_details/host_right/content.tsx b/x-pack/plugins/security_solution/public/flyout/entity_details/host_right/content.tsx
index 64d5ea41898a02..a2d7b7b733ee06 100644
--- a/x-pack/plugins/security_solution/public/flyout/entity_details/host_right/content.tsx
+++ b/x-pack/plugins/security_solution/public/flyout/entity_details/host_right/content.tsx
@@ -26,16 +26,20 @@ interface HostPanelContentProps {
   isDraggable: boolean;
   openDetailsPanel: (tab: EntityDetailsLeftPanelTab) => void;
   hostName: string;
+  onAssetCriticalityChange: () => void;
+  recalculatingScore: boolean;
 }
 
 export const HostPanelContent = ({
   hostName,
   observedHost,
   riskScoreState,
+  recalculatingScore,
   contextID,
   scopeId,
   isDraggable,
   openDetailsPanel,
+  onAssetCriticalityChange,
 }: HostPanelContentProps) => {
   const observedFields = useObservedHostFields(observedHost);
 
@@ -45,13 +49,17 @@ export const HostPanelContent = ({
         <>
           <RiskSummary
             riskScoreData={riskScoreState}
+            recalculatingScore={recalculatingScore}
             queryId={HOST_PANEL_RISK_SCORE_QUERY_ID}
             openDetailsPanel={openDetailsPanel}
           />
           <EuiHorizontalRule />
         </>
       )}
-      <AssetCriticalityAccordion entity={{ name: hostName, type: 'host' }} />
+      <AssetCriticalityAccordion
+        entity={{ name: hostName, type: 'host' }}
+        onChange={onAssetCriticalityChange}
+      />
       <ObservedEntity
         observedData={observedHost}
         contextID={contextID}
diff --git a/x-pack/plugins/security_solution/public/flyout/entity_details/host_right/hooks/use_observed_host.ts b/x-pack/plugins/security_solution/public/flyout/entity_details/host_right/hooks/use_observed_host.ts
index 980407b0346491..79af9a2897df58 100644
--- a/x-pack/plugins/security_solution/public/flyout/entity_details/host_right/hooks/use_observed_host.ts
+++ b/x-pack/plugins/security_solution/public/flyout/entity_details/host_right/hooks/use_observed_host.ts
@@ -6,6 +6,8 @@
  */
 
 import { useMemo } from 'react';
+import { useDeepEqualSelector } from '../../../../common/hooks/use_selector';
+import { inputsSelectors } from '../../../../common/store';
 import { useHostDetails } from '../../../../explore/hosts/containers/hosts/details';
 import { useFirstLastSeen } from '../../../../common/containers/use_first_last_seen';
 import { useGlobalTime } from '../../../../common/containers/use_global_time';
@@ -15,12 +17,21 @@ import { Direction, NOT_EVENT_KIND_ASSET_FILTER } from '../../../../../common/se
 import { HOST_PANEL_OBSERVED_HOST_QUERY_ID, HOST_PANEL_RISK_SCORE_QUERY_ID } from '..';
 import { useQueryInspector } from '../../../../common/components/page/manage_query';
 import type { ObservedEntityData } from '../../shared/components/observed_entity/types';
+import { getSourcererScopeId, isActiveTimeline } from '../../../../helpers';
 
 export const useObservedHost = (
-  hostName: string
+  hostName: string,
+  scopeId: string
 ): Omit<ObservedEntityData<HostItem>, 'anomalies'> => {
-  const { to, from, isInitializing, setQuery, deleteQuery } = useGlobalTime();
-  const { selectedPatterns } = useSourcererDataView();
+  const timelineTime = useDeepEqualSelector((state) =>
+    inputsSelectors.timelineTimeRangeSelector(state)
+  );
+  const globalTime = useGlobalTime();
+  const isActiveTimelines = isActiveTimeline(scopeId);
+  const { to, from } = isActiveTimelines ? timelineTime : globalTime;
+  const { isInitializing, setQuery, deleteQuery } = globalTime;
+
+  const { selectedPatterns } = useSourcererDataView(getSourcererScopeId(scopeId));
 
   const [isLoading, { hostDetails, inspect: inspectObservedHost }, refetch] = useHostDetails({
     endDate: to,
diff --git a/x-pack/plugins/security_solution/public/flyout/entity_details/host_right/index.test.tsx b/x-pack/plugins/security_solution/public/flyout/entity_details/host_right/index.test.tsx
index 467a1be82a44cf..1d81792c07e1d9 100644
--- a/x-pack/plugins/security_solution/public/flyout/entity_details/host_right/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/flyout/entity_details/host_right/index.test.tsx
@@ -51,22 +51,6 @@ describe('HostPanel', () => {
     expect(getByTestId('securitySolutionFlyoutNavigationExpandDetailButton')).toBeInTheDocument();
   });
 
-  it('renders loading state when risk score is loading', () => {
-    mockedHostRiskScore.mockReturnValue({
-      ...mockHostRiskScoreState,
-      data: undefined,
-      loading: true,
-    });
-
-    const { getByTestId } = render(
-      <TestProviders>
-        <HostPanel {...mockProps} />
-      </TestProviders>
-    );
-
-    expect(getByTestId('securitySolutionFlyoutLoading')).toBeInTheDocument();
-  });
-
   it('renders loading state when observed host is loading', () => {
     mockedUseObservedHost.mockReturnValue({
       ...mockObservedHostData,
diff --git a/x-pack/plugins/security_solution/public/flyout/entity_details/host_right/index.tsx b/x-pack/plugins/security_solution/public/flyout/entity_details/host_right/index.tsx
index 3d649ad360cd0c..580d71e0913701 100644
--- a/x-pack/plugins/security_solution/public/flyout/entity_details/host_right/index.tsx
+++ b/x-pack/plugins/security_solution/public/flyout/entity_details/host_right/index.tsx
@@ -9,6 +9,10 @@ import React, { useCallback, useMemo } from 'react';
 import type { FlyoutPanelProps } from '@kbn/expandable-flyout';
 import { useExpandableFlyoutApi } from '@kbn/expandable-flyout';
 
+import { useRefetchQueryById } from '../../../entity_analytics/api/hooks/use_refetch_query_by_id';
+import { RISK_INPUTS_TAB_QUERY_ID } from '../../../entity_analytics/components/entity_details_flyout/tabs/risk_inputs/risk_inputs_tab';
+import type { Refetch } from '../../../common/types';
+import { useCalculateEntityRiskScore } from '../../../entity_analytics/api/hooks/use_calculate_entity_risk_score';
 import { useKibana } from '../../../common/lib/kibana/kibana_react';
 import { hostToCriteria } from '../../../common/components/ml/criteria/host_to_criteria';
 import { useRiskScore } from '../../../entity_analytics/api/hooks/use_risk_score';
@@ -68,6 +72,18 @@ export const HostPanel = ({ contextID, scopeId, hostName, isDraggable }: HostPan
   const hostRiskData = hostRisk && hostRisk.length > 0 ? hostRisk[0] : undefined;
   const isRiskScoreExist = !!hostRiskData?.host.risk;
 
+  const refetchRiskInputsTab = useRefetchQueryById(RISK_INPUTS_TAB_QUERY_ID);
+  const refetchRiskScore = useCallback(() => {
+    refetch();
+    (refetchRiskInputsTab as Refetch | null)?.();
+  }, [refetch, refetchRiskInputsTab]);
+
+  const { isLoading: recalculatingScore, calculateEntityRiskScore } = useCalculateEntityRiskScore(
+    RiskScoreEntity.host,
+    hostName,
+    { onSuccess: refetchRiskScore }
+  );
+
   useQueryInspector({
     deleteQuery,
     inspect: inspectRiskScore,
@@ -96,9 +112,9 @@ export const HostPanel = ({ contextID, scopeId, hostName, isDraggable }: HostPan
   );
 
   const openDefaultPanel = useCallback(() => openTabPanel(), [openTabPanel]);
-  const observedHost = useObservedHost(hostName);
+  const observedHost = useObservedHost(hostName, scopeId);
 
-  if (riskScoreState.loading || observedHost.isLoading) {
+  if (observedHost.isLoading) {
     return <FlyoutLoading />;
   }
 
@@ -134,6 +150,8 @@ export const HostPanel = ({ contextID, scopeId, hostName, isDraggable }: HostPan
               scopeId={scopeId}
               isDraggable={!!isDraggable}
               openDetailsPanel={openTabPanel}
+              recalculatingScore={recalculatingScore}
+              onAssetCriticalityChange={calculateEntityRiskScore}
             />
           </>
         );
diff --git a/x-pack/plugins/security_solution/public/flyout/entity_details/shared/components/entity_table/columns.tsx b/x-pack/plugins/security_solution/public/flyout/entity_details/shared/components/entity_table/columns.tsx
index cda6113ded653a..d84e1357aaecd5 100644
--- a/x-pack/plugins/security_solution/public/flyout/entity_details/shared/components/entity_table/columns.tsx
+++ b/x-pack/plugins/security_solution/public/flyout/entity_details/shared/components/entity_table/columns.tsx
@@ -11,7 +11,6 @@ import { euiThemeVars } from '@kbn/ui-theme';
 import { FormattedMessage } from '@kbn/i18n-react';
 import { DefaultFieldRenderer } from '../../../../../timelines/components/field_renderers/field_renderers';
 import { getEmptyTagValue } from '../../../../../common/components/empty_value';
-import { getSourcererScopeId } from '../../../../../helpers';
 import type { BasicEntityData, EntityTableColumns } from './types';
 
 export const getEntityTableColumns = <T extends BasicEntityData>(
@@ -58,7 +57,6 @@ export const getEntityTableColumns = <T extends BasicEntityData>(
             attrName={field}
             idPrefix={contextID ? `entityTable-${contextID}` : 'entityTable'}
             isDraggable={isDraggable}
-            sourcererScopeId={getSourcererScopeId(scopeId)}
             scopeId={scopeId}
             render={renderField}
             data-test-subj="entity-table-value"
diff --git a/x-pack/plugins/security_solution/public/flyout/entity_details/user_right/content.stories.tsx b/x-pack/plugins/security_solution/public/flyout/entity_details/user_right/content.stories.tsx
index 64fa6dcd809137..57705099edc05d 100644
--- a/x-pack/plugins/security_solution/public/flyout/entity_details/user_right/content.stories.tsx
+++ b/x-pack/plugins/security_solution/public/flyout/entity_details/user_right/content.stories.tsx
@@ -39,6 +39,8 @@ storiesOf('Components/UserPanelContent', module)
       isDraggable={false}
       openDetailsPanel={() => {}}
       userName={'test-user-name'}
+      onAssetCriticalityChange={() => {}}
+      recalculatingScore={false}
     />
   ))
   .add('integration disabled', () => (
@@ -55,6 +57,8 @@ storiesOf('Components/UserPanelContent', module)
       isDraggable={false}
       openDetailsPanel={() => {}}
       userName={'test-user-name'}
+      onAssetCriticalityChange={() => {}}
+      recalculatingScore={false}
     />
   ))
   .add('no managed data', () => (
@@ -71,6 +75,8 @@ storiesOf('Components/UserPanelContent', module)
       isDraggable={false}
       openDetailsPanel={() => {}}
       userName={'test-user-name'}
+      onAssetCriticalityChange={() => {}}
+      recalculatingScore={false}
     />
   ))
   .add('no observed data', () => (
@@ -107,6 +113,8 @@ storiesOf('Components/UserPanelContent', module)
       isDraggable={false}
       openDetailsPanel={() => {}}
       userName={'test-user-name'}
+      onAssetCriticalityChange={() => {}}
+      recalculatingScore={false}
     />
   ))
   .add('loading', () => (
@@ -147,5 +155,7 @@ storiesOf('Components/UserPanelContent', module)
       isDraggable={false}
       openDetailsPanel={() => {}}
       userName={'test-user-name'}
+      onAssetCriticalityChange={() => {}}
+      recalculatingScore={false}
     />
   ));
diff --git a/x-pack/plugins/security_solution/public/flyout/entity_details/user_right/content.tsx b/x-pack/plugins/security_solution/public/flyout/entity_details/user_right/content.tsx
index 7c40e4b30507f1..46e5e9beaa3aa9 100644
--- a/x-pack/plugins/security_solution/public/flyout/entity_details/user_right/content.tsx
+++ b/x-pack/plugins/security_solution/public/flyout/entity_details/user_right/content.tsx
@@ -29,9 +29,11 @@ interface UserPanelContentProps {
   observedUser: ObservedEntityData<UserItem>;
   managedUser: ManagedUserData;
   riskScoreState: RiskScoreState<RiskScoreEntity.user>;
+  recalculatingScore: boolean;
   contextID: string;
   scopeId: string;
   isDraggable: boolean;
+  onAssetCriticalityChange: () => void;
   openDetailsPanel: (tab: EntityDetailsLeftPanelTab) => void;
 }
 
@@ -40,10 +42,12 @@ export const UserPanelContent = ({
   observedUser,
   managedUser,
   riskScoreState,
+  recalculatingScore,
   contextID,
   scopeId,
   isDraggable,
   openDetailsPanel,
+  onAssetCriticalityChange,
 }: UserPanelContentProps) => {
   const observedFields = useObservedUserItems(observedUser);
   const isManagedUserEnable = useIsExperimentalFeatureEnabled('newUserDetailsFlyoutManagedUser');
@@ -54,13 +58,17 @@ export const UserPanelContent = ({
         <>
           <RiskSummary
             riskScoreData={riskScoreState}
+            recalculatingScore={recalculatingScore}
             queryId={USER_PANEL_RISK_SCORE_QUERY_ID}
             openDetailsPanel={openDetailsPanel}
           />
           <EuiHorizontalRule />
         </>
       )}
-      <AssetCriticalityAccordion entity={{ name: userName, type: 'user' }} />
+      <AssetCriticalityAccordion
+        entity={{ name: userName, type: 'user' }}
+        onChange={onAssetCriticalityChange}
+      />
       <ObservedEntity
         observedData={observedUser}
         contextID={contextID}
diff --git a/x-pack/plugins/security_solution/public/flyout/entity_details/user_right/hooks/use_observed_user.ts b/x-pack/plugins/security_solution/public/flyout/entity_details/user_right/hooks/use_observed_user.ts
index 6d1ae0ab11e003..a72d0e236fe080 100644
--- a/x-pack/plugins/security_solution/public/flyout/entity_details/user_right/hooks/use_observed_user.ts
+++ b/x-pack/plugins/security_solution/public/flyout/entity_details/user_right/hooks/use_observed_user.ts
@@ -6,6 +6,8 @@
  */
 
 import { useMemo } from 'react';
+import { useDeepEqualSelector } from '../../../../common/hooks/use_selector';
+import { inputsSelectors } from '../../../../common/store';
 import { useQueryInspector } from '../../../../common/components/page/manage_query';
 import type { ObservedEntityData } from '../../shared/components/observed_entity/types';
 import { useObservedUserDetails } from '../../../../explore/users/containers/users/observed_details';
@@ -14,12 +16,21 @@ import { Direction, NOT_EVENT_KIND_ASSET_FILTER } from '../../../../../common/se
 import { useSourcererDataView } from '../../../../common/containers/sourcerer';
 import { useGlobalTime } from '../../../../common/containers/use_global_time';
 import { useFirstLastSeen } from '../../../../common/containers/use_first_last_seen';
+import { getSourcererScopeId, isActiveTimeline } from '../../../../helpers';
 
 export const useObservedUser = (
-  userName: string
+  userName: string,
+  scopeId: string
 ): Omit<ObservedEntityData<UserItem>, 'anomalies'> => {
-  const { selectedPatterns } = useSourcererDataView();
-  const { to, from, isInitializing, deleteQuery, setQuery } = useGlobalTime();
+  const timelineTime = useDeepEqualSelector((state) =>
+    inputsSelectors.timelineTimeRangeSelector(state)
+  );
+  const globalTime = useGlobalTime();
+  const isActiveTimelines = isActiveTimeline(scopeId);
+  const { to, from } = isActiveTimelines ? timelineTime : globalTime;
+  const { isInitializing, setQuery, deleteQuery } = globalTime;
+
+  const { selectedPatterns } = useSourcererDataView(getSourcererScopeId(scopeId));
 
   const [loadingObservedUser, { userDetails: observedUserDetails, inspect, refetch, id: queryId }] =
     useObservedUserDetails({
diff --git a/x-pack/plugins/security_solution/public/flyout/entity_details/user_right/index.test.tsx b/x-pack/plugins/security_solution/public/flyout/entity_details/user_right/index.test.tsx
index 6d5bcc4019c3c5..51a654817d74d3 100644
--- a/x-pack/plugins/security_solution/public/flyout/entity_details/user_right/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/flyout/entity_details/user_right/index.test.tsx
@@ -69,22 +69,6 @@ describe('UserPanel', () => {
     expect(getByTestId('securitySolutionFlyoutNavigationExpandDetailButton')).toBeInTheDocument();
   });
 
-  it('renders loading state when risk score is loading', () => {
-    mockedUseRiskScore.mockReturnValue({
-      ...mockRiskScoreState,
-      data: undefined,
-      loading: true,
-    });
-
-    const { getByTestId } = render(
-      <TestProviders>
-        <UserPanel {...mockProps} />
-      </TestProviders>
-    );
-
-    expect(getByTestId('securitySolutionFlyoutLoading')).toBeInTheDocument();
-  });
-
   it('renders loading state when observed user is loading', () => {
     mockedUseObservedUser.mockReturnValue({
       ...mockObservedUser,
diff --git a/x-pack/plugins/security_solution/public/flyout/entity_details/user_right/index.tsx b/x-pack/plugins/security_solution/public/flyout/entity_details/user_right/index.tsx
index a342a1318bb240..956f4e838ff8d0 100644
--- a/x-pack/plugins/security_solution/public/flyout/entity_details/user_right/index.tsx
+++ b/x-pack/plugins/security_solution/public/flyout/entity_details/user_right/index.tsx
@@ -8,6 +8,10 @@
 import React, { useCallback, useMemo } from 'react';
 import type { FlyoutPanelProps } from '@kbn/expandable-flyout';
 import { useExpandableFlyoutApi } from '@kbn/expandable-flyout';
+import { useRefetchQueryById } from '../../../entity_analytics/api/hooks/use_refetch_query_by_id';
+import type { Refetch } from '../../../common/types';
+import { RISK_INPUTS_TAB_QUERY_ID } from '../../../entity_analytics/components/entity_details_flyout/tabs/risk_inputs/risk_inputs_tab';
+import { useCalculateEntityRiskScore } from '../../../entity_analytics/api/hooks/use_calculate_entity_risk_score';
 import { useKibana } from '../../../common/lib/kibana/kibana_react';
 import { useRiskScore } from '../../../entity_analytics/api/hooks/use_risk_score';
 import { ManagedUserDatasetKey } from '../../../../common/search_strategy/security_solution/users/managed_details';
@@ -63,13 +67,25 @@ export const UserPanel = ({ contextID, scopeId, userName, isDraggable }: UserPan
   const { inspect, refetch, loading } = riskScoreState;
   const { to, from, isInitializing, setQuery, deleteQuery } = useGlobalTime();
 
-  const observedUser = useObservedUser(userName);
+  const observedUser = useObservedUser(userName, scopeId);
   const email = observedUser.details.user?.email;
   const managedUser = useManagedUser(userName, email, observedUser.isLoading);
 
   const { data: userRisk } = riskScoreState;
   const userRiskData = userRisk && userRisk.length > 0 ? userRisk[0] : undefined;
 
+  const refetchRiskInputsTab = useRefetchQueryById(RISK_INPUTS_TAB_QUERY_ID);
+  const refetchRiskScore = useCallback(() => {
+    refetch();
+    (refetchRiskInputsTab as Refetch | null)?.();
+  }, [refetch, refetchRiskInputsTab]);
+
+  const { isLoading: recalculatingScore, calculateEntityRiskScore } = useCalculateEntityRiskScore(
+    RiskScoreEntity.user,
+    userName,
+    { onSuccess: refetchRiskScore }
+  );
+
   useQueryInspector({
     deleteQuery,
     inspect,
@@ -108,7 +124,7 @@ export const UserPanel = ({ contextID, scopeId, userName, isDraggable }: UserPan
     !!managedUser.data?.[ManagedUserDatasetKey.OKTA] ||
     !!managedUser.data?.[ManagedUserDatasetKey.ENTRA];
 
-  if (riskScoreState.loading || observedUser.isLoading || managedUser.isLoading) {
+  if (observedUser.isLoading || managedUser.isLoading) {
     return <FlyoutLoading />;
   }
 
@@ -144,6 +160,8 @@ export const UserPanel = ({ contextID, scopeId, userName, isDraggable }: UserPan
               managedUser={managedUser}
               observedUser={observedUserWithAnomalies}
               riskScoreState={riskScoreState}
+              recalculatingScore={recalculatingScore}
+              onAssetCriticalityChange={calculateEntityRiskScore}
               contextID={contextID}
               scopeId={scopeId}
               isDraggable={!!isDraggable}
diff --git a/x-pack/plugins/ml/public/application/components/ml_embedded_map/index.ts b/x-pack/plugins/security_solution/public/lazy_actions.ts
similarity index 80%
rename from x-pack/plugins/ml/public/application/components/ml_embedded_map/index.ts
rename to x-pack/plugins/security_solution/public/lazy_actions.ts
index 3829e98450d739..771d03af1ef780 100644
--- a/x-pack/plugins/ml/public/application/components/ml_embedded_map/index.ts
+++ b/x-pack/plugins/security_solution/public/lazy_actions.ts
@@ -5,4 +5,4 @@
  * 2.0.
  */
 
-export { MlEmbeddedMapComponent } from './ml_embedded_map';
+export { registerActions } from './app/actions';
diff --git a/x-pack/plugins/security_solution/public/management/cypress/e2e/response_actions/response_console/process_operations.cy.ts b/x-pack/plugins/security_solution/public/management/cypress/e2e/response_actions/response_console/process_operations.cy.ts
index f7c70ebf8c7e9f..1b5fcddf6b3925 100644
--- a/x-pack/plugins/security_solution/public/management/cypress/e2e/response_actions/response_console/process_operations.cy.ts
+++ b/x-pack/plugins/security_solution/public/management/cypress/e2e/response_actions/response_console/process_operations.cy.ts
@@ -26,7 +26,7 @@ import { deleteAllLoadedEndpointData } from '../../../tasks/delete_all_endpoint_
 
 const AGENT_BEAT_FILE_PATH_SUFFIX = '/components/agentbeat';
 
-describe('Response console', { tags: ['@ess', '@serverless'] }, () => {
+describe('Response console', { tags: ['@ess', '@serverless', '@skipInServerlessMKI'] }, () => {
   beforeEach(() => {
     login();
   });
diff --git a/x-pack/plugins/security_solution/public/management/cypress/fixtures/artifacts_page.ts b/x-pack/plugins/security_solution/public/management/cypress/fixtures/artifacts_page.ts
index f47818208cb8f8..8662294ced6d22 100644
--- a/x-pack/plugins/security_solution/public/management/cypress/fixtures/artifacts_page.ts
+++ b/x-pack/plugins/security_solution/public/management/cypress/fixtures/artifacts_page.ts
@@ -193,8 +193,9 @@ export const getArtifactsListTestsData = (): ArtifactsFixtureType[] => [
           selector: 'fieldAutocompleteComboBox',
         },
         {
-          type: 'click',
-          customSelector: 'button[title="@timestamp"]',
+          type: 'input',
+          customSelector: '[data-test-subj="fieldAutocompleteComboBox"] input',
+          value: '@timestamp{downArrow}{enter}',
         },
         {
           type: 'click',
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/hooks/use_endpoint_action_items.tsx b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/hooks/use_endpoint_action_items.tsx
index 1bd0c3dff62ff0..5003aeae08840e 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/hooks/use_endpoint_action_items.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/hooks/use_endpoint_action_items.tsx
@@ -43,7 +43,9 @@ export const useEndpointActionItems = (
     canIsolateHost,
     canUnIsolateHost,
     canAccessEndpointActionsLogManagement,
-    canAccessFleet,
+    canReadFleetAgentPolicies,
+    canWriteFleetAgents,
+    canReadFleetAgents,
   } = useUserPrivileges().endpointPrivileges;
 
   return useMemo<ContextMenuItemNavByRouterProps[]>(() => {
@@ -177,7 +179,7 @@ export const useEndpointActionItems = (
           />
         ),
       },
-      ...(canAccessFleet
+      ...(canReadFleetAgentPolicies
         ? [
             {
               icon: 'gear',
@@ -204,6 +206,10 @@ export const useEndpointActionItems = (
                 />
               ),
             },
+          ]
+        : []),
+      ...(canReadFleetAgents
+        ? [
             {
               icon: 'gear',
               key: 'agentDetailsLink',
@@ -228,6 +234,10 @@ export const useEndpointActionItems = (
                 />
               ),
             },
+          ]
+        : []),
+      ...(canWriteFleetAgents
+        ? [
             {
               icon: 'gear',
               key: 'agentPolicyReassignLink',
@@ -272,6 +282,8 @@ export const useEndpointActionItems = (
     options?.isEndpointList,
     canIsolateHost,
     canUnIsolateHost,
-    canAccessFleet,
+    canReadFleetAgentPolicies,
+    canReadFleetAgents,
+    canWriteFleetAgents,
   ]);
 };
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/index.test.tsx b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/index.test.tsx
index f625e88e8a30c3..91bc557d94d2d5 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/index.test.tsx
@@ -1455,12 +1455,15 @@ describe('when on the endpoint list page', () => {
       const hostLink = await renderResult.findByTestId('hostLink');
       expect(hostLink).not.toBeNull();
     });
-    it('shows Agent Policy, View Agent Details and Reassign Policy Links when canAccessFleet RBAC control is enabled', async () => {
+    it('shows Agent Policy, View Agent Details and Reassign Policy Links when canReadFleetAgents,canWriteFleetAgents,canReadFleetAgentPolicies RBAC control is enabled', async () => {
       mockUserPrivileges.mockReturnValue({
         ...mockInitialUserPrivilegesState(),
         endpointPrivileges: {
           ...mockInitialUserPrivilegesState().endpointPrivileges,
           canAccessFleet: true,
+          canReadFleetAgents: true,
+          canWriteFleetAgents: true,
+          canReadFleetAgentPolicies: true,
         },
       });
       await renderAndClickActionsButton();
diff --git a/x-pack/plugins/security_solution/public/overview/components/detection_response/host_alerts_table/host_alerts_table.tsx b/x-pack/plugins/security_solution/public/overview/components/detection_response/host_alerts_table/host_alerts_table.tsx
index 0799b0ea3c6100..ba0af845d2d6cd 100644
--- a/x-pack/plugins/security_solution/public/overview/components/detection_response/host_alerts_table/host_alerts_table.tsx
+++ b/x-pack/plugins/security_solution/public/overview/components/detection_response/host_alerts_table/host_alerts_table.tsx
@@ -20,7 +20,6 @@ import {
 } from '@elastic/eui';
 
 import { ALERT_SEVERITY } from '@kbn/rule-data-utils';
-import { CellActionsMode } from '@kbn/cell-actions';
 import { useNavigateToAlertsPageWithFilters } from '../../../../common/hooks/use_navigate_to_alerts_page_with_filters';
 import { FormattedCount } from '../../../../common/components/formatted_number';
 import { HeaderSection } from '../../../../common/components/header_section';
@@ -35,6 +34,7 @@ import { ITEMS_PER_PAGE, SEVERITY_COLOR } from '../utils';
 import type { HostAlertsItem } from './use_host_alerts_items';
 import { useHostAlertsItems } from './use_host_alerts_items';
 import {
+  CellActionsMode,
   SecurityCellActions,
   SecurityCellActionsTrigger,
 } from '../../../../common/components/cell_actions';
diff --git a/x-pack/plugins/security_solution/public/overview/components/detection_response/rule_alerts_table/rule_alerts_table.tsx b/x-pack/plugins/security_solution/public/overview/components/detection_response/rule_alerts_table/rule_alerts_table.tsx
index eb58820531ad09..fc92df5eb14b42 100644
--- a/x-pack/plugins/security_solution/public/overview/components/detection_response/rule_alerts_table/rule_alerts_table.tsx
+++ b/x-pack/plugins/security_solution/public/overview/components/detection_response/rule_alerts_table/rule_alerts_table.tsx
@@ -21,8 +21,7 @@ import {
 import { FormattedRelative } from '@kbn/i18n-react';
 import type { Severity } from '@kbn/securitysolution-io-ts-alerting-types';
 import { ALERT_RULE_NAME, ALERT_WORKFLOW_STATUS } from '@kbn/rule-data-utils';
-import { CellActionsMode } from '@kbn/cell-actions';
-import { SecurityCellActionsTrigger } from '../../../../actions/constants';
+import { SecurityCellActionsTrigger } from '../../../../app/actions/constants';
 import { useNavigateToAlertsPageWithFilters } from '../../../../common/hooks/use_navigate_to_alerts_page_with_filters';
 import { HeaderSection } from '../../../../common/components/header_section';
 
@@ -38,7 +37,7 @@ import { HoverVisibilityContainer } from '../../../../common/components/hover_vi
 import { BUTTON_CLASS as INSPECT_BUTTON_CLASS } from '../../../../common/components/inspect';
 import { LastUpdatedAt } from '../../../../common/components/last_updated_at';
 import { FormattedCount } from '../../../../common/components/formatted_number';
-import { SecurityCellActions } from '../../../../common/components/cell_actions';
+import { SecurityCellActions, CellActionsMode } from '../../../../common/components/cell_actions';
 import { useGlobalFilterQuery } from '../../../../common/hooks/use_global_filter_query';
 import { SourcererScopeName } from '../../../../common/store/sourcerer/model';
 
diff --git a/x-pack/plugins/security_solution/public/overview/components/detection_response/user_alerts_table/user_alerts_table.tsx b/x-pack/plugins/security_solution/public/overview/components/detection_response/user_alerts_table/user_alerts_table.tsx
index 6f9b57a1b727d1..bfa86d3ac2e404 100644
--- a/x-pack/plugins/security_solution/public/overview/components/detection_response/user_alerts_table/user_alerts_table.tsx
+++ b/x-pack/plugins/security_solution/public/overview/components/detection_response/user_alerts_table/user_alerts_table.tsx
@@ -20,8 +20,7 @@ import {
 } from '@elastic/eui';
 
 import { ALERT_SEVERITY } from '@kbn/rule-data-utils';
-import { CellActionsMode } from '@kbn/cell-actions';
-import { SecurityCellActionsTrigger } from '../../../../actions/constants';
+import { SecurityCellActionsTrigger } from '../../../../app/actions/constants';
 import { useNavigateToAlertsPageWithFilters } from '../../../../common/hooks/use_navigate_to_alerts_page_with_filters';
 import { FormattedCount } from '../../../../common/components/formatted_number';
 import { HeaderSection } from '../../../../common/components/header_section';
@@ -34,7 +33,7 @@ import * as i18n from '../translations';
 import { ITEMS_PER_PAGE, SEVERITY_COLOR } from '../utils';
 import type { UserAlertsItem } from './use_user_alerts_items';
 import { useUserAlertsItems } from './use_user_alerts_items';
-import { SecurityCellActions } from '../../../../common/components/cell_actions';
+import { SecurityCellActions, CellActionsMode } from '../../../../common/components/cell_actions';
 import { useGlobalFilterQuery } from '../../../../common/hooks/use_global_filter_query';
 import { SourcererScopeName } from '../../../../common/store/sourcerer/model';
 
diff --git a/x-pack/plugins/security_solution/public/overview/components/host_overview/endpoint_overview/index.tsx b/x-pack/plugins/security_solution/public/overview/components/host_overview/endpoint_overview/index.tsx
index ce1ec4cab8ef4b..0215ca442e2200 100644
--- a/x-pack/plugins/security_solution/public/overview/components/host_overview/endpoint_overview/index.tsx
+++ b/x-pack/plugins/security_solution/public/overview/components/host_overview/endpoint_overview/index.tsx
@@ -17,25 +17,24 @@ import { DefaultFieldRenderer } from '../../../../timelines/components/field_ren
 import * as i18n from './translations';
 import type { EndpointFields } from '../../../../../common/search_strategy/security_solution/hosts';
 import { HostPolicyResponseActionStatus } from '../../../../../common/search_strategy/security_solution/hosts';
-import type { SourcererScopeName } from '../../../../common/store/sourcerer/model';
 
 interface Props {
   contextID?: string;
   data: EndpointFields | null;
-  sourcererScopeId?: SourcererScopeName;
+  scopeId?: string;
 }
 
-export const EndpointOverview = React.memo<Props>(({ contextID, data, sourcererScopeId }) => {
+export const EndpointOverview = React.memo<Props>(({ contextID, data, scopeId }) => {
   const getDefaultRenderer = useCallback(
     (fieldName: string, fieldData: EndpointFields, attrName: string) => (
       <DefaultFieldRenderer
         rowItems={[getOr('', fieldName, fieldData)]}
         attrName={attrName}
         idPrefix={contextID ? `endpoint-overview-${contextID}` : 'endpoint-overview'}
-        sourcererScopeId={sourcererScopeId}
+        scopeId={scopeId}
       />
     ),
-    [contextID, sourcererScopeId]
+    [contextID, scopeId]
   );
   const descriptionLists: Readonly<DescriptionList[][]> = useMemo(() => {
     const appliedPolicy = data?.hostInfo?.metadata.Endpoint.policy.applied;
diff --git a/x-pack/plugins/security_solution/public/overview/components/host_overview/index.tsx b/x-pack/plugins/security_solution/public/overview/components/host_overview/index.tsx
index 92ff1435851173..6ac68b95227626 100644
--- a/x-pack/plugins/security_solution/public/overview/components/host_overview/index.tsx
+++ b/x-pack/plugins/security_solution/public/overview/components/host_overview/index.tsx
@@ -10,6 +10,9 @@ import { euiDarkVars as darkTheme, euiLightVars as lightTheme } from '@kbn/ui-th
 import { getOr } from 'lodash/fp';
 import React, { useCallback, useMemo } from 'react';
 import styled from 'styled-components';
+import { useGlobalTime } from '../../../common/containers/use_global_time';
+import { useQueryInspector } from '../../../common/components/page/manage_query';
+import { FIRST_RECORD_PAGINATION } from '../../../entity_analytics/common';
 import { useRiskScore } from '../../../entity_analytics/api/hooks/use_risk_score';
 import type { HostItem } from '../../../../common/search_strategy';
 import { buildHostNamesFilter, RiskScoreEntity } from '../../../../common/search_strategy';
@@ -37,12 +40,11 @@ import { EndpointOverview } from './endpoint_overview';
 import { OverviewDescriptionList } from '../../../common/components/overview_description_list';
 import { RiskScoreLevel } from '../../../entity_analytics/components/severity/common';
 import { RiskScoreHeaderTitle } from '../../../entity_analytics/components/risk_score_onboarding/risk_score_header_title';
-import type { SourcererScopeName } from '../../../common/store/sourcerer/model';
 import { RiskScoreDocTooltip } from '../common';
 
 interface HostSummaryProps {
   contextID?: string; // used to provide unique draggable context when viewing in the side panel
-  sourcererScopeId?: SourcererScopeName;
+  scopeId?: string;
   data: HostItem;
   id: string;
   isDraggable?: boolean;
@@ -63,11 +65,13 @@ const HostRiskOverviewWrapper = styled(EuiFlexGroup)`
   width: ${({ $width }: { $width: string }) => $width};
 `;
 
+export const HOST_OVERVIEW_RISK_SCORE_QUERY_ID = 'riskInputsTabQuery';
+
 export const HostOverview = React.memo<HostSummaryProps>(
   ({
     anomaliesData,
     contextID,
-    sourcererScopeId,
+    scopeId,
     data,
     endDate,
     id,
@@ -88,11 +92,29 @@ export const HostOverview = React.memo<HostSummaryProps>(
       () => (hostName ? buildHostNamesFilter([hostName]) : undefined),
       [hostName]
     );
+    const { deleteQuery, setQuery } = useGlobalTime();
 
-    const { data: hostRisk, isAuthorized } = useRiskScore({
+    const {
+      data: hostRisk,
+      isAuthorized,
+      inspect: inspectRiskScore,
+      loading: loadingRiskScore,
+      refetch: refetchRiskScore,
+    } = useRiskScore({
       filterQuery,
       riskEntity: RiskScoreEntity.host,
       skip: hostName == null,
+      onlyLatest: false,
+      pagination: FIRST_RECORD_PAGINATION,
+    });
+
+    useQueryInspector({
+      deleteQuery,
+      inspect: inspectRiskScore,
+      loading: loadingRiskScore,
+      queryId: HOST_OVERVIEW_RISK_SCORE_QUERY_ID,
+      refetch: refetchRiskScore,
+      setQuery,
     });
 
     const getDefaultRenderer = useCallback(
@@ -102,10 +124,10 @@ export const HostOverview = React.memo<HostSummaryProps>(
           attrName={fieldName}
           idPrefix={contextID ? `host-overview-${contextID}` : 'host-overview'}
           isDraggable={isDraggable}
-          sourcererScopeId={sourcererScopeId}
+          scopeId={scopeId}
         />
       ),
-      [contextID, isDraggable, sourcererScopeId]
+      [contextID, isDraggable, scopeId]
     );
 
     const [hostRiskScore, hostRiskLevel] = useMemo(() => {
@@ -233,7 +255,7 @@ export const HostOverview = React.memo<HostSummaryProps>(
                 rowItems={getOr([], 'host.ip', data)}
                 attrName={'host.ip'}
                 idPrefix={contextID ? `host-overview-${contextID}` : 'host-overview'}
-                sourcererScopeId={sourcererScopeId}
+                scopeId={scopeId}
                 isDraggable={isDraggable}
                 render={(ip) => (ip != null ? <NetworkDetailsLink ip={ip} /> : getEmptyTagValue())}
               />
@@ -270,7 +292,7 @@ export const HostOverview = React.memo<HostSummaryProps>(
           },
         ],
       ],
-      [contextID, sourcererScopeId, data, firstColumn, getDefaultRenderer, isDraggable]
+      [contextID, scopeId, data, firstColumn, getDefaultRenderer, isDraggable]
     );
     return (
       <>
@@ -317,11 +339,7 @@ export const HostOverview = React.memo<HostSummaryProps>(
           <>
             <EuiHorizontalRule />
             <OverviewWrapper direction={isInDetailsSidePanel ? 'column' : 'row'}>
-              <EndpointOverview
-                contextID={contextID}
-                data={data.endpoint}
-                sourcererScopeId={sourcererScopeId}
-              />
+              <EndpointOverview contextID={contextID} data={data.endpoint} scopeId={scopeId} />
 
               {loading && (
                 <Loader
diff --git a/x-pack/plugins/security_solution/public/overview/components/recent_timelines/recent_timelines.tsx b/x-pack/plugins/security_solution/public/overview/components/recent_timelines/recent_timelines.tsx
index 971f71990b723b..92ae01123dab91 100644
--- a/x-pack/plugins/security_solution/public/overview/components/recent_timelines/recent_timelines.tsx
+++ b/x-pack/plugins/security_solution/public/overview/components/recent_timelines/recent_timelines.tsx
@@ -5,14 +5,7 @@
  * 2.0.
  */
 
-import {
-  EuiFlexGroup,
-  EuiFlexItem,
-  EuiSpacer,
-  EuiText,
-  EuiToolTip,
-  EuiButtonIcon,
-} from '@elastic/eui';
+import { EuiSpacer, EuiText, EuiToolTip, EuiButtonIcon } from '@elastic/eui';
 import React, { useCallback, useMemo } from 'react';
 
 import styled from 'styled-components';
@@ -21,7 +14,7 @@ import type {
   OnOpenTimeline,
   OpenTimelineResult,
 } from '../../../timelines/components/open_timeline/types';
-import { WithHoverActions } from '../../../common/components/with_hover_actions';
+import { HoverPopover } from '../../../common/components/hover_popover';
 import { TimelineType } from '../../../../common/api/timeline';
 
 import { RecentTimelineCounts } from './counts';
@@ -53,56 +46,42 @@ const RecentTimelinesItem = React.memo<RecentTimelinesItemProps>(
       [onOpenTimeline, timeline.savedObjectId]
     );
 
-    const render = useCallback(
-      (showHoverContent) => (
-        <EuiFlexGroup
-          gutterSize="none"
-          justifyContent="spaceBetween"
-          data-test-subj="overview-recent-timelines"
-        >
-          <EuiFlexItem grow={false}>
-            <RecentTimelineHeader onOpenTimeline={onOpenTimeline} timeline={timeline} />
-            <RecentTimelineCounts timeline={timeline} />
-            {timeline.description && timeline.description.length && (
-              <EuiText color="subdued" size="xs">
-                <ClampText>{timeline.description}</ClampText>
-              </EuiText>
-            )}
-          </EuiFlexItem>
-
-          {showHoverContent && (
-            <EuiFlexItem grow={false}>
-              <EuiToolTip
-                content={
+    return (
+      <>
+        <HoverPopover
+          anchorPosition="rightDown"
+          hoverContent={
+            <EuiToolTip
+              content={
+                timeline.timelineType === TimelineType.default
+                  ? i18n.OPEN_AS_DUPLICATE
+                  : i18n.OPEN_AS_DUPLICATE_TEMPLATE
+              }
+            >
+              <EuiButtonIcon
+                aria-label={
                   timeline.timelineType === TimelineType.default
                     ? i18n.OPEN_AS_DUPLICATE
                     : i18n.OPEN_AS_DUPLICATE_TEMPLATE
                 }
-              >
-                <EuiButtonIcon
-                  aria-label={
-                    timeline.timelineType === TimelineType.default
-                      ? i18n.OPEN_AS_DUPLICATE
-                      : i18n.OPEN_AS_DUPLICATE_TEMPLATE
-                  }
-                  data-test-subj="open-duplicate"
-                  isDisabled={timeline.savedObjectId == null}
-                  iconSize="s"
-                  iconType="copy"
-                  onClick={handleClick}
-                  size="s"
-                />
-              </EuiToolTip>
-            </EuiFlexItem>
+                data-test-subj="open-duplicate"
+                isDisabled={timeline.savedObjectId == null}
+                iconSize="s"
+                iconType="copy"
+                onClick={handleClick}
+                size="s"
+              />
+            </EuiToolTip>
+          }
+        >
+          <RecentTimelineHeader onOpenTimeline={onOpenTimeline} timeline={timeline} />
+          <RecentTimelineCounts timeline={timeline} />
+          {timeline.description && timeline.description.length && (
+            <EuiText color="subdued" size="xs">
+              <ClampText>{timeline.description}</ClampText>
+            </EuiText>
           )}
-        </EuiFlexGroup>
-      ),
-      [handleClick, onOpenTimeline, timeline]
-    );
-
-    return (
-      <>
-        <WithHoverActions render={render} />
+        </HoverPopover>
         <>{!isLastItem && <EuiSpacer size="l" />}</>
       </>
     );
@@ -142,7 +121,7 @@ export const RecentTimelines = React.memo<RecentTimelinesProps>(
       );
     }
 
-    return <>{content}</>;
+    return <div data-test-subj="overview-recent-timelines">{content}</div>;
   }
 );
 
diff --git a/x-pack/plugins/security_solution/public/overview/components/user_overview/index.tsx b/x-pack/plugins/security_solution/public/overview/components/user_overview/index.tsx
index bd9e56dffee8d4..30e528509b9c1a 100644
--- a/x-pack/plugins/security_solution/public/overview/components/user_overview/index.tsx
+++ b/x-pack/plugins/security_solution/public/overview/components/user_overview/index.tsx
@@ -10,6 +10,9 @@ import { euiDarkVars as darkTheme, euiLightVars as lightTheme } from '@kbn/ui-th
 import { getOr } from 'lodash/fp';
 import React, { useCallback, useMemo } from 'react';
 import styled from 'styled-components';
+import { useGlobalTime } from '../../../common/containers/use_global_time';
+import { FIRST_RECORD_PAGINATION } from '../../../entity_analytics/common';
+import { useQueryInspector } from '../../../common/components/page/manage_query';
 import { useRiskScore } from '../../../entity_analytics/api/hooks/use_risk_score';
 import { buildUserNamesFilter, RiskScoreEntity } from '../../../../common/search_strategy';
 import type { DescriptionList } from '../../../../common/utility_types';
@@ -35,12 +38,11 @@ import { OverviewDescriptionList } from '../../../common/components/overview_des
 import { RiskScoreLevel } from '../../../entity_analytics/components/severity/common';
 import type { UserItem } from '../../../../common/search_strategy/security_solution/users/common';
 import { RiskScoreHeaderTitle } from '../../../entity_analytics/components/risk_score_onboarding/risk_score_header_title';
-import type { SourcererScopeName } from '../../../common/store/sourcerer/model';
 import { RiskScoreDocTooltip } from '../common';
 
 export interface UserSummaryProps {
   contextID?: string; // used to provide unique draggable context when viewing in the side panel
-  sourcererScopeId?: SourcererScopeName;
+  scopeId?: string;
   data: UserItem;
   id: string;
   isDraggable?: boolean;
@@ -61,11 +63,13 @@ const UserRiskOverviewWrapper = styled(EuiFlexGroup)`
   width: ${({ $width }: { $width: string }) => $width};
 `;
 
+export const USER_OVERVIEW_RISK_SCORE_QUERY_ID = 'riskInputsTabQuery';
+
 export const UserOverview = React.memo<UserSummaryProps>(
   ({
     anomaliesData,
     contextID,
-    sourcererScopeId,
+    scopeId,
     data,
     id,
     isDraggable = false,
@@ -86,11 +90,29 @@ export const UserOverview = React.memo<UserSummaryProps>(
       () => (userName ? buildUserNamesFilter([userName]) : undefined),
       [userName]
     );
+    const { deleteQuery, setQuery } = useGlobalTime();
 
-    const { data: userRisk, isAuthorized } = useRiskScore({
+    const {
+      data: userRisk,
+      isAuthorized,
+      inspect: inspectRiskScore,
+      loading: loadingRiskScore,
+      refetch: refetchRiskScore,
+    } = useRiskScore({
       filterQuery,
       skip: userName == null,
       riskEntity: RiskScoreEntity.user,
+      onlyLatest: false,
+      pagination: FIRST_RECORD_PAGINATION,
+    });
+
+    useQueryInspector({
+      deleteQuery,
+      inspect: inspectRiskScore,
+      loading: loadingRiskScore,
+      queryId: USER_OVERVIEW_RISK_SCORE_QUERY_ID,
+      refetch: refetchRiskScore,
+      setQuery,
     });
 
     const getDefaultRenderer = useCallback(
@@ -100,10 +122,10 @@ export const UserOverview = React.memo<UserSummaryProps>(
           attrName={fieldName}
           idPrefix={contextID ? `user-overview-${contextID}` : 'user-overview'}
           isDraggable={isDraggable}
-          sourcererScopeId={sourcererScopeId}
+          scopeId={scopeId}
         />
       ),
-      [contextID, isDraggable, sourcererScopeId]
+      [contextID, isDraggable, scopeId]
     );
 
     const [userRiskScore, userRiskLevel] = useMemo(() => {
@@ -245,7 +267,7 @@ export const UserOverview = React.memo<UserSummaryProps>(
                 rowItems={getOr([], 'host.ip', data)}
                 attrName={'host.ip'}
                 idPrefix={contextID ? `user-overview-${contextID}` : 'user-overview'}
-                sourcererScopeId={sourcererScopeId}
+                scopeId={scopeId}
                 isDraggable={isDraggable}
                 render={(ip) => (ip != null ? <NetworkDetailsLink ip={ip} /> : getEmptyTagValue())}
               />
@@ -258,7 +280,7 @@ export const UserOverview = React.memo<UserSummaryProps>(
         indexPatterns,
         getDefaultRenderer,
         contextID,
-        sourcererScopeId,
+        scopeId,
         isDraggable,
         userName,
         firstColumn,
diff --git a/x-pack/plugins/security_solution/public/overview/pages/detection_response.tsx b/x-pack/plugins/security_solution/public/overview/pages/detection_response.tsx
index edfda063ac5baf..3da5612254215c 100644
--- a/x-pack/plugins/security_solution/public/overview/pages/detection_response.tsx
+++ b/x-pack/plugins/security_solution/public/overview/pages/detection_response.tsx
@@ -4,7 +4,7 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-import React from 'react';
+import React, { useMemo } from 'react';
 import { EuiFlexGroup, EuiFlexItem, EuiLoadingSpinner } from '@elastic/eui';
 import type { DocLinks } from '@kbn/doc-links';
 import { APP_ID } from '../../../common';
@@ -43,6 +43,8 @@ const DetectionResponseComponent = () => {
   const canReadCases = userCasesPermissions.read;
   const canReadAlerts = hasKibanaREAD && hasIndexRead;
   const isSocTrendsEnabled = useIsExperimentalFeatureEnabled('socTrendsEnabled');
+  const additionalFilters = useMemo(() => (filterQuery ? [filterQuery] : []), [filterQuery]);
+
   if (!canReadAlerts && !canReadCases) {
     return <NoPrivileges docLinkSelector={(docLinks: DocLinks) => docLinks.siem.privileges} />;
   }
@@ -66,7 +68,7 @@ const DetectionResponseComponent = () => {
                       <EuiFlexItem>
                         <AlertsByStatus
                           signalIndexName={signalIndexName}
-                          additionalFilters={filterQuery ? [filterQuery] : undefined}
+                          additionalFilters={additionalFilters}
                         />
                       </EuiFlexItem>
                     )}
diff --git a/x-pack/plugins/security_solution/public/plugin.tsx b/x-pack/plugins/security_solution/public/plugin.tsx
index dfadc74330281c..7b0ff954371c03 100644
--- a/x-pack/plugins/security_solution/public/plugin.tsx
+++ b/x-pack/plugins/security_solution/public/plugin.tsx
@@ -16,7 +16,6 @@ import type {
   CoreStart,
   PluginInitializerContext,
   Plugin as IPlugin,
-  AppMount,
 } from '@kbn/core/public';
 import { DEFAULT_APP_CATEGORIES } from '@kbn/core/public';
 import { Storage } from '@kbn/kibana-utils-plugin/public';
@@ -33,7 +32,7 @@ import type {
   StartedSubPlugins,
   StartPluginsDependencies,
 } from './types';
-import { SOLUTION_NAME } from './common/translations';
+import { SOLUTION_NAME, ASSISTANT_MANAGEMENT_TITLE } from './common/translations';
 
 import { APP_ID, APP_UI_ID, APP_PATH, APP_ICON_SOLUTION } from '../common/constants';
 
@@ -94,93 +93,18 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
   ): PluginSetup {
     this.services.setup(core, plugins);
 
-    const { home, triggersActionsUi, usageCollection, management } = plugins;
+    const { home, triggersActionsUi, usageCollection, management, cases } = plugins;
 
-    const assistantManagementTitle = i18n.translate(
-      'xpack.securitySolution.securityAiAssistantManagement.app.title',
-      {
-        defaultMessage: 'AI Assistant for Security',
-      }
-    );
-
-    if (home) {
-      home.featureCatalogue.registerSolution({
-        id: APP_ID,
-        title: SOLUTION_NAME,
-        description: i18n.translate('xpack.securitySolution.featureCatalogueDescription', {
-          defaultMessage:
-            'Prevent, collect, detect, and respond to threats for unified protection across your infrastructure.',
-        }),
-        icon: 'logoSecurity',
-        path: APP_PATH,
-        order: 300,
-      });
-
-      home.featureCatalogue.register({
-        id: 'ai_assistant_security',
-        title: assistantManagementTitle,
-        description: i18n.translate(
-          'xpack.securitySolution.securityAiAssistantManagement.app.description',
-          {
-            defaultMessage: 'Manage your AI Assistant for Security.',
-          }
-        ),
-        icon: 'sparkles',
-        path: '/app/management/kibana/securityAiAssistantManagement',
-        showOnHomePage: false,
-        category: 'admin',
-      });
-
-      if (management) {
-        management.sections.section.kibana.registerApp({
-          id: 'securityAiAssistantManagement',
-          title: assistantManagementTitle,
-          hideFromSidebar: true,
-          order: 1,
-          mount: async (params) => {
-            // required to show the alert table inside cases
-            const { alertsTableConfigurationRegistry } = plugins.triggersActionsUi;
-            const { registerAlertsTableConfiguration } =
-              await this.lazyRegisterAlertsTableConfiguration();
-            registerAlertsTableConfiguration(alertsTableConfigurationRegistry, this.storage);
-
-            const [coreStart, startPlugins] = await core.getStartServices();
-            const subPlugins = await this.startSubPlugins(this.storage, coreStart, startPlugins);
-            const store = await this.store(coreStart, startPlugins, subPlugins);
-            const services = await this.services.generateServices(coreStart, startPlugins);
-            await this.registerActions(store, params.history, core, services);
-
-            const { renderApp } = await this.lazyApplicationDependencies();
-            const { ManagementSettings } = await this.lazyAssistantSettingsManagement();
-
-            return renderApp({
-              ...params,
-              services,
-              store,
-              usageCollection: plugins.usageCollection,
-              children: <ManagementSettings />,
-            });
-          },
-        });
-      }
-    }
-
-    const mount: AppMount = async (params) => {
+    // Lazily instantiate subPlugins and initialize services
+    const mountDependencies = async (params?: AppMountParameters) => {
+      const { renderApp } = await this.lazyApplicationDependencies();
       const [coreStart, startPlugins] = await core.getStartServices();
-      const services = await this.services.generateServices(coreStart, startPlugins, params);
 
       const subPlugins = await this.startSubPlugins(this.storage, coreStart, startPlugins);
       const store = await this.store(coreStart, startPlugins, subPlugins);
 
-      const { renderApp } = await this.lazyApplicationDependencies();
-      const { getSubPluginRoutesByCapabilities } = await this.lazyHelpersForRoutes();
-
-      await this.registerActions(store, params.history, core, services);
-      await this.registerAlertsTableConfiguration(triggersActionsUi);
-
-      const subPluginRoutes = getSubPluginRoutesByCapabilities(subPlugins, services);
-
-      return renderApp({ ...params, services, store, usageCollection, subPluginRoutes });
+      const services = await this.services.generateServices(coreStart, startPlugins, params);
+      return { renderApp, subPlugins, store, services };
     };
 
     // Register main Security Solution plugin
@@ -192,7 +116,17 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
       updater$: this.appUpdater$,
       visibleIn: ['globalSearch', 'home', 'kibanaOverview'],
       euiIconType: APP_ICON_SOLUTION,
-      mount,
+      mount: async (params) => {
+        const { renderApp, services, store, subPlugins } = await mountDependencies(params);
+        const { getSubPluginRoutesByCapabilities } = await this.lazyHelpersForRoutes();
+
+        await this.registerActions(store, params.history, core, services);
+        await this.registerAlertsTableConfiguration(triggersActionsUi);
+
+        const subPluginRoutes = getSubPluginRoutesByCapabilities(subPlugins, services);
+
+        return renderApp({ ...params, services, store, usageCollection, subPluginRoutes });
+      },
     });
 
     // Register legacy SIEM app for backward compatibility
@@ -215,7 +149,53 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
       },
     });
 
-    plugins.cases?.attachmentFramework.registerExternalReference(
+    home?.featureCatalogue.registerSolution({
+      id: APP_ID,
+      title: SOLUTION_NAME,
+      description: i18n.translate('xpack.securitySolution.featureCatalogueDescription', {
+        defaultMessage:
+          'Prevent, collect, detect, and respond to threats for unified protection across your infrastructure.',
+      }),
+      icon: 'logoSecurity',
+      path: APP_PATH,
+      order: 300,
+    });
+
+    home?.featureCatalogue.register({
+      id: 'ai_assistant_security',
+      title: ASSISTANT_MANAGEMENT_TITLE,
+      description: i18n.translate(
+        'xpack.securitySolution.securityAiAssistantManagement.app.description',
+        {
+          defaultMessage: 'Manage your AI Assistant for Security.',
+        }
+      ),
+      icon: 'sparkles',
+      path: '/app/management/kibana/securityAiAssistantManagement',
+      showOnHomePage: false,
+      category: 'admin',
+    });
+
+    management?.sections.section.kibana.registerApp({
+      id: 'securityAiAssistantManagement',
+      title: ASSISTANT_MANAGEMENT_TITLE,
+      hideFromSidebar: true,
+      order: 1,
+      mount: async (params) => {
+        const { renderApp, services, store } = await mountDependencies();
+        const { ManagementSettings } = await this.lazyAssistantSettingsManagement();
+
+        return renderApp({
+          ...params,
+          services,
+          store,
+          usageCollection,
+          children: <ManagementSettings />,
+        });
+      },
+    });
+
+    cases?.attachmentFramework.registerExternalReference(
       getExternalReferenceAttachmentEndpointRegular()
     );
 
@@ -338,9 +318,7 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
     const subPlugins = await this.createSubPlugins();
     return {
       alerts: subPlugins.alerts.start(storage),
-      attackDiscovery: subPlugins.attackDiscovery.start(
-        this.experimentalFeatures.attackDiscoveryEnabled
-      ),
+      attackDiscovery: subPlugins.attackDiscovery.start(),
       cases: subPlugins.cases.start(),
       cloudDefend: subPlugins.cloudDefend.start(),
       cloudSecurityPosture: subPlugins.cloudSecurityPosture.start(),
@@ -523,8 +501,8 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
      * See https://webpack.js.org/api/module-methods/#magic-comments
      */
     return import(
-      /* webpackChunkName: "actions" */
-      './actions'
+      /* webpackChunkName: "lazy_actions" */
+      './lazy_actions'
     );
   }
 
@@ -534,7 +512,7 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
      * See https://webpack.js.org/api/module-methods/#magic-comments
      */
     return import(
-      /* webpackChunkName: "actions" */
+      /* webpackChunkName: "lazy_assistant_settings_management" */
       './lazy_assistant_settings_management'
     );
   }
diff --git a/x-pack/plugins/security_solution/public/plugin_services.ts b/x-pack/plugins/security_solution/public/plugin_services.ts
index dceb1597715cfa..38ac65c08c8be5 100644
--- a/x-pack/plugins/security_solution/public/plugin_services.ts
+++ b/x-pack/plugins/security_solution/public/plugin_services.ts
@@ -6,7 +6,7 @@
  */
 
 import type { AppMountParameters, CoreSetup, CoreStart, PackageInfo } from '@kbn/core/public';
-import { FilterManager, NowProvider, QueryService } from '@kbn/data-plugin/public';
+import { NowProvider, QueryService } from '@kbn/data-plugin/public';
 import type { DataPublicPluginStart, QueryStart } from '@kbn/data-plugin/public';
 import { Storage } from '@kbn/kibana-utils-plugin/public';
 import { initTelemetry, TelemetryService } from './common/lib/telemetry';
@@ -31,6 +31,7 @@ import type {
 export class PluginServices {
   private readonly telemetry: TelemetryService = new TelemetryService();
   private readonly queryService: QueryService = new QueryService();
+  private readonly timelineQueryService: QueryService = new QueryService();
   private readonly storage = new Storage(localStorage);
   private readonly sessionStorage = new Storage(sessionStorage);
 
@@ -69,7 +70,13 @@ export class PluginServices {
       { prebuiltRulesPackageVersion: this.prebuiltRulesPackageVersion }
     );
 
-    this.queryService?.setup({
+    this.queryService.setup({
+      uiSettings: coreSetup.uiSettings,
+      storage: this.storage,
+      nowProvider: new NowProvider(),
+    });
+
+    this.timelineQueryService.setup({
       uiSettings: coreSetup.uiSettings,
       storage: this.storage,
       nowProvider: new NowProvider(),
@@ -92,6 +99,7 @@ export class PluginServices {
 
   public stop() {
     this.queryService.stop();
+    this.timelineQueryService.stop();
     licenseService.stop();
   }
 
@@ -105,12 +113,23 @@ export class PluginServices {
 
     const { savedObjectsTaggingOss, ...plugins } = startPlugins;
 
-    const query = this.queryService.start({
-      uiSettings: coreStart.uiSettings,
-      storage: this.storage,
-      http: coreStart.http,
-    });
-    const customDataService = this.startCustomDataService(query, startPlugins.data);
+    const customDataService = this.startCustomDataService(
+      this.queryService.start({
+        uiSettings: coreStart.uiSettings,
+        storage: this.storage,
+        http: coreStart.http,
+      }),
+      startPlugins.data
+    );
+
+    const timelineDataService = this.startTimelineDataService(
+      this.timelineQueryService.start({
+        uiSettings: coreStart.uiSettings,
+        storage: this.storage,
+        http: coreStart.http,
+      }),
+      startPlugins.data
+    );
 
     return {
       ...coreStart,
@@ -119,17 +138,19 @@ export class PluginServices {
       apm,
       configSettings: this.configSettings,
       savedObjectsTagging: savedObjectsTaggingOss.getTaggingApi(),
-      ...(params?.setHeaderActionMenu ? { setHeaderActionMenu: params.setHeaderActionMenu } : {}),
       storage: this.storage,
       sessionStorage: this.sessionStorage,
       security: startPlugins.security,
-      ...(params?.onAppLeave ? { onAppLeave: params.onAppLeave } : {}),
       securityLayout: { getPluginWrapper: () => SecuritySolutionTemplateWrapper },
       contentManagement: startPlugins.contentManagement,
       telemetry: this.telemetry.start(),
       customDataService,
+      timelineDataService,
       topValuesPopover: new TopValuesPopoverService(),
-      timelineFilterManager: new FilterManager(coreStart.uiSettings),
+      ...(params && {
+        onAppLeave: params.onAppLeave,
+        setHeaderActionMenu: params.setHeaderActionMenu,
+      }),
     };
   }
 
@@ -150,4 +171,12 @@ export class PluginServices {
     customDataService.query.filterManager._name = 'customFilterManager';
     return customDataService;
   };
+
+  private startTimelineDataService = (query: QueryStart, data: DataPublicPluginStart) => {
+    // Used in the unified timeline
+    return {
+      ...data,
+      query,
+    };
+  };
 }
diff --git a/x-pack/plugins/security_solution/public/timelines/components/field_renderers/__snapshots__/field_renderers.test.tsx.snap b/x-pack/plugins/security_solution/public/timelines/components/field_renderers/__snapshots__/field_renderers.test.tsx.snap
index 270ca0c6c54b77..fd6498075112b8 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/field_renderers/__snapshots__/field_renderers.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/timelines/components/field_renderers/__snapshots__/field_renderers.test.tsx.snap
@@ -17,28 +17,28 @@ exports[`Field Renderers #autonomousSystemRenderer it renders correctly against
       class="euiFlexItem emotion-euiFlexItem-growZero"
     >
       <div
-        class=""
+        data-test-subj="cellActions-renderContent-source.as.organization.name"
       >
-        <div
-          class="euiPopover emotion-euiPopover-inline-block"
-        >
+        <div>
           <div
-            data-test-subj="withHoverActionsButton"
+            class="euiPopover emotion-euiPopover-inline-block"
           >
-            <div
-              data-provider-id="draggableId.content.autonomous-system-renderer-default-draggable-ip-overview-source_as_organization_name"
-              tabindex="-1"
-            >
-              <span
-                class="c0"
-                data-test-subj="render-content-source.as.organization.name"
+            <div>
+              <div
+                data-provider-id="draggableId.content.autonomous-system-renderer-default-draggable-ip-overview-source_as_organization_name"
+                tabindex="-1"
               >
                 <span
-                  class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
+                  class="c0"
+                  data-test-subj="render-content-source.as.organization.name"
                 >
-                  Test Org
+                  <span
+                    class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
+                  >
+                    Test Org
+                  </span>
                 </span>
-              </span>
+              </div>
             </div>
           </div>
         </div>
@@ -53,28 +53,28 @@ exports[`Field Renderers #autonomousSystemRenderer it renders correctly against
       class="euiFlexItem emotion-euiFlexItem-growZero"
     >
       <div
-        class=""
+        data-test-subj="cellActions-renderContent-source.as.number"
       >
-        <div
-          class="euiPopover emotion-euiPopover-inline-block"
-        >
+        <div>
           <div
-            data-test-subj="withHoverActionsButton"
+            class="euiPopover emotion-euiPopover-inline-block"
           >
-            <div
-              data-provider-id="draggableId.content.autonomous-system-renderer-default-draggable-ip-overview-source_as_number"
-              tabindex="-1"
-            >
-              <span
-                class="c0"
-                data-test-subj="render-content-source.as.number"
+            <div>
+              <div
+                data-provider-id="draggableId.content.autonomous-system-renderer-default-draggable-ip-overview-source_as_number"
+                tabindex="-1"
               >
                 <span
-                  class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
+                  class="c0"
+                  data-test-subj="render-content-source.as.number"
                 >
-                  12345
+                  <span
+                    class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
+                  >
+                    12345
+                  </span>
                 </span>
-              </span>
+              </div>
             </div>
           </div>
         </div>
@@ -105,35 +105,35 @@ exports[`Field Renderers #hostIdRenderer it renders correctly against snapshot 1
 }
 
 <div
-    class=""
+    data-test-subj="cellActions-renderContent-host.name"
   >
-    <div
-      class="euiPopover emotion-euiPopover-inline-block"
-    >
+    <div>
       <div
-        data-test-subj="withHoverActionsButton"
+        class="euiPopover emotion-euiPopover-inline-block"
       >
-        <div
-          data-provider-id="draggableId.content.host-name-renderer-default-draggable-ip-overview-host-name"
-          tabindex="-1"
-        >
-          <span
-            class="c0"
-            data-test-subj="render-content-host.name"
+        <div>
+          <div
+            data-provider-id="draggableId.content.host-name-renderer-default-draggable-ip-overview-host-name"
+            tabindex="-1"
           >
             <span
-              class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
+              class="c0"
+              data-test-subj="render-content-host.name"
             >
-              <a
-                class="euiLink emotion-euiLink-primary"
-                data-test-subj="host-details-button"
-                href="securitySolutionUI/hosts/name/raspberrypi"
-                rel="noreferrer"
+              <span
+                class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
               >
-                raspberrypi
-              </a>
+                <a
+                  class="euiLink emotion-euiLink-primary"
+                  data-test-subj="host-details-button"
+                  href="securitySolutionUI/hosts/name/raspberrypi"
+                  rel="noreferrer"
+                >
+                  raspberrypi
+                </a>
+              </span>
             </span>
-          </span>
+          </div>
         </div>
       </div>
     </div>
@@ -152,35 +152,35 @@ exports[`Field Renderers #hostNameRenderer it renders correctly against snapshot
 }
 
 <div
-    class=""
+    data-test-subj="cellActions-renderContent-host.name"
   >
-    <div
-      class="euiPopover emotion-euiPopover-inline-block"
-    >
+    <div>
       <div
-        data-test-subj="withHoverActionsButton"
+        class="euiPopover emotion-euiPopover-inline-block"
       >
-        <div
-          data-provider-id="draggableId.content.host-name-renderer-default-draggable-ip-overview-host-name"
-          tabindex="-1"
-        >
-          <span
-            class="c0"
-            data-test-subj="render-content-host.name"
+        <div>
+          <div
+            data-provider-id="draggableId.content.host-name-renderer-default-draggable-ip-overview-host-name"
+            tabindex="-1"
           >
             <span
-              class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
+              class="c0"
+              data-test-subj="render-content-host.name"
             >
-              <a
-                class="euiLink emotion-euiLink-primary"
-                data-test-subj="host-details-button"
-                href="securitySolutionUI/hosts/name/raspberrypi"
-                rel="noreferrer"
+              <span
+                class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
               >
-                raspberrypi
-              </a>
+                <a
+                  class="euiLink emotion-euiLink-primary"
+                  data-test-subj="host-details-button"
+                  href="securitySolutionUI/hosts/name/raspberrypi"
+                  rel="noreferrer"
+                >
+                  raspberrypi
+                </a>
+              </span>
             </span>
-          </span>
+          </div>
         </div>
       </div>
     </div>
@@ -205,28 +205,28 @@ exports[`Field Renderers #locationRenderer it renders correctly against snapshot
       class="euiFlexItem emotion-euiFlexItem-growZero"
     >
       <div
-        class=""
+        data-test-subj="cellActions-renderContent-source.geo.city_name"
       >
-        <div
-          class="euiPopover emotion-euiPopover-inline-block"
-        >
+        <div>
           <div
-            data-test-subj="withHoverActionsButton"
+            class="euiPopover emotion-euiPopover-inline-block"
           >
-            <div
-              data-provider-id="draggableId.content.location-renderer-default-draggable-ip-overview-source_geo_city_name"
-              tabindex="-1"
-            >
-              <span
-                class="c0"
-                data-test-subj="render-content-source.geo.city_name"
+            <div>
+              <div
+                data-provider-id="draggableId.content.location-renderer-default-draggable-ip-overview-source_geo_city_name"
+                tabindex="-1"
               >
                 <span
-                  class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
+                  class="c0"
+                  data-test-subj="render-content-source.geo.city_name"
                 >
-                  New York
+                  <span
+                    class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
+                  >
+                    New York
+                  </span>
                 </span>
-              </span>
+              </div>
             </div>
           </div>
         </div>
@@ -237,28 +237,28 @@ exports[`Field Renderers #locationRenderer it renders correctly against snapshot
       class="euiFlexItem emotion-euiFlexItem-growZero"
     >
       <div
-        class=""
+        data-test-subj="cellActions-renderContent-source.geo.region_name"
       >
-        <div
-          class="euiPopover emotion-euiPopover-inline-block"
-        >
+        <div>
           <div
-            data-test-subj="withHoverActionsButton"
+            class="euiPopover emotion-euiPopover-inline-block"
           >
-            <div
-              data-provider-id="draggableId.content.location-renderer-default-draggable-ip-overview-source_geo_region_name"
-              tabindex="-1"
-            >
-              <span
-                class="c0"
-                data-test-subj="render-content-source.geo.region_name"
+            <div>
+              <div
+                data-provider-id="draggableId.content.location-renderer-default-draggable-ip-overview-source_geo_region_name"
+                tabindex="-1"
               >
                 <span
-                  class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
+                  class="c0"
+                  data-test-subj="render-content-source.geo.region_name"
                 >
-                  New York
+                  <span
+                    class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
+                  >
+                    New York
+                  </span>
                 </span>
-              </span>
+              </div>
             </div>
           </div>
         </div>
diff --git a/x-pack/plugins/security_solution/public/timelines/components/field_renderers/field_renderers.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/field_renderers/field_renderers.test.tsx
index d9edcb4cf0695b..c6d5c657d77909 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/field_renderers/field_renderers.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/field_renderers/field_renderers.test.tsx
@@ -43,7 +43,8 @@ describe('Field Renderers', () => {
   describe('#locationRenderer', () => {
     test('it renders correctly against snapshot', () => {
       const { asFragment } = render(
-        locationRenderer(['source.geo.city_name', 'source.geo.region_name'], mockData.complete)
+        locationRenderer(['source.geo.city_name', 'source.geo.region_name'], mockData.complete),
+        { wrapper: TestProviders }
       );
 
       expect(asFragment()).toMatchSnapshot();
@@ -66,7 +67,9 @@ describe('Field Renderers', () => {
 
   describe('#dateRenderer', () => {
     test('it renders correctly against snapshot', () => {
-      const { asFragment } = render(dateRenderer(mockData.complete.source?.firstSeen));
+      const { asFragment } = render(dateRenderer(mockData.complete.source?.firstSeen), {
+        wrapper: TestProviders,
+      });
 
       expect(asFragment()).toMatchSnapshot();
     });
@@ -83,7 +86,8 @@ describe('Field Renderers', () => {
 
     test('it renders correctly against snapshot', () => {
       const { asFragment } = render(
-        autonomousSystemRenderer(mockData.complete.source!.autonomousSystem!, FlowTarget.source)
+        autonomousSystemRenderer(mockData.complete.source!.autonomousSystem!, FlowTarget.source),
+        { wrapper: TestProviders }
       );
 
       expect(asFragment()).toMatchSnapshot();
diff --git a/x-pack/plugins/security_solution/public/timelines/components/field_renderers/field_renderers.tsx b/x-pack/plugins/security_solution/public/timelines/components/field_renderers/field_renderers.tsx
index afdb79365ff5cd..4d676843244235 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/field_renderers/field_renderers.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/field_renderers/field_renderers.tsx
@@ -12,6 +12,7 @@ import React, { useCallback, Fragment, useMemo, useState, useContext } from 'rea
 import styled from 'styled-components';
 
 import type { HostEcs } from '@kbn/securitysolution-ecs';
+import { getSourcererScopeId } from '../../../helpers';
 import {
   SecurityCellActions,
   CellActionsMode,
@@ -200,7 +201,6 @@ interface DefaultFieldRendererProps {
   moreMaxHeight?: string;
   render?: (item: string) => React.ReactNode;
   rowItems: string[] | null | undefined;
-  sourcererScopeId?: SourcererScopeName;
   scopeId?: string;
 }
 
@@ -212,7 +212,6 @@ export const DefaultFieldRendererComponent: React.FC<DefaultFieldRendererProps>
   moreMaxHeight = DEFAULT_MORE_MAX_HEIGHT,
   render,
   rowItems,
-  sourcererScopeId,
   scopeId,
 }) => {
   if (rowItems != null && rowItems.length > 0) {
@@ -235,8 +234,8 @@ export const DefaultFieldRendererComponent: React.FC<DefaultFieldRendererProps>
               field={attrName}
               value={rowItem}
               isAggregatable={true}
-              fieldType={'keyword'}
               scopeId={scopeId}
+              fieldType={'keyword'}
             >
               {render ? render(rowItem) : rowItem}
             </DefaultDraggable>
@@ -261,7 +260,7 @@ export const DefaultFieldRendererComponent: React.FC<DefaultFieldRendererProps>
             overflowIndexStart={displayCount}
             render={render}
             rowItems={rowItems}
-            sourcererScopeId={sourcererScopeId}
+            scopeId={scopeId}
           />
         </EuiFlexItem>
       </DraggableContainerFlexGroup>
@@ -284,7 +283,7 @@ interface DefaultFieldRendererOverflowProps {
   render?: (item: string) => React.ReactNode;
   overflowIndexStart?: number;
   moreMaxHeight: string;
-  sourcererScopeId?: SourcererScopeName;
+  scopeId?: string;
 }
 
 interface MoreContainerProps {
@@ -294,20 +293,14 @@ interface MoreContainerProps {
   moreMaxHeight: string;
   overflowIndexStart: number;
   render?: (item: string) => React.ReactNode;
-  sourcererScopeId?: SourcererScopeName;
+  scopeId?: string;
 }
 
 export const MoreContainer = React.memo<MoreContainerProps>(
-  ({
-    fieldName,
-    idPrefix,
-    moreMaxHeight,
-    overflowIndexStart,
-    render,
-    values,
-    sourcererScopeId,
-  }) => {
+  ({ fieldName, idPrefix, moreMaxHeight, overflowIndexStart, render, values, scopeId }) => {
     const { timelineId } = useContext(TimelineContext);
+    const defaultedScopeId = scopeId ?? timelineId;
+    const sourcererScopeId = getSourcererScopeId(defaultedScopeId ?? '');
 
     const moreItemsWithHoverActions = useMemo(
       () =>
@@ -323,14 +316,9 @@ export const MoreContainer = React.memo<MoreContainerProps>(
                   visibleCellActions={5}
                   showActionTooltips
                   triggerId={SecurityCellActionsTrigger.DEFAULT}
-                  data={{
-                    value,
-                    field: fieldName,
-                  }}
+                  data={{ value, field: fieldName }}
                   sourcererScopeId={sourcererScopeId ?? SourcererScopeName.default}
-                  metadata={{
-                    scopeId: timelineId ?? undefined,
-                  }}
+                  metadata={{ scopeId: defaultedScopeId ?? undefined }}
                 >
                   <>{render ? render(value) : defaultToEmptyTag(value)}</>
                 </SecurityCellActions>
@@ -340,7 +328,7 @@ export const MoreContainer = React.memo<MoreContainerProps>(
 
           return acc;
         }, []),
-      [values, overflowIndexStart, idPrefix, fieldName, timelineId, render, sourcererScopeId]
+      [values, overflowIndexStart, idPrefix, fieldName, sourcererScopeId, defaultedScopeId, render]
     );
 
     return (
@@ -362,15 +350,7 @@ export const MoreContainer = React.memo<MoreContainerProps>(
 MoreContainer.displayName = 'MoreContainer';
 
 export const DefaultFieldRendererOverflow = React.memo<DefaultFieldRendererOverflowProps>(
-  ({
-    attrName,
-    idPrefix,
-    moreMaxHeight,
-    overflowIndexStart = 5,
-    render,
-    rowItems,
-    sourcererScopeId,
-  }) => {
+  ({ attrName, idPrefix, moreMaxHeight, overflowIndexStart = 5, render, rowItems, scopeId }) => {
     const [isOpen, setIsOpen] = useState(false);
     const togglePopover = useCallback(() => setIsOpen((currentIsOpen) => !currentIsOpen), []);
     const button = useMemo(
@@ -411,7 +391,7 @@ export const DefaultFieldRendererOverflow = React.memo<DefaultFieldRendererOverf
               values={rowItems}
               moreMaxHeight={moreMaxHeight}
               overflowIndexStart={overflowIndexStart}
-              sourcererScopeId={sourcererScopeId}
+              scopeId={scopeId}
             />
           </EuiPopover>
         )}
diff --git a/x-pack/plugins/security_solution/public/timelines/components/netflow/__snapshots__/index.test.tsx.snap b/x-pack/plugins/security_solution/public/timelines/components/netflow/__snapshots__/index.test.tsx.snap
index 6aa17ff879ccc1..ce3d8e7f58936d 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/netflow/__snapshots__/index.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/timelines/components/netflow/__snapshots__/index.test.tsx.snap
@@ -209,68 +209,68 @@ tr:hover .c2:focus::before {
               class="euiFlexItem emotion-euiFlexItem-growZero"
             >
               <div
-                class=""
+                data-test-subj="cellActions-renderContent-user.name"
               >
-                <div
-                  class="euiPopover emotion-euiPopover-inline-block"
-                >
+                <div>
                   <div
-                    data-test-subj="withHoverActionsButton"
+                    class="euiPopover emotion-euiPopover-inline-block"
                   >
-                    <div
-                      class="c1"
-                      data-test-subj="draggableWrapperDiv"
-                    >
+                    <div>
                       <div
-                        data-rfd-droppable-context-id="0"
-                        data-rfd-droppable-id="droppableId.content.draggable-badge-default-draggable-test-abcd-user_name-first_last"
+                        class="c1"
+                        data-test-subj="draggableWrapperDiv"
                       >
                         <div
-                          class="draggable-keyboard-wrapper"
-                          data-test-subj="draggableWrapperKeyboardHandler"
-                          role="button"
-                          tabindex="0"
+                          data-rfd-droppable-context-id="0"
+                          data-rfd-droppable-id="droppableId.content.draggable-badge-default-draggable-test-abcd-user_name-first_last"
                         >
                           <div
-                            aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                            class="c2"
-                            data-rfd-drag-handle-context-id="0"
-                            data-rfd-drag-handle-draggable-id="draggableId.content.draggable-badge-default-draggable-test-abcd-user_name-first_last"
-                            data-rfd-draggable-context-id="0"
-                            data-rfd-draggable-id="draggableId.content.draggable-badge-default-draggable-test-abcd-user_name-first_last"
-                            data-test-subj="providerContainer"
-                            draggable="false"
+                            class="draggable-keyboard-wrapper"
+                            data-test-subj="draggableWrapperKeyboardHandler"
                             role="button"
-                            tabindex="-1"
+                            tabindex="0"
                           >
-                            <span
-                              class="c3"
-                              data-test-subj="draggable-content-user.name"
+                            <div
+                              aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                              class="c2"
+                              data-rfd-drag-handle-context-id="0"
+                              data-rfd-drag-handle-draggable-id="draggableId.content.draggable-badge-default-draggable-test-abcd-user_name-first_last"
+                              data-rfd-draggable-context-id="0"
+                              data-rfd-draggable-id="draggableId.content.draggable-badge-default-draggable-test-abcd-user_name-first_last"
+                              data-test-subj="providerContainer"
+                              draggable="false"
+                              role="button"
+                              tabindex="-1"
                             >
                               <span
-                                class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
+                                class="c3"
+                                data-test-subj="draggable-content-user.name"
                               >
                                 <span
-                                  class="euiBadge c4 emotion-euiBadge-hollow"
-                                  title=""
+                                  class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                                 >
                                   <span
-                                    class="euiBadge__content emotion-euiBadge__content"
+                                    class="euiBadge c4 emotion-euiBadge-hollow"
+                                    title=""
                                   >
                                     <span
-                                      class="euiBadge__icon emotion-euiBadge__icon-left"
-                                      color="inherit"
-                                      data-euiicon-type="user"
-                                    />
-                                    <span
-                                      class="euiBadge__text emotion-euiBadge__text"
+                                      class="euiBadge__content emotion-euiBadge__content"
                                     >
-                                      first.last
+                                      <span
+                                        class="euiBadge__icon emotion-euiBadge__icon-left"
+                                        color="inherit"
+                                        data-euiicon-type="user"
+                                      />
+                                      <span
+                                        class="euiBadge__text emotion-euiBadge__text"
+                                      >
+                                        first.last
+                                      </span>
                                     </span>
                                   </span>
                                 </span>
                               </span>
-                            </span>
+                            </div>
                           </div>
                         </div>
                       </div>
@@ -283,71 +283,59 @@ tr:hover .c2:focus::before {
               class="euiFlexItem emotion-euiFlexItem-growZero"
             >
               <div
-                class=""
+                class="c1"
+                data-test-subj="draggableWrapperDiv"
               >
                 <div
-                  class="euiPopover emotion-euiPopover-inline-block"
+                  data-rfd-droppable-context-id="0"
+                  data-rfd-droppable-id="droppableId.content.draggable-badge-default-draggable-test-abcd-process_name-rat"
                 >
                   <div
-                    data-test-subj="withHoverActionsButton"
+                    class="draggable-keyboard-wrapper"
+                    data-test-subj="draggableWrapperKeyboardHandler"
+                    role="button"
+                    tabindex="0"
                   >
                     <div
-                      class="c1"
-                      data-test-subj="draggableWrapperDiv"
+                      aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                      class="c2"
+                      data-rfd-drag-handle-context-id="0"
+                      data-rfd-drag-handle-draggable-id="draggableId.content.draggable-badge-default-draggable-test-abcd-process_name-rat"
+                      data-rfd-draggable-context-id="0"
+                      data-rfd-draggable-id="draggableId.content.draggable-badge-default-draggable-test-abcd-process_name-rat"
+                      data-test-subj="providerContainer"
+                      draggable="false"
+                      role="button"
+                      tabindex="-1"
                     >
-                      <div
-                        data-rfd-droppable-context-id="0"
-                        data-rfd-droppable-id="droppableId.content.draggable-badge-default-draggable-test-abcd-process_name-rat"
+                      <span
+                        class="c3"
+                        data-test-subj="draggable-content-process.name"
                       >
-                        <div
-                          class="draggable-keyboard-wrapper"
-                          data-test-subj="draggableWrapperKeyboardHandler"
-                          role="button"
-                          tabindex="0"
+                        <span
+                          class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                         >
-                          <div
-                            aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                            class="c2"
-                            data-rfd-drag-handle-context-id="0"
-                            data-rfd-drag-handle-draggable-id="draggableId.content.draggable-badge-default-draggable-test-abcd-process_name-rat"
-                            data-rfd-draggable-context-id="0"
-                            data-rfd-draggable-id="draggableId.content.draggable-badge-default-draggable-test-abcd-process_name-rat"
-                            data-test-subj="providerContainer"
-                            draggable="false"
-                            role="button"
-                            tabindex="-1"
+                          <span
+                            class="euiBadge c4 emotion-euiBadge-hollow"
+                            title=""
                           >
                             <span
-                              class="c3"
-                              data-test-subj="draggable-content-process.name"
+                              class="euiBadge__content emotion-euiBadge__content"
                             >
                               <span
-                                class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
+                                class="euiBadge__icon emotion-euiBadge__icon-left"
+                                color="inherit"
+                                data-euiicon-type="console"
+                              />
+                              <span
+                                class="euiBadge__text emotion-euiBadge__text"
                               >
-                                <span
-                                  class="euiBadge c4 emotion-euiBadge-hollow"
-                                  title=""
-                                >
-                                  <span
-                                    class="euiBadge__content emotion-euiBadge__content"
-                                  >
-                                    <span
-                                      class="euiBadge__icon emotion-euiBadge__icon-left"
-                                      color="inherit"
-                                      data-euiicon-type="console"
-                                    />
-                                    <span
-                                      class="euiBadge__text emotion-euiBadge__text"
-                                    >
-                                      rat
-                                    </span>
-                                  </span>
-                                </span>
+                                rat
                               </span>
                             </span>
-                          </div>
-                        </div>
-                      </div>
+                          </span>
+                        </span>
+                      </span>
                     </div>
                   </div>
                 </div>
@@ -366,65 +354,53 @@ tr:hover .c2:focus::before {
               class="euiFlexItem emotion-euiFlexItem-growZero"
             >
               <div
-                class=""
+                class="c1"
+                data-test-subj="draggableWrapperDiv"
               >
                 <div
-                  class="euiPopover emotion-euiPopover-inline-block"
+                  data-rfd-droppable-context-id="0"
+                  data-rfd-droppable-id="droppableId.content.duration-event-start-end-default-draggable-test-abcd-event_duration-1000000"
                 >
                   <div
-                    data-test-subj="withHoverActionsButton"
+                    class="draggable-keyboard-wrapper"
+                    data-test-subj="draggableWrapperKeyboardHandler"
+                    role="button"
+                    tabindex="0"
                   >
                     <div
-                      class="c1"
-                      data-test-subj="draggableWrapperDiv"
+                      aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                      class="c2"
+                      data-rfd-drag-handle-context-id="0"
+                      data-rfd-drag-handle-draggable-id="draggableId.content.duration-event-start-end-default-draggable-test-abcd-event_duration-1000000"
+                      data-rfd-draggable-context-id="0"
+                      data-rfd-draggable-id="draggableId.content.duration-event-start-end-default-draggable-test-abcd-event_duration-1000000"
+                      data-test-subj="providerContainer"
+                      draggable="false"
+                      role="button"
+                      tabindex="-1"
                     >
-                      <div
-                        data-rfd-droppable-context-id="0"
-                        data-rfd-droppable-id="droppableId.content.duration-event-start-end-default-draggable-test-abcd-event_duration-1000000"
+                      <span
+                        class="c3"
+                        data-test-subj="draggable-content-event.duration"
                       >
                         <div
-                          class="draggable-keyboard-wrapper"
-                          data-test-subj="draggableWrapperKeyboardHandler"
-                          role="button"
-                          tabindex="0"
+                          class="euiText emotion-euiText-xs"
                         >
-                          <div
-                            aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                            class="c2"
-                            data-rfd-drag-handle-context-id="0"
-                            data-rfd-drag-handle-draggable-id="draggableId.content.duration-event-start-end-default-draggable-test-abcd-event_duration-1000000"
-                            data-rfd-draggable-context-id="0"
-                            data-rfd-draggable-id="draggableId.content.duration-event-start-end-default-draggable-test-abcd-event_duration-1000000"
-                            data-test-subj="providerContainer"
-                            draggable="false"
-                            role="button"
-                            tabindex="-1"
+                          <span
+                            class="c5"
+                            data-euiicon-type="clock"
+                          />
+                          <span
+                            class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                           >
-                            <span
-                              class="c3"
-                              data-test-subj="draggable-content-event.duration"
+                            <div
+                              data-test-subj="formatted-duration"
                             >
-                              <div
-                                class="euiText emotion-euiText-xs"
-                              >
-                                <span
-                                  class="c5"
-                                  data-euiicon-type="clock"
-                                />
-                                <span
-                                  class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
-                                >
-                                  <div
-                                    data-test-subj="formatted-duration"
-                                  >
-                                    1ms
-                                  </div>
-                                </span>
-                              </div>
-                            </span>
-                          </div>
+                              1ms
+                            </div>
+                          </span>
                         </div>
-                      </div>
+                      </span>
                     </div>
                   </div>
                 </div>
@@ -434,61 +410,49 @@ tr:hover .c2:focus::before {
               class="euiFlexItem emotion-euiFlexItem-growZero"
             >
               <div
-                class=""
+                class="c1"
+                data-test-subj="draggableWrapperDiv"
               >
                 <div
-                  class="euiPopover emotion-euiPopover-inline-block"
+                  data-rfd-droppable-context-id="0"
+                  data-rfd-droppable-id="droppableId.content.duration-event-start-end-default-draggable-test-abcd-event_start-2018-11-12T19:03:25_836Z"
                 >
                   <div
-                    data-test-subj="withHoverActionsButton"
+                    class="draggable-keyboard-wrapper"
+                    data-test-subj="draggableWrapperKeyboardHandler"
+                    role="button"
+                    tabindex="0"
                   >
                     <div
-                      class="c1"
-                      data-test-subj="draggableWrapperDiv"
+                      aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                      class="c2"
+                      data-rfd-drag-handle-context-id="0"
+                      data-rfd-drag-handle-draggable-id="draggableId.content.duration-event-start-end-default-draggable-test-abcd-event_start-2018-11-12T19:03:25_836Z"
+                      data-rfd-draggable-context-id="0"
+                      data-rfd-draggable-id="draggableId.content.duration-event-start-end-default-draggable-test-abcd-event_start-2018-11-12T19:03:25_836Z"
+                      data-test-subj="providerContainer"
+                      draggable="false"
+                      role="button"
+                      tabindex="-1"
                     >
-                      <div
-                        data-rfd-droppable-context-id="0"
-                        data-rfd-droppable-id="droppableId.content.duration-event-start-end-default-draggable-test-abcd-event_start-2018-11-12T19:03:25_836Z"
+                      <span
+                        class="c3"
+                        data-test-subj="draggable-content-event.start"
                       >
                         <div
-                          class="draggable-keyboard-wrapper"
-                          data-test-subj="draggableWrapperKeyboardHandler"
-                          role="button"
-                          tabindex="0"
+                          class="euiText emotion-euiText-xs"
                         >
-                          <div
-                            aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                            class="c2"
-                            data-rfd-drag-handle-context-id="0"
-                            data-rfd-drag-handle-draggable-id="draggableId.content.duration-event-start-end-default-draggable-test-abcd-event_start-2018-11-12T19:03:25_836Z"
-                            data-rfd-draggable-context-id="0"
-                            data-rfd-draggable-id="draggableId.content.duration-event-start-end-default-draggable-test-abcd-event_start-2018-11-12T19:03:25_836Z"
-                            data-test-subj="providerContainer"
-                            draggable="false"
-                            role="button"
-                            tabindex="-1"
+                          <span
+                            class="c5"
+                            data-euiicon-type="clock"
+                          />
+                          <span
+                            class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                           >
-                            <span
-                              class="c3"
-                              data-test-subj="draggable-content-event.start"
-                            >
-                              <div
-                                class="euiText emotion-euiText-xs"
-                              >
-                                <span
-                                  class="c5"
-                                  data-euiicon-type="clock"
-                                />
-                                <span
-                                  class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
-                                >
-                                  Nov 12, 2018 @ 19:03:25.836
-                                </span>
-                              </div>
-                            </span>
-                          </div>
+                            Nov 12, 2018 @ 19:03:25.836
+                          </span>
                         </div>
-                      </div>
+                      </span>
                     </div>
                   </div>
                 </div>
@@ -498,58 +462,58 @@ tr:hover .c2:focus::before {
               class="euiFlexItem emotion-euiFlexItem-growZero"
             >
               <div
-                class=""
+                data-test-subj="cellActions-renderContent-event.end"
               >
-                <div
-                  class="euiPopover emotion-euiPopover-inline-block"
-                >
+                <div>
                   <div
-                    data-test-subj="withHoverActionsButton"
+                    class="euiPopover emotion-euiPopover-inline-block"
                   >
-                    <div
-                      class="c1"
-                      data-test-subj="draggableWrapperDiv"
-                    >
+                    <div>
                       <div
-                        data-rfd-droppable-context-id="0"
-                        data-rfd-droppable-id="droppableId.content.duration-event-start-end-default-draggable-test-abcd-event_end-2018-11-12T19:03:25_936Z"
+                        class="c1"
+                        data-test-subj="draggableWrapperDiv"
                       >
                         <div
-                          class="draggable-keyboard-wrapper"
-                          data-test-subj="draggableWrapperKeyboardHandler"
-                          role="button"
-                          tabindex="0"
+                          data-rfd-droppable-context-id="0"
+                          data-rfd-droppable-id="droppableId.content.duration-event-start-end-default-draggable-test-abcd-event_end-2018-11-12T19:03:25_936Z"
                         >
                           <div
-                            aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                            class="c2"
-                            data-rfd-drag-handle-context-id="0"
-                            data-rfd-drag-handle-draggable-id="draggableId.content.duration-event-start-end-default-draggable-test-abcd-event_end-2018-11-12T19:03:25_936Z"
-                            data-rfd-draggable-context-id="0"
-                            data-rfd-draggable-id="draggableId.content.duration-event-start-end-default-draggable-test-abcd-event_end-2018-11-12T19:03:25_936Z"
-                            data-test-subj="providerContainer"
-                            draggable="false"
+                            class="draggable-keyboard-wrapper"
+                            data-test-subj="draggableWrapperKeyboardHandler"
                             role="button"
-                            tabindex="-1"
+                            tabindex="0"
                           >
-                            <span
-                              class="c3"
-                              data-test-subj="draggable-content-event.end"
+                            <div
+                              aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                              class="c2"
+                              data-rfd-drag-handle-context-id="0"
+                              data-rfd-drag-handle-draggable-id="draggableId.content.duration-event-start-end-default-draggable-test-abcd-event_end-2018-11-12T19:03:25_936Z"
+                              data-rfd-draggable-context-id="0"
+                              data-rfd-draggable-id="draggableId.content.duration-event-start-end-default-draggable-test-abcd-event_end-2018-11-12T19:03:25_936Z"
+                              data-test-subj="providerContainer"
+                              draggable="false"
+                              role="button"
+                              tabindex="-1"
                             >
-                              <div
-                                class="euiText emotion-euiText-xs"
+                              <span
+                                class="c3"
+                                data-test-subj="draggable-content-event.end"
                               >
-                                <span
-                                  class="c5"
-                                  data-euiicon-type="clock"
-                                />
-                                <span
-                                  class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
+                                <div
+                                  class="euiText emotion-euiText-xs"
                                 >
-                                  Nov 12, 2018 @ 19:03:25.936
-                                </span>
-                              </div>
-                            </span>
+                                  <span
+                                    class="c5"
+                                    data-euiicon-type="clock"
+                                  />
+                                  <span
+                                    class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
+                                  >
+                                    Nov 12, 2018 @ 19:03:25.936
+                                  </span>
+                                </div>
+                              </span>
+                            </div>
                           </div>
                         </div>
                       </div>
@@ -576,71 +540,59 @@ tr:hover .c2:focus::before {
                   class="euiFlexItem c6 emotion-euiFlexItem-growZero"
                 >
                   <div
-                    class=""
+                    class="c1"
+                    data-test-subj="draggableWrapperDiv"
                   >
                     <div
-                      class="euiPopover emotion-euiPopover-inline-block"
+                      data-rfd-droppable-context-id="0"
+                      data-rfd-droppable-id="droppableId.content.draggable-badge-default-draggable-test-abcd-network_direction-outgoing"
                     >
                       <div
-                        data-test-subj="withHoverActionsButton"
+                        class="draggable-keyboard-wrapper"
+                        data-test-subj="draggableWrapperKeyboardHandler"
+                        role="button"
+                        tabindex="0"
                       >
                         <div
-                          class="c1"
-                          data-test-subj="draggableWrapperDiv"
+                          aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                          class="c2"
+                          data-rfd-drag-handle-context-id="0"
+                          data-rfd-drag-handle-draggable-id="draggableId.content.draggable-badge-default-draggable-test-abcd-network_direction-outgoing"
+                          data-rfd-draggable-context-id="0"
+                          data-rfd-draggable-id="draggableId.content.draggable-badge-default-draggable-test-abcd-network_direction-outgoing"
+                          data-test-subj="providerContainer"
+                          draggable="false"
+                          role="button"
+                          tabindex="-1"
                         >
-                          <div
-                            data-rfd-droppable-context-id="0"
-                            data-rfd-droppable-id="droppableId.content.draggable-badge-default-draggable-test-abcd-network_direction-outgoing"
+                          <span
+                            class="c3"
+                            data-test-subj="draggable-content-network.direction"
                           >
-                            <div
-                              class="draggable-keyboard-wrapper"
-                              data-test-subj="draggableWrapperKeyboardHandler"
-                              role="button"
-                              tabindex="0"
+                            <span
+                              class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                             >
-                              <div
-                                aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                class="c2"
-                                data-rfd-drag-handle-context-id="0"
-                                data-rfd-drag-handle-draggable-id="draggableId.content.draggable-badge-default-draggable-test-abcd-network_direction-outgoing"
-                                data-rfd-draggable-context-id="0"
-                                data-rfd-draggable-id="draggableId.content.draggable-badge-default-draggable-test-abcd-network_direction-outgoing"
-                                data-test-subj="providerContainer"
-                                draggable="false"
-                                role="button"
-                                tabindex="-1"
+                              <span
+                                class="euiBadge c4 emotion-euiBadge-hollow"
+                                title=""
                               >
                                 <span
-                                  class="c3"
-                                  data-test-subj="draggable-content-network.direction"
+                                  class="euiBadge__content emotion-euiBadge__content"
                                 >
                                   <span
-                                    class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
+                                    class="euiBadge__icon emotion-euiBadge__icon-left"
+                                    color="inherit"
+                                    data-euiicon-type="arrowUp"
+                                  />
+                                  <span
+                                    class="euiBadge__text emotion-euiBadge__text"
                                   >
-                                    <span
-                                      class="euiBadge c4 emotion-euiBadge-hollow"
-                                      title=""
-                                    >
-                                      <span
-                                        class="euiBadge__content emotion-euiBadge__content"
-                                      >
-                                        <span
-                                          class="euiBadge__icon emotion-euiBadge__icon-left"
-                                          color="inherit"
-                                          data-euiicon-type="arrowUp"
-                                        />
-                                        <span
-                                          class="euiBadge__text emotion-euiBadge__text"
-                                        >
-                                          outgoing
-                                        </span>
-                                      </span>
-                                    </span>
+                                    outgoing
                                   </span>
                                 </span>
-                              </div>
-                            </div>
-                          </div>
+                              </span>
+                            </span>
+                          </span>
                         </div>
                       </div>
                     </div>
@@ -650,66 +602,54 @@ tr:hover .c2:focus::before {
                   class="euiFlexItem c6 emotion-euiFlexItem-growZero"
                 >
                   <div
-                    class=""
+                    class="c1"
+                    data-test-subj="draggableWrapperDiv"
                   >
                     <div
-                      class="euiPopover emotion-euiPopover-inline-block"
+                      data-rfd-droppable-context-id="0"
+                      data-rfd-droppable-id="droppableId.content.draggable-badge-default-draggable-test-abcd-network_protocol-http"
                     >
                       <div
-                        data-test-subj="withHoverActionsButton"
+                        class="draggable-keyboard-wrapper"
+                        data-test-subj="draggableWrapperKeyboardHandler"
+                        role="button"
+                        tabindex="0"
                       >
                         <div
-                          class="c1"
-                          data-test-subj="draggableWrapperDiv"
+                          aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                          class="c2"
+                          data-rfd-drag-handle-context-id="0"
+                          data-rfd-drag-handle-draggable-id="draggableId.content.draggable-badge-default-draggable-test-abcd-network_protocol-http"
+                          data-rfd-draggable-context-id="0"
+                          data-rfd-draggable-id="draggableId.content.draggable-badge-default-draggable-test-abcd-network_protocol-http"
+                          data-test-subj="providerContainer"
+                          draggable="false"
+                          role="button"
+                          tabindex="-1"
                         >
-                          <div
-                            data-rfd-droppable-context-id="0"
-                            data-rfd-droppable-id="droppableId.content.draggable-badge-default-draggable-test-abcd-network_protocol-http"
+                          <span
+                            class="c3"
+                            data-test-subj="draggable-content-network.protocol"
                           >
-                            <div
-                              class="draggable-keyboard-wrapper"
-                              data-test-subj="draggableWrapperKeyboardHandler"
-                              role="button"
-                              tabindex="0"
+                            <span
+                              class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                             >
-                              <div
-                                aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                class="c2"
-                                data-rfd-drag-handle-context-id="0"
-                                data-rfd-drag-handle-draggable-id="draggableId.content.draggable-badge-default-draggable-test-abcd-network_protocol-http"
-                                data-rfd-draggable-context-id="0"
-                                data-rfd-draggable-id="draggableId.content.draggable-badge-default-draggable-test-abcd-network_protocol-http"
-                                data-test-subj="providerContainer"
-                                draggable="false"
-                                role="button"
-                                tabindex="-1"
+                              <span
+                                class="euiBadge c4 emotion-euiBadge-hollow"
+                                title=""
                               >
                                 <span
-                                  class="c3"
-                                  data-test-subj="draggable-content-network.protocol"
+                                  class="euiBadge__content emotion-euiBadge__content"
                                 >
                                   <span
-                                    class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
+                                    class="euiBadge__text emotion-euiBadge__text"
                                   >
-                                    <span
-                                      class="euiBadge c4 emotion-euiBadge-hollow"
-                                      title=""
-                                    >
-                                      <span
-                                        class="euiBadge__content emotion-euiBadge__content"
-                                      >
-                                        <span
-                                          class="euiBadge__text emotion-euiBadge__text"
-                                        >
-                                          http
-                                        </span>
-                                      </span>
-                                    </span>
+                                    http
                                   </span>
                                 </span>
-                              </div>
-                            </div>
-                          </div>
+                              </span>
+                            </span>
+                          </span>
                         </div>
                       </div>
                     </div>
@@ -719,59 +659,47 @@ tr:hover .c2:focus::before {
                   class="euiFlexItem c6 emotion-euiFlexItem-growZero"
                 >
                   <div
-                    class=""
+                    class="c1"
+                    data-test-subj="draggableWrapperDiv"
                   >
                     <div
-                      class="euiPopover emotion-euiPopover-inline-block"
+                      data-rfd-droppable-context-id="0"
+                      data-rfd-droppable-id="droppableId.content.network-default-draggable-test-abcd-network_bytes-100"
                     >
                       <div
-                        data-test-subj="withHoverActionsButton"
+                        class="draggable-keyboard-wrapper"
+                        data-test-subj="draggableWrapperKeyboardHandler"
+                        role="button"
+                        tabindex="0"
                       >
                         <div
-                          class="c1"
-                          data-test-subj="draggableWrapperDiv"
+                          aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                          class="c2"
+                          data-rfd-drag-handle-context-id="0"
+                          data-rfd-drag-handle-draggable-id="draggableId.content.network-default-draggable-test-abcd-network_bytes-100"
+                          data-rfd-draggable-context-id="0"
+                          data-rfd-draggable-id="draggableId.content.network-default-draggable-test-abcd-network_bytes-100"
+                          data-test-subj="providerContainer"
+                          draggable="false"
+                          role="button"
+                          tabindex="-1"
                         >
-                          <div
-                            data-rfd-droppable-context-id="0"
-                            data-rfd-droppable-id="droppableId.content.network-default-draggable-test-abcd-network_bytes-100"
+                          <span
+                            class="c3"
+                            data-test-subj="draggable-content-network.bytes"
                           >
-                            <div
-                              class="draggable-keyboard-wrapper"
-                              data-test-subj="draggableWrapperKeyboardHandler"
-                              role="button"
-                              tabindex="0"
+                            <span
+                              class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                             >
                               <div
-                                aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                class="c2"
-                                data-rfd-drag-handle-context-id="0"
-                                data-rfd-drag-handle-draggable-id="draggableId.content.network-default-draggable-test-abcd-network_bytes-100"
-                                data-rfd-draggable-context-id="0"
-                                data-rfd-draggable-id="draggableId.content.network-default-draggable-test-abcd-network_bytes-100"
-                                data-test-subj="providerContainer"
-                                draggable="false"
-                                role="button"
-                                tabindex="-1"
+                                class="euiText c7 emotion-euiText-xs"
                               >
-                                <span
-                                  class="c3"
-                                  data-test-subj="draggable-content-network.bytes"
-                                >
-                                  <span
-                                    class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
-                                  >
-                                    <div
-                                      class="euiText c7 emotion-euiText-xs"
-                                    >
-                                      <span>
-                                        100B
-                                      </span>
-                                    </div>
-                                  </span>
+                                <span>
+                                  100B
                                 </span>
                               </div>
-                            </div>
-                          </div>
+                            </span>
+                          </span>
                         </div>
                       </div>
                     </div>
@@ -781,59 +709,47 @@ tr:hover .c2:focus::before {
                   class="euiFlexItem c6 emotion-euiFlexItem-growZero"
                 >
                   <div
-                    class=""
+                    class="c1"
+                    data-test-subj="draggableWrapperDiv"
                   >
                     <div
-                      class="euiPopover emotion-euiPopover-inline-block"
+                      data-rfd-droppable-context-id="0"
+                      data-rfd-droppable-id="droppableId.content.network-default-draggable-test-abcd-network_packets-3"
                     >
                       <div
-                        data-test-subj="withHoverActionsButton"
+                        class="draggable-keyboard-wrapper"
+                        data-test-subj="draggableWrapperKeyboardHandler"
+                        role="button"
+                        tabindex="0"
                       >
                         <div
-                          class="c1"
-                          data-test-subj="draggableWrapperDiv"
+                          aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                          class="c2"
+                          data-rfd-drag-handle-context-id="0"
+                          data-rfd-drag-handle-draggable-id="draggableId.content.network-default-draggable-test-abcd-network_packets-3"
+                          data-rfd-draggable-context-id="0"
+                          data-rfd-draggable-id="draggableId.content.network-default-draggable-test-abcd-network_packets-3"
+                          data-test-subj="providerContainer"
+                          draggable="false"
+                          role="button"
+                          tabindex="-1"
                         >
-                          <div
-                            data-rfd-droppable-context-id="0"
-                            data-rfd-droppable-id="droppableId.content.network-default-draggable-test-abcd-network_packets-3"
+                          <span
+                            class="c3"
+                            data-test-subj="draggable-content-network.packets"
                           >
-                            <div
-                              class="draggable-keyboard-wrapper"
-                              data-test-subj="draggableWrapperKeyboardHandler"
-                              role="button"
-                              tabindex="0"
+                            <span
+                              class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                             >
                               <div
-                                aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                class="c2"
-                                data-rfd-drag-handle-context-id="0"
-                                data-rfd-drag-handle-draggable-id="draggableId.content.network-default-draggable-test-abcd-network_packets-3"
-                                data-rfd-draggable-context-id="0"
-                                data-rfd-draggable-id="draggableId.content.network-default-draggable-test-abcd-network_packets-3"
-                                data-test-subj="providerContainer"
-                                draggable="false"
-                                role="button"
-                                tabindex="-1"
+                                class="euiText c7 emotion-euiText-xs"
                               >
-                                <span
-                                  class="c3"
-                                  data-test-subj="draggable-content-network.packets"
-                                >
-                                  <span
-                                    class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
-                                  >
-                                    <div
-                                      class="euiText c7 emotion-euiText-xs"
-                                    >
-                                      <span>
-                                        3 pkts
-                                      </span>
-                                    </div>
-                                  </span>
+                                <span>
+                                  3 pkts
                                 </span>
                               </div>
-                            </div>
-                          </div>
+                            </span>
+                          </span>
                         </div>
                       </div>
                     </div>
@@ -843,66 +759,54 @@ tr:hover .c2:focus::before {
                   class="euiFlexItem c6 emotion-euiFlexItem-growZero"
                 >
                   <div
-                    class=""
+                    class="c1"
+                    data-test-subj="draggableWrapperDiv"
                   >
                     <div
-                      class="euiPopover emotion-euiPopover-inline-block"
+                      data-rfd-droppable-context-id="0"
+                      data-rfd-droppable-id="droppableId.content.draggable-badge-default-draggable-test-abcd-network_transport-tcp"
                     >
                       <div
-                        data-test-subj="withHoverActionsButton"
+                        class="draggable-keyboard-wrapper"
+                        data-test-subj="draggableWrapperKeyboardHandler"
+                        role="button"
+                        tabindex="0"
                       >
                         <div
-                          class="c1"
-                          data-test-subj="draggableWrapperDiv"
+                          aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                          class="c2"
+                          data-rfd-drag-handle-context-id="0"
+                          data-rfd-drag-handle-draggable-id="draggableId.content.draggable-badge-default-draggable-test-abcd-network_transport-tcp"
+                          data-rfd-draggable-context-id="0"
+                          data-rfd-draggable-id="draggableId.content.draggable-badge-default-draggable-test-abcd-network_transport-tcp"
+                          data-test-subj="providerContainer"
+                          draggable="false"
+                          role="button"
+                          tabindex="-1"
                         >
-                          <div
-                            data-rfd-droppable-context-id="0"
-                            data-rfd-droppable-id="droppableId.content.draggable-badge-default-draggable-test-abcd-network_transport-tcp"
+                          <span
+                            class="c3"
+                            data-test-subj="draggable-content-network.transport"
                           >
-                            <div
-                              class="draggable-keyboard-wrapper"
-                              data-test-subj="draggableWrapperKeyboardHandler"
-                              role="button"
-                              tabindex="0"
+                            <span
+                              class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                             >
-                              <div
-                                aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                class="c2"
-                                data-rfd-drag-handle-context-id="0"
-                                data-rfd-drag-handle-draggable-id="draggableId.content.draggable-badge-default-draggable-test-abcd-network_transport-tcp"
-                                data-rfd-draggable-context-id="0"
-                                data-rfd-draggable-id="draggableId.content.draggable-badge-default-draggable-test-abcd-network_transport-tcp"
-                                data-test-subj="providerContainer"
-                                draggable="false"
-                                role="button"
-                                tabindex="-1"
+                              <span
+                                class="euiBadge c4 emotion-euiBadge-hollow"
+                                title=""
                               >
                                 <span
-                                  class="c3"
-                                  data-test-subj="draggable-content-network.transport"
+                                  class="euiBadge__content emotion-euiBadge__content"
                                 >
                                   <span
-                                    class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
+                                    class="euiBadge__text emotion-euiBadge__text"
                                   >
-                                    <span
-                                      class="euiBadge c4 emotion-euiBadge-hollow"
-                                      title=""
-                                    >
-                                      <span
-                                        class="euiBadge__content emotion-euiBadge__content"
-                                      >
-                                        <span
-                                          class="euiBadge__text emotion-euiBadge__text"
-                                        >
-                                          tcp
-                                        </span>
-                                      </span>
-                                    </span>
+                                    tcp
                                   </span>
                                 </span>
-                              </div>
-                            </div>
-                          </div>
+                              </span>
+                            </span>
+                          </span>
                         </div>
                       </div>
                     </div>
@@ -912,66 +816,54 @@ tr:hover .c2:focus::before {
                   class="euiFlexItem emotion-euiFlexItem-growZero"
                 >
                   <div
-                    class=""
+                    class="c1"
+                    data-test-subj="draggableWrapperDiv"
                   >
                     <div
-                      class="euiPopover emotion-euiPopover-inline-block"
+                      data-rfd-droppable-context-id="0"
+                      data-rfd-droppable-id="droppableId.content.draggable-badge-default-draggable-test-abcd-network_community_id-we_live_in_a"
                     >
                       <div
-                        data-test-subj="withHoverActionsButton"
+                        class="draggable-keyboard-wrapper"
+                        data-test-subj="draggableWrapperKeyboardHandler"
+                        role="button"
+                        tabindex="0"
                       >
                         <div
-                          class="c1"
-                          data-test-subj="draggableWrapperDiv"
+                          aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                          class="c2"
+                          data-rfd-drag-handle-context-id="0"
+                          data-rfd-drag-handle-draggable-id="draggableId.content.draggable-badge-default-draggable-test-abcd-network_community_id-we_live_in_a"
+                          data-rfd-draggable-context-id="0"
+                          data-rfd-draggable-id="draggableId.content.draggable-badge-default-draggable-test-abcd-network_community_id-we_live_in_a"
+                          data-test-subj="providerContainer"
+                          draggable="false"
+                          role="button"
+                          tabindex="-1"
                         >
-                          <div
-                            data-rfd-droppable-context-id="0"
-                            data-rfd-droppable-id="droppableId.content.draggable-badge-default-draggable-test-abcd-network_community_id-we_live_in_a"
+                          <span
+                            class="c3"
+                            data-test-subj="draggable-content-network.community_id"
                           >
-                            <div
-                              class="draggable-keyboard-wrapper"
-                              data-test-subj="draggableWrapperKeyboardHandler"
-                              role="button"
-                              tabindex="0"
+                            <span
+                              class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                             >
-                              <div
-                                aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                class="c2"
-                                data-rfd-drag-handle-context-id="0"
-                                data-rfd-drag-handle-draggable-id="draggableId.content.draggable-badge-default-draggable-test-abcd-network_community_id-we_live_in_a"
-                                data-rfd-draggable-context-id="0"
-                                data-rfd-draggable-id="draggableId.content.draggable-badge-default-draggable-test-abcd-network_community_id-we_live_in_a"
-                                data-test-subj="providerContainer"
-                                draggable="false"
-                                role="button"
-                                tabindex="-1"
+                              <span
+                                class="euiBadge c4 emotion-euiBadge-hollow"
+                                title=""
                               >
                                 <span
-                                  class="c3"
-                                  data-test-subj="draggable-content-network.community_id"
+                                  class="euiBadge__content emotion-euiBadge__content"
                                 >
                                   <span
-                                    class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
+                                    class="euiBadge__text emotion-euiBadge__text"
                                   >
-                                    <span
-                                      class="euiBadge c4 emotion-euiBadge-hollow"
-                                      title=""
-                                    >
-                                      <span
-                                        class="euiBadge__content emotion-euiBadge__content"
-                                      >
-                                        <span
-                                          class="euiBadge__text emotion-euiBadge__text"
-                                        >
-                                          we.live.in.a
-                                        </span>
-                                      </span>
-                                    </span>
+                                    we.live.in.a
                                   </span>
                                 </span>
-                              </div>
-                            </div>
-                          </div>
+                              </span>
+                            </span>
+                          </span>
                         </div>
                       </div>
                     </div>
@@ -1028,57 +920,57 @@ tr:hover .c2:focus::before {
                                     class="euiFlexItem emotion-euiFlexItem-growZero"
                                   >
                                     <div
-                                      class=""
+                                      data-test-subj="cellActions-renderContent-source.ip"
                                     >
-                                      <div
-                                        class="euiPopover emotion-euiPopover-inline-block"
-                                      >
+                                      <div>
                                         <div
-                                          data-test-subj="withHoverActionsButton"
+                                          class="euiPopover emotion-euiPopover-inline-block"
                                         >
-                                          <div
-                                            class="c1"
-                                            data-test-subj="draggableWrapperDiv"
-                                          >
+                                          <div>
                                             <div
-                                              data-rfd-droppable-context-id="0"
-                                              data-rfd-droppable-id="droppableId.content.formatted-ip-data-provider-test-source_ip-192_168_1_2-abcd"
+                                              class="c1"
+                                              data-test-subj="draggableWrapperDiv"
                                             >
                                               <div
-                                                class="draggable-keyboard-wrapper"
-                                                data-test-subj="draggableWrapperKeyboardHandler"
-                                                role="button"
-                                                tabindex="0"
+                                                data-rfd-droppable-context-id="0"
+                                                data-rfd-droppable-id="droppableId.content.formatted-ip-data-provider-test-source_ip-192_168_1_2-abcd"
                                               >
                                                 <div
-                                                  aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                                  class="c2"
-                                                  data-rfd-drag-handle-context-id="0"
-                                                  data-rfd-drag-handle-draggable-id="draggableId.content.formatted-ip-data-provider-test-source_ip-192_168_1_2-abcd"
-                                                  data-rfd-draggable-context-id="0"
-                                                  data-rfd-draggable-id="draggableId.content.formatted-ip-data-provider-test-source_ip-192_168_1_2-abcd"
-                                                  data-test-subj="providerContainer"
-                                                  draggable="false"
+                                                  class="draggable-keyboard-wrapper"
+                                                  data-test-subj="draggableWrapperKeyboardHandler"
                                                   role="button"
-                                                  tabindex="-1"
+                                                  tabindex="0"
                                                 >
-                                                  <span
-                                                    class="c10"
-                                                    data-test-subj="draggable-truncatable-content"
+                                                  <div
+                                                    aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                                                    class="c2"
+                                                    data-rfd-drag-handle-context-id="0"
+                                                    data-rfd-drag-handle-draggable-id="draggableId.content.formatted-ip-data-provider-test-source_ip-192_168_1_2-abcd"
+                                                    data-rfd-draggable-context-id="0"
+                                                    data-rfd-draggable-id="draggableId.content.formatted-ip-data-provider-test-source_ip-192_168_1_2-abcd"
+                                                    data-test-subj="providerContainer"
+                                                    draggable="false"
+                                                    role="button"
+                                                    tabindex="-1"
                                                   >
                                                     <span
-                                                      class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
+                                                      class="c10"
+                                                      data-test-subj="draggable-truncatable-content"
                                                     >
-                                                      <a
-                                                        class="euiLink emotion-euiLink-primary"
-                                                        data-test-subj="network-details"
-                                                        href="/ip/192.168.1.2/source/events"
-                                                        rel="noreferrer"
+                                                      <span
+                                                        class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                                                       >
-                                                        192.168.1.2
-                                                      </a>
+                                                        <a
+                                                          class="euiLink emotion-euiLink-primary"
+                                                          data-test-subj="network-details"
+                                                          href="/ip/192.168.1.2/source/events"
+                                                          rel="noreferrer"
+                                                        >
+                                                          192.168.1.2
+                                                        </a>
+                                                      </span>
                                                     </span>
-                                                  </span>
+                                                  </div>
                                                 </div>
                                               </div>
                                             </div>
@@ -1153,53 +1045,41 @@ tr:hover .c2:focus::before {
                                     class="euiFlexItem emotion-euiFlexItem-growZero"
                                   >
                                     <div
-                                      class=""
+                                      class="c1"
+                                      data-test-subj="draggableWrapperDiv"
                                     >
                                       <div
-                                        class="euiPopover emotion-euiPopover-inline-block"
+                                        data-rfd-droppable-context-id="0"
+                                        data-rfd-droppable-id="droppableId.content.geo-field-values-default-draggable-test-abcd-source_geo_continent_name-North America"
                                       >
                                         <div
-                                          data-test-subj="withHoverActionsButton"
+                                          class="draggable-keyboard-wrapper"
+                                          data-test-subj="draggableWrapperKeyboardHandler"
+                                          role="button"
+                                          tabindex="0"
                                         >
                                           <div
-                                            class="c1"
-                                            data-test-subj="draggableWrapperDiv"
+                                            aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                                            class="c2"
+                                            data-rfd-drag-handle-context-id="0"
+                                            data-rfd-drag-handle-draggable-id="draggableId.content.geo-field-values-default-draggable-test-abcd-source_geo_continent_name-North America"
+                                            data-rfd-draggable-context-id="0"
+                                            data-rfd-draggable-id="draggableId.content.geo-field-values-default-draggable-test-abcd-source_geo_continent_name-North America"
+                                            data-test-subj="providerContainer"
+                                            draggable="false"
+                                            role="button"
+                                            tabindex="-1"
                                           >
-                                            <div
-                                              data-rfd-droppable-context-id="0"
-                                              data-rfd-droppable-id="droppableId.content.geo-field-values-default-draggable-test-abcd-source_geo_continent_name-North America"
+                                            <span
+                                              class="c3"
+                                              data-test-subj="draggable-content-source.geo.continent_name"
                                             >
-                                              <div
-                                                class="draggable-keyboard-wrapper"
-                                                data-test-subj="draggableWrapperKeyboardHandler"
-                                                role="button"
-                                                tabindex="0"
+                                              <span
+                                                class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                                               >
-                                                <div
-                                                  aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                                  class="c2"
-                                                  data-rfd-drag-handle-context-id="0"
-                                                  data-rfd-drag-handle-draggable-id="draggableId.content.geo-field-values-default-draggable-test-abcd-source_geo_continent_name-North America"
-                                                  data-rfd-draggable-context-id="0"
-                                                  data-rfd-draggable-id="draggableId.content.geo-field-values-default-draggable-test-abcd-source_geo_continent_name-North America"
-                                                  data-test-subj="providerContainer"
-                                                  draggable="false"
-                                                  role="button"
-                                                  tabindex="-1"
-                                                >
-                                                  <span
-                                                    class="c3"
-                                                    data-test-subj="draggable-content-source.geo.continent_name"
-                                                  >
-                                                    <span
-                                                      class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
-                                                    >
-                                                      North America
-                                                    </span>
-                                                  </span>
-                                                </div>
-                                              </div>
-                                            </div>
+                                                North America
+                                              </span>
+                                            </span>
                                           </div>
                                         </div>
                                       </div>
@@ -1217,53 +1097,41 @@ tr:hover .c2:focus::before {
                                     class="euiFlexItem emotion-euiFlexItem-growZero"
                                   >
                                     <div
-                                      class=""
+                                      class="c1"
+                                      data-test-subj="draggableWrapperDiv"
                                     >
                                       <div
-                                        class="euiPopover emotion-euiPopover-inline-block"
+                                        data-rfd-droppable-context-id="0"
+                                        data-rfd-droppable-id="droppableId.content.geo-field-values-default-draggable-test-abcd-source_geo_country_name-United States"
                                       >
                                         <div
-                                          data-test-subj="withHoverActionsButton"
+                                          class="draggable-keyboard-wrapper"
+                                          data-test-subj="draggableWrapperKeyboardHandler"
+                                          role="button"
+                                          tabindex="0"
                                         >
                                           <div
-                                            class="c1"
-                                            data-test-subj="draggableWrapperDiv"
+                                            aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                                            class="c2"
+                                            data-rfd-drag-handle-context-id="0"
+                                            data-rfd-drag-handle-draggable-id="draggableId.content.geo-field-values-default-draggable-test-abcd-source_geo_country_name-United States"
+                                            data-rfd-draggable-context-id="0"
+                                            data-rfd-draggable-id="draggableId.content.geo-field-values-default-draggable-test-abcd-source_geo_country_name-United States"
+                                            data-test-subj="providerContainer"
+                                            draggable="false"
+                                            role="button"
+                                            tabindex="-1"
                                           >
-                                            <div
-                                              data-rfd-droppable-context-id="0"
-                                              data-rfd-droppable-id="droppableId.content.geo-field-values-default-draggable-test-abcd-source_geo_country_name-United States"
+                                            <span
+                                              class="c3"
+                                              data-test-subj="draggable-content-source.geo.country_name"
                                             >
-                                              <div
-                                                class="draggable-keyboard-wrapper"
-                                                data-test-subj="draggableWrapperKeyboardHandler"
-                                                role="button"
-                                                tabindex="0"
+                                              <span
+                                                class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                                               >
-                                                <div
-                                                  aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                                  class="c2"
-                                                  data-rfd-drag-handle-context-id="0"
-                                                  data-rfd-drag-handle-draggable-id="draggableId.content.geo-field-values-default-draggable-test-abcd-source_geo_country_name-United States"
-                                                  data-rfd-draggable-context-id="0"
-                                                  data-rfd-draggable-id="draggableId.content.geo-field-values-default-draggable-test-abcd-source_geo_country_name-United States"
-                                                  data-test-subj="providerContainer"
-                                                  draggable="false"
-                                                  role="button"
-                                                  tabindex="-1"
-                                                >
-                                                  <span
-                                                    class="c3"
-                                                    data-test-subj="draggable-content-source.geo.country_name"
-                                                  >
-                                                    <span
-                                                      class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
-                                                    >
-                                                      United States
-                                                    </span>
-                                                  </span>
-                                                </div>
-                                              </div>
-                                            </div>
+                                                United States
+                                              </span>
+                                            </span>
                                           </div>
                                         </div>
                                       </div>
@@ -1291,53 +1159,41 @@ tr:hover .c2:focus::before {
                                     class="euiFlexItem emotion-euiFlexItem-growZero"
                                   >
                                     <div
-                                      class=""
+                                      class="c1"
+                                      data-test-subj="draggableWrapperDiv"
                                     >
                                       <div
-                                        class="euiPopover emotion-euiPopover-inline-block"
+                                        data-rfd-droppable-context-id="0"
+                                        data-rfd-droppable-id="droppableId.content.geo-field-values-default-draggable-test-abcd-source_geo_country_iso_code-US"
                                       >
                                         <div
-                                          data-test-subj="withHoverActionsButton"
+                                          class="draggable-keyboard-wrapper"
+                                          data-test-subj="draggableWrapperKeyboardHandler"
+                                          role="button"
+                                          tabindex="0"
                                         >
                                           <div
-                                            class="c1"
-                                            data-test-subj="draggableWrapperDiv"
+                                            aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                                            class="c2"
+                                            data-rfd-drag-handle-context-id="0"
+                                            data-rfd-drag-handle-draggable-id="draggableId.content.geo-field-values-default-draggable-test-abcd-source_geo_country_iso_code-US"
+                                            data-rfd-draggable-context-id="0"
+                                            data-rfd-draggable-id="draggableId.content.geo-field-values-default-draggable-test-abcd-source_geo_country_iso_code-US"
+                                            data-test-subj="providerContainer"
+                                            draggable="false"
+                                            role="button"
+                                            tabindex="-1"
                                           >
-                                            <div
-                                              data-rfd-droppable-context-id="0"
-                                              data-rfd-droppable-id="droppableId.content.geo-field-values-default-draggable-test-abcd-source_geo_country_iso_code-US"
+                                            <span
+                                              class="c3"
+                                              data-test-subj="draggable-content-source.geo.country_iso_code"
                                             >
-                                              <div
-                                                class="draggable-keyboard-wrapper"
-                                                data-test-subj="draggableWrapperKeyboardHandler"
-                                                role="button"
-                                                tabindex="0"
+                                              <span
+                                                class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                                               >
-                                                <div
-                                                  aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                                  class="c2"
-                                                  data-rfd-drag-handle-context-id="0"
-                                                  data-rfd-drag-handle-draggable-id="draggableId.content.geo-field-values-default-draggable-test-abcd-source_geo_country_iso_code-US"
-                                                  data-rfd-draggable-context-id="0"
-                                                  data-rfd-draggable-id="draggableId.content.geo-field-values-default-draggable-test-abcd-source_geo_country_iso_code-US"
-                                                  data-test-subj="providerContainer"
-                                                  draggable="false"
-                                                  role="button"
-                                                  tabindex="-1"
-                                                >
-                                                  <span
-                                                    class="c3"
-                                                    data-test-subj="draggable-content-source.geo.country_iso_code"
-                                                  >
-                                                    <span
-                                                      class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
-                                                    >
-                                                      US
-                                                    </span>
-                                                  </span>
-                                                </div>
-                                              </div>
-                                            </div>
+                                                US
+                                              </span>
+                                            </span>
                                           </div>
                                         </div>
                                       </div>
@@ -1355,53 +1211,41 @@ tr:hover .c2:focus::before {
                                     class="euiFlexItem emotion-euiFlexItem-growZero"
                                   >
                                     <div
-                                      class=""
+                                      class="c1"
+                                      data-test-subj="draggableWrapperDiv"
                                     >
                                       <div
-                                        class="euiPopover emotion-euiPopover-inline-block"
+                                        data-rfd-droppable-context-id="0"
+                                        data-rfd-droppable-id="droppableId.content.geo-field-values-default-draggable-test-abcd-source_geo_region_name-Georgia"
                                       >
                                         <div
-                                          data-test-subj="withHoverActionsButton"
+                                          class="draggable-keyboard-wrapper"
+                                          data-test-subj="draggableWrapperKeyboardHandler"
+                                          role="button"
+                                          tabindex="0"
                                         >
                                           <div
-                                            class="c1"
-                                            data-test-subj="draggableWrapperDiv"
+                                            aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                                            class="c2"
+                                            data-rfd-drag-handle-context-id="0"
+                                            data-rfd-drag-handle-draggable-id="draggableId.content.geo-field-values-default-draggable-test-abcd-source_geo_region_name-Georgia"
+                                            data-rfd-draggable-context-id="0"
+                                            data-rfd-draggable-id="draggableId.content.geo-field-values-default-draggable-test-abcd-source_geo_region_name-Georgia"
+                                            data-test-subj="providerContainer"
+                                            draggable="false"
+                                            role="button"
+                                            tabindex="-1"
                                           >
-                                            <div
-                                              data-rfd-droppable-context-id="0"
-                                              data-rfd-droppable-id="droppableId.content.geo-field-values-default-draggable-test-abcd-source_geo_region_name-Georgia"
+                                            <span
+                                              class="c3"
+                                              data-test-subj="draggable-content-source.geo.region_name"
                                             >
-                                              <div
-                                                class="draggable-keyboard-wrapper"
-                                                data-test-subj="draggableWrapperKeyboardHandler"
-                                                role="button"
-                                                tabindex="0"
+                                              <span
+                                                class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                                               >
-                                                <div
-                                                  aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                                  class="c2"
-                                                  data-rfd-drag-handle-context-id="0"
-                                                  data-rfd-drag-handle-draggable-id="draggableId.content.geo-field-values-default-draggable-test-abcd-source_geo_region_name-Georgia"
-                                                  data-rfd-draggable-context-id="0"
-                                                  data-rfd-draggable-id="draggableId.content.geo-field-values-default-draggable-test-abcd-source_geo_region_name-Georgia"
-                                                  data-test-subj="providerContainer"
-                                                  draggable="false"
-                                                  role="button"
-                                                  tabindex="-1"
-                                                >
-                                                  <span
-                                                    class="c3"
-                                                    data-test-subj="draggable-content-source.geo.region_name"
-                                                  >
-                                                    <span
-                                                      class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
-                                                    >
-                                                      Georgia
-                                                    </span>
-                                                  </span>
-                                                </div>
-                                              </div>
-                                            </div>
+                                                Georgia
+                                              </span>
+                                            </span>
                                           </div>
                                         </div>
                                       </div>
@@ -1419,53 +1263,41 @@ tr:hover .c2:focus::before {
                                     class="euiFlexItem emotion-euiFlexItem-growZero"
                                   >
                                     <div
-                                      class=""
+                                      class="c1"
+                                      data-test-subj="draggableWrapperDiv"
                                     >
                                       <div
-                                        class="euiPopover emotion-euiPopover-inline-block"
+                                        data-rfd-droppable-context-id="0"
+                                        data-rfd-droppable-id="droppableId.content.geo-field-values-default-draggable-test-abcd-source_geo_city_name-Atlanta"
                                       >
                                         <div
-                                          data-test-subj="withHoverActionsButton"
+                                          class="draggable-keyboard-wrapper"
+                                          data-test-subj="draggableWrapperKeyboardHandler"
+                                          role="button"
+                                          tabindex="0"
                                         >
                                           <div
-                                            class="c1"
-                                            data-test-subj="draggableWrapperDiv"
+                                            aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                                            class="c2"
+                                            data-rfd-drag-handle-context-id="0"
+                                            data-rfd-drag-handle-draggable-id="draggableId.content.geo-field-values-default-draggable-test-abcd-source_geo_city_name-Atlanta"
+                                            data-rfd-draggable-context-id="0"
+                                            data-rfd-draggable-id="draggableId.content.geo-field-values-default-draggable-test-abcd-source_geo_city_name-Atlanta"
+                                            data-test-subj="providerContainer"
+                                            draggable="false"
+                                            role="button"
+                                            tabindex="-1"
                                           >
-                                            <div
-                                              data-rfd-droppable-context-id="0"
-                                              data-rfd-droppable-id="droppableId.content.geo-field-values-default-draggable-test-abcd-source_geo_city_name-Atlanta"
+                                            <span
+                                              class="c3"
+                                              data-test-subj="draggable-content-source.geo.city_name"
                                             >
-                                              <div
-                                                class="draggable-keyboard-wrapper"
-                                                data-test-subj="draggableWrapperKeyboardHandler"
-                                                role="button"
-                                                tabindex="0"
+                                              <span
+                                                class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                                               >
-                                                <div
-                                                  aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                                  class="c2"
-                                                  data-rfd-drag-handle-context-id="0"
-                                                  data-rfd-drag-handle-draggable-id="draggableId.content.geo-field-values-default-draggable-test-abcd-source_geo_city_name-Atlanta"
-                                                  data-rfd-draggable-context-id="0"
-                                                  data-rfd-draggable-id="draggableId.content.geo-field-values-default-draggable-test-abcd-source_geo_city_name-Atlanta"
-                                                  data-test-subj="providerContainer"
-                                                  draggable="false"
-                                                  role="button"
-                                                  tabindex="-1"
-                                                >
-                                                  <span
-                                                    class="c3"
-                                                    data-test-subj="draggable-content-source.geo.city_name"
-                                                  >
-                                                    <span
-                                                      class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
-                                                    >
-                                                      Atlanta
-                                                    </span>
-                                                  </span>
-                                                </div>
-                                              </div>
-                                            </div>
+                                                Atlanta
+                                              </span>
+                                            </span>
                                           </div>
                                         </div>
                                       </div>
@@ -1501,64 +1333,52 @@ tr:hover .c2:focus::before {
                         class="euiFlexItem emotion-euiFlexItem-growZero"
                       >
                         <div
-                          class=""
+                          class="c1"
+                          data-test-subj="draggableWrapperDiv"
                         >
                           <div
-                            class="euiPopover emotion-euiPopover-inline-block"
+                            data-rfd-droppable-context-id="0"
+                            data-rfd-droppable-id="droppableId.content.source-arrow-default-draggable-test-abcd-source_bytes-60"
                           >
                             <div
-                              data-test-subj="withHoverActionsButton"
+                              class="draggable-keyboard-wrapper"
+                              data-test-subj="draggableWrapperKeyboardHandler"
+                              role="button"
+                              tabindex="0"
                             >
                               <div
-                                class="c1"
-                                data-test-subj="draggableWrapperDiv"
+                                aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                                class="c2"
+                                data-rfd-drag-handle-context-id="0"
+                                data-rfd-drag-handle-draggable-id="draggableId.content.source-arrow-default-draggable-test-abcd-source_bytes-60"
+                                data-rfd-draggable-context-id="0"
+                                data-rfd-draggable-id="draggableId.content.source-arrow-default-draggable-test-abcd-source_bytes-60"
+                                data-test-subj="providerContainer"
+                                draggable="false"
+                                role="button"
+                                tabindex="-1"
                               >
-                                <div
-                                  data-rfd-droppable-context-id="0"
-                                  data-rfd-droppable-id="droppableId.content.source-arrow-default-draggable-test-abcd-source_bytes-60"
+                                <span
+                                  class="c3"
+                                  data-test-subj="draggable-content-source.bytes"
                                 >
-                                  <div
-                                    class="draggable-keyboard-wrapper"
-                                    data-test-subj="draggableWrapperKeyboardHandler"
-                                    role="button"
-                                    tabindex="0"
+                                  <span
+                                    class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                                   >
                                     <div
-                                      aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                      class="c2"
-                                      data-rfd-drag-handle-context-id="0"
-                                      data-rfd-drag-handle-draggable-id="draggableId.content.source-arrow-default-draggable-test-abcd-source_bytes-60"
-                                      data-rfd-draggable-context-id="0"
-                                      data-rfd-draggable-id="draggableId.content.source-arrow-default-draggable-test-abcd-source_bytes-60"
-                                      data-test-subj="providerContainer"
-                                      draggable="false"
-                                      role="button"
-                                      tabindex="-1"
+                                      class="euiText c17 emotion-euiText-xs"
                                     >
                                       <span
-                                        class="c3"
-                                        data-test-subj="draggable-content-source.bytes"
+                                        class="c18"
                                       >
-                                        <span
-                                          class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
-                                        >
-                                          <div
-                                            class="euiText c17 emotion-euiText-xs"
-                                          >
-                                            <span
-                                              class="c18"
-                                            >
-                                              (60.00%)
-                                            </span>
-                                            <span>
-                                              60B
-                                            </span>
-                                          </div>
-                                        </span>
+                                        (60.00%)
+                                      </span>
+                                      <span>
+                                        60B
                                       </span>
                                     </div>
-                                  </div>
-                                </div>
+                                  </span>
+                                </span>
                               </div>
                             </div>
                           </div>
@@ -1576,59 +1396,47 @@ tr:hover .c2:focus::before {
                         class="euiFlexItem emotion-euiFlexItem-growZero"
                       >
                         <div
-                          class=""
+                          class="c1"
+                          data-test-subj="draggableWrapperDiv"
                         >
                           <div
-                            class="euiPopover emotion-euiPopover-inline-block"
+                            data-rfd-droppable-context-id="0"
+                            data-rfd-droppable-id="droppableId.content.source-arrow-default-draggable-test-abcd-source_packets-2"
                           >
                             <div
-                              data-test-subj="withHoverActionsButton"
+                              class="draggable-keyboard-wrapper"
+                              data-test-subj="draggableWrapperKeyboardHandler"
+                              role="button"
+                              tabindex="0"
                             >
                               <div
-                                class="c1"
-                                data-test-subj="draggableWrapperDiv"
+                                aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                                class="c2"
+                                data-rfd-drag-handle-context-id="0"
+                                data-rfd-drag-handle-draggable-id="draggableId.content.source-arrow-default-draggable-test-abcd-source_packets-2"
+                                data-rfd-draggable-context-id="0"
+                                data-rfd-draggable-id="draggableId.content.source-arrow-default-draggable-test-abcd-source_packets-2"
+                                data-test-subj="providerContainer"
+                                draggable="false"
+                                role="button"
+                                tabindex="-1"
                               >
-                                <div
-                                  data-rfd-droppable-context-id="0"
-                                  data-rfd-droppable-id="droppableId.content.source-arrow-default-draggable-test-abcd-source_packets-2"
+                                <span
+                                  class="c3"
+                                  data-test-subj="draggable-content-source.packets"
                                 >
-                                  <div
-                                    class="draggable-keyboard-wrapper"
-                                    data-test-subj="draggableWrapperKeyboardHandler"
-                                    role="button"
-                                    tabindex="0"
+                                  <span
+                                    class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                                   >
                                     <div
-                                      aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                      class="c2"
-                                      data-rfd-drag-handle-context-id="0"
-                                      data-rfd-drag-handle-draggable-id="draggableId.content.source-arrow-default-draggable-test-abcd-source_packets-2"
-                                      data-rfd-draggable-context-id="0"
-                                      data-rfd-draggable-id="draggableId.content.source-arrow-default-draggable-test-abcd-source_packets-2"
-                                      data-test-subj="providerContainer"
-                                      draggable="false"
-                                      role="button"
-                                      tabindex="-1"
+                                      class="euiText c17 emotion-euiText-xs"
                                     >
-                                      <span
-                                        class="c3"
-                                        data-test-subj="draggable-content-source.packets"
-                                      >
-                                        <span
-                                          class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
-                                        >
-                                          <div
-                                            class="euiText c17 emotion-euiText-xs"
-                                          >
-                                            <span>
-                                              2 pkts
-                                            </span>
-                                          </div>
-                                        </span>
+                                      <span>
+                                        2 pkts
                                       </span>
                                     </div>
-                                  </div>
-                                </div>
+                                  </span>
+                                </span>
                               </div>
                             </div>
                           </div>
@@ -1680,61 +1488,61 @@ tr:hover .c2:focus::before {
                         class="euiFlexItem emotion-euiFlexItem-growZero"
                       >
                         <div
-                          class=""
+                          data-test-subj="cellActions-renderContent-destination.bytes"
                         >
-                          <div
-                            class="euiPopover emotion-euiPopover-inline-block"
-                          >
+                          <div>
                             <div
-                              data-test-subj="withHoverActionsButton"
+                              class="euiPopover emotion-euiPopover-inline-block"
                             >
-                              <div
-                                class="c1"
-                                data-test-subj="draggableWrapperDiv"
-                              >
+                              <div>
                                 <div
-                                  data-rfd-droppable-context-id="0"
-                                  data-rfd-droppable-id="droppableId.content.destination-arrow-default-draggable-test-abcd-destination_bytes-40"
+                                  class="c1"
+                                  data-test-subj="draggableWrapperDiv"
                                 >
                                   <div
-                                    class="draggable-keyboard-wrapper"
-                                    data-test-subj="draggableWrapperKeyboardHandler"
-                                    role="button"
-                                    tabindex="0"
+                                    data-rfd-droppable-context-id="0"
+                                    data-rfd-droppable-id="droppableId.content.destination-arrow-default-draggable-test-abcd-destination_bytes-40"
                                   >
                                     <div
-                                      aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                      class="c2"
-                                      data-rfd-drag-handle-context-id="0"
-                                      data-rfd-drag-handle-draggable-id="draggableId.content.destination-arrow-default-draggable-test-abcd-destination_bytes-40"
-                                      data-rfd-draggable-context-id="0"
-                                      data-rfd-draggable-id="draggableId.content.destination-arrow-default-draggable-test-abcd-destination_bytes-40"
-                                      data-test-subj="providerContainer"
-                                      draggable="false"
+                                      class="draggable-keyboard-wrapper"
+                                      data-test-subj="draggableWrapperKeyboardHandler"
                                       role="button"
-                                      tabindex="-1"
+                                      tabindex="0"
                                     >
-                                      <span
-                                        class="c3"
-                                        data-test-subj="draggable-content-destination.bytes"
+                                      <div
+                                        aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                                        class="c2"
+                                        data-rfd-drag-handle-context-id="0"
+                                        data-rfd-drag-handle-draggable-id="draggableId.content.destination-arrow-default-draggable-test-abcd-destination_bytes-40"
+                                        data-rfd-draggable-context-id="0"
+                                        data-rfd-draggable-id="draggableId.content.destination-arrow-default-draggable-test-abcd-destination_bytes-40"
+                                        data-test-subj="providerContainer"
+                                        draggable="false"
+                                        role="button"
+                                        tabindex="-1"
                                       >
                                         <span
-                                          class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
+                                          class="c3"
+                                          data-test-subj="draggable-content-destination.bytes"
                                         >
-                                          <div
-                                            class="euiText c17 emotion-euiText-xs"
+                                          <span
+                                            class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                                           >
-                                            <span
-                                              class="c18"
+                                            <div
+                                              class="euiText c17 emotion-euiText-xs"
                                             >
-                                              (40.00%)
-                                            </span>
-                                            <span>
-                                              40B
-                                            </span>
-                                          </div>
+                                              <span
+                                                class="c18"
+                                              >
+                                                (40.00%)
+                                              </span>
+                                              <span>
+                                                40B
+                                              </span>
+                                            </div>
+                                          </span>
                                         </span>
-                                      </span>
+                                      </div>
                                     </div>
                                   </div>
                                 </div>
@@ -1755,59 +1563,47 @@ tr:hover .c2:focus::before {
                         class="euiFlexItem emotion-euiFlexItem-growZero"
                       >
                         <div
-                          class=""
+                          class="c1"
+                          data-test-subj="draggableWrapperDiv"
                         >
                           <div
-                            class="euiPopover emotion-euiPopover-inline-block"
+                            data-rfd-droppable-context-id="0"
+                            data-rfd-droppable-id="droppableId.content.destination-arrow-default-draggable-test-abcd-destination_packets-1"
                           >
                             <div
-                              data-test-subj="withHoverActionsButton"
+                              class="draggable-keyboard-wrapper"
+                              data-test-subj="draggableWrapperKeyboardHandler"
+                              role="button"
+                              tabindex="0"
                             >
                               <div
-                                class="c1"
-                                data-test-subj="draggableWrapperDiv"
+                                aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                                class="c2"
+                                data-rfd-drag-handle-context-id="0"
+                                data-rfd-drag-handle-draggable-id="draggableId.content.destination-arrow-default-draggable-test-abcd-destination_packets-1"
+                                data-rfd-draggable-context-id="0"
+                                data-rfd-draggable-id="draggableId.content.destination-arrow-default-draggable-test-abcd-destination_packets-1"
+                                data-test-subj="providerContainer"
+                                draggable="false"
+                                role="button"
+                                tabindex="-1"
                               >
-                                <div
-                                  data-rfd-droppable-context-id="0"
-                                  data-rfd-droppable-id="droppableId.content.destination-arrow-default-draggable-test-abcd-destination_packets-1"
+                                <span
+                                  class="c3"
+                                  data-test-subj="draggable-content-destination.packets"
                                 >
-                                  <div
-                                    class="draggable-keyboard-wrapper"
-                                    data-test-subj="draggableWrapperKeyboardHandler"
-                                    role="button"
-                                    tabindex="0"
+                                  <span
+                                    class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                                   >
                                     <div
-                                      aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                      class="c2"
-                                      data-rfd-drag-handle-context-id="0"
-                                      data-rfd-drag-handle-draggable-id="draggableId.content.destination-arrow-default-draggable-test-abcd-destination_packets-1"
-                                      data-rfd-draggable-context-id="0"
-                                      data-rfd-draggable-id="draggableId.content.destination-arrow-default-draggable-test-abcd-destination_packets-1"
-                                      data-test-subj="providerContainer"
-                                      draggable="false"
-                                      role="button"
-                                      tabindex="-1"
+                                      class="euiText c17 emotion-euiText-xs"
                                     >
-                                      <span
-                                        class="c3"
-                                        data-test-subj="draggable-content-destination.packets"
-                                      >
-                                        <span
-                                          class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
-                                        >
-                                          <div
-                                            class="euiText c17 emotion-euiText-xs"
-                                          >
-                                            <span>
-                                              1 pkts
-                                            </span>
-                                          </div>
-                                        </span>
+                                      <span>
+                                        1 pkts
                                       </span>
                                     </div>
-                                  </div>
-                                </div>
+                                  </span>
+                                </span>
                               </div>
                             </div>
                           </div>
@@ -1867,57 +1663,57 @@ tr:hover .c2:focus::before {
                                     class="euiFlexItem emotion-euiFlexItem-growZero"
                                   >
                                     <div
-                                      class=""
+                                      data-test-subj="cellActions-renderContent-destination.ip"
                                     >
-                                      <div
-                                        class="euiPopover emotion-euiPopover-inline-block"
-                                      >
+                                      <div>
                                         <div
-                                          data-test-subj="withHoverActionsButton"
+                                          class="euiPopover emotion-euiPopover-inline-block"
                                         >
-                                          <div
-                                            class="c1"
-                                            data-test-subj="draggableWrapperDiv"
-                                          >
+                                          <div>
                                             <div
-                                              data-rfd-droppable-context-id="0"
-                                              data-rfd-droppable-id="droppableId.content.formatted-ip-data-provider-test-destination_ip-10_1_2_3-abcd"
+                                              class="c1"
+                                              data-test-subj="draggableWrapperDiv"
                                             >
                                               <div
-                                                class="draggable-keyboard-wrapper"
-                                                data-test-subj="draggableWrapperKeyboardHandler"
-                                                role="button"
-                                                tabindex="0"
+                                                data-rfd-droppable-context-id="0"
+                                                data-rfd-droppable-id="droppableId.content.formatted-ip-data-provider-test-destination_ip-10_1_2_3-abcd"
                                               >
                                                 <div
-                                                  aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                                  class="c2"
-                                                  data-rfd-drag-handle-context-id="0"
-                                                  data-rfd-drag-handle-draggable-id="draggableId.content.formatted-ip-data-provider-test-destination_ip-10_1_2_3-abcd"
-                                                  data-rfd-draggable-context-id="0"
-                                                  data-rfd-draggable-id="draggableId.content.formatted-ip-data-provider-test-destination_ip-10_1_2_3-abcd"
-                                                  data-test-subj="providerContainer"
-                                                  draggable="false"
+                                                  class="draggable-keyboard-wrapper"
+                                                  data-test-subj="draggableWrapperKeyboardHandler"
                                                   role="button"
-                                                  tabindex="-1"
+                                                  tabindex="0"
                                                 >
-                                                  <span
-                                                    class="c10"
-                                                    data-test-subj="draggable-truncatable-content"
+                                                  <div
+                                                    aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                                                    class="c2"
+                                                    data-rfd-drag-handle-context-id="0"
+                                                    data-rfd-drag-handle-draggable-id="draggableId.content.formatted-ip-data-provider-test-destination_ip-10_1_2_3-abcd"
+                                                    data-rfd-draggable-context-id="0"
+                                                    data-rfd-draggable-id="draggableId.content.formatted-ip-data-provider-test-destination_ip-10_1_2_3-abcd"
+                                                    data-test-subj="providerContainer"
+                                                    draggable="false"
+                                                    role="button"
+                                                    tabindex="-1"
                                                   >
                                                     <span
-                                                      class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
+                                                      class="c10"
+                                                      data-test-subj="draggable-truncatable-content"
                                                     >
-                                                      <a
-                                                        class="euiLink emotion-euiLink-primary"
-                                                        data-test-subj="network-details"
-                                                        href="/ip/10.1.2.3/source/events"
-                                                        rel="noreferrer"
+                                                      <span
+                                                        class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                                                       >
-                                                        10.1.2.3
-                                                      </a>
+                                                        <a
+                                                          class="euiLink emotion-euiLink-primary"
+                                                          data-test-subj="network-details"
+                                                          href="/ip/10.1.2.3/source/events"
+                                                          rel="noreferrer"
+                                                        >
+                                                          10.1.2.3
+                                                        </a>
+                                                      </span>
                                                     </span>
-                                                  </span>
+                                                  </div>
                                                 </div>
                                               </div>
                                             </div>
@@ -1992,53 +1788,41 @@ tr:hover .c2:focus::before {
                                     class="euiFlexItem emotion-euiFlexItem-growZero"
                                   >
                                     <div
-                                      class=""
+                                      class="c1"
+                                      data-test-subj="draggableWrapperDiv"
                                     >
                                       <div
-                                        class="euiPopover emotion-euiPopover-inline-block"
+                                        data-rfd-droppable-context-id="0"
+                                        data-rfd-droppable-id="droppableId.content.geo-field-values-default-draggable-test-abcd-destination_geo_continent_name-North America"
                                       >
                                         <div
-                                          data-test-subj="withHoverActionsButton"
+                                          class="draggable-keyboard-wrapper"
+                                          data-test-subj="draggableWrapperKeyboardHandler"
+                                          role="button"
+                                          tabindex="0"
                                         >
                                           <div
-                                            class="c1"
-                                            data-test-subj="draggableWrapperDiv"
+                                            aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                                            class="c2"
+                                            data-rfd-drag-handle-context-id="0"
+                                            data-rfd-drag-handle-draggable-id="draggableId.content.geo-field-values-default-draggable-test-abcd-destination_geo_continent_name-North America"
+                                            data-rfd-draggable-context-id="0"
+                                            data-rfd-draggable-id="draggableId.content.geo-field-values-default-draggable-test-abcd-destination_geo_continent_name-North America"
+                                            data-test-subj="providerContainer"
+                                            draggable="false"
+                                            role="button"
+                                            tabindex="-1"
                                           >
-                                            <div
-                                              data-rfd-droppable-context-id="0"
-                                              data-rfd-droppable-id="droppableId.content.geo-field-values-default-draggable-test-abcd-destination_geo_continent_name-North America"
+                                            <span
+                                              class="c3"
+                                              data-test-subj="draggable-content-destination.geo.continent_name"
                                             >
-                                              <div
-                                                class="draggable-keyboard-wrapper"
-                                                data-test-subj="draggableWrapperKeyboardHandler"
-                                                role="button"
-                                                tabindex="0"
+                                              <span
+                                                class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                                               >
-                                                <div
-                                                  aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                                  class="c2"
-                                                  data-rfd-drag-handle-context-id="0"
-                                                  data-rfd-drag-handle-draggable-id="draggableId.content.geo-field-values-default-draggable-test-abcd-destination_geo_continent_name-North America"
-                                                  data-rfd-draggable-context-id="0"
-                                                  data-rfd-draggable-id="draggableId.content.geo-field-values-default-draggable-test-abcd-destination_geo_continent_name-North America"
-                                                  data-test-subj="providerContainer"
-                                                  draggable="false"
-                                                  role="button"
-                                                  tabindex="-1"
-                                                >
-                                                  <span
-                                                    class="c3"
-                                                    data-test-subj="draggable-content-destination.geo.continent_name"
-                                                  >
-                                                    <span
-                                                      class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
-                                                    >
-                                                      North America
-                                                    </span>
-                                                  </span>
-                                                </div>
-                                              </div>
-                                            </div>
+                                                North America
+                                              </span>
+                                            </span>
                                           </div>
                                         </div>
                                       </div>
@@ -2056,53 +1840,41 @@ tr:hover .c2:focus::before {
                                     class="euiFlexItem emotion-euiFlexItem-growZero"
                                   >
                                     <div
-                                      class=""
+                                      class="c1"
+                                      data-test-subj="draggableWrapperDiv"
                                     >
                                       <div
-                                        class="euiPopover emotion-euiPopover-inline-block"
+                                        data-rfd-droppable-context-id="0"
+                                        data-rfd-droppable-id="droppableId.content.geo-field-values-default-draggable-test-abcd-destination_geo_country_name-United States"
                                       >
                                         <div
-                                          data-test-subj="withHoverActionsButton"
+                                          class="draggable-keyboard-wrapper"
+                                          data-test-subj="draggableWrapperKeyboardHandler"
+                                          role="button"
+                                          tabindex="0"
                                         >
                                           <div
-                                            class="c1"
-                                            data-test-subj="draggableWrapperDiv"
+                                            aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                                            class="c2"
+                                            data-rfd-drag-handle-context-id="0"
+                                            data-rfd-drag-handle-draggable-id="draggableId.content.geo-field-values-default-draggable-test-abcd-destination_geo_country_name-United States"
+                                            data-rfd-draggable-context-id="0"
+                                            data-rfd-draggable-id="draggableId.content.geo-field-values-default-draggable-test-abcd-destination_geo_country_name-United States"
+                                            data-test-subj="providerContainer"
+                                            draggable="false"
+                                            role="button"
+                                            tabindex="-1"
                                           >
-                                            <div
-                                              data-rfd-droppable-context-id="0"
-                                              data-rfd-droppable-id="droppableId.content.geo-field-values-default-draggable-test-abcd-destination_geo_country_name-United States"
+                                            <span
+                                              class="c3"
+                                              data-test-subj="draggable-content-destination.geo.country_name"
                                             >
-                                              <div
-                                                class="draggable-keyboard-wrapper"
-                                                data-test-subj="draggableWrapperKeyboardHandler"
-                                                role="button"
-                                                tabindex="0"
+                                              <span
+                                                class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                                               >
-                                                <div
-                                                  aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                                  class="c2"
-                                                  data-rfd-drag-handle-context-id="0"
-                                                  data-rfd-drag-handle-draggable-id="draggableId.content.geo-field-values-default-draggable-test-abcd-destination_geo_country_name-United States"
-                                                  data-rfd-draggable-context-id="0"
-                                                  data-rfd-draggable-id="draggableId.content.geo-field-values-default-draggable-test-abcd-destination_geo_country_name-United States"
-                                                  data-test-subj="providerContainer"
-                                                  draggable="false"
-                                                  role="button"
-                                                  tabindex="-1"
-                                                >
-                                                  <span
-                                                    class="c3"
-                                                    data-test-subj="draggable-content-destination.geo.country_name"
-                                                  >
-                                                    <span
-                                                      class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
-                                                    >
-                                                      United States
-                                                    </span>
-                                                  </span>
-                                                </div>
-                                              </div>
-                                            </div>
+                                                United States
+                                              </span>
+                                            </span>
                                           </div>
                                         </div>
                                       </div>
@@ -2130,53 +1902,41 @@ tr:hover .c2:focus::before {
                                     class="euiFlexItem emotion-euiFlexItem-growZero"
                                   >
                                     <div
-                                      class=""
+                                      class="c1"
+                                      data-test-subj="draggableWrapperDiv"
                                     >
                                       <div
-                                        class="euiPopover emotion-euiPopover-inline-block"
+                                        data-rfd-droppable-context-id="0"
+                                        data-rfd-droppable-id="droppableId.content.geo-field-values-default-draggable-test-abcd-destination_geo_country_iso_code-US"
                                       >
                                         <div
-                                          data-test-subj="withHoverActionsButton"
+                                          class="draggable-keyboard-wrapper"
+                                          data-test-subj="draggableWrapperKeyboardHandler"
+                                          role="button"
+                                          tabindex="0"
                                         >
                                           <div
-                                            class="c1"
-                                            data-test-subj="draggableWrapperDiv"
+                                            aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                                            class="c2"
+                                            data-rfd-drag-handle-context-id="0"
+                                            data-rfd-drag-handle-draggable-id="draggableId.content.geo-field-values-default-draggable-test-abcd-destination_geo_country_iso_code-US"
+                                            data-rfd-draggable-context-id="0"
+                                            data-rfd-draggable-id="draggableId.content.geo-field-values-default-draggable-test-abcd-destination_geo_country_iso_code-US"
+                                            data-test-subj="providerContainer"
+                                            draggable="false"
+                                            role="button"
+                                            tabindex="-1"
                                           >
-                                            <div
-                                              data-rfd-droppable-context-id="0"
-                                              data-rfd-droppable-id="droppableId.content.geo-field-values-default-draggable-test-abcd-destination_geo_country_iso_code-US"
+                                            <span
+                                              class="c3"
+                                              data-test-subj="draggable-content-destination.geo.country_iso_code"
                                             >
-                                              <div
-                                                class="draggable-keyboard-wrapper"
-                                                data-test-subj="draggableWrapperKeyboardHandler"
-                                                role="button"
-                                                tabindex="0"
+                                              <span
+                                                class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                                               >
-                                                <div
-                                                  aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                                  class="c2"
-                                                  data-rfd-drag-handle-context-id="0"
-                                                  data-rfd-drag-handle-draggable-id="draggableId.content.geo-field-values-default-draggable-test-abcd-destination_geo_country_iso_code-US"
-                                                  data-rfd-draggable-context-id="0"
-                                                  data-rfd-draggable-id="draggableId.content.geo-field-values-default-draggable-test-abcd-destination_geo_country_iso_code-US"
-                                                  data-test-subj="providerContainer"
-                                                  draggable="false"
-                                                  role="button"
-                                                  tabindex="-1"
-                                                >
-                                                  <span
-                                                    class="c3"
-                                                    data-test-subj="draggable-content-destination.geo.country_iso_code"
-                                                  >
-                                                    <span
-                                                      class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
-                                                    >
-                                                      US
-                                                    </span>
-                                                  </span>
-                                                </div>
-                                              </div>
-                                            </div>
+                                                US
+                                              </span>
+                                            </span>
                                           </div>
                                         </div>
                                       </div>
@@ -2194,53 +1954,41 @@ tr:hover .c2:focus::before {
                                     class="euiFlexItem emotion-euiFlexItem-growZero"
                                   >
                                     <div
-                                      class=""
+                                      class="c1"
+                                      data-test-subj="draggableWrapperDiv"
                                     >
                                       <div
-                                        class="euiPopover emotion-euiPopover-inline-block"
+                                        data-rfd-droppable-context-id="0"
+                                        data-rfd-droppable-id="droppableId.content.geo-field-values-default-draggable-test-abcd-destination_geo_region_name-New York"
                                       >
                                         <div
-                                          data-test-subj="withHoverActionsButton"
+                                          class="draggable-keyboard-wrapper"
+                                          data-test-subj="draggableWrapperKeyboardHandler"
+                                          role="button"
+                                          tabindex="0"
                                         >
                                           <div
-                                            class="c1"
-                                            data-test-subj="draggableWrapperDiv"
+                                            aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                                            class="c2"
+                                            data-rfd-drag-handle-context-id="0"
+                                            data-rfd-drag-handle-draggable-id="draggableId.content.geo-field-values-default-draggable-test-abcd-destination_geo_region_name-New York"
+                                            data-rfd-draggable-context-id="0"
+                                            data-rfd-draggable-id="draggableId.content.geo-field-values-default-draggable-test-abcd-destination_geo_region_name-New York"
+                                            data-test-subj="providerContainer"
+                                            draggable="false"
+                                            role="button"
+                                            tabindex="-1"
                                           >
-                                            <div
-                                              data-rfd-droppable-context-id="0"
-                                              data-rfd-droppable-id="droppableId.content.geo-field-values-default-draggable-test-abcd-destination_geo_region_name-New York"
+                                            <span
+                                              class="c3"
+                                              data-test-subj="draggable-content-destination.geo.region_name"
                                             >
-                                              <div
-                                                class="draggable-keyboard-wrapper"
-                                                data-test-subj="draggableWrapperKeyboardHandler"
-                                                role="button"
-                                                tabindex="0"
+                                              <span
+                                                class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                                               >
-                                                <div
-                                                  aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                                  class="c2"
-                                                  data-rfd-drag-handle-context-id="0"
-                                                  data-rfd-drag-handle-draggable-id="draggableId.content.geo-field-values-default-draggable-test-abcd-destination_geo_region_name-New York"
-                                                  data-rfd-draggable-context-id="0"
-                                                  data-rfd-draggable-id="draggableId.content.geo-field-values-default-draggable-test-abcd-destination_geo_region_name-New York"
-                                                  data-test-subj="providerContainer"
-                                                  draggable="false"
-                                                  role="button"
-                                                  tabindex="-1"
-                                                >
-                                                  <span
-                                                    class="c3"
-                                                    data-test-subj="draggable-content-destination.geo.region_name"
-                                                  >
-                                                    <span
-                                                      class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
-                                                    >
-                                                      New York
-                                                    </span>
-                                                  </span>
-                                                </div>
-                                              </div>
-                                            </div>
+                                                New York
+                                              </span>
+                                            </span>
                                           </div>
                                         </div>
                                       </div>
@@ -2258,53 +2006,41 @@ tr:hover .c2:focus::before {
                                     class="euiFlexItem emotion-euiFlexItem-growZero"
                                   >
                                     <div
-                                      class=""
+                                      class="c1"
+                                      data-test-subj="draggableWrapperDiv"
                                     >
                                       <div
-                                        class="euiPopover emotion-euiPopover-inline-block"
+                                        data-rfd-droppable-context-id="0"
+                                        data-rfd-droppable-id="droppableId.content.geo-field-values-default-draggable-test-abcd-destination_geo_city_name-New York"
                                       >
                                         <div
-                                          data-test-subj="withHoverActionsButton"
+                                          class="draggable-keyboard-wrapper"
+                                          data-test-subj="draggableWrapperKeyboardHandler"
+                                          role="button"
+                                          tabindex="0"
                                         >
                                           <div
-                                            class="c1"
-                                            data-test-subj="draggableWrapperDiv"
+                                            aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                                            class="c2"
+                                            data-rfd-drag-handle-context-id="0"
+                                            data-rfd-drag-handle-draggable-id="draggableId.content.geo-field-values-default-draggable-test-abcd-destination_geo_city_name-New York"
+                                            data-rfd-draggable-context-id="0"
+                                            data-rfd-draggable-id="draggableId.content.geo-field-values-default-draggable-test-abcd-destination_geo_city_name-New York"
+                                            data-test-subj="providerContainer"
+                                            draggable="false"
+                                            role="button"
+                                            tabindex="-1"
                                           >
-                                            <div
-                                              data-rfd-droppable-context-id="0"
-                                              data-rfd-droppable-id="droppableId.content.geo-field-values-default-draggable-test-abcd-destination_geo_city_name-New York"
+                                            <span
+                                              class="c3"
+                                              data-test-subj="draggable-content-destination.geo.city_name"
                                             >
-                                              <div
-                                                class="draggable-keyboard-wrapper"
-                                                data-test-subj="draggableWrapperKeyboardHandler"
-                                                role="button"
-                                                tabindex="0"
+                                              <span
+                                                class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                                               >
-                                                <div
-                                                  aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                                  class="c2"
-                                                  data-rfd-drag-handle-context-id="0"
-                                                  data-rfd-drag-handle-draggable-id="draggableId.content.geo-field-values-default-draggable-test-abcd-destination_geo_city_name-New York"
-                                                  data-rfd-draggable-context-id="0"
-                                                  data-rfd-draggable-id="draggableId.content.geo-field-values-default-draggable-test-abcd-destination_geo_city_name-New York"
-                                                  data-test-subj="providerContainer"
-                                                  draggable="false"
-                                                  role="button"
-                                                  tabindex="-1"
-                                                >
-                                                  <span
-                                                    class="c3"
-                                                    data-test-subj="draggable-content-destination.geo.city_name"
-                                                  >
-                                                    <span
-                                                      class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
-                                                    >
-                                                      New York
-                                                    </span>
-                                                  </span>
-                                                </div>
-                                              </div>
-                                            </div>
+                                                New York
+                                              </span>
+                                            </span>
                                           </div>
                                         </div>
                                       </div>
@@ -2336,95 +2072,83 @@ tr:hover .c2:focus::before {
           class="euiFlexItem emotion-euiFlexItem-growZero"
         >
           <div
-            class=""
+            class="c1"
+            data-test-subj="draggableWrapperDiv"
           >
             <div
-              class="euiPopover emotion-euiPopover-inline-block"
+              data-rfd-droppable-context-id="0"
+              data-rfd-droppable-id="droppableId.content.draggable-badge-default-draggable-test-abcd-tls_fingerprints_ja3_hash-tls_fingerprints_ja3_hash-value"
             >
               <div
-                data-test-subj="withHoverActionsButton"
+                class="draggable-keyboard-wrapper"
+                data-test-subj="draggableWrapperKeyboardHandler"
+                role="button"
+                tabindex="0"
               >
                 <div
-                  class="c1"
-                  data-test-subj="draggableWrapperDiv"
+                  aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                  class="c2"
+                  data-rfd-drag-handle-context-id="0"
+                  data-rfd-drag-handle-draggable-id="draggableId.content.draggable-badge-default-draggable-test-abcd-tls_fingerprints_ja3_hash-tls_fingerprints_ja3_hash-value"
+                  data-rfd-draggable-context-id="0"
+                  data-rfd-draggable-id="draggableId.content.draggable-badge-default-draggable-test-abcd-tls_fingerprints_ja3_hash-tls_fingerprints_ja3_hash-value"
+                  data-test-subj="providerContainer"
+                  draggable="false"
+                  role="button"
+                  tabindex="-1"
                 >
-                  <div
-                    data-rfd-droppable-context-id="0"
-                    data-rfd-droppable-id="droppableId.content.draggable-badge-default-draggable-test-abcd-tls_fingerprints_ja3_hash-tls_fingerprints_ja3_hash-value"
+                  <span
+                    class="c3"
+                    data-test-subj="draggable-content-tls.fingerprints.ja3.hash"
                   >
-                    <div
-                      class="draggable-keyboard-wrapper"
-                      data-test-subj="draggableWrapperKeyboardHandler"
-                      role="button"
-                      tabindex="0"
+                    <span
+                      class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                     >
-                      <div
-                        aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                        class="c2"
-                        data-rfd-drag-handle-context-id="0"
-                        data-rfd-drag-handle-draggable-id="draggableId.content.draggable-badge-default-draggable-test-abcd-tls_fingerprints_ja3_hash-tls_fingerprints_ja3_hash-value"
-                        data-rfd-draggable-context-id="0"
-                        data-rfd-draggable-id="draggableId.content.draggable-badge-default-draggable-test-abcd-tls_fingerprints_ja3_hash-tls_fingerprints_ja3_hash-value"
-                        data-test-subj="providerContainer"
-                        draggable="false"
-                        role="button"
-                        tabindex="-1"
+                      <span
+                        class="euiBadge c4 emotion-euiBadge-hollow"
+                        title=""
                       >
                         <span
-                          class="c3"
-                          data-test-subj="draggable-content-tls.fingerprints.ja3.hash"
+                          class="euiBadge__content emotion-euiBadge__content"
                         >
                           <span
-                            class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
+                            class="euiBadge__icon emotion-euiBadge__icon-left"
+                            color="inherit"
+                            data-euiicon-type="snowflake"
+                          />
+                          <span
+                            class="euiBadge__text emotion-euiBadge__text"
                           >
                             <span
-                              class="euiBadge c4 emotion-euiBadge-hollow"
-                              title=""
+                              class="c20"
+                            >
+                              ja3
+                            </span>
+                            <a
+                              class="euiLink emotion-euiLink-primary"
+                              data-test-subj="ja3-fingerprint-link"
+                              href="https://sslbl.abuse.ch/ja3-fingerprints/tls.fingerprints.ja3.hash-value"
+                              rel="noopener noreferrer"
+                              target="_blank"
                             >
+                              tls.fingerprints.ja3.hash-value
                               <span
-                                class="euiBadge__content emotion-euiBadge__content"
+                                class="emotion-EuiExternalLinkIcon"
+                                data-euiicon-type="popout"
                               >
-                                <span
-                                  class="euiBadge__icon emotion-euiBadge__icon-left"
-                                  color="inherit"
-                                  data-euiicon-type="snowflake"
-                                />
-                                <span
-                                  class="euiBadge__text emotion-euiBadge__text"
-                                >
-                                  <span
-                                    class="c20"
-                                  >
-                                    ja3
-                                  </span>
-                                  <a
-                                    class="euiLink emotion-euiLink-primary"
-                                    data-test-subj="ja3-fingerprint-link"
-                                    href="https://sslbl.abuse.ch/ja3-fingerprints/tls.fingerprints.ja3.hash-value"
-                                    rel="noopener noreferrer"
-                                    target="_blank"
-                                  >
-                                    tls.fingerprints.ja3.hash-value
-                                    <span
-                                      class="emotion-EuiExternalLinkIcon"
-                                      data-euiicon-type="popout"
-                                    >
-                                      External link
-                                    </span>
-                                    <span
-                                      class="emotion-euiScreenReaderOnly"
-                                    >
-                                      (opens in a new tab or window)
-                                    </span>
-                                  </a>
-                                </span>
+                                External link
                               </span>
-                            </span>
+                              <span
+                                class="emotion-euiScreenReaderOnly"
+                              >
+                                (opens in a new tab or window)
+                              </span>
+                            </a>
                           </span>
                         </span>
-                      </div>
-                    </div>
-                  </div>
+                      </span>
+                    </span>
+                  </span>
                 </div>
               </div>
             </div>
@@ -2434,95 +2158,83 @@ tr:hover .c2:focus::before {
           class="euiFlexItem emotion-euiFlexItem-growZero"
         >
           <div
-            class=""
+            class="c1"
+            data-test-subj="draggableWrapperDiv"
           >
             <div
-              class="euiPopover emotion-euiPopover-inline-block"
+              data-rfd-droppable-context-id="0"
+              data-rfd-droppable-id="droppableId.content.draggable-badge-default-draggable-test-abcd-tls_client_certificate_fingerprint_sha1-tls_client_certificate_fingerprint_sha1-value"
             >
               <div
-                data-test-subj="withHoverActionsButton"
+                class="draggable-keyboard-wrapper"
+                data-test-subj="draggableWrapperKeyboardHandler"
+                role="button"
+                tabindex="0"
               >
                 <div
-                  class="c1"
-                  data-test-subj="draggableWrapperDiv"
+                  aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                  class="c2"
+                  data-rfd-drag-handle-context-id="0"
+                  data-rfd-drag-handle-draggable-id="draggableId.content.draggable-badge-default-draggable-test-abcd-tls_client_certificate_fingerprint_sha1-tls_client_certificate_fingerprint_sha1-value"
+                  data-rfd-draggable-context-id="0"
+                  data-rfd-draggable-id="draggableId.content.draggable-badge-default-draggable-test-abcd-tls_client_certificate_fingerprint_sha1-tls_client_certificate_fingerprint_sha1-value"
+                  data-test-subj="providerContainer"
+                  draggable="false"
+                  role="button"
+                  tabindex="-1"
                 >
-                  <div
-                    data-rfd-droppable-context-id="0"
-                    data-rfd-droppable-id="droppableId.content.draggable-badge-default-draggable-test-abcd-tls_client_certificate_fingerprint_sha1-tls_client_certificate_fingerprint_sha1-value"
+                  <span
+                    class="c3"
+                    data-test-subj="draggable-content-tls.client_certificate.fingerprint.sha1"
                   >
-                    <div
-                      class="draggable-keyboard-wrapper"
-                      data-test-subj="draggableWrapperKeyboardHandler"
-                      role="button"
-                      tabindex="0"
+                    <span
+                      class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                     >
-                      <div
-                        aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                        class="c2"
-                        data-rfd-drag-handle-context-id="0"
-                        data-rfd-drag-handle-draggable-id="draggableId.content.draggable-badge-default-draggable-test-abcd-tls_client_certificate_fingerprint_sha1-tls_client_certificate_fingerprint_sha1-value"
-                        data-rfd-draggable-context-id="0"
-                        data-rfd-draggable-id="draggableId.content.draggable-badge-default-draggable-test-abcd-tls_client_certificate_fingerprint_sha1-tls_client_certificate_fingerprint_sha1-value"
-                        data-test-subj="providerContainer"
-                        draggable="false"
-                        role="button"
-                        tabindex="-1"
+                      <span
+                        class="euiBadge c4 emotion-euiBadge-hollow"
+                        title=""
                       >
                         <span
-                          class="c3"
-                          data-test-subj="draggable-content-tls.client_certificate.fingerprint.sha1"
+                          class="euiBadge__content emotion-euiBadge__content"
                         >
                           <span
-                            class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
+                            class="euiBadge__icon emotion-euiBadge__icon-left"
+                            color="inherit"
+                            data-euiicon-type="snowflake"
+                          />
+                          <span
+                            class="euiBadge__text emotion-euiBadge__text"
                           >
                             <span
-                              class="euiBadge c4 emotion-euiBadge-hollow"
-                              title=""
+                              class="c21"
+                            >
+                              client cert
+                            </span>
+                            <a
+                              class="euiLink emotion-euiLink-primary"
+                              data-test-subj="certificate-fingerprint-link"
+                              href="https://sslbl.abuse.ch/ssl-certificates/sha1/tls.client_certificate.fingerprint.sha1-value"
+                              rel="noopener noreferrer"
+                              target="_blank"
                             >
+                              tls.client_certificate.fingerprint.sha1-value
                               <span
-                                class="euiBadge__content emotion-euiBadge__content"
+                                class="emotion-EuiExternalLinkIcon"
+                                data-euiicon-type="popout"
                               >
-                                <span
-                                  class="euiBadge__icon emotion-euiBadge__icon-left"
-                                  color="inherit"
-                                  data-euiicon-type="snowflake"
-                                />
-                                <span
-                                  class="euiBadge__text emotion-euiBadge__text"
-                                >
-                                  <span
-                                    class="c21"
-                                  >
-                                    client cert
-                                  </span>
-                                  <a
-                                    class="euiLink emotion-euiLink-primary"
-                                    data-test-subj="certificate-fingerprint-link"
-                                    href="https://sslbl.abuse.ch/ssl-certificates/sha1/tls.client_certificate.fingerprint.sha1-value"
-                                    rel="noopener noreferrer"
-                                    target="_blank"
-                                  >
-                                    tls.client_certificate.fingerprint.sha1-value
-                                    <span
-                                      class="emotion-EuiExternalLinkIcon"
-                                      data-euiicon-type="popout"
-                                    >
-                                      External link
-                                    </span>
-                                    <span
-                                      class="emotion-euiScreenReaderOnly"
-                                    >
-                                      (opens in a new tab or window)
-                                    </span>
-                                  </a>
-                                </span>
+                                External link
                               </span>
-                            </span>
+                              <span
+                                class="emotion-euiScreenReaderOnly"
+                              >
+                                (opens in a new tab or window)
+                              </span>
+                            </a>
                           </span>
                         </span>
-                      </div>
-                    </div>
-                  </div>
+                      </span>
+                    </span>
+                  </span>
                 </div>
               </div>
             </div>
@@ -2532,95 +2244,83 @@ tr:hover .c2:focus::before {
           class="euiFlexItem emotion-euiFlexItem-growZero"
         >
           <div
-            class=""
+            class="c1"
+            data-test-subj="draggableWrapperDiv"
           >
             <div
-              class="euiPopover emotion-euiPopover-inline-block"
+              data-rfd-droppable-context-id="0"
+              data-rfd-droppable-id="droppableId.content.draggable-badge-default-draggable-test-abcd-tls_server_certificate_fingerprint_sha1-tls_server_certificate_fingerprint_sha1-value"
             >
               <div
-                data-test-subj="withHoverActionsButton"
+                class="draggable-keyboard-wrapper"
+                data-test-subj="draggableWrapperKeyboardHandler"
+                role="button"
+                tabindex="0"
               >
                 <div
-                  class="c1"
-                  data-test-subj="draggableWrapperDiv"
+                  aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                  class="c2"
+                  data-rfd-drag-handle-context-id="0"
+                  data-rfd-drag-handle-draggable-id="draggableId.content.draggable-badge-default-draggable-test-abcd-tls_server_certificate_fingerprint_sha1-tls_server_certificate_fingerprint_sha1-value"
+                  data-rfd-draggable-context-id="0"
+                  data-rfd-draggable-id="draggableId.content.draggable-badge-default-draggable-test-abcd-tls_server_certificate_fingerprint_sha1-tls_server_certificate_fingerprint_sha1-value"
+                  data-test-subj="providerContainer"
+                  draggable="false"
+                  role="button"
+                  tabindex="-1"
                 >
-                  <div
-                    data-rfd-droppable-context-id="0"
-                    data-rfd-droppable-id="droppableId.content.draggable-badge-default-draggable-test-abcd-tls_server_certificate_fingerprint_sha1-tls_server_certificate_fingerprint_sha1-value"
+                  <span
+                    class="c3"
+                    data-test-subj="draggable-content-tls.server_certificate.fingerprint.sha1"
                   >
-                    <div
-                      class="draggable-keyboard-wrapper"
-                      data-test-subj="draggableWrapperKeyboardHandler"
-                      role="button"
-                      tabindex="0"
+                    <span
+                      class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                     >
-                      <div
-                        aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                        class="c2"
-                        data-rfd-drag-handle-context-id="0"
-                        data-rfd-drag-handle-draggable-id="draggableId.content.draggable-badge-default-draggable-test-abcd-tls_server_certificate_fingerprint_sha1-tls_server_certificate_fingerprint_sha1-value"
-                        data-rfd-draggable-context-id="0"
-                        data-rfd-draggable-id="draggableId.content.draggable-badge-default-draggable-test-abcd-tls_server_certificate_fingerprint_sha1-tls_server_certificate_fingerprint_sha1-value"
-                        data-test-subj="providerContainer"
-                        draggable="false"
-                        role="button"
-                        tabindex="-1"
+                      <span
+                        class="euiBadge c4 emotion-euiBadge-hollow"
+                        title=""
                       >
                         <span
-                          class="c3"
-                          data-test-subj="draggable-content-tls.server_certificate.fingerprint.sha1"
+                          class="euiBadge__content emotion-euiBadge__content"
                         >
                           <span
-                            class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
+                            class="euiBadge__icon emotion-euiBadge__icon-left"
+                            color="inherit"
+                            data-euiicon-type="snowflake"
+                          />
+                          <span
+                            class="euiBadge__text emotion-euiBadge__text"
                           >
                             <span
-                              class="euiBadge c4 emotion-euiBadge-hollow"
-                              title=""
+                              class="c21"
+                            >
+                              server cert
+                            </span>
+                            <a
+                              class="euiLink emotion-euiLink-primary"
+                              data-test-subj="certificate-fingerprint-link"
+                              href="https://sslbl.abuse.ch/ssl-certificates/sha1/tls.server_certificate.fingerprint.sha1-value"
+                              rel="noopener noreferrer"
+                              target="_blank"
                             >
+                              tls.server_certificate.fingerprint.sha1-value
                               <span
-                                class="euiBadge__content emotion-euiBadge__content"
+                                class="emotion-EuiExternalLinkIcon"
+                                data-euiicon-type="popout"
                               >
-                                <span
-                                  class="euiBadge__icon emotion-euiBadge__icon-left"
-                                  color="inherit"
-                                  data-euiicon-type="snowflake"
-                                />
-                                <span
-                                  class="euiBadge__text emotion-euiBadge__text"
-                                >
-                                  <span
-                                    class="c21"
-                                  >
-                                    server cert
-                                  </span>
-                                  <a
-                                    class="euiLink emotion-euiLink-primary"
-                                    data-test-subj="certificate-fingerprint-link"
-                                    href="https://sslbl.abuse.ch/ssl-certificates/sha1/tls.server_certificate.fingerprint.sha1-value"
-                                    rel="noopener noreferrer"
-                                    target="_blank"
-                                  >
-                                    tls.server_certificate.fingerprint.sha1-value
-                                    <span
-                                      class="emotion-EuiExternalLinkIcon"
-                                      data-euiicon-type="popout"
-                                    >
-                                      External link
-                                    </span>
-                                    <span
-                                      class="emotion-euiScreenReaderOnly"
-                                    >
-                                      (opens in a new tab or window)
-                                    </span>
-                                  </a>
-                                </span>
+                                External link
                               </span>
-                            </span>
+                              <span
+                                class="emotion-euiScreenReaderOnly"
+                              >
+                                (opens in a new tab or window)
+                              </span>
+                            </a>
                           </span>
                         </span>
-                      </div>
-                    </div>
-                  </div>
+                      </span>
+                    </span>
+                  </span>
                 </div>
               </div>
             </div>
diff --git a/x-pack/plugins/security_solution/public/timelines/components/side_panel/host_details/expandable_host.tsx b/x-pack/plugins/security_solution/public/timelines/components/side_panel/host_details/expandable_host.tsx
index c5f805a53ac87e..3c0ae21ac81cb5 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/side_panel/host_details/expandable_host.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/side_panel/host_details/expandable_host.tsx
@@ -21,7 +21,6 @@ import { AnomalyTableProvider } from '../../../../common/components/ml/anomaly/a
 import { hostToCriteria } from '../../../../common/components/ml/criteria/host_to_criteria';
 import { scoreIntervalToDateTime } from '../../../../common/components/ml/score/score_interval_to_datetime';
 import { useHostDetails, ID } from '../../../../explore/hosts/containers/hosts/details';
-import { getSourcererScopeId } from '../../../../helpers';
 
 interface ExpandableHostProps {
   hostName: string;
@@ -100,7 +99,7 @@ export const ExpandableHostDetails = ({
       {({ isLoadingAnomaliesData, anomaliesData, jobNameById }) => (
         <HostOverview
           contextID={contextID}
-          sourcererScopeId={getSourcererScopeId(scopeId)}
+          scopeId={scopeId}
           id={ID}
           isInDetailsSidePanel
           data={hostOverview as HostItem}
diff --git a/x-pack/plugins/security_solution/public/timelines/components/side_panel/new_user_detail/columns.tsx b/x-pack/plugins/security_solution/public/timelines/components/side_panel/new_user_detail/columns.tsx
index fc3aeb6aedd9f3..7ea3168c406a03 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/side_panel/new_user_detail/columns.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/side_panel/new_user_detail/columns.tsx
@@ -9,7 +9,6 @@ import { css } from '@emotion/react';
 import React from 'react';
 import { euiThemeVars } from '@kbn/ui-theme';
 import type { EuiBasicTableColumn } from '@elastic/eui';
-import { SourcererScopeName } from '../../../../common/store/sourcerer/model';
 import { DefaultFieldRenderer } from '../../field_renderers/field_renderers';
 import type { ManagedUsersTableColumns, ManagedUserTable } from './types';
 import * as i18n from './translations';
@@ -45,7 +44,6 @@ export const getManagedUserTableColumns = (
           attrName={field}
           idPrefix={contextID ? `managedUser-${contextID}` : 'managedUser'}
           isDraggable={isDraggable}
-          sourcererScopeId={SourcererScopeName.default}
         />
       ) : (
         defaultToEmptyTag(value)
diff --git a/x-pack/plugins/security_solution/public/timelines/components/side_panel/user_details/expandable_user.tsx b/x-pack/plugins/security_solution/public/timelines/components/side_panel/user_details/expandable_user.tsx
index b85b31c2185c52..db75d224682fdf 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/side_panel/user_details/expandable_user.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/side_panel/user_details/expandable_user.tsx
@@ -21,7 +21,6 @@ import { getCriteriaFromUsersType } from '../../../../common/components/ml/crite
 import { scoreIntervalToDateTime } from '../../../../common/components/ml/score/score_interval_to_datetime';
 import { AnomalyTableProvider } from '../../../../common/components/ml/anomaly/anomaly_table_provider';
 import { UsersType } from '../../../../explore/users/store/model';
-import { getSourcererScopeId } from '../../../../helpers';
 
 export const QUERY_ID = 'usersDetailsQuery';
 export interface ExpandableUserProps {
@@ -99,7 +98,7 @@ export const ExpandableUserDetails = ({
           data={userDetails}
           loading={loading}
           contextID={contextID}
-          sourcererScopeId={getSourcererScopeId(scopeId)}
+          scopeId={scopeId}
           isDraggable={isDraggable}
           id={QUERY_ID}
           anomaliesData={anomaliesData}
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/alert_renderer/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/alert_renderer/index.tsx
index 018b56ff6508c5..0361c7d4702150 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/alert_renderer/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/alert_renderer/index.tsx
@@ -8,7 +8,6 @@
 import { get } from 'lodash/fp';
 import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
 import React from 'react';
-import styled from 'styled-components';
 
 import { AlertField } from './alert_field';
 import type { RowRenderer } from '../../../../../../../common/types';
@@ -52,10 +51,6 @@ export const ALERT_RENDERER_FIELDS = [
   USER_NAME,
 ];
 
-const AlertRendererFlexGroup = styled(EuiFlexGroup)`
-  gap: ${({ theme }) => theme.eui.euiSizeXS};
-`;
-
 export const alertRenderer: RowRenderer = {
   id: RowRendererId.alert,
   isInstance: (ecs) => eventKindMatches(get('event.kind', ecs)),
@@ -77,12 +72,7 @@ export const alertRenderer: RowRenderer = {
     return (
       <RowRendererContainer>
         <Details data-test-subj="alertRenderer">
-          <AlertRendererFlexGroup
-            alignItems="center"
-            gutterSize="none"
-            justifyContent="center"
-            wrap={true}
-          >
+          <EuiFlexGroup alignItems="center" gutterSize="xs" justifyContent="center" wrap={true}>
             <AlertField
               contextId={contextId}
               data-test-subj={EVENT_CATEGORY}
@@ -232,7 +222,7 @@ export const alertRenderer: RowRenderer = {
               scopeId={scopeId}
               values={kibanaAlertRuleName}
             />
-          </AlertRendererFlexGroup>
+          </EuiFlexGroup>
         </Details>
       </RowRendererContainer>
     );
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/netflow/__snapshots__/netflow_row_renderer.test.tsx.snap b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/netflow/__snapshots__/netflow_row_renderer.test.tsx.snap
index fa510b06b588a4..9d2956c56d5881 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/netflow/__snapshots__/netflow_row_renderer.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/netflow/__snapshots__/netflow_row_renderer.test.tsx.snap
@@ -233,78 +233,78 @@ tr:hover .c4:focus::before {
                   class="euiFlexItem emotion-euiFlexItem-growZero"
                 >
                   <div
-                    class=""
+                    data-test-subj="cellActions-renderContent-user.name"
                   >
-                    <div
-                      class="euiPopover emotion-euiPopover-inline-block"
-                    >
+                    <div>
                       <div
-                        data-test-subj="withHoverActionsButton"
+                        class="euiPopover emotion-euiPopover-inline-block"
                       >
-                        <div
-                          class="c3"
-                          data-test-subj="draggableWrapperDiv"
-                        >
+                        <div>
                           <div
-                            data-rfd-droppable-context-id="0"
-                            data-rfd-droppable-id="droppableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-user_name-first_last"
+                            class="c3"
+                            data-test-subj="draggableWrapperDiv"
                           >
                             <div
-                              class="draggable-keyboard-wrapper"
-                              data-test-subj="draggableWrapperKeyboardHandler"
-                              role="button"
-                              tabindex="0"
+                              data-rfd-droppable-context-id="0"
+                              data-rfd-droppable-id="droppableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-user_name-first_last"
                             >
                               <div
-                                aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                class="c4"
-                                data-rfd-drag-handle-context-id="0"
-                                data-rfd-drag-handle-draggable-id="draggableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-user_name-first_last"
-                                data-rfd-draggable-context-id="0"
-                                data-rfd-draggable-id="draggableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-user_name-first_last"
-                                data-test-subj="providerContainer"
-                                draggable="false"
+                                class="draggable-keyboard-wrapper"
+                                data-test-subj="draggableWrapperKeyboardHandler"
                                 role="button"
-                                tabindex="-1"
+                                tabindex="0"
                               >
-                                <p
-                                  class="emotion-euiScreenReaderOnly"
-                                >
-                                  user.name
-                                </p>
-                                <span
-                                  class="c5"
-                                  data-test-subj="draggable-content-user.name"
+                                <div
+                                  aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                                  class="c4"
+                                  data-rfd-drag-handle-context-id="0"
+                                  data-rfd-drag-handle-draggable-id="draggableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-user_name-first_last"
+                                  data-rfd-draggable-context-id="0"
+                                  data-rfd-draggable-id="draggableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-user_name-first_last"
+                                  data-test-subj="providerContainer"
+                                  draggable="false"
+                                  role="button"
+                                  tabindex="-1"
                                 >
+                                  <p
+                                    class="emotion-euiScreenReaderOnly"
+                                  >
+                                    user.name
+                                  </p>
                                   <span
-                                    class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
+                                    class="c5"
+                                    data-test-subj="draggable-content-user.name"
                                   >
                                     <span
-                                      class="euiBadge c6 emotion-euiBadge-hollow"
-                                      title=""
+                                      class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                                     >
                                       <span
-                                        class="euiBadge__content emotion-euiBadge__content"
+                                        class="euiBadge c6 emotion-euiBadge-hollow"
+                                        title=""
                                       >
                                         <span
-                                          class="euiBadge__icon emotion-euiBadge__icon-left"
-                                          color="inherit"
-                                          data-euiicon-type="user"
-                                        />
-                                        <span
-                                          class="euiBadge__text emotion-euiBadge__text"
+                                          class="euiBadge__content emotion-euiBadge__content"
                                         >
-                                          first.last
+                                          <span
+                                            class="euiBadge__icon emotion-euiBadge__icon-left"
+                                            color="inherit"
+                                            data-euiicon-type="user"
+                                          />
+                                          <span
+                                            class="euiBadge__text emotion-euiBadge__text"
+                                          >
+                                            first.last
+                                          </span>
                                         </span>
                                       </span>
                                     </span>
                                   </span>
-                                </span>
-                                <p
-                                  class="emotion-euiScreenReaderOnly"
-                                >
-                                  Press enter for options, or press space to begin dragging.
-                                </p>
+                                  <p
+                                    class="emotion-euiScreenReaderOnly"
+                                  >
+                                    Press enter for options, or press space to begin dragging.
+                                  </p>
+                                </div>
                               </div>
                             </div>
                           </div>
@@ -317,81 +317,69 @@ tr:hover .c4:focus::before {
                   class="euiFlexItem emotion-euiFlexItem-growZero"
                 >
                   <div
-                    class=""
+                    class="c3"
+                    data-test-subj="draggableWrapperDiv"
                   >
                     <div
-                      class="euiPopover emotion-euiPopover-inline-block"
+                      data-rfd-droppable-context-id="0"
+                      data-rfd-droppable-id="droppableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-process_name-rat"
                     >
                       <div
-                        data-test-subj="withHoverActionsButton"
+                        class="draggable-keyboard-wrapper"
+                        data-test-subj="draggableWrapperKeyboardHandler"
+                        role="button"
+                        tabindex="0"
                       >
                         <div
-                          class="c3"
-                          data-test-subj="draggableWrapperDiv"
+                          aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                          class="c4"
+                          data-rfd-drag-handle-context-id="0"
+                          data-rfd-drag-handle-draggable-id="draggableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-process_name-rat"
+                          data-rfd-draggable-context-id="0"
+                          data-rfd-draggable-id="draggableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-process_name-rat"
+                          data-test-subj="providerContainer"
+                          draggable="false"
+                          role="button"
+                          tabindex="-1"
                         >
-                          <div
-                            data-rfd-droppable-context-id="0"
-                            data-rfd-droppable-id="droppableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-process_name-rat"
+                          <p
+                            class="emotion-euiScreenReaderOnly"
                           >
-                            <div
-                              class="draggable-keyboard-wrapper"
-                              data-test-subj="draggableWrapperKeyboardHandler"
-                              role="button"
-                              tabindex="0"
+                            process.name
+                          </p>
+                          <span
+                            class="c5"
+                            data-test-subj="draggable-content-process.name"
+                          >
+                            <span
+                              class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                             >
-                              <div
-                                aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                class="c4"
-                                data-rfd-drag-handle-context-id="0"
-                                data-rfd-drag-handle-draggable-id="draggableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-process_name-rat"
-                                data-rfd-draggable-context-id="0"
-                                data-rfd-draggable-id="draggableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-process_name-rat"
-                                data-test-subj="providerContainer"
-                                draggable="false"
-                                role="button"
-                                tabindex="-1"
+                              <span
+                                class="euiBadge c6 emotion-euiBadge-hollow"
+                                title=""
                               >
-                                <p
-                                  class="emotion-euiScreenReaderOnly"
-                                >
-                                  process.name
-                                </p>
                                 <span
-                                  class="c5"
-                                  data-test-subj="draggable-content-process.name"
+                                  class="euiBadge__content emotion-euiBadge__content"
                                 >
                                   <span
-                                    class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
+                                    class="euiBadge__icon emotion-euiBadge__icon-left"
+                                    color="inherit"
+                                    data-euiicon-type="console"
+                                  />
+                                  <span
+                                    class="euiBadge__text emotion-euiBadge__text"
                                   >
-                                    <span
-                                      class="euiBadge c6 emotion-euiBadge-hollow"
-                                      title=""
-                                    >
-                                      <span
-                                        class="euiBadge__content emotion-euiBadge__content"
-                                      >
-                                        <span
-                                          class="euiBadge__icon emotion-euiBadge__icon-left"
-                                          color="inherit"
-                                          data-euiicon-type="console"
-                                        />
-                                        <span
-                                          class="euiBadge__text emotion-euiBadge__text"
-                                        >
-                                          rat
-                                        </span>
-                                      </span>
-                                    </span>
+                                    rat
                                   </span>
                                 </span>
-                                <p
-                                  class="emotion-euiScreenReaderOnly"
-                                >
-                                  Press enter for options, or press space to begin dragging.
-                                </p>
-                              </div>
-                            </div>
-                          </div>
+                              </span>
+                            </span>
+                          </span>
+                          <p
+                            class="emotion-euiScreenReaderOnly"
+                          >
+                            Press enter for options, or press space to begin dragging.
+                          </p>
                         </div>
                       </div>
                     </div>
@@ -410,75 +398,63 @@ tr:hover .c4:focus::before {
                   class="euiFlexItem emotion-euiFlexItem-growZero"
                 >
                   <div
-                    class=""
+                    class="c3"
+                    data-test-subj="draggableWrapperDiv"
                   >
                     <div
-                      class="euiPopover emotion-euiPopover-inline-block"
+                      data-rfd-droppable-context-id="0"
+                      data-rfd-droppable-id="droppableId.content.duration-event-start-end-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-event_duration-1000000"
                     >
                       <div
-                        data-test-subj="withHoverActionsButton"
+                        class="draggable-keyboard-wrapper"
+                        data-test-subj="draggableWrapperKeyboardHandler"
+                        role="button"
+                        tabindex="0"
                       >
                         <div
-                          class="c3"
-                          data-test-subj="draggableWrapperDiv"
+                          aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                          class="c4"
+                          data-rfd-drag-handle-context-id="0"
+                          data-rfd-drag-handle-draggable-id="draggableId.content.duration-event-start-end-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-event_duration-1000000"
+                          data-rfd-draggable-context-id="0"
+                          data-rfd-draggable-id="draggableId.content.duration-event-start-end-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-event_duration-1000000"
+                          data-test-subj="providerContainer"
+                          draggable="false"
+                          role="button"
+                          tabindex="-1"
                         >
-                          <div
-                            data-rfd-droppable-context-id="0"
-                            data-rfd-droppable-id="droppableId.content.duration-event-start-end-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-event_duration-1000000"
+                          <p
+                            class="emotion-euiScreenReaderOnly"
+                          >
+                            event.duration
+                          </p>
+                          <span
+                            class="c5"
+                            data-test-subj="draggable-content-event.duration"
                           >
                             <div
-                              class="draggable-keyboard-wrapper"
-                              data-test-subj="draggableWrapperKeyboardHandler"
-                              role="button"
-                              tabindex="0"
+                              class="euiText emotion-euiText-xs"
                             >
-                              <div
-                                aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                class="c4"
-                                data-rfd-drag-handle-context-id="0"
-                                data-rfd-drag-handle-draggable-id="draggableId.content.duration-event-start-end-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-event_duration-1000000"
-                                data-rfd-draggable-context-id="0"
-                                data-rfd-draggable-id="draggableId.content.duration-event-start-end-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-event_duration-1000000"
-                                data-test-subj="providerContainer"
-                                draggable="false"
-                                role="button"
-                                tabindex="-1"
+                              <span
+                                class="c7"
+                                data-euiicon-type="clock"
+                              />
+                              <span
+                                class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                               >
-                                <p
-                                  class="emotion-euiScreenReaderOnly"
-                                >
-                                  event.duration
-                                </p>
-                                <span
-                                  class="c5"
-                                  data-test-subj="draggable-content-event.duration"
-                                >
-                                  <div
-                                    class="euiText emotion-euiText-xs"
-                                  >
-                                    <span
-                                      class="c7"
-                                      data-euiicon-type="clock"
-                                    />
-                                    <span
-                                      class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
-                                    >
-                                      <div
-                                        data-test-subj="formatted-duration"
-                                      >
-                                        1ms
-                                      </div>
-                                    </span>
-                                  </div>
-                                </span>
-                                <p
-                                  class="emotion-euiScreenReaderOnly"
+                                <div
+                                  data-test-subj="formatted-duration"
                                 >
-                                  Press enter for options, or press space to begin dragging.
-                                </p>
-                              </div>
+                                  1ms
+                                </div>
+                              </span>
                             </div>
-                          </div>
+                          </span>
+                          <p
+                            class="emotion-euiScreenReaderOnly"
+                          >
+                            Press enter for options, or press space to begin dragging.
+                          </p>
                         </div>
                       </div>
                     </div>
@@ -488,71 +464,59 @@ tr:hover .c4:focus::before {
                   class="euiFlexItem emotion-euiFlexItem-growZero"
                 >
                   <div
-                    class=""
+                    class="c3"
+                    data-test-subj="draggableWrapperDiv"
                   >
                     <div
-                      class="euiPopover emotion-euiPopover-inline-block"
+                      data-rfd-droppable-context-id="0"
+                      data-rfd-droppable-id="droppableId.content.duration-event-start-end-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-event_start-2018-11-12T19:03:25_836Z"
                     >
                       <div
-                        data-test-subj="withHoverActionsButton"
+                        class="draggable-keyboard-wrapper"
+                        data-test-subj="draggableWrapperKeyboardHandler"
+                        role="button"
+                        tabindex="0"
                       >
                         <div
-                          class="c3"
-                          data-test-subj="draggableWrapperDiv"
+                          aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                          class="c4"
+                          data-rfd-drag-handle-context-id="0"
+                          data-rfd-drag-handle-draggable-id="draggableId.content.duration-event-start-end-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-event_start-2018-11-12T19:03:25_836Z"
+                          data-rfd-draggable-context-id="0"
+                          data-rfd-draggable-id="draggableId.content.duration-event-start-end-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-event_start-2018-11-12T19:03:25_836Z"
+                          data-test-subj="providerContainer"
+                          draggable="false"
+                          role="button"
+                          tabindex="-1"
                         >
-                          <div
-                            data-rfd-droppable-context-id="0"
-                            data-rfd-droppable-id="droppableId.content.duration-event-start-end-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-event_start-2018-11-12T19:03:25_836Z"
+                          <p
+                            class="emotion-euiScreenReaderOnly"
+                          >
+                            event.start
+                          </p>
+                          <span
+                            class="c5"
+                            data-test-subj="draggable-content-event.start"
                           >
                             <div
-                              class="draggable-keyboard-wrapper"
-                              data-test-subj="draggableWrapperKeyboardHandler"
-                              role="button"
-                              tabindex="0"
+                              class="euiText emotion-euiText-xs"
                             >
-                              <div
-                                aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                class="c4"
-                                data-rfd-drag-handle-context-id="0"
-                                data-rfd-drag-handle-draggable-id="draggableId.content.duration-event-start-end-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-event_start-2018-11-12T19:03:25_836Z"
-                                data-rfd-draggable-context-id="0"
-                                data-rfd-draggable-id="draggableId.content.duration-event-start-end-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-event_start-2018-11-12T19:03:25_836Z"
-                                data-test-subj="providerContainer"
-                                draggable="false"
-                                role="button"
-                                tabindex="-1"
+                              <span
+                                class="c7"
+                                data-euiicon-type="clock"
+                              />
+                              <span
+                                class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                               >
-                                <p
-                                  class="emotion-euiScreenReaderOnly"
-                                >
-                                  event.start
-                                </p>
-                                <span
-                                  class="c5"
-                                  data-test-subj="draggable-content-event.start"
-                                >
-                                  <div
-                                    class="euiText emotion-euiText-xs"
-                                  >
-                                    <span
-                                      class="c7"
-                                      data-euiicon-type="clock"
-                                    />
-                                    <span
-                                      class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
-                                    >
-                                      Nov 12, 2018 @ 19:03:25.836
-                                    </span>
-                                  </div>
-                                </span>
-                                <p
-                                  class="emotion-euiScreenReaderOnly"
-                                >
-                                  Press enter for options, or press space to begin dragging.
-                                </p>
-                              </div>
+                                Nov 12, 2018 @ 19:03:25.836
+                              </span>
                             </div>
-                          </div>
+                          </span>
+                          <p
+                            class="emotion-euiScreenReaderOnly"
+                          >
+                            Press enter for options, or press space to begin dragging.
+                          </p>
                         </div>
                       </div>
                     </div>
@@ -562,68 +526,68 @@ tr:hover .c4:focus::before {
                   class="euiFlexItem emotion-euiFlexItem-growZero"
                 >
                   <div
-                    class=""
+                    data-test-subj="cellActions-renderContent-event.end"
                   >
-                    <div
-                      class="euiPopover emotion-euiPopover-inline-block"
-                    >
+                    <div>
                       <div
-                        data-test-subj="withHoverActionsButton"
+                        class="euiPopover emotion-euiPopover-inline-block"
                       >
-                        <div
-                          class="c3"
-                          data-test-subj="draggableWrapperDiv"
-                        >
+                        <div>
                           <div
-                            data-rfd-droppable-context-id="0"
-                            data-rfd-droppable-id="droppableId.content.duration-event-start-end-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-event_end-2018-11-12T19:03:25_936Z"
+                            class="c3"
+                            data-test-subj="draggableWrapperDiv"
                           >
                             <div
-                              class="draggable-keyboard-wrapper"
-                              data-test-subj="draggableWrapperKeyboardHandler"
-                              role="button"
-                              tabindex="0"
+                              data-rfd-droppable-context-id="0"
+                              data-rfd-droppable-id="droppableId.content.duration-event-start-end-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-event_end-2018-11-12T19:03:25_936Z"
                             >
                               <div
-                                aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                class="c4"
-                                data-rfd-drag-handle-context-id="0"
-                                data-rfd-drag-handle-draggable-id="draggableId.content.duration-event-start-end-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-event_end-2018-11-12T19:03:25_936Z"
-                                data-rfd-draggable-context-id="0"
-                                data-rfd-draggable-id="draggableId.content.duration-event-start-end-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-event_end-2018-11-12T19:03:25_936Z"
-                                data-test-subj="providerContainer"
-                                draggable="false"
+                                class="draggable-keyboard-wrapper"
+                                data-test-subj="draggableWrapperKeyboardHandler"
                                 role="button"
-                                tabindex="-1"
+                                tabindex="0"
                               >
-                                <p
-                                  class="emotion-euiScreenReaderOnly"
-                                >
-                                  event.end
-                                </p>
-                                <span
-                                  class="c5"
-                                  data-test-subj="draggable-content-event.end"
+                                <div
+                                  aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                                  class="c4"
+                                  data-rfd-drag-handle-context-id="0"
+                                  data-rfd-drag-handle-draggable-id="draggableId.content.duration-event-start-end-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-event_end-2018-11-12T19:03:25_936Z"
+                                  data-rfd-draggable-context-id="0"
+                                  data-rfd-draggable-id="draggableId.content.duration-event-start-end-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-event_end-2018-11-12T19:03:25_936Z"
+                                  data-test-subj="providerContainer"
+                                  draggable="false"
+                                  role="button"
+                                  tabindex="-1"
                                 >
-                                  <div
-                                    class="euiText emotion-euiText-xs"
+                                  <p
+                                    class="emotion-euiScreenReaderOnly"
                                   >
-                                    <span
-                                      class="c7"
-                                      data-euiicon-type="clock"
-                                    />
-                                    <span
-                                      class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
+                                    event.end
+                                  </p>
+                                  <span
+                                    class="c5"
+                                    data-test-subj="draggable-content-event.end"
+                                  >
+                                    <div
+                                      class="euiText emotion-euiText-xs"
                                     >
-                                      Nov 12, 2018 @ 19:03:25.936
-                                    </span>
-                                  </div>
-                                </span>
-                                <p
-                                  class="emotion-euiScreenReaderOnly"
-                                >
-                                  Press enter for options, or press space to begin dragging.
-                                </p>
+                                      <span
+                                        class="c7"
+                                        data-euiicon-type="clock"
+                                      />
+                                      <span
+                                        class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
+                                      >
+                                        Nov 12, 2018 @ 19:03:25.936
+                                      </span>
+                                    </div>
+                                  </span>
+                                  <p
+                                    class="emotion-euiScreenReaderOnly"
+                                  >
+                                    Press enter for options, or press space to begin dragging.
+                                  </p>
+                                </div>
                               </div>
                             </div>
                           </div>
@@ -650,81 +614,69 @@ tr:hover .c4:focus::before {
                       class="euiFlexItem c8 emotion-euiFlexItem-growZero"
                     >
                       <div
-                        class=""
+                        class="c3"
+                        data-test-subj="draggableWrapperDiv"
                       >
                         <div
-                          class="euiPopover emotion-euiPopover-inline-block"
+                          data-rfd-droppable-context-id="0"
+                          data-rfd-droppable-id="droppableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-network_direction-outgoing"
                         >
                           <div
-                            data-test-subj="withHoverActionsButton"
+                            class="draggable-keyboard-wrapper"
+                            data-test-subj="draggableWrapperKeyboardHandler"
+                            role="button"
+                            tabindex="0"
                           >
                             <div
-                              class="c3"
-                              data-test-subj="draggableWrapperDiv"
+                              aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                              class="c4"
+                              data-rfd-drag-handle-context-id="0"
+                              data-rfd-drag-handle-draggable-id="draggableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-network_direction-outgoing"
+                              data-rfd-draggable-context-id="0"
+                              data-rfd-draggable-id="draggableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-network_direction-outgoing"
+                              data-test-subj="providerContainer"
+                              draggable="false"
+                              role="button"
+                              tabindex="-1"
                             >
-                              <div
-                                data-rfd-droppable-context-id="0"
-                                data-rfd-droppable-id="droppableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-network_direction-outgoing"
+                              <p
+                                class="emotion-euiScreenReaderOnly"
                               >
-                                <div
-                                  class="draggable-keyboard-wrapper"
-                                  data-test-subj="draggableWrapperKeyboardHandler"
-                                  role="button"
-                                  tabindex="0"
+                                network.direction
+                              </p>
+                              <span
+                                class="c5"
+                                data-test-subj="draggable-content-network.direction"
+                              >
+                                <span
+                                  class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                                 >
-                                  <div
-                                    aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                    class="c4"
-                                    data-rfd-drag-handle-context-id="0"
-                                    data-rfd-drag-handle-draggable-id="draggableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-network_direction-outgoing"
-                                    data-rfd-draggable-context-id="0"
-                                    data-rfd-draggable-id="draggableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-network_direction-outgoing"
-                                    data-test-subj="providerContainer"
-                                    draggable="false"
-                                    role="button"
-                                    tabindex="-1"
+                                  <span
+                                    class="euiBadge c6 emotion-euiBadge-hollow"
+                                    title=""
                                   >
-                                    <p
-                                      class="emotion-euiScreenReaderOnly"
-                                    >
-                                      network.direction
-                                    </p>
                                     <span
-                                      class="c5"
-                                      data-test-subj="draggable-content-network.direction"
+                                      class="euiBadge__content emotion-euiBadge__content"
                                     >
                                       <span
-                                        class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
+                                        class="euiBadge__icon emotion-euiBadge__icon-left"
+                                        color="inherit"
+                                        data-euiicon-type="arrowUp"
+                                      />
+                                      <span
+                                        class="euiBadge__text emotion-euiBadge__text"
                                       >
-                                        <span
-                                          class="euiBadge c6 emotion-euiBadge-hollow"
-                                          title=""
-                                        >
-                                          <span
-                                            class="euiBadge__content emotion-euiBadge__content"
-                                          >
-                                            <span
-                                              class="euiBadge__icon emotion-euiBadge__icon-left"
-                                              color="inherit"
-                                              data-euiicon-type="arrowUp"
-                                            />
-                                            <span
-                                              class="euiBadge__text emotion-euiBadge__text"
-                                            >
-                                              outgoing
-                                            </span>
-                                          </span>
-                                        </span>
+                                        outgoing
                                       </span>
                                     </span>
-                                    <p
-                                      class="emotion-euiScreenReaderOnly"
-                                    >
-                                      Press enter for options, or press space to begin dragging.
-                                    </p>
-                                  </div>
-                                </div>
-                              </div>
+                                  </span>
+                                </span>
+                              </span>
+                              <p
+                                class="emotion-euiScreenReaderOnly"
+                              >
+                                Press enter for options, or press space to begin dragging.
+                              </p>
                             </div>
                           </div>
                         </div>
@@ -734,76 +686,64 @@ tr:hover .c4:focus::before {
                       class="euiFlexItem c8 emotion-euiFlexItem-growZero"
                     >
                       <div
-                        class=""
+                        class="c3"
+                        data-test-subj="draggableWrapperDiv"
                       >
                         <div
-                          class="euiPopover emotion-euiPopover-inline-block"
+                          data-rfd-droppable-context-id="0"
+                          data-rfd-droppable-id="droppableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-network_protocol-http"
                         >
                           <div
-                            data-test-subj="withHoverActionsButton"
+                            class="draggable-keyboard-wrapper"
+                            data-test-subj="draggableWrapperKeyboardHandler"
+                            role="button"
+                            tabindex="0"
                           >
                             <div
-                              class="c3"
-                              data-test-subj="draggableWrapperDiv"
+                              aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                              class="c4"
+                              data-rfd-drag-handle-context-id="0"
+                              data-rfd-drag-handle-draggable-id="draggableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-network_protocol-http"
+                              data-rfd-draggable-context-id="0"
+                              data-rfd-draggable-id="draggableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-network_protocol-http"
+                              data-test-subj="providerContainer"
+                              draggable="false"
+                              role="button"
+                              tabindex="-1"
                             >
-                              <div
-                                data-rfd-droppable-context-id="0"
-                                data-rfd-droppable-id="droppableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-network_protocol-http"
+                              <p
+                                class="emotion-euiScreenReaderOnly"
                               >
-                                <div
-                                  class="draggable-keyboard-wrapper"
-                                  data-test-subj="draggableWrapperKeyboardHandler"
-                                  role="button"
-                                  tabindex="0"
+                                network.protocol
+                              </p>
+                              <span
+                                class="c5"
+                                data-test-subj="draggable-content-network.protocol"
+                              >
+                                <span
+                                  class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                                 >
-                                  <div
-                                    aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                    class="c4"
-                                    data-rfd-drag-handle-context-id="0"
-                                    data-rfd-drag-handle-draggable-id="draggableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-network_protocol-http"
-                                    data-rfd-draggable-context-id="0"
-                                    data-rfd-draggable-id="draggableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-network_protocol-http"
-                                    data-test-subj="providerContainer"
-                                    draggable="false"
-                                    role="button"
-                                    tabindex="-1"
+                                  <span
+                                    class="euiBadge c6 emotion-euiBadge-hollow"
+                                    title=""
                                   >
-                                    <p
-                                      class="emotion-euiScreenReaderOnly"
-                                    >
-                                      network.protocol
-                                    </p>
                                     <span
-                                      class="c5"
-                                      data-test-subj="draggable-content-network.protocol"
+                                      class="euiBadge__content emotion-euiBadge__content"
                                     >
                                       <span
-                                        class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
+                                        class="euiBadge__text emotion-euiBadge__text"
                                       >
-                                        <span
-                                          class="euiBadge c6 emotion-euiBadge-hollow"
-                                          title=""
-                                        >
-                                          <span
-                                            class="euiBadge__content emotion-euiBadge__content"
-                                          >
-                                            <span
-                                              class="euiBadge__text emotion-euiBadge__text"
-                                            >
-                                              http
-                                            </span>
-                                          </span>
-                                        </span>
+                                        http
                                       </span>
                                     </span>
-                                    <p
-                                      class="emotion-euiScreenReaderOnly"
-                                    >
-                                      Press enter for options, or press space to begin dragging.
-                                    </p>
-                                  </div>
-                                </div>
-                              </div>
+                                  </span>
+                                </span>
+                              </span>
+                              <p
+                                class="emotion-euiScreenReaderOnly"
+                              >
+                                Press enter for options, or press space to begin dragging.
+                              </p>
                             </div>
                           </div>
                         </div>
@@ -813,69 +753,57 @@ tr:hover .c4:focus::before {
                       class="euiFlexItem c8 emotion-euiFlexItem-growZero"
                     >
                       <div
-                        class=""
+                        class="c3"
+                        data-test-subj="draggableWrapperDiv"
                       >
                         <div
-                          class="euiPopover emotion-euiPopover-inline-block"
+                          data-rfd-droppable-context-id="0"
+                          data-rfd-droppable-id="droppableId.content.network-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-network_bytes-100"
                         >
                           <div
-                            data-test-subj="withHoverActionsButton"
+                            class="draggable-keyboard-wrapper"
+                            data-test-subj="draggableWrapperKeyboardHandler"
+                            role="button"
+                            tabindex="0"
                           >
                             <div
-                              class="c3"
-                              data-test-subj="draggableWrapperDiv"
+                              aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                              class="c4"
+                              data-rfd-drag-handle-context-id="0"
+                              data-rfd-drag-handle-draggable-id="draggableId.content.network-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-network_bytes-100"
+                              data-rfd-draggable-context-id="0"
+                              data-rfd-draggable-id="draggableId.content.network-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-network_bytes-100"
+                              data-test-subj="providerContainer"
+                              draggable="false"
+                              role="button"
+                              tabindex="-1"
                             >
-                              <div
-                                data-rfd-droppable-context-id="0"
-                                data-rfd-droppable-id="droppableId.content.network-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-network_bytes-100"
+                              <p
+                                class="emotion-euiScreenReaderOnly"
                               >
-                                <div
-                                  class="draggable-keyboard-wrapper"
-                                  data-test-subj="draggableWrapperKeyboardHandler"
-                                  role="button"
-                                  tabindex="0"
+                                network.bytes
+                              </p>
+                              <span
+                                class="c5"
+                                data-test-subj="draggable-content-network.bytes"
+                              >
+                                <span
+                                  class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                                 >
                                   <div
-                                    aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                    class="c4"
-                                    data-rfd-drag-handle-context-id="0"
-                                    data-rfd-drag-handle-draggable-id="draggableId.content.network-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-network_bytes-100"
-                                    data-rfd-draggable-context-id="0"
-                                    data-rfd-draggable-id="draggableId.content.network-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-network_bytes-100"
-                                    data-test-subj="providerContainer"
-                                    draggable="false"
-                                    role="button"
-                                    tabindex="-1"
+                                    class="euiText c9 emotion-euiText-xs"
                                   >
-                                    <p
-                                      class="emotion-euiScreenReaderOnly"
-                                    >
-                                      network.bytes
-                                    </p>
-                                    <span
-                                      class="c5"
-                                      data-test-subj="draggable-content-network.bytes"
-                                    >
-                                      <span
-                                        class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
-                                      >
-                                        <div
-                                          class="euiText c9 emotion-euiText-xs"
-                                        >
-                                          <span>
-                                            100B
-                                          </span>
-                                        </div>
-                                      </span>
+                                    <span>
+                                      100B
                                     </span>
-                                    <p
-                                      class="emotion-euiScreenReaderOnly"
-                                    >
-                                      Press enter for options, or press space to begin dragging.
-                                    </p>
                                   </div>
-                                </div>
-                              </div>
+                                </span>
+                              </span>
+                              <p
+                                class="emotion-euiScreenReaderOnly"
+                              >
+                                Press enter for options, or press space to begin dragging.
+                              </p>
                             </div>
                           </div>
                         </div>
@@ -885,69 +813,57 @@ tr:hover .c4:focus::before {
                       class="euiFlexItem c8 emotion-euiFlexItem-growZero"
                     >
                       <div
-                        class=""
+                        class="c3"
+                        data-test-subj="draggableWrapperDiv"
                       >
                         <div
-                          class="euiPopover emotion-euiPopover-inline-block"
+                          data-rfd-droppable-context-id="0"
+                          data-rfd-droppable-id="droppableId.content.network-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-network_packets-3"
                         >
                           <div
-                            data-test-subj="withHoverActionsButton"
+                            class="draggable-keyboard-wrapper"
+                            data-test-subj="draggableWrapperKeyboardHandler"
+                            role="button"
+                            tabindex="0"
                           >
                             <div
-                              class="c3"
-                              data-test-subj="draggableWrapperDiv"
+                              aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                              class="c4"
+                              data-rfd-drag-handle-context-id="0"
+                              data-rfd-drag-handle-draggable-id="draggableId.content.network-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-network_packets-3"
+                              data-rfd-draggable-context-id="0"
+                              data-rfd-draggable-id="draggableId.content.network-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-network_packets-3"
+                              data-test-subj="providerContainer"
+                              draggable="false"
+                              role="button"
+                              tabindex="-1"
                             >
-                              <div
-                                data-rfd-droppable-context-id="0"
-                                data-rfd-droppable-id="droppableId.content.network-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-network_packets-3"
+                              <p
+                                class="emotion-euiScreenReaderOnly"
                               >
-                                <div
-                                  class="draggable-keyboard-wrapper"
-                                  data-test-subj="draggableWrapperKeyboardHandler"
-                                  role="button"
-                                  tabindex="0"
+                                network.packets
+                              </p>
+                              <span
+                                class="c5"
+                                data-test-subj="draggable-content-network.packets"
+                              >
+                                <span
+                                  class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                                 >
                                   <div
-                                    aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                    class="c4"
-                                    data-rfd-drag-handle-context-id="0"
-                                    data-rfd-drag-handle-draggable-id="draggableId.content.network-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-network_packets-3"
-                                    data-rfd-draggable-context-id="0"
-                                    data-rfd-draggable-id="draggableId.content.network-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-network_packets-3"
-                                    data-test-subj="providerContainer"
-                                    draggable="false"
-                                    role="button"
-                                    tabindex="-1"
+                                    class="euiText c9 emotion-euiText-xs"
                                   >
-                                    <p
-                                      class="emotion-euiScreenReaderOnly"
-                                    >
-                                      network.packets
-                                    </p>
-                                    <span
-                                      class="c5"
-                                      data-test-subj="draggable-content-network.packets"
-                                    >
-                                      <span
-                                        class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
-                                      >
-                                        <div
-                                          class="euiText c9 emotion-euiText-xs"
-                                        >
-                                          <span>
-                                            3 pkts
-                                          </span>
-                                        </div>
-                                      </span>
+                                    <span>
+                                      3 pkts
                                     </span>
-                                    <p
-                                      class="emotion-euiScreenReaderOnly"
-                                    >
-                                      Press enter for options, or press space to begin dragging.
-                                    </p>
                                   </div>
-                                </div>
-                              </div>
+                                </span>
+                              </span>
+                              <p
+                                class="emotion-euiScreenReaderOnly"
+                              >
+                                Press enter for options, or press space to begin dragging.
+                              </p>
                             </div>
                           </div>
                         </div>
@@ -957,76 +873,64 @@ tr:hover .c4:focus::before {
                       class="euiFlexItem c8 emotion-euiFlexItem-growZero"
                     >
                       <div
-                        class=""
+                        class="c3"
+                        data-test-subj="draggableWrapperDiv"
                       >
                         <div
-                          class="euiPopover emotion-euiPopover-inline-block"
+                          data-rfd-droppable-context-id="0"
+                          data-rfd-droppable-id="droppableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-network_transport-tcp"
                         >
                           <div
-                            data-test-subj="withHoverActionsButton"
+                            class="draggable-keyboard-wrapper"
+                            data-test-subj="draggableWrapperKeyboardHandler"
+                            role="button"
+                            tabindex="0"
                           >
                             <div
-                              class="c3"
-                              data-test-subj="draggableWrapperDiv"
+                              aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                              class="c4"
+                              data-rfd-drag-handle-context-id="0"
+                              data-rfd-drag-handle-draggable-id="draggableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-network_transport-tcp"
+                              data-rfd-draggable-context-id="0"
+                              data-rfd-draggable-id="draggableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-network_transport-tcp"
+                              data-test-subj="providerContainer"
+                              draggable="false"
+                              role="button"
+                              tabindex="-1"
                             >
-                              <div
-                                data-rfd-droppable-context-id="0"
-                                data-rfd-droppable-id="droppableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-network_transport-tcp"
+                              <p
+                                class="emotion-euiScreenReaderOnly"
                               >
-                                <div
-                                  class="draggable-keyboard-wrapper"
-                                  data-test-subj="draggableWrapperKeyboardHandler"
-                                  role="button"
-                                  tabindex="0"
+                                network.transport
+                              </p>
+                              <span
+                                class="c5"
+                                data-test-subj="draggable-content-network.transport"
+                              >
+                                <span
+                                  class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                                 >
-                                  <div
-                                    aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                    class="c4"
-                                    data-rfd-drag-handle-context-id="0"
-                                    data-rfd-drag-handle-draggable-id="draggableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-network_transport-tcp"
-                                    data-rfd-draggable-context-id="0"
-                                    data-rfd-draggable-id="draggableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-network_transport-tcp"
-                                    data-test-subj="providerContainer"
-                                    draggable="false"
-                                    role="button"
-                                    tabindex="-1"
+                                  <span
+                                    class="euiBadge c6 emotion-euiBadge-hollow"
+                                    title=""
                                   >
-                                    <p
-                                      class="emotion-euiScreenReaderOnly"
-                                    >
-                                      network.transport
-                                    </p>
                                     <span
-                                      class="c5"
-                                      data-test-subj="draggable-content-network.transport"
+                                      class="euiBadge__content emotion-euiBadge__content"
                                     >
                                       <span
-                                        class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
+                                        class="euiBadge__text emotion-euiBadge__text"
                                       >
-                                        <span
-                                          class="euiBadge c6 emotion-euiBadge-hollow"
-                                          title=""
-                                        >
-                                          <span
-                                            class="euiBadge__content emotion-euiBadge__content"
-                                          >
-                                            <span
-                                              class="euiBadge__text emotion-euiBadge__text"
-                                            >
-                                              tcp
-                                            </span>
-                                          </span>
-                                        </span>
+                                        tcp
                                       </span>
                                     </span>
-                                    <p
-                                      class="emotion-euiScreenReaderOnly"
-                                    >
-                                      Press enter for options, or press space to begin dragging.
-                                    </p>
-                                  </div>
-                                </div>
-                              </div>
+                                  </span>
+                                </span>
+                              </span>
+                              <p
+                                class="emotion-euiScreenReaderOnly"
+                              >
+                                Press enter for options, or press space to begin dragging.
+                              </p>
                             </div>
                           </div>
                         </div>
@@ -1036,76 +940,64 @@ tr:hover .c4:focus::before {
                       class="euiFlexItem emotion-euiFlexItem-growZero"
                     >
                       <div
-                        class=""
+                        class="c3"
+                        data-test-subj="draggableWrapperDiv"
                       >
                         <div
-                          class="euiPopover emotion-euiPopover-inline-block"
+                          data-rfd-droppable-context-id="0"
+                          data-rfd-droppable-id="droppableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-network_community_id-we_live_in_a"
                         >
                           <div
-                            data-test-subj="withHoverActionsButton"
+                            class="draggable-keyboard-wrapper"
+                            data-test-subj="draggableWrapperKeyboardHandler"
+                            role="button"
+                            tabindex="0"
                           >
                             <div
-                              class="c3"
-                              data-test-subj="draggableWrapperDiv"
+                              aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                              class="c4"
+                              data-rfd-drag-handle-context-id="0"
+                              data-rfd-drag-handle-draggable-id="draggableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-network_community_id-we_live_in_a"
+                              data-rfd-draggable-context-id="0"
+                              data-rfd-draggable-id="draggableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-network_community_id-we_live_in_a"
+                              data-test-subj="providerContainer"
+                              draggable="false"
+                              role="button"
+                              tabindex="-1"
                             >
-                              <div
-                                data-rfd-droppable-context-id="0"
-                                data-rfd-droppable-id="droppableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-network_community_id-we_live_in_a"
+                              <p
+                                class="emotion-euiScreenReaderOnly"
                               >
-                                <div
-                                  class="draggable-keyboard-wrapper"
-                                  data-test-subj="draggableWrapperKeyboardHandler"
-                                  role="button"
-                                  tabindex="0"
+                                network.community_id
+                              </p>
+                              <span
+                                class="c5"
+                                data-test-subj="draggable-content-network.community_id"
+                              >
+                                <span
+                                  class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                                 >
-                                  <div
-                                    aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                    class="c4"
-                                    data-rfd-drag-handle-context-id="0"
-                                    data-rfd-drag-handle-draggable-id="draggableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-network_community_id-we_live_in_a"
-                                    data-rfd-draggable-context-id="0"
-                                    data-rfd-draggable-id="draggableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-network_community_id-we_live_in_a"
-                                    data-test-subj="providerContainer"
-                                    draggable="false"
-                                    role="button"
-                                    tabindex="-1"
+                                  <span
+                                    class="euiBadge c6 emotion-euiBadge-hollow"
+                                    title=""
                                   >
-                                    <p
-                                      class="emotion-euiScreenReaderOnly"
-                                    >
-                                      network.community_id
-                                    </p>
                                     <span
-                                      class="c5"
-                                      data-test-subj="draggable-content-network.community_id"
+                                      class="euiBadge__content emotion-euiBadge__content"
                                     >
                                       <span
-                                        class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
+                                        class="euiBadge__text emotion-euiBadge__text"
                                       >
-                                        <span
-                                          class="euiBadge c6 emotion-euiBadge-hollow"
-                                          title=""
-                                        >
-                                          <span
-                                            class="euiBadge__content emotion-euiBadge__content"
-                                          >
-                                            <span
-                                              class="euiBadge__text emotion-euiBadge__text"
-                                            >
-                                              we.live.in.a
-                                            </span>
-                                          </span>
-                                        </span>
+                                        we.live.in.a
                                       </span>
                                     </span>
-                                    <p
-                                      class="emotion-euiScreenReaderOnly"
-                                    >
-                                      Press enter for options, or press space to begin dragging.
-                                    </p>
-                                  </div>
-                                </div>
-                              </div>
+                                  </span>
+                                </span>
+                              </span>
+                              <p
+                                class="emotion-euiScreenReaderOnly"
+                              >
+                                Press enter for options, or press space to begin dragging.
+                              </p>
                             </div>
                           </div>
                         </div>
@@ -1162,67 +1054,67 @@ tr:hover .c4:focus::before {
                                         class="euiFlexItem emotion-euiFlexItem-growZero"
                                       >
                                         <div
-                                          class=""
+                                          data-test-subj="cellActions-renderContent-source.ip"
                                         >
-                                          <div
-                                            class="euiPopover emotion-euiPopover-inline-block"
-                                          >
+                                          <div>
                                             <div
-                                              data-test-subj="withHoverActionsButton"
+                                              class="euiPopover emotion-euiPopover-inline-block"
                                             >
-                                              <div
-                                                class="c3"
-                                                data-test-subj="draggableWrapperDiv"
-                                              >
+                                              <div>
                                                 <div
-                                                  data-rfd-droppable-context-id="0"
-                                                  data-rfd-droppable-id="droppableId.content.formatted-ip-data-provider-netflow-row-renderer-render-row-timeline-test-abcd-source_ip-192_168_1_2-abcd"
+                                                  class="c3"
+                                                  data-test-subj="draggableWrapperDiv"
                                                 >
                                                   <div
-                                                    class="draggable-keyboard-wrapper"
-                                                    data-test-subj="draggableWrapperKeyboardHandler"
-                                                    role="button"
-                                                    tabindex="0"
+                                                    data-rfd-droppable-context-id="0"
+                                                    data-rfd-droppable-id="droppableId.content.formatted-ip-data-provider-netflow-row-renderer-render-row-timeline-test-abcd-source_ip-192_168_1_2-abcd"
                                                   >
                                                     <div
-                                                      aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                                      class="c4"
-                                                      data-rfd-drag-handle-context-id="0"
-                                                      data-rfd-drag-handle-draggable-id="draggableId.content.formatted-ip-data-provider-netflow-row-renderer-render-row-timeline-test-abcd-source_ip-192_168_1_2-abcd"
-                                                      data-rfd-draggable-context-id="0"
-                                                      data-rfd-draggable-id="draggableId.content.formatted-ip-data-provider-netflow-row-renderer-render-row-timeline-test-abcd-source_ip-192_168_1_2-abcd"
-                                                      data-test-subj="providerContainer"
-                                                      draggable="false"
+                                                      class="draggable-keyboard-wrapper"
+                                                      data-test-subj="draggableWrapperKeyboardHandler"
                                                       role="button"
-                                                      tabindex="-1"
+                                                      tabindex="0"
                                                     >
-                                                      <p
-                                                        class="emotion-euiScreenReaderOnly"
-                                                      >
-                                                        source.ip
-                                                      </p>
-                                                      <span
-                                                        class="c12"
-                                                        data-test-subj="draggable-truncatable-content"
+                                                      <div
+                                                        aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                                                        class="c4"
+                                                        data-rfd-drag-handle-context-id="0"
+                                                        data-rfd-drag-handle-draggable-id="draggableId.content.formatted-ip-data-provider-netflow-row-renderer-render-row-timeline-test-abcd-source_ip-192_168_1_2-abcd"
+                                                        data-rfd-draggable-context-id="0"
+                                                        data-rfd-draggable-id="draggableId.content.formatted-ip-data-provider-netflow-row-renderer-render-row-timeline-test-abcd-source_ip-192_168_1_2-abcd"
+                                                        data-test-subj="providerContainer"
+                                                        draggable="false"
+                                                        role="button"
+                                                        tabindex="-1"
                                                       >
+                                                        <p
+                                                          class="emotion-euiScreenReaderOnly"
+                                                        >
+                                                          source.ip
+                                                        </p>
                                                         <span
-                                                          class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
+                                                          class="c12"
+                                                          data-test-subj="draggable-truncatable-content"
                                                         >
-                                                          <a
-                                                            class="euiLink emotion-euiLink-primary"
-                                                            data-test-subj="network-details"
-                                                            href="/ip/192.168.1.2/source/events"
-                                                            rel="noreferrer"
+                                                          <span
+                                                            class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                                                           >
-                                                            192.168.1.2
-                                                          </a>
+                                                            <a
+                                                              class="euiLink emotion-euiLink-primary"
+                                                              data-test-subj="network-details"
+                                                              href="/ip/192.168.1.2/source/events"
+                                                              rel="noreferrer"
+                                                            >
+                                                              192.168.1.2
+                                                            </a>
+                                                          </span>
                                                         </span>
-                                                      </span>
-                                                      <p
-                                                        class="emotion-euiScreenReaderOnly"
-                                                      >
-                                                        Press enter for options, or press space to begin dragging.
-                                                      </p>
+                                                        <p
+                                                          class="emotion-euiScreenReaderOnly"
+                                                        >
+                                                          Press enter for options, or press space to begin dragging.
+                                                        </p>
+                                                      </div>
                                                     </div>
                                                   </div>
                                                 </div>
@@ -1251,83 +1143,83 @@ tr:hover .c4:focus::before {
                                             class="euiFlexItem emotion-euiFlexItem-growZero"
                                           >
                                             <div
-                                              class=""
+                                              data-test-subj="cellActions-renderContent-source.port"
                                             >
-                                              <div
-                                                class="euiPopover emotion-euiPopover-inline-block"
-                                              >
+                                              <div>
                                                 <div
-                                                  data-test-subj="withHoverActionsButton"
+                                                  class="euiPopover emotion-euiPopover-inline-block"
                                                 >
-                                                  <div
-                                                    class="c3"
-                                                    data-test-subj="draggableWrapperDiv"
-                                                  >
+                                                  <div>
                                                     <div
-                                                      data-rfd-droppable-context-id="0"
-                                                      data-rfd-droppable-id="droppableId.content.port-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-source_port-9987"
+                                                      class="c3"
+                                                      data-test-subj="draggableWrapperDiv"
                                                     >
                                                       <div
-                                                        class="draggable-keyboard-wrapper"
-                                                        data-test-subj="draggableWrapperKeyboardHandler"
-                                                        role="button"
-                                                        tabindex="0"
+                                                        data-rfd-droppable-context-id="0"
+                                                        data-rfd-droppable-id="droppableId.content.port-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-source_port-9987"
                                                       >
                                                         <div
-                                                          aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                                          class="c4"
-                                                          data-rfd-drag-handle-context-id="0"
-                                                          data-rfd-drag-handle-draggable-id="draggableId.content.port-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-source_port-9987"
-                                                          data-rfd-draggable-context-id="0"
-                                                          data-rfd-draggable-id="draggableId.content.port-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-source_port-9987"
-                                                          data-test-subj="providerContainer"
-                                                          draggable="false"
+                                                          class="draggable-keyboard-wrapper"
+                                                          data-test-subj="draggableWrapperKeyboardHandler"
                                                           role="button"
-                                                          tabindex="-1"
+                                                          tabindex="0"
                                                         >
-                                                          <p
-                                                            class="emotion-euiScreenReaderOnly"
-                                                          >
-                                                            source.port
-                                                          </p>
-                                                          <span
-                                                            class="c5"
-                                                            data-test-subj="draggable-content-source.port"
+                                                          <div
+                                                            aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                                                            class="c4"
+                                                            data-rfd-drag-handle-context-id="0"
+                                                            data-rfd-drag-handle-draggable-id="draggableId.content.port-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-source_port-9987"
+                                                            data-rfd-draggable-context-id="0"
+                                                            data-rfd-draggable-id="draggableId.content.port-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-source_port-9987"
+                                                            data-test-subj="providerContainer"
+                                                            draggable="false"
+                                                            role="button"
+                                                            tabindex="-1"
                                                           >
+                                                            <p
+                                                              class="emotion-euiScreenReaderOnly"
+                                                            >
+                                                              source.port
+                                                            </p>
                                                             <span
-                                                              class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
+                                                              class="c5"
+                                                              data-test-subj="draggable-content-source.port"
                                                             >
-                                                              <div
-                                                                class="c14"
+                                                              <span
+                                                                class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                                                               >
-                                                                <a
-                                                                  class="euiLink emotion-euiLink-primary"
-                                                                  data-test-subj="port-or-service-name-link"
-                                                                  href="https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=9987"
-                                                                  rel="noopener noreferrer"
-                                                                  target="_blank"
+                                                                <div
+                                                                  class="c14"
                                                                 >
-                                                                  9987
-                                                                  <span
-                                                                    class="emotion-EuiExternalLinkIcon"
-                                                                    data-euiicon-type="popout"
-                                                                  >
-                                                                    External link
-                                                                  </span>
-                                                                  <span
-                                                                    class="emotion-euiScreenReaderOnly"
+                                                                  <a
+                                                                    class="euiLink emotion-euiLink-primary"
+                                                                    data-test-subj="port-or-service-name-link"
+                                                                    href="https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=9987"
+                                                                    rel="noopener noreferrer"
+                                                                    target="_blank"
                                                                   >
-                                                                    (opens in a new tab or window)
-                                                                  </span>
-                                                                </a>
-                                                              </div>
+                                                                    9987
+                                                                    <span
+                                                                      class="emotion-EuiExternalLinkIcon"
+                                                                      data-euiicon-type="popout"
+                                                                    >
+                                                                      External link
+                                                                    </span>
+                                                                    <span
+                                                                      class="emotion-euiScreenReaderOnly"
+                                                                    >
+                                                                      (opens in a new tab or window)
+                                                                    </span>
+                                                                  </a>
+                                                                </div>
+                                                              </span>
                                                             </span>
-                                                          </span>
-                                                          <p
-                                                            class="emotion-euiScreenReaderOnly"
-                                                          >
-                                                            Press enter for options, or press space to begin dragging.
-                                                          </p>
+                                                            <p
+                                                              class="emotion-euiScreenReaderOnly"
+                                                            >
+                                                              Press enter for options, or press space to begin dragging.
+                                                            </p>
+                                                          </div>
                                                         </div>
                                                       </div>
                                                     </div>
@@ -1358,63 +1250,51 @@ tr:hover .c4:focus::before {
                                         class="euiFlexItem emotion-euiFlexItem-growZero"
                                       >
                                         <div
-                                          class=""
+                                          class="c3"
+                                          data-test-subj="draggableWrapperDiv"
                                         >
                                           <div
-                                            class="euiPopover emotion-euiPopover-inline-block"
+                                            data-rfd-droppable-context-id="0"
+                                            data-rfd-droppable-id="droppableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-source_geo_continent_name-North America"
                                           >
                                             <div
-                                              data-test-subj="withHoverActionsButton"
+                                              class="draggable-keyboard-wrapper"
+                                              data-test-subj="draggableWrapperKeyboardHandler"
+                                              role="button"
+                                              tabindex="0"
                                             >
                                               <div
-                                                class="c3"
-                                                data-test-subj="draggableWrapperDiv"
+                                                aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                                                class="c4"
+                                                data-rfd-drag-handle-context-id="0"
+                                                data-rfd-drag-handle-draggable-id="draggableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-source_geo_continent_name-North America"
+                                                data-rfd-draggable-context-id="0"
+                                                data-rfd-draggable-id="draggableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-source_geo_continent_name-North America"
+                                                data-test-subj="providerContainer"
+                                                draggable="false"
+                                                role="button"
+                                                tabindex="-1"
                                               >
-                                                <div
-                                                  data-rfd-droppable-context-id="0"
-                                                  data-rfd-droppable-id="droppableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-source_geo_continent_name-North America"
+                                                <p
+                                                  class="emotion-euiScreenReaderOnly"
                                                 >
-                                                  <div
-                                                    class="draggable-keyboard-wrapper"
-                                                    data-test-subj="draggableWrapperKeyboardHandler"
-                                                    role="button"
-                                                    tabindex="0"
+                                                  source.geo.continent_name
+                                                </p>
+                                                <span
+                                                  class="c5"
+                                                  data-test-subj="draggable-content-source.geo.continent_name"
+                                                >
+                                                  <span
+                                                    class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                                                   >
-                                                    <div
-                                                      aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                                      class="c4"
-                                                      data-rfd-drag-handle-context-id="0"
-                                                      data-rfd-drag-handle-draggable-id="draggableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-source_geo_continent_name-North America"
-                                                      data-rfd-draggable-context-id="0"
-                                                      data-rfd-draggable-id="draggableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-source_geo_continent_name-North America"
-                                                      data-test-subj="providerContainer"
-                                                      draggable="false"
-                                                      role="button"
-                                                      tabindex="-1"
-                                                    >
-                                                      <p
-                                                        class="emotion-euiScreenReaderOnly"
-                                                      >
-                                                        source.geo.continent_name
-                                                      </p>
-                                                      <span
-                                                        class="c5"
-                                                        data-test-subj="draggable-content-source.geo.continent_name"
-                                                      >
-                                                        <span
-                                                          class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
-                                                        >
-                                                          North America
-                                                        </span>
-                                                      </span>
-                                                      <p
-                                                        class="emotion-euiScreenReaderOnly"
-                                                      >
-                                                        Press enter for options, or press space to begin dragging.
-                                                      </p>
-                                                    </div>
-                                                  </div>
-                                                </div>
+                                                    North America
+                                                  </span>
+                                                </span>
+                                                <p
+                                                  class="emotion-euiScreenReaderOnly"
+                                                >
+                                                  Press enter for options, or press space to begin dragging.
+                                                </p>
                                               </div>
                                             </div>
                                           </div>
@@ -1432,63 +1312,51 @@ tr:hover .c4:focus::before {
                                         class="euiFlexItem emotion-euiFlexItem-growZero"
                                       >
                                         <div
-                                          class=""
+                                          class="c3"
+                                          data-test-subj="draggableWrapperDiv"
                                         >
                                           <div
-                                            class="euiPopover emotion-euiPopover-inline-block"
+                                            data-rfd-droppable-context-id="0"
+                                            data-rfd-droppable-id="droppableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-source_geo_country_name-United States"
                                           >
                                             <div
-                                              data-test-subj="withHoverActionsButton"
+                                              class="draggable-keyboard-wrapper"
+                                              data-test-subj="draggableWrapperKeyboardHandler"
+                                              role="button"
+                                              tabindex="0"
                                             >
                                               <div
-                                                class="c3"
-                                                data-test-subj="draggableWrapperDiv"
+                                                aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                                                class="c4"
+                                                data-rfd-drag-handle-context-id="0"
+                                                data-rfd-drag-handle-draggable-id="draggableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-source_geo_country_name-United States"
+                                                data-rfd-draggable-context-id="0"
+                                                data-rfd-draggable-id="draggableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-source_geo_country_name-United States"
+                                                data-test-subj="providerContainer"
+                                                draggable="false"
+                                                role="button"
+                                                tabindex="-1"
                                               >
-                                                <div
-                                                  data-rfd-droppable-context-id="0"
-                                                  data-rfd-droppable-id="droppableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-source_geo_country_name-United States"
+                                                <p
+                                                  class="emotion-euiScreenReaderOnly"
                                                 >
-                                                  <div
-                                                    class="draggable-keyboard-wrapper"
-                                                    data-test-subj="draggableWrapperKeyboardHandler"
-                                                    role="button"
-                                                    tabindex="0"
+                                                  source.geo.country_name
+                                                </p>
+                                                <span
+                                                  class="c5"
+                                                  data-test-subj="draggable-content-source.geo.country_name"
+                                                >
+                                                  <span
+                                                    class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                                                   >
-                                                    <div
-                                                      aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                                      class="c4"
-                                                      data-rfd-drag-handle-context-id="0"
-                                                      data-rfd-drag-handle-draggable-id="draggableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-source_geo_country_name-United States"
-                                                      data-rfd-draggable-context-id="0"
-                                                      data-rfd-draggable-id="draggableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-source_geo_country_name-United States"
-                                                      data-test-subj="providerContainer"
-                                                      draggable="false"
-                                                      role="button"
-                                                      tabindex="-1"
-                                                    >
-                                                      <p
-                                                        class="emotion-euiScreenReaderOnly"
-                                                      >
-                                                        source.geo.country_name
-                                                      </p>
-                                                      <span
-                                                        class="c5"
-                                                        data-test-subj="draggable-content-source.geo.country_name"
-                                                      >
-                                                        <span
-                                                          class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
-                                                        >
-                                                          United States
-                                                        </span>
-                                                      </span>
-                                                      <p
-                                                        class="emotion-euiScreenReaderOnly"
-                                                      >
-                                                        Press enter for options, or press space to begin dragging.
-                                                      </p>
-                                                    </div>
-                                                  </div>
-                                                </div>
+                                                    United States
+                                                  </span>
+                                                </span>
+                                                <p
+                                                  class="emotion-euiScreenReaderOnly"
+                                                >
+                                                  Press enter for options, or press space to begin dragging.
+                                                </p>
                                               </div>
                                             </div>
                                           </div>
@@ -1516,63 +1384,51 @@ tr:hover .c4:focus::before {
                                         class="euiFlexItem emotion-euiFlexItem-growZero"
                                       >
                                         <div
-                                          class=""
+                                          class="c3"
+                                          data-test-subj="draggableWrapperDiv"
                                         >
                                           <div
-                                            class="euiPopover emotion-euiPopover-inline-block"
+                                            data-rfd-droppable-context-id="0"
+                                            data-rfd-droppable-id="droppableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-source_geo_country_iso_code-US"
                                           >
                                             <div
-                                              data-test-subj="withHoverActionsButton"
+                                              class="draggable-keyboard-wrapper"
+                                              data-test-subj="draggableWrapperKeyboardHandler"
+                                              role="button"
+                                              tabindex="0"
                                             >
                                               <div
-                                                class="c3"
-                                                data-test-subj="draggableWrapperDiv"
+                                                aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                                                class="c4"
+                                                data-rfd-drag-handle-context-id="0"
+                                                data-rfd-drag-handle-draggable-id="draggableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-source_geo_country_iso_code-US"
+                                                data-rfd-draggable-context-id="0"
+                                                data-rfd-draggable-id="draggableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-source_geo_country_iso_code-US"
+                                                data-test-subj="providerContainer"
+                                                draggable="false"
+                                                role="button"
+                                                tabindex="-1"
                                               >
-                                                <div
-                                                  data-rfd-droppable-context-id="0"
-                                                  data-rfd-droppable-id="droppableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-source_geo_country_iso_code-US"
+                                                <p
+                                                  class="emotion-euiScreenReaderOnly"
                                                 >
-                                                  <div
-                                                    class="draggable-keyboard-wrapper"
-                                                    data-test-subj="draggableWrapperKeyboardHandler"
-                                                    role="button"
-                                                    tabindex="0"
+                                                  source.geo.country_iso_code
+                                                </p>
+                                                <span
+                                                  class="c5"
+                                                  data-test-subj="draggable-content-source.geo.country_iso_code"
+                                                >
+                                                  <span
+                                                    class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                                                   >
-                                                    <div
-                                                      aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                                      class="c4"
-                                                      data-rfd-drag-handle-context-id="0"
-                                                      data-rfd-drag-handle-draggable-id="draggableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-source_geo_country_iso_code-US"
-                                                      data-rfd-draggable-context-id="0"
-                                                      data-rfd-draggable-id="draggableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-source_geo_country_iso_code-US"
-                                                      data-test-subj="providerContainer"
-                                                      draggable="false"
-                                                      role="button"
-                                                      tabindex="-1"
-                                                    >
-                                                      <p
-                                                        class="emotion-euiScreenReaderOnly"
-                                                      >
-                                                        source.geo.country_iso_code
-                                                      </p>
-                                                      <span
-                                                        class="c5"
-                                                        data-test-subj="draggable-content-source.geo.country_iso_code"
-                                                      >
-                                                        <span
-                                                          class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
-                                                        >
-                                                          US
-                                                        </span>
-                                                      </span>
-                                                      <p
-                                                        class="emotion-euiScreenReaderOnly"
-                                                      >
-                                                        Press enter for options, or press space to begin dragging.
-                                                      </p>
-                                                    </div>
-                                                  </div>
-                                                </div>
+                                                    US
+                                                  </span>
+                                                </span>
+                                                <p
+                                                  class="emotion-euiScreenReaderOnly"
+                                                >
+                                                  Press enter for options, or press space to begin dragging.
+                                                </p>
                                               </div>
                                             </div>
                                           </div>
@@ -1590,63 +1446,51 @@ tr:hover .c4:focus::before {
                                         class="euiFlexItem emotion-euiFlexItem-growZero"
                                       >
                                         <div
-                                          class=""
+                                          class="c3"
+                                          data-test-subj="draggableWrapperDiv"
                                         >
                                           <div
-                                            class="euiPopover emotion-euiPopover-inline-block"
+                                            data-rfd-droppable-context-id="0"
+                                            data-rfd-droppable-id="droppableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-source_geo_region_name-Georgia"
                                           >
                                             <div
-                                              data-test-subj="withHoverActionsButton"
+                                              class="draggable-keyboard-wrapper"
+                                              data-test-subj="draggableWrapperKeyboardHandler"
+                                              role="button"
+                                              tabindex="0"
                                             >
                                               <div
-                                                class="c3"
-                                                data-test-subj="draggableWrapperDiv"
+                                                aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                                                class="c4"
+                                                data-rfd-drag-handle-context-id="0"
+                                                data-rfd-drag-handle-draggable-id="draggableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-source_geo_region_name-Georgia"
+                                                data-rfd-draggable-context-id="0"
+                                                data-rfd-draggable-id="draggableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-source_geo_region_name-Georgia"
+                                                data-test-subj="providerContainer"
+                                                draggable="false"
+                                                role="button"
+                                                tabindex="-1"
                                               >
-                                                <div
-                                                  data-rfd-droppable-context-id="0"
-                                                  data-rfd-droppable-id="droppableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-source_geo_region_name-Georgia"
+                                                <p
+                                                  class="emotion-euiScreenReaderOnly"
                                                 >
-                                                  <div
-                                                    class="draggable-keyboard-wrapper"
-                                                    data-test-subj="draggableWrapperKeyboardHandler"
-                                                    role="button"
-                                                    tabindex="0"
+                                                  source.geo.region_name
+                                                </p>
+                                                <span
+                                                  class="c5"
+                                                  data-test-subj="draggable-content-source.geo.region_name"
+                                                >
+                                                  <span
+                                                    class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                                                   >
-                                                    <div
-                                                      aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                                      class="c4"
-                                                      data-rfd-drag-handle-context-id="0"
-                                                      data-rfd-drag-handle-draggable-id="draggableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-source_geo_region_name-Georgia"
-                                                      data-rfd-draggable-context-id="0"
-                                                      data-rfd-draggable-id="draggableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-source_geo_region_name-Georgia"
-                                                      data-test-subj="providerContainer"
-                                                      draggable="false"
-                                                      role="button"
-                                                      tabindex="-1"
-                                                    >
-                                                      <p
-                                                        class="emotion-euiScreenReaderOnly"
-                                                      >
-                                                        source.geo.region_name
-                                                      </p>
-                                                      <span
-                                                        class="c5"
-                                                        data-test-subj="draggable-content-source.geo.region_name"
-                                                      >
-                                                        <span
-                                                          class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
-                                                        >
-                                                          Georgia
-                                                        </span>
-                                                      </span>
-                                                      <p
-                                                        class="emotion-euiScreenReaderOnly"
-                                                      >
-                                                        Press enter for options, or press space to begin dragging.
-                                                      </p>
-                                                    </div>
-                                                  </div>
-                                                </div>
+                                                    Georgia
+                                                  </span>
+                                                </span>
+                                                <p
+                                                  class="emotion-euiScreenReaderOnly"
+                                                >
+                                                  Press enter for options, or press space to begin dragging.
+                                                </p>
                                               </div>
                                             </div>
                                           </div>
@@ -1664,63 +1508,51 @@ tr:hover .c4:focus::before {
                                         class="euiFlexItem emotion-euiFlexItem-growZero"
                                       >
                                         <div
-                                          class=""
+                                          class="c3"
+                                          data-test-subj="draggableWrapperDiv"
                                         >
                                           <div
-                                            class="euiPopover emotion-euiPopover-inline-block"
+                                            data-rfd-droppable-context-id="0"
+                                            data-rfd-droppable-id="droppableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-source_geo_city_name-Atlanta"
                                           >
                                             <div
-                                              data-test-subj="withHoverActionsButton"
+                                              class="draggable-keyboard-wrapper"
+                                              data-test-subj="draggableWrapperKeyboardHandler"
+                                              role="button"
+                                              tabindex="0"
                                             >
                                               <div
-                                                class="c3"
-                                                data-test-subj="draggableWrapperDiv"
+                                                aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                                                class="c4"
+                                                data-rfd-drag-handle-context-id="0"
+                                                data-rfd-drag-handle-draggable-id="draggableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-source_geo_city_name-Atlanta"
+                                                data-rfd-draggable-context-id="0"
+                                                data-rfd-draggable-id="draggableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-source_geo_city_name-Atlanta"
+                                                data-test-subj="providerContainer"
+                                                draggable="false"
+                                                role="button"
+                                                tabindex="-1"
                                               >
-                                                <div
-                                                  data-rfd-droppable-context-id="0"
-                                                  data-rfd-droppable-id="droppableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-source_geo_city_name-Atlanta"
+                                                <p
+                                                  class="emotion-euiScreenReaderOnly"
                                                 >
-                                                  <div
-                                                    class="draggable-keyboard-wrapper"
-                                                    data-test-subj="draggableWrapperKeyboardHandler"
-                                                    role="button"
-                                                    tabindex="0"
+                                                  source.geo.city_name
+                                                </p>
+                                                <span
+                                                  class="c5"
+                                                  data-test-subj="draggable-content-source.geo.city_name"
+                                                >
+                                                  <span
+                                                    class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                                                   >
-                                                    <div
-                                                      aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                                      class="c4"
-                                                      data-rfd-drag-handle-context-id="0"
-                                                      data-rfd-drag-handle-draggable-id="draggableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-source_geo_city_name-Atlanta"
-                                                      data-rfd-draggable-context-id="0"
-                                                      data-rfd-draggable-id="draggableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-source_geo_city_name-Atlanta"
-                                                      data-test-subj="providerContainer"
-                                                      draggable="false"
-                                                      role="button"
-                                                      tabindex="-1"
-                                                    >
-                                                      <p
-                                                        class="emotion-euiScreenReaderOnly"
-                                                      >
-                                                        source.geo.city_name
-                                                      </p>
-                                                      <span
-                                                        class="c5"
-                                                        data-test-subj="draggable-content-source.geo.city_name"
-                                                      >
-                                                        <span
-                                                          class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
-                                                        >
-                                                          Atlanta
-                                                        </span>
-                                                      </span>
-                                                      <p
-                                                        class="emotion-euiScreenReaderOnly"
-                                                      >
-                                                        Press enter for options, or press space to begin dragging.
-                                                      </p>
-                                                    </div>
-                                                  </div>
-                                                </div>
+                                                    Atlanta
+                                                  </span>
+                                                </span>
+                                                <p
+                                                  class="emotion-euiScreenReaderOnly"
+                                                >
+                                                  Press enter for options, or press space to begin dragging.
+                                                </p>
                                               </div>
                                             </div>
                                           </div>
@@ -1756,74 +1588,62 @@ tr:hover .c4:focus::before {
                             class="euiFlexItem emotion-euiFlexItem-growZero"
                           >
                             <div
-                              class=""
+                              class="c3"
+                              data-test-subj="draggableWrapperDiv"
                             >
                               <div
-                                class="euiPopover emotion-euiPopover-inline-block"
+                                data-rfd-droppable-context-id="0"
+                                data-rfd-droppable-id="droppableId.content.source-arrow-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-source_bytes-60"
                               >
                                 <div
-                                  data-test-subj="withHoverActionsButton"
+                                  class="draggable-keyboard-wrapper"
+                                  data-test-subj="draggableWrapperKeyboardHandler"
+                                  role="button"
+                                  tabindex="0"
                                 >
                                   <div
-                                    class="c3"
-                                    data-test-subj="draggableWrapperDiv"
+                                    aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                                    class="c4"
+                                    data-rfd-drag-handle-context-id="0"
+                                    data-rfd-drag-handle-draggable-id="draggableId.content.source-arrow-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-source_bytes-60"
+                                    data-rfd-draggable-context-id="0"
+                                    data-rfd-draggable-id="draggableId.content.source-arrow-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-source_bytes-60"
+                                    data-test-subj="providerContainer"
+                                    draggable="false"
+                                    role="button"
+                                    tabindex="-1"
                                   >
-                                    <div
-                                      data-rfd-droppable-context-id="0"
-                                      data-rfd-droppable-id="droppableId.content.source-arrow-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-source_bytes-60"
+                                    <p
+                                      class="emotion-euiScreenReaderOnly"
                                     >
-                                      <div
-                                        class="draggable-keyboard-wrapper"
-                                        data-test-subj="draggableWrapperKeyboardHandler"
-                                        role="button"
-                                        tabindex="0"
+                                      source.bytes
+                                    </p>
+                                    <span
+                                      class="c5"
+                                      data-test-subj="draggable-content-source.bytes"
+                                    >
+                                      <span
+                                        class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                                       >
                                         <div
-                                          aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                          class="c4"
-                                          data-rfd-drag-handle-context-id="0"
-                                          data-rfd-drag-handle-draggable-id="draggableId.content.source-arrow-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-source_bytes-60"
-                                          data-rfd-draggable-context-id="0"
-                                          data-rfd-draggable-id="draggableId.content.source-arrow-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-source_bytes-60"
-                                          data-test-subj="providerContainer"
-                                          draggable="false"
-                                          role="button"
-                                          tabindex="-1"
+                                          class="euiText c19 emotion-euiText-xs"
                                         >
-                                          <p
-                                            class="emotion-euiScreenReaderOnly"
-                                          >
-                                            source.bytes
-                                          </p>
                                           <span
-                                            class="c5"
-                                            data-test-subj="draggable-content-source.bytes"
+                                            class="c20"
                                           >
-                                            <span
-                                              class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
-                                            >
-                                              <div
-                                                class="euiText c19 emotion-euiText-xs"
-                                              >
-                                                <span
-                                                  class="c20"
-                                                >
-                                                  (60.00%)
-                                                </span>
-                                                <span>
-                                                  60B
-                                                </span>
-                                              </div>
-                                            </span>
+                                            (60.00%)
+                                          </span>
+                                          <span>
+                                            60B
                                           </span>
-                                          <p
-                                            class="emotion-euiScreenReaderOnly"
-                                          >
-                                            Press enter for options, or press space to begin dragging.
-                                          </p>
                                         </div>
-                                      </div>
-                                    </div>
+                                      </span>
+                                    </span>
+                                    <p
+                                      class="emotion-euiScreenReaderOnly"
+                                    >
+                                      Press enter for options, or press space to begin dragging.
+                                    </p>
                                   </div>
                                 </div>
                               </div>
@@ -1841,69 +1661,57 @@ tr:hover .c4:focus::before {
                             class="euiFlexItem emotion-euiFlexItem-growZero"
                           >
                             <div
-                              class=""
+                              class="c3"
+                              data-test-subj="draggableWrapperDiv"
                             >
                               <div
-                                class="euiPopover emotion-euiPopover-inline-block"
+                                data-rfd-droppable-context-id="0"
+                                data-rfd-droppable-id="droppableId.content.source-arrow-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-source_packets-2"
                               >
                                 <div
-                                  data-test-subj="withHoverActionsButton"
+                                  class="draggable-keyboard-wrapper"
+                                  data-test-subj="draggableWrapperKeyboardHandler"
+                                  role="button"
+                                  tabindex="0"
                                 >
                                   <div
-                                    class="c3"
-                                    data-test-subj="draggableWrapperDiv"
+                                    aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                                    class="c4"
+                                    data-rfd-drag-handle-context-id="0"
+                                    data-rfd-drag-handle-draggable-id="draggableId.content.source-arrow-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-source_packets-2"
+                                    data-rfd-draggable-context-id="0"
+                                    data-rfd-draggable-id="draggableId.content.source-arrow-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-source_packets-2"
+                                    data-test-subj="providerContainer"
+                                    draggable="false"
+                                    role="button"
+                                    tabindex="-1"
                                   >
-                                    <div
-                                      data-rfd-droppable-context-id="0"
-                                      data-rfd-droppable-id="droppableId.content.source-arrow-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-source_packets-2"
+                                    <p
+                                      class="emotion-euiScreenReaderOnly"
                                     >
-                                      <div
-                                        class="draggable-keyboard-wrapper"
-                                        data-test-subj="draggableWrapperKeyboardHandler"
-                                        role="button"
-                                        tabindex="0"
+                                      source.packets
+                                    </p>
+                                    <span
+                                      class="c5"
+                                      data-test-subj="draggable-content-source.packets"
+                                    >
+                                      <span
+                                        class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                                       >
                                         <div
-                                          aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                          class="c4"
-                                          data-rfd-drag-handle-context-id="0"
-                                          data-rfd-drag-handle-draggable-id="draggableId.content.source-arrow-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-source_packets-2"
-                                          data-rfd-draggable-context-id="0"
-                                          data-rfd-draggable-id="draggableId.content.source-arrow-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-source_packets-2"
-                                          data-test-subj="providerContainer"
-                                          draggable="false"
-                                          role="button"
-                                          tabindex="-1"
+                                          class="euiText c19 emotion-euiText-xs"
                                         >
-                                          <p
-                                            class="emotion-euiScreenReaderOnly"
-                                          >
-                                            source.packets
-                                          </p>
-                                          <span
-                                            class="c5"
-                                            data-test-subj="draggable-content-source.packets"
-                                          >
-                                            <span
-                                              class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
-                                            >
-                                              <div
-                                                class="euiText c19 emotion-euiText-xs"
-                                              >
-                                                <span>
-                                                  2 pkts
-                                                </span>
-                                              </div>
-                                            </span>
+                                          <span>
+                                            2 pkts
                                           </span>
-                                          <p
-                                            class="emotion-euiScreenReaderOnly"
-                                          >
-                                            Press enter for options, or press space to begin dragging.
-                                          </p>
                                         </div>
-                                      </div>
-                                    </div>
+                                      </span>
+                                    </span>
+                                    <p
+                                      class="emotion-euiScreenReaderOnly"
+                                    >
+                                      Press enter for options, or press space to begin dragging.
+                                    </p>
                                   </div>
                                 </div>
                               </div>
@@ -1955,71 +1763,71 @@ tr:hover .c4:focus::before {
                             class="euiFlexItem emotion-euiFlexItem-growZero"
                           >
                             <div
-                              class=""
+                              data-test-subj="cellActions-renderContent-destination.bytes"
                             >
-                              <div
-                                class="euiPopover emotion-euiPopover-inline-block"
-                              >
+                              <div>
                                 <div
-                                  data-test-subj="withHoverActionsButton"
+                                  class="euiPopover emotion-euiPopover-inline-block"
                                 >
-                                  <div
-                                    class="c3"
-                                    data-test-subj="draggableWrapperDiv"
-                                  >
+                                  <div>
                                     <div
-                                      data-rfd-droppable-context-id="0"
-                                      data-rfd-droppable-id="droppableId.content.destination-arrow-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-destination_bytes-40"
+                                      class="c3"
+                                      data-test-subj="draggableWrapperDiv"
                                     >
                                       <div
-                                        class="draggable-keyboard-wrapper"
-                                        data-test-subj="draggableWrapperKeyboardHandler"
-                                        role="button"
-                                        tabindex="0"
+                                        data-rfd-droppable-context-id="0"
+                                        data-rfd-droppable-id="droppableId.content.destination-arrow-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-destination_bytes-40"
                                       >
                                         <div
-                                          aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                          class="c4"
-                                          data-rfd-drag-handle-context-id="0"
-                                          data-rfd-drag-handle-draggable-id="draggableId.content.destination-arrow-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-destination_bytes-40"
-                                          data-rfd-draggable-context-id="0"
-                                          data-rfd-draggable-id="draggableId.content.destination-arrow-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-destination_bytes-40"
-                                          data-test-subj="providerContainer"
-                                          draggable="false"
+                                          class="draggable-keyboard-wrapper"
+                                          data-test-subj="draggableWrapperKeyboardHandler"
                                           role="button"
-                                          tabindex="-1"
+                                          tabindex="0"
                                         >
-                                          <p
-                                            class="emotion-euiScreenReaderOnly"
-                                          >
-                                            destination.bytes
-                                          </p>
-                                          <span
-                                            class="c5"
-                                            data-test-subj="draggable-content-destination.bytes"
+                                          <div
+                                            aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                                            class="c4"
+                                            data-rfd-drag-handle-context-id="0"
+                                            data-rfd-drag-handle-draggable-id="draggableId.content.destination-arrow-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-destination_bytes-40"
+                                            data-rfd-draggable-context-id="0"
+                                            data-rfd-draggable-id="draggableId.content.destination-arrow-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-destination_bytes-40"
+                                            data-test-subj="providerContainer"
+                                            draggable="false"
+                                            role="button"
+                                            tabindex="-1"
                                           >
+                                            <p
+                                              class="emotion-euiScreenReaderOnly"
+                                            >
+                                              destination.bytes
+                                            </p>
                                             <span
-                                              class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
+                                              class="c5"
+                                              data-test-subj="draggable-content-destination.bytes"
                                             >
-                                              <div
-                                                class="euiText c19 emotion-euiText-xs"
+                                              <span
+                                                class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                                               >
-                                                <span
-                                                  class="c20"
+                                                <div
+                                                  class="euiText c19 emotion-euiText-xs"
                                                 >
-                                                  (40.00%)
-                                                </span>
-                                                <span>
-                                                  40B
-                                                </span>
-                                              </div>
+                                                  <span
+                                                    class="c20"
+                                                  >
+                                                    (40.00%)
+                                                  </span>
+                                                  <span>
+                                                    40B
+                                                  </span>
+                                                </div>
+                                              </span>
                                             </span>
-                                          </span>
-                                          <p
-                                            class="emotion-euiScreenReaderOnly"
-                                          >
-                                            Press enter for options, or press space to begin dragging.
-                                          </p>
+                                            <p
+                                              class="emotion-euiScreenReaderOnly"
+                                            >
+                                              Press enter for options, or press space to begin dragging.
+                                            </p>
+                                          </div>
                                         </div>
                                       </div>
                                     </div>
@@ -2040,69 +1848,57 @@ tr:hover .c4:focus::before {
                             class="euiFlexItem emotion-euiFlexItem-growZero"
                           >
                             <div
-                              class=""
+                              class="c3"
+                              data-test-subj="draggableWrapperDiv"
                             >
                               <div
-                                class="euiPopover emotion-euiPopover-inline-block"
+                                data-rfd-droppable-context-id="0"
+                                data-rfd-droppable-id="droppableId.content.destination-arrow-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-destination_packets-1"
                               >
                                 <div
-                                  data-test-subj="withHoverActionsButton"
+                                  class="draggable-keyboard-wrapper"
+                                  data-test-subj="draggableWrapperKeyboardHandler"
+                                  role="button"
+                                  tabindex="0"
                                 >
                                   <div
-                                    class="c3"
-                                    data-test-subj="draggableWrapperDiv"
+                                    aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                                    class="c4"
+                                    data-rfd-drag-handle-context-id="0"
+                                    data-rfd-drag-handle-draggable-id="draggableId.content.destination-arrow-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-destination_packets-1"
+                                    data-rfd-draggable-context-id="0"
+                                    data-rfd-draggable-id="draggableId.content.destination-arrow-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-destination_packets-1"
+                                    data-test-subj="providerContainer"
+                                    draggable="false"
+                                    role="button"
+                                    tabindex="-1"
                                   >
-                                    <div
-                                      data-rfd-droppable-context-id="0"
-                                      data-rfd-droppable-id="droppableId.content.destination-arrow-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-destination_packets-1"
+                                    <p
+                                      class="emotion-euiScreenReaderOnly"
                                     >
-                                      <div
-                                        class="draggable-keyboard-wrapper"
-                                        data-test-subj="draggableWrapperKeyboardHandler"
-                                        role="button"
-                                        tabindex="0"
-                                      >
-                                        <div
-                                          aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                          class="c4"
-                                          data-rfd-drag-handle-context-id="0"
-                                          data-rfd-drag-handle-draggable-id="draggableId.content.destination-arrow-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-destination_packets-1"
-                                          data-rfd-draggable-context-id="0"
-                                          data-rfd-draggable-id="draggableId.content.destination-arrow-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-destination_packets-1"
-                                          data-test-subj="providerContainer"
-                                          draggable="false"
-                                          role="button"
-                                          tabindex="-1"
-                                        >
-                                          <p
-                                            class="emotion-euiScreenReaderOnly"
-                                          >
-                                            destination.packets
-                                          </p>
-                                          <span
-                                            class="c5"
-                                            data-test-subj="draggable-content-destination.packets"
-                                          >
-                                            <span
-                                              class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
-                                            >
-                                              <div
-                                                class="euiText c19 emotion-euiText-xs"
-                                              >
-                                                <span>
-                                                  1 pkts
-                                                </span>
-                                              </div>
-                                            </span>
+                                      destination.packets
+                                    </p>
+                                    <span
+                                      class="c5"
+                                      data-test-subj="draggable-content-destination.packets"
+                                    >
+                                      <span
+                                        class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
+                                      >
+                                        <div
+                                          class="euiText c19 emotion-euiText-xs"
+                                        >
+                                          <span>
+                                            1 pkts
                                           </span>
-                                          <p
-                                            class="emotion-euiScreenReaderOnly"
-                                          >
-                                            Press enter for options, or press space to begin dragging.
-                                          </p>
                                         </div>
-                                      </div>
-                                    </div>
+                                      </span>
+                                    </span>
+                                    <p
+                                      class="emotion-euiScreenReaderOnly"
+                                    >
+                                      Press enter for options, or press space to begin dragging.
+                                    </p>
                                   </div>
                                 </div>
                               </div>
@@ -2162,67 +1958,67 @@ tr:hover .c4:focus::before {
                                         class="euiFlexItem emotion-euiFlexItem-growZero"
                                       >
                                         <div
-                                          class=""
+                                          data-test-subj="cellActions-renderContent-destination.ip"
                                         >
-                                          <div
-                                            class="euiPopover emotion-euiPopover-inline-block"
-                                          >
+                                          <div>
                                             <div
-                                              data-test-subj="withHoverActionsButton"
+                                              class="euiPopover emotion-euiPopover-inline-block"
                                             >
-                                              <div
-                                                class="c3"
-                                                data-test-subj="draggableWrapperDiv"
-                                              >
+                                              <div>
                                                 <div
-                                                  data-rfd-droppable-context-id="0"
-                                                  data-rfd-droppable-id="droppableId.content.formatted-ip-data-provider-netflow-row-renderer-render-row-timeline-test-abcd-destination_ip-10_1_2_3-abcd"
+                                                  class="c3"
+                                                  data-test-subj="draggableWrapperDiv"
                                                 >
                                                   <div
-                                                    class="draggable-keyboard-wrapper"
-                                                    data-test-subj="draggableWrapperKeyboardHandler"
-                                                    role="button"
-                                                    tabindex="0"
+                                                    data-rfd-droppable-context-id="0"
+                                                    data-rfd-droppable-id="droppableId.content.formatted-ip-data-provider-netflow-row-renderer-render-row-timeline-test-abcd-destination_ip-10_1_2_3-abcd"
                                                   >
                                                     <div
-                                                      aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                                      class="c4"
-                                                      data-rfd-drag-handle-context-id="0"
-                                                      data-rfd-drag-handle-draggable-id="draggableId.content.formatted-ip-data-provider-netflow-row-renderer-render-row-timeline-test-abcd-destination_ip-10_1_2_3-abcd"
-                                                      data-rfd-draggable-context-id="0"
-                                                      data-rfd-draggable-id="draggableId.content.formatted-ip-data-provider-netflow-row-renderer-render-row-timeline-test-abcd-destination_ip-10_1_2_3-abcd"
-                                                      data-test-subj="providerContainer"
-                                                      draggable="false"
+                                                      class="draggable-keyboard-wrapper"
+                                                      data-test-subj="draggableWrapperKeyboardHandler"
                                                       role="button"
-                                                      tabindex="-1"
+                                                      tabindex="0"
                                                     >
-                                                      <p
-                                                        class="emotion-euiScreenReaderOnly"
-                                                      >
-                                                        destination.ip
-                                                      </p>
-                                                      <span
-                                                        class="c12"
-                                                        data-test-subj="draggable-truncatable-content"
+                                                      <div
+                                                        aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                                                        class="c4"
+                                                        data-rfd-drag-handle-context-id="0"
+                                                        data-rfd-drag-handle-draggable-id="draggableId.content.formatted-ip-data-provider-netflow-row-renderer-render-row-timeline-test-abcd-destination_ip-10_1_2_3-abcd"
+                                                        data-rfd-draggable-context-id="0"
+                                                        data-rfd-draggable-id="draggableId.content.formatted-ip-data-provider-netflow-row-renderer-render-row-timeline-test-abcd-destination_ip-10_1_2_3-abcd"
+                                                        data-test-subj="providerContainer"
+                                                        draggable="false"
+                                                        role="button"
+                                                        tabindex="-1"
                                                       >
+                                                        <p
+                                                          class="emotion-euiScreenReaderOnly"
+                                                        >
+                                                          destination.ip
+                                                        </p>
                                                         <span
-                                                          class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
+                                                          class="c12"
+                                                          data-test-subj="draggable-truncatable-content"
                                                         >
-                                                          <a
-                                                            class="euiLink emotion-euiLink-primary"
-                                                            data-test-subj="network-details"
-                                                            href="/ip/10.1.2.3/source/events"
-                                                            rel="noreferrer"
+                                                          <span
+                                                            class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                                                           >
-                                                            10.1.2.3
-                                                          </a>
+                                                            <a
+                                                              class="euiLink emotion-euiLink-primary"
+                                                              data-test-subj="network-details"
+                                                              href="/ip/10.1.2.3/source/events"
+                                                              rel="noreferrer"
+                                                            >
+                                                              10.1.2.3
+                                                            </a>
+                                                          </span>
                                                         </span>
-                                                      </span>
-                                                      <p
-                                                        class="emotion-euiScreenReaderOnly"
-                                                      >
-                                                        Press enter for options, or press space to begin dragging.
-                                                      </p>
+                                                        <p
+                                                          class="emotion-euiScreenReaderOnly"
+                                                        >
+                                                          Press enter for options, or press space to begin dragging.
+                                                        </p>
+                                                      </div>
                                                     </div>
                                                   </div>
                                                 </div>
@@ -2251,83 +2047,83 @@ tr:hover .c4:focus::before {
                                             class="euiFlexItem emotion-euiFlexItem-growZero"
                                           >
                                             <div
-                                              class=""
+                                              data-test-subj="cellActions-renderContent-destination.port"
                                             >
-                                              <div
-                                                class="euiPopover emotion-euiPopover-inline-block"
-                                              >
+                                              <div>
                                                 <div
-                                                  data-test-subj="withHoverActionsButton"
+                                                  class="euiPopover emotion-euiPopover-inline-block"
                                                 >
-                                                  <div
-                                                    class="c3"
-                                                    data-test-subj="draggableWrapperDiv"
-                                                  >
+                                                  <div>
                                                     <div
-                                                      data-rfd-droppable-context-id="0"
-                                                      data-rfd-droppable-id="droppableId.content.port-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-destination_port-80"
+                                                      class="c3"
+                                                      data-test-subj="draggableWrapperDiv"
                                                     >
                                                       <div
-                                                        class="draggable-keyboard-wrapper"
-                                                        data-test-subj="draggableWrapperKeyboardHandler"
-                                                        role="button"
-                                                        tabindex="0"
+                                                        data-rfd-droppable-context-id="0"
+                                                        data-rfd-droppable-id="droppableId.content.port-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-destination_port-80"
                                                       >
                                                         <div
-                                                          aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                                          class="c4"
-                                                          data-rfd-drag-handle-context-id="0"
-                                                          data-rfd-drag-handle-draggable-id="draggableId.content.port-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-destination_port-80"
-                                                          data-rfd-draggable-context-id="0"
-                                                          data-rfd-draggable-id="draggableId.content.port-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-destination_port-80"
-                                                          data-test-subj="providerContainer"
-                                                          draggable="false"
+                                                          class="draggable-keyboard-wrapper"
+                                                          data-test-subj="draggableWrapperKeyboardHandler"
                                                           role="button"
-                                                          tabindex="-1"
+                                                          tabindex="0"
                                                         >
-                                                          <p
-                                                            class="emotion-euiScreenReaderOnly"
-                                                          >
-                                                            destination.port
-                                                          </p>
-                                                          <span
-                                                            class="c5"
-                                                            data-test-subj="draggable-content-destination.port"
+                                                          <div
+                                                            aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                                                            class="c4"
+                                                            data-rfd-drag-handle-context-id="0"
+                                                            data-rfd-drag-handle-draggable-id="draggableId.content.port-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-destination_port-80"
+                                                            data-rfd-draggable-context-id="0"
+                                                            data-rfd-draggable-id="draggableId.content.port-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-destination_port-80"
+                                                            data-test-subj="providerContainer"
+                                                            draggable="false"
+                                                            role="button"
+                                                            tabindex="-1"
                                                           >
+                                                            <p
+                                                              class="emotion-euiScreenReaderOnly"
+                                                            >
+                                                              destination.port
+                                                            </p>
                                                             <span
-                                                              class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
+                                                              class="c5"
+                                                              data-test-subj="draggable-content-destination.port"
                                                             >
-                                                              <div
-                                                                class="c14"
+                                                              <span
+                                                                class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                                                               >
-                                                                <a
-                                                                  class="euiLink emotion-euiLink-primary"
-                                                                  data-test-subj="port-or-service-name-link"
-                                                                  href="https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=80"
-                                                                  rel="noopener noreferrer"
-                                                                  target="_blank"
+                                                                <div
+                                                                  class="c14"
                                                                 >
-                                                                  80
-                                                                  <span
-                                                                    class="emotion-EuiExternalLinkIcon"
-                                                                    data-euiicon-type="popout"
+                                                                  <a
+                                                                    class="euiLink emotion-euiLink-primary"
+                                                                    data-test-subj="port-or-service-name-link"
+                                                                    href="https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=80"
+                                                                    rel="noopener noreferrer"
+                                                                    target="_blank"
                                                                   >
-                                                                    External link
-                                                                  </span>
-                                                                  <span
-                                                                    class="emotion-euiScreenReaderOnly"
-                                                                  >
-                                                                    (opens in a new tab or window)
-                                                                  </span>
-                                                                </a>
-                                                              </div>
+                                                                    80
+                                                                    <span
+                                                                      class="emotion-EuiExternalLinkIcon"
+                                                                      data-euiicon-type="popout"
+                                                                    >
+                                                                      External link
+                                                                    </span>
+                                                                    <span
+                                                                      class="emotion-euiScreenReaderOnly"
+                                                                    >
+                                                                      (opens in a new tab or window)
+                                                                    </span>
+                                                                  </a>
+                                                                </div>
+                                                              </span>
                                                             </span>
-                                                          </span>
-                                                          <p
-                                                            class="emotion-euiScreenReaderOnly"
-                                                          >
-                                                            Press enter for options, or press space to begin dragging.
-                                                          </p>
+                                                            <p
+                                                              class="emotion-euiScreenReaderOnly"
+                                                            >
+                                                              Press enter for options, or press space to begin dragging.
+                                                            </p>
+                                                          </div>
                                                         </div>
                                                       </div>
                                                     </div>
@@ -2358,63 +2154,51 @@ tr:hover .c4:focus::before {
                                         class="euiFlexItem emotion-euiFlexItem-growZero"
                                       >
                                         <div
-                                          class=""
+                                          class="c3"
+                                          data-test-subj="draggableWrapperDiv"
                                         >
                                           <div
-                                            class="euiPopover emotion-euiPopover-inline-block"
+                                            data-rfd-droppable-context-id="0"
+                                            data-rfd-droppable-id="droppableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-destination_geo_continent_name-North America"
                                           >
                                             <div
-                                              data-test-subj="withHoverActionsButton"
+                                              class="draggable-keyboard-wrapper"
+                                              data-test-subj="draggableWrapperKeyboardHandler"
+                                              role="button"
+                                              tabindex="0"
                                             >
                                               <div
-                                                class="c3"
-                                                data-test-subj="draggableWrapperDiv"
+                                                aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                                                class="c4"
+                                                data-rfd-drag-handle-context-id="0"
+                                                data-rfd-drag-handle-draggable-id="draggableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-destination_geo_continent_name-North America"
+                                                data-rfd-draggable-context-id="0"
+                                                data-rfd-draggable-id="draggableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-destination_geo_continent_name-North America"
+                                                data-test-subj="providerContainer"
+                                                draggable="false"
+                                                role="button"
+                                                tabindex="-1"
                                               >
-                                                <div
-                                                  data-rfd-droppable-context-id="0"
-                                                  data-rfd-droppable-id="droppableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-destination_geo_continent_name-North America"
+                                                <p
+                                                  class="emotion-euiScreenReaderOnly"
                                                 >
-                                                  <div
-                                                    class="draggable-keyboard-wrapper"
-                                                    data-test-subj="draggableWrapperKeyboardHandler"
-                                                    role="button"
-                                                    tabindex="0"
+                                                  destination.geo.continent_name
+                                                </p>
+                                                <span
+                                                  class="c5"
+                                                  data-test-subj="draggable-content-destination.geo.continent_name"
+                                                >
+                                                  <span
+                                                    class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                                                   >
-                                                    <div
-                                                      aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                                      class="c4"
-                                                      data-rfd-drag-handle-context-id="0"
-                                                      data-rfd-drag-handle-draggable-id="draggableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-destination_geo_continent_name-North America"
-                                                      data-rfd-draggable-context-id="0"
-                                                      data-rfd-draggable-id="draggableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-destination_geo_continent_name-North America"
-                                                      data-test-subj="providerContainer"
-                                                      draggable="false"
-                                                      role="button"
-                                                      tabindex="-1"
-                                                    >
-                                                      <p
-                                                        class="emotion-euiScreenReaderOnly"
-                                                      >
-                                                        destination.geo.continent_name
-                                                      </p>
-                                                      <span
-                                                        class="c5"
-                                                        data-test-subj="draggable-content-destination.geo.continent_name"
-                                                      >
-                                                        <span
-                                                          class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
-                                                        >
-                                                          North America
-                                                        </span>
-                                                      </span>
-                                                      <p
-                                                        class="emotion-euiScreenReaderOnly"
-                                                      >
-                                                        Press enter for options, or press space to begin dragging.
-                                                      </p>
-                                                    </div>
-                                                  </div>
-                                                </div>
+                                                    North America
+                                                  </span>
+                                                </span>
+                                                <p
+                                                  class="emotion-euiScreenReaderOnly"
+                                                >
+                                                  Press enter for options, or press space to begin dragging.
+                                                </p>
                                               </div>
                                             </div>
                                           </div>
@@ -2432,63 +2216,51 @@ tr:hover .c4:focus::before {
                                         class="euiFlexItem emotion-euiFlexItem-growZero"
                                       >
                                         <div
-                                          class=""
+                                          class="c3"
+                                          data-test-subj="draggableWrapperDiv"
                                         >
                                           <div
-                                            class="euiPopover emotion-euiPopover-inline-block"
+                                            data-rfd-droppable-context-id="0"
+                                            data-rfd-droppable-id="droppableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-destination_geo_country_name-United States"
                                           >
                                             <div
-                                              data-test-subj="withHoverActionsButton"
+                                              class="draggable-keyboard-wrapper"
+                                              data-test-subj="draggableWrapperKeyboardHandler"
+                                              role="button"
+                                              tabindex="0"
                                             >
                                               <div
-                                                class="c3"
-                                                data-test-subj="draggableWrapperDiv"
+                                                aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                                                class="c4"
+                                                data-rfd-drag-handle-context-id="0"
+                                                data-rfd-drag-handle-draggable-id="draggableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-destination_geo_country_name-United States"
+                                                data-rfd-draggable-context-id="0"
+                                                data-rfd-draggable-id="draggableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-destination_geo_country_name-United States"
+                                                data-test-subj="providerContainer"
+                                                draggable="false"
+                                                role="button"
+                                                tabindex="-1"
                                               >
-                                                <div
-                                                  data-rfd-droppable-context-id="0"
-                                                  data-rfd-droppable-id="droppableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-destination_geo_country_name-United States"
+                                                <p
+                                                  class="emotion-euiScreenReaderOnly"
                                                 >
-                                                  <div
-                                                    class="draggable-keyboard-wrapper"
-                                                    data-test-subj="draggableWrapperKeyboardHandler"
-                                                    role="button"
-                                                    tabindex="0"
+                                                  destination.geo.country_name
+                                                </p>
+                                                <span
+                                                  class="c5"
+                                                  data-test-subj="draggable-content-destination.geo.country_name"
+                                                >
+                                                  <span
+                                                    class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                                                   >
-                                                    <div
-                                                      aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                                      class="c4"
-                                                      data-rfd-drag-handle-context-id="0"
-                                                      data-rfd-drag-handle-draggable-id="draggableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-destination_geo_country_name-United States"
-                                                      data-rfd-draggable-context-id="0"
-                                                      data-rfd-draggable-id="draggableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-destination_geo_country_name-United States"
-                                                      data-test-subj="providerContainer"
-                                                      draggable="false"
-                                                      role="button"
-                                                      tabindex="-1"
-                                                    >
-                                                      <p
-                                                        class="emotion-euiScreenReaderOnly"
-                                                      >
-                                                        destination.geo.country_name
-                                                      </p>
-                                                      <span
-                                                        class="c5"
-                                                        data-test-subj="draggable-content-destination.geo.country_name"
-                                                      >
-                                                        <span
-                                                          class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
-                                                        >
-                                                          United States
-                                                        </span>
-                                                      </span>
-                                                      <p
-                                                        class="emotion-euiScreenReaderOnly"
-                                                      >
-                                                        Press enter for options, or press space to begin dragging.
-                                                      </p>
-                                                    </div>
-                                                  </div>
-                                                </div>
+                                                    United States
+                                                  </span>
+                                                </span>
+                                                <p
+                                                  class="emotion-euiScreenReaderOnly"
+                                                >
+                                                  Press enter for options, or press space to begin dragging.
+                                                </p>
                                               </div>
                                             </div>
                                           </div>
@@ -2516,63 +2288,51 @@ tr:hover .c4:focus::before {
                                         class="euiFlexItem emotion-euiFlexItem-growZero"
                                       >
                                         <div
-                                          class=""
+                                          class="c3"
+                                          data-test-subj="draggableWrapperDiv"
                                         >
                                           <div
-                                            class="euiPopover emotion-euiPopover-inline-block"
+                                            data-rfd-droppable-context-id="0"
+                                            data-rfd-droppable-id="droppableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-destination_geo_country_iso_code-US"
                                           >
                                             <div
-                                              data-test-subj="withHoverActionsButton"
+                                              class="draggable-keyboard-wrapper"
+                                              data-test-subj="draggableWrapperKeyboardHandler"
+                                              role="button"
+                                              tabindex="0"
                                             >
                                               <div
-                                                class="c3"
-                                                data-test-subj="draggableWrapperDiv"
+                                                aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                                                class="c4"
+                                                data-rfd-drag-handle-context-id="0"
+                                                data-rfd-drag-handle-draggable-id="draggableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-destination_geo_country_iso_code-US"
+                                                data-rfd-draggable-context-id="0"
+                                                data-rfd-draggable-id="draggableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-destination_geo_country_iso_code-US"
+                                                data-test-subj="providerContainer"
+                                                draggable="false"
+                                                role="button"
+                                                tabindex="-1"
                                               >
-                                                <div
-                                                  data-rfd-droppable-context-id="0"
-                                                  data-rfd-droppable-id="droppableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-destination_geo_country_iso_code-US"
+                                                <p
+                                                  class="emotion-euiScreenReaderOnly"
                                                 >
-                                                  <div
-                                                    class="draggable-keyboard-wrapper"
-                                                    data-test-subj="draggableWrapperKeyboardHandler"
-                                                    role="button"
-                                                    tabindex="0"
+                                                  destination.geo.country_iso_code
+                                                </p>
+                                                <span
+                                                  class="c5"
+                                                  data-test-subj="draggable-content-destination.geo.country_iso_code"
+                                                >
+                                                  <span
+                                                    class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                                                   >
-                                                    <div
-                                                      aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                                      class="c4"
-                                                      data-rfd-drag-handle-context-id="0"
-                                                      data-rfd-drag-handle-draggable-id="draggableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-destination_geo_country_iso_code-US"
-                                                      data-rfd-draggable-context-id="0"
-                                                      data-rfd-draggable-id="draggableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-destination_geo_country_iso_code-US"
-                                                      data-test-subj="providerContainer"
-                                                      draggable="false"
-                                                      role="button"
-                                                      tabindex="-1"
-                                                    >
-                                                      <p
-                                                        class="emotion-euiScreenReaderOnly"
-                                                      >
-                                                        destination.geo.country_iso_code
-                                                      </p>
-                                                      <span
-                                                        class="c5"
-                                                        data-test-subj="draggable-content-destination.geo.country_iso_code"
-                                                      >
-                                                        <span
-                                                          class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
-                                                        >
-                                                          US
-                                                        </span>
-                                                      </span>
-                                                      <p
-                                                        class="emotion-euiScreenReaderOnly"
-                                                      >
-                                                        Press enter for options, or press space to begin dragging.
-                                                      </p>
-                                                    </div>
-                                                  </div>
-                                                </div>
+                                                    US
+                                                  </span>
+                                                </span>
+                                                <p
+                                                  class="emotion-euiScreenReaderOnly"
+                                                >
+                                                  Press enter for options, or press space to begin dragging.
+                                                </p>
                                               </div>
                                             </div>
                                           </div>
@@ -2590,63 +2350,51 @@ tr:hover .c4:focus::before {
                                         class="euiFlexItem emotion-euiFlexItem-growZero"
                                       >
                                         <div
-                                          class=""
+                                          class="c3"
+                                          data-test-subj="draggableWrapperDiv"
                                         >
                                           <div
-                                            class="euiPopover emotion-euiPopover-inline-block"
+                                            data-rfd-droppable-context-id="0"
+                                            data-rfd-droppable-id="droppableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-destination_geo_region_name-New York"
                                           >
                                             <div
-                                              data-test-subj="withHoverActionsButton"
+                                              class="draggable-keyboard-wrapper"
+                                              data-test-subj="draggableWrapperKeyboardHandler"
+                                              role="button"
+                                              tabindex="0"
                                             >
                                               <div
-                                                class="c3"
-                                                data-test-subj="draggableWrapperDiv"
+                                                aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                                                class="c4"
+                                                data-rfd-drag-handle-context-id="0"
+                                                data-rfd-drag-handle-draggable-id="draggableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-destination_geo_region_name-New York"
+                                                data-rfd-draggable-context-id="0"
+                                                data-rfd-draggable-id="draggableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-destination_geo_region_name-New York"
+                                                data-test-subj="providerContainer"
+                                                draggable="false"
+                                                role="button"
+                                                tabindex="-1"
                                               >
-                                                <div
-                                                  data-rfd-droppable-context-id="0"
-                                                  data-rfd-droppable-id="droppableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-destination_geo_region_name-New York"
+                                                <p
+                                                  class="emotion-euiScreenReaderOnly"
                                                 >
-                                                  <div
-                                                    class="draggable-keyboard-wrapper"
-                                                    data-test-subj="draggableWrapperKeyboardHandler"
-                                                    role="button"
-                                                    tabindex="0"
+                                                  destination.geo.region_name
+                                                </p>
+                                                <span
+                                                  class="c5"
+                                                  data-test-subj="draggable-content-destination.geo.region_name"
+                                                >
+                                                  <span
+                                                    class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                                                   >
-                                                    <div
-                                                      aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                                      class="c4"
-                                                      data-rfd-drag-handle-context-id="0"
-                                                      data-rfd-drag-handle-draggable-id="draggableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-destination_geo_region_name-New York"
-                                                      data-rfd-draggable-context-id="0"
-                                                      data-rfd-draggable-id="draggableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-destination_geo_region_name-New York"
-                                                      data-test-subj="providerContainer"
-                                                      draggable="false"
-                                                      role="button"
-                                                      tabindex="-1"
-                                                    >
-                                                      <p
-                                                        class="emotion-euiScreenReaderOnly"
-                                                      >
-                                                        destination.geo.region_name
-                                                      </p>
-                                                      <span
-                                                        class="c5"
-                                                        data-test-subj="draggable-content-destination.geo.region_name"
-                                                      >
-                                                        <span
-                                                          class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
-                                                        >
-                                                          New York
-                                                        </span>
-                                                      </span>
-                                                      <p
-                                                        class="emotion-euiScreenReaderOnly"
-                                                      >
-                                                        Press enter for options, or press space to begin dragging.
-                                                      </p>
-                                                    </div>
-                                                  </div>
-                                                </div>
+                                                    New York
+                                                  </span>
+                                                </span>
+                                                <p
+                                                  class="emotion-euiScreenReaderOnly"
+                                                >
+                                                  Press enter for options, or press space to begin dragging.
+                                                </p>
                                               </div>
                                             </div>
                                           </div>
@@ -2664,63 +2412,51 @@ tr:hover .c4:focus::before {
                                         class="euiFlexItem emotion-euiFlexItem-growZero"
                                       >
                                         <div
-                                          class=""
+                                          class="c3"
+                                          data-test-subj="draggableWrapperDiv"
                                         >
                                           <div
-                                            class="euiPopover emotion-euiPopover-inline-block"
+                                            data-rfd-droppable-context-id="0"
+                                            data-rfd-droppable-id="droppableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-destination_geo_city_name-New York"
                                           >
                                             <div
-                                              data-test-subj="withHoverActionsButton"
+                                              class="draggable-keyboard-wrapper"
+                                              data-test-subj="draggableWrapperKeyboardHandler"
+                                              role="button"
+                                              tabindex="0"
                                             >
                                               <div
-                                                class="c3"
-                                                data-test-subj="draggableWrapperDiv"
+                                                aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                                                class="c4"
+                                                data-rfd-drag-handle-context-id="0"
+                                                data-rfd-drag-handle-draggable-id="draggableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-destination_geo_city_name-New York"
+                                                data-rfd-draggable-context-id="0"
+                                                data-rfd-draggable-id="draggableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-destination_geo_city_name-New York"
+                                                data-test-subj="providerContainer"
+                                                draggable="false"
+                                                role="button"
+                                                tabindex="-1"
                                               >
-                                                <div
-                                                  data-rfd-droppable-context-id="0"
-                                                  data-rfd-droppable-id="droppableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-destination_geo_city_name-New York"
+                                                <p
+                                                  class="emotion-euiScreenReaderOnly"
                                                 >
-                                                  <div
-                                                    class="draggable-keyboard-wrapper"
-                                                    data-test-subj="draggableWrapperKeyboardHandler"
-                                                    role="button"
-                                                    tabindex="0"
+                                                  destination.geo.city_name
+                                                </p>
+                                                <span
+                                                  class="c5"
+                                                  data-test-subj="draggable-content-destination.geo.city_name"
+                                                >
+                                                  <span
+                                                    class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                                                   >
-                                                    <div
-                                                      aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                                                      class="c4"
-                                                      data-rfd-drag-handle-context-id="0"
-                                                      data-rfd-drag-handle-draggable-id="draggableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-destination_geo_city_name-New York"
-                                                      data-rfd-draggable-context-id="0"
-                                                      data-rfd-draggable-id="draggableId.content.geo-field-values-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-destination_geo_city_name-New York"
-                                                      data-test-subj="providerContainer"
-                                                      draggable="false"
-                                                      role="button"
-                                                      tabindex="-1"
-                                                    >
-                                                      <p
-                                                        class="emotion-euiScreenReaderOnly"
-                                                      >
-                                                        destination.geo.city_name
-                                                      </p>
-                                                      <span
-                                                        class="c5"
-                                                        data-test-subj="draggable-content-destination.geo.city_name"
-                                                      >
-                                                        <span
-                                                          class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
-                                                        >
-                                                          New York
-                                                        </span>
-                                                      </span>
-                                                      <p
-                                                        class="emotion-euiScreenReaderOnly"
-                                                      >
-                                                        Press enter for options, or press space to begin dragging.
-                                                      </p>
-                                                    </div>
-                                                  </div>
-                                                </div>
+                                                    New York
+                                                  </span>
+                                                </span>
+                                                <p
+                                                  class="emotion-euiScreenReaderOnly"
+                                                >
+                                                  Press enter for options, or press space to begin dragging.
+                                                </p>
                                               </div>
                                             </div>
                                           </div>
@@ -2752,105 +2488,93 @@ tr:hover .c4:focus::before {
               class="euiFlexItem emotion-euiFlexItem-growZero"
             >
               <div
-                class=""
+                class="c3"
+                data-test-subj="draggableWrapperDiv"
               >
                 <div
-                  class="euiPopover emotion-euiPopover-inline-block"
+                  data-rfd-droppable-context-id="0"
+                  data-rfd-droppable-id="droppableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-tls_fingerprints_ja3_hash-tls_fingerprints_ja3_hash-value"
                 >
                   <div
-                    data-test-subj="withHoverActionsButton"
+                    class="draggable-keyboard-wrapper"
+                    data-test-subj="draggableWrapperKeyboardHandler"
+                    role="button"
+                    tabindex="0"
                   >
                     <div
-                      class="c3"
-                      data-test-subj="draggableWrapperDiv"
+                      aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                      class="c4"
+                      data-rfd-drag-handle-context-id="0"
+                      data-rfd-drag-handle-draggable-id="draggableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-tls_fingerprints_ja3_hash-tls_fingerprints_ja3_hash-value"
+                      data-rfd-draggable-context-id="0"
+                      data-rfd-draggable-id="draggableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-tls_fingerprints_ja3_hash-tls_fingerprints_ja3_hash-value"
+                      data-test-subj="providerContainer"
+                      draggable="false"
+                      role="button"
+                      tabindex="-1"
                     >
-                      <div
-                        data-rfd-droppable-context-id="0"
-                        data-rfd-droppable-id="droppableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-tls_fingerprints_ja3_hash-tls_fingerprints_ja3_hash-value"
+                      <p
+                        class="emotion-euiScreenReaderOnly"
                       >
-                        <div
-                          class="draggable-keyboard-wrapper"
-                          data-test-subj="draggableWrapperKeyboardHandler"
-                          role="button"
-                          tabindex="0"
+                        tls.fingerprints.ja3.hash
+                      </p>
+                      <span
+                        class="c5"
+                        data-test-subj="draggable-content-tls.fingerprints.ja3.hash"
+                      >
+                        <span
+                          class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                         >
-                          <div
-                            aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                            class="c4"
-                            data-rfd-drag-handle-context-id="0"
-                            data-rfd-drag-handle-draggable-id="draggableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-tls_fingerprints_ja3_hash-tls_fingerprints_ja3_hash-value"
-                            data-rfd-draggable-context-id="0"
-                            data-rfd-draggable-id="draggableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-tls_fingerprints_ja3_hash-tls_fingerprints_ja3_hash-value"
-                            data-test-subj="providerContainer"
-                            draggable="false"
-                            role="button"
-                            tabindex="-1"
+                          <span
+                            class="euiBadge c6 emotion-euiBadge-hollow"
+                            title=""
                           >
-                            <p
-                              class="emotion-euiScreenReaderOnly"
-                            >
-                              tls.fingerprints.ja3.hash
-                            </p>
                             <span
-                              class="c5"
-                              data-test-subj="draggable-content-tls.fingerprints.ja3.hash"
+                              class="euiBadge__content emotion-euiBadge__content"
                             >
                               <span
-                                class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
+                                class="euiBadge__icon emotion-euiBadge__icon-left"
+                                color="inherit"
+                                data-euiicon-type="snowflake"
+                              />
+                              <span
+                                class="euiBadge__text emotion-euiBadge__text"
                               >
                                 <span
-                                  class="euiBadge c6 emotion-euiBadge-hollow"
-                                  title=""
+                                  class="c22"
                                 >
+                                  ja3
+                                </span>
+                                <a
+                                  class="euiLink emotion-euiLink-primary"
+                                  data-test-subj="ja3-fingerprint-link"
+                                  href="https://sslbl.abuse.ch/ja3-fingerprints/tls.fingerprints.ja3.hash-value"
+                                  rel="noopener noreferrer"
+                                  target="_blank"
+                                >
+                                  tls.fingerprints.ja3.hash-value
                                   <span
-                                    class="euiBadge__content emotion-euiBadge__content"
+                                    class="emotion-EuiExternalLinkIcon"
+                                    data-euiicon-type="popout"
                                   >
-                                    <span
-                                      class="euiBadge__icon emotion-euiBadge__icon-left"
-                                      color="inherit"
-                                      data-euiicon-type="snowflake"
-                                    />
-                                    <span
-                                      class="euiBadge__text emotion-euiBadge__text"
-                                    >
-                                      <span
-                                        class="c22"
-                                      >
-                                        ja3
-                                      </span>
-                                      <a
-                                        class="euiLink emotion-euiLink-primary"
-                                        data-test-subj="ja3-fingerprint-link"
-                                        href="https://sslbl.abuse.ch/ja3-fingerprints/tls.fingerprints.ja3.hash-value"
-                                        rel="noopener noreferrer"
-                                        target="_blank"
-                                      >
-                                        tls.fingerprints.ja3.hash-value
-                                        <span
-                                          class="emotion-EuiExternalLinkIcon"
-                                          data-euiicon-type="popout"
-                                        >
-                                          External link
-                                        </span>
-                                        <span
-                                          class="emotion-euiScreenReaderOnly"
-                                        >
-                                          (opens in a new tab or window)
-                                        </span>
-                                      </a>
-                                    </span>
+                                    External link
                                   </span>
-                                </span>
+                                  <span
+                                    class="emotion-euiScreenReaderOnly"
+                                  >
+                                    (opens in a new tab or window)
+                                  </span>
+                                </a>
                               </span>
                             </span>
-                            <p
-                              class="emotion-euiScreenReaderOnly"
-                            >
-                              Press enter for options, or press space to begin dragging.
-                            </p>
-                          </div>
-                        </div>
-                      </div>
+                          </span>
+                        </span>
+                      </span>
+                      <p
+                        class="emotion-euiScreenReaderOnly"
+                      >
+                        Press enter for options, or press space to begin dragging.
+                      </p>
                     </div>
                   </div>
                 </div>
@@ -2860,105 +2584,93 @@ tr:hover .c4:focus::before {
               class="euiFlexItem emotion-euiFlexItem-growZero"
             >
               <div
-                class=""
+                class="c3"
+                data-test-subj="draggableWrapperDiv"
               >
                 <div
-                  class="euiPopover emotion-euiPopover-inline-block"
+                  data-rfd-droppable-context-id="0"
+                  data-rfd-droppable-id="droppableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-tls_client_certificate_fingerprint_sha1-tls_client_certificate_fingerprint_sha1-value"
                 >
                   <div
-                    data-test-subj="withHoverActionsButton"
+                    class="draggable-keyboard-wrapper"
+                    data-test-subj="draggableWrapperKeyboardHandler"
+                    role="button"
+                    tabindex="0"
                   >
                     <div
-                      class="c3"
-                      data-test-subj="draggableWrapperDiv"
+                      aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                      class="c4"
+                      data-rfd-drag-handle-context-id="0"
+                      data-rfd-drag-handle-draggable-id="draggableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-tls_client_certificate_fingerprint_sha1-tls_client_certificate_fingerprint_sha1-value"
+                      data-rfd-draggable-context-id="0"
+                      data-rfd-draggable-id="draggableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-tls_client_certificate_fingerprint_sha1-tls_client_certificate_fingerprint_sha1-value"
+                      data-test-subj="providerContainer"
+                      draggable="false"
+                      role="button"
+                      tabindex="-1"
                     >
-                      <div
-                        data-rfd-droppable-context-id="0"
-                        data-rfd-droppable-id="droppableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-tls_client_certificate_fingerprint_sha1-tls_client_certificate_fingerprint_sha1-value"
+                      <p
+                        class="emotion-euiScreenReaderOnly"
                       >
-                        <div
-                          class="draggable-keyboard-wrapper"
-                          data-test-subj="draggableWrapperKeyboardHandler"
-                          role="button"
-                          tabindex="0"
+                        tls.client_certificate.fingerprint.sha1
+                      </p>
+                      <span
+                        class="c5"
+                        data-test-subj="draggable-content-tls.client_certificate.fingerprint.sha1"
+                      >
+                        <span
+                          class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                         >
-                          <div
-                            aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                            class="c4"
-                            data-rfd-drag-handle-context-id="0"
-                            data-rfd-drag-handle-draggable-id="draggableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-tls_client_certificate_fingerprint_sha1-tls_client_certificate_fingerprint_sha1-value"
-                            data-rfd-draggable-context-id="0"
-                            data-rfd-draggable-id="draggableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-tls_client_certificate_fingerprint_sha1-tls_client_certificate_fingerprint_sha1-value"
-                            data-test-subj="providerContainer"
-                            draggable="false"
-                            role="button"
-                            tabindex="-1"
+                          <span
+                            class="euiBadge c6 emotion-euiBadge-hollow"
+                            title=""
                           >
-                            <p
-                              class="emotion-euiScreenReaderOnly"
-                            >
-                              tls.client_certificate.fingerprint.sha1
-                            </p>
                             <span
-                              class="c5"
-                              data-test-subj="draggable-content-tls.client_certificate.fingerprint.sha1"
+                              class="euiBadge__content emotion-euiBadge__content"
                             >
                               <span
-                                class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
+                                class="euiBadge__icon emotion-euiBadge__icon-left"
+                                color="inherit"
+                                data-euiicon-type="snowflake"
+                              />
+                              <span
+                                class="euiBadge__text emotion-euiBadge__text"
                               >
                                 <span
-                                  class="euiBadge c6 emotion-euiBadge-hollow"
-                                  title=""
+                                  class="c23"
                                 >
+                                  client cert
+                                </span>
+                                <a
+                                  class="euiLink emotion-euiLink-primary"
+                                  data-test-subj="certificate-fingerprint-link"
+                                  href="https://sslbl.abuse.ch/ssl-certificates/sha1/tls.client_certificate.fingerprint.sha1-value"
+                                  rel="noopener noreferrer"
+                                  target="_blank"
+                                >
+                                  tls.client_certificate.fingerprint.sha1-value
                                   <span
-                                    class="euiBadge__content emotion-euiBadge__content"
+                                    class="emotion-EuiExternalLinkIcon"
+                                    data-euiicon-type="popout"
                                   >
-                                    <span
-                                      class="euiBadge__icon emotion-euiBadge__icon-left"
-                                      color="inherit"
-                                      data-euiicon-type="snowflake"
-                                    />
-                                    <span
-                                      class="euiBadge__text emotion-euiBadge__text"
-                                    >
-                                      <span
-                                        class="c23"
-                                      >
-                                        client cert
-                                      </span>
-                                      <a
-                                        class="euiLink emotion-euiLink-primary"
-                                        data-test-subj="certificate-fingerprint-link"
-                                        href="https://sslbl.abuse.ch/ssl-certificates/sha1/tls.client_certificate.fingerprint.sha1-value"
-                                        rel="noopener noreferrer"
-                                        target="_blank"
-                                      >
-                                        tls.client_certificate.fingerprint.sha1-value
-                                        <span
-                                          class="emotion-EuiExternalLinkIcon"
-                                          data-euiicon-type="popout"
-                                        >
-                                          External link
-                                        </span>
-                                        <span
-                                          class="emotion-euiScreenReaderOnly"
-                                        >
-                                          (opens in a new tab or window)
-                                        </span>
-                                      </a>
-                                    </span>
+                                    External link
                                   </span>
-                                </span>
+                                  <span
+                                    class="emotion-euiScreenReaderOnly"
+                                  >
+                                    (opens in a new tab or window)
+                                  </span>
+                                </a>
                               </span>
                             </span>
-                            <p
-                              class="emotion-euiScreenReaderOnly"
-                            >
-                              Press enter for options, or press space to begin dragging.
-                            </p>
-                          </div>
-                        </div>
-                      </div>
+                          </span>
+                        </span>
+                      </span>
+                      <p
+                        class="emotion-euiScreenReaderOnly"
+                      >
+                        Press enter for options, or press space to begin dragging.
+                      </p>
                     </div>
                   </div>
                 </div>
@@ -2968,105 +2680,93 @@ tr:hover .c4:focus::before {
               class="euiFlexItem emotion-euiFlexItem-growZero"
             >
               <div
-                class=""
+                class="c3"
+                data-test-subj="draggableWrapperDiv"
               >
                 <div
-                  class="euiPopover emotion-euiPopover-inline-block"
+                  data-rfd-droppable-context-id="0"
+                  data-rfd-droppable-id="droppableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-tls_server_certificate_fingerprint_sha1-tls_server_certificate_fingerprint_sha1-value"
                 >
                   <div
-                    data-test-subj="withHoverActionsButton"
+                    class="draggable-keyboard-wrapper"
+                    data-test-subj="draggableWrapperKeyboardHandler"
+                    role="button"
+                    tabindex="0"
                   >
                     <div
-                      class="c3"
-                      data-test-subj="draggableWrapperDiv"
+                      aria-describedby="rfd-hidden-text-0-hidden-text-0"
+                      class="c4"
+                      data-rfd-drag-handle-context-id="0"
+                      data-rfd-drag-handle-draggable-id="draggableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-tls_server_certificate_fingerprint_sha1-tls_server_certificate_fingerprint_sha1-value"
+                      data-rfd-draggable-context-id="0"
+                      data-rfd-draggable-id="draggableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-tls_server_certificate_fingerprint_sha1-tls_server_certificate_fingerprint_sha1-value"
+                      data-test-subj="providerContainer"
+                      draggable="false"
+                      role="button"
+                      tabindex="-1"
                     >
-                      <div
-                        data-rfd-droppable-context-id="0"
-                        data-rfd-droppable-id="droppableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-tls_server_certificate_fingerprint_sha1-tls_server_certificate_fingerprint_sha1-value"
+                      <p
+                        class="emotion-euiScreenReaderOnly"
                       >
-                        <div
-                          class="draggable-keyboard-wrapper"
-                          data-test-subj="draggableWrapperKeyboardHandler"
-                          role="button"
-                          tabindex="0"
+                        tls.server_certificate.fingerprint.sha1
+                      </p>
+                      <span
+                        class="c5"
+                        data-test-subj="draggable-content-tls.server_certificate.fingerprint.sha1"
+                      >
+                        <span
+                          class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
                         >
-                          <div
-                            aria-describedby="rfd-hidden-text-0-hidden-text-0"
-                            class="c4"
-                            data-rfd-drag-handle-context-id="0"
-                            data-rfd-drag-handle-draggable-id="draggableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-tls_server_certificate_fingerprint_sha1-tls_server_certificate_fingerprint_sha1-value"
-                            data-rfd-draggable-context-id="0"
-                            data-rfd-draggable-id="draggableId.content.draggable-badge-default-draggable-netflow-row-renderer-render-row-timeline-test-abcd-abcd-tls_server_certificate_fingerprint_sha1-tls_server_certificate_fingerprint_sha1-value"
-                            data-test-subj="providerContainer"
-                            draggable="false"
-                            role="button"
-                            tabindex="-1"
+                          <span
+                            class="euiBadge c6 emotion-euiBadge-hollow"
+                            title=""
                           >
-                            <p
-                              class="emotion-euiScreenReaderOnly"
-                            >
-                              tls.server_certificate.fingerprint.sha1
-                            </p>
                             <span
-                              class="c5"
-                              data-test-subj="draggable-content-tls.server_certificate.fingerprint.sha1"
+                              class="euiBadge__content emotion-euiBadge__content"
                             >
                               <span
-                                class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
+                                class="euiBadge__icon emotion-euiBadge__icon-left"
+                                color="inherit"
+                                data-euiicon-type="snowflake"
+                              />
+                              <span
+                                class="euiBadge__text emotion-euiBadge__text"
                               >
                                 <span
-                                  class="euiBadge c6 emotion-euiBadge-hollow"
-                                  title=""
+                                  class="c23"
                                 >
+                                  server cert
+                                </span>
+                                <a
+                                  class="euiLink emotion-euiLink-primary"
+                                  data-test-subj="certificate-fingerprint-link"
+                                  href="https://sslbl.abuse.ch/ssl-certificates/sha1/tls.server_certificate.fingerprint.sha1-value"
+                                  rel="noopener noreferrer"
+                                  target="_blank"
+                                >
+                                  tls.server_certificate.fingerprint.sha1-value
                                   <span
-                                    class="euiBadge__content emotion-euiBadge__content"
+                                    class="emotion-EuiExternalLinkIcon"
+                                    data-euiicon-type="popout"
                                   >
-                                    <span
-                                      class="euiBadge__icon emotion-euiBadge__icon-left"
-                                      color="inherit"
-                                      data-euiicon-type="snowflake"
-                                    />
-                                    <span
-                                      class="euiBadge__text emotion-euiBadge__text"
-                                    >
-                                      <span
-                                        class="c23"
-                                      >
-                                        server cert
-                                      </span>
-                                      <a
-                                        class="euiLink emotion-euiLink-primary"
-                                        data-test-subj="certificate-fingerprint-link"
-                                        href="https://sslbl.abuse.ch/ssl-certificates/sha1/tls.server_certificate.fingerprint.sha1-value"
-                                        rel="noopener noreferrer"
-                                        target="_blank"
-                                      >
-                                        tls.server_certificate.fingerprint.sha1-value
-                                        <span
-                                          class="emotion-EuiExternalLinkIcon"
-                                          data-euiicon-type="popout"
-                                        >
-                                          External link
-                                        </span>
-                                        <span
-                                          class="emotion-euiScreenReaderOnly"
-                                        >
-                                          (opens in a new tab or window)
-                                        </span>
-                                      </a>
-                                    </span>
+                                    External link
                                   </span>
-                                </span>
+                                  <span
+                                    class="emotion-euiScreenReaderOnly"
+                                  >
+                                    (opens in a new tab or window)
+                                  </span>
+                                </a>
                               </span>
                             </span>
-                            <p
-                              class="emotion-euiScreenReaderOnly"
-                            >
-                              Press enter for options, or press space to begin dragging.
-                            </p>
-                          </div>
-                        </div>
-                      </div>
+                          </span>
+                        </span>
+                      </span>
+                      <p
+                        class="emotion-euiScreenReaderOnly"
+                      >
+                        Press enter for options, or press space to begin dragging.
+                      </p>
                     </div>
                   </div>
                 </div>
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/helpers.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/helpers.tsx
index 0f22f4ea15cacc..82ea7bac73fad4 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/helpers.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/helpers.tsx
@@ -7,6 +7,7 @@
 
 import { isEmpty, isNumber } from 'lodash/fp';
 
+import type { Filter } from '@kbn/es-query';
 import {
   elementOrChildrenHasFocus,
   getFocusedAriaColindexCell,
@@ -280,3 +281,8 @@ export const buildIsOneOfQueryMatch = ({
 export const isPrimitiveArray = (value: unknown): value is Array<string | number | boolean> =>
   Array.isArray(value) &&
   (value.every((x) => typeof x === 'string') || value.every((x) => typeof x === 'number'));
+
+export const TIMELINE_FILTER_DROP_AREA = 'timeline-filter-drop-area';
+
+export const getNonDropAreaFilters = (filters: Filter[] = []) =>
+  filters.filter((f: Filter) => f.meta.controlledBy !== TIMELINE_FILTER_DROP_AREA);
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/query_bar/eql/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/query_bar/eql/index.tsx
index 8e165a2303036e..0758ec73271b0f 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/query_bar/eql/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/query_bar/eql/index.tsx
@@ -8,7 +8,7 @@
 import { isEmpty, isEqual } from 'lodash';
 import React, { memo, useCallback, useEffect, useMemo, useRef, useState } from 'react';
 import { useDispatch } from 'react-redux';
-import styled from 'styled-components';
+import { css } from '@emotion/css';
 
 import type {
   EqlOptionsSelected,
@@ -64,7 +64,7 @@ const schema: FormSchema<TimelineEqlQueryBar> = {
   },
 };
 
-const HiddenUseField = styled(UseField)`
+const hiddenUseFieldClassName = css`
   display: none;
 `;
 
@@ -188,8 +188,8 @@ export const EqlQueryBarTimeline = memo(({ timelineId }: { timelineId: string })
 
   return (
     <Form form={form} data-test-subj="EqlQueryBarTimeline">
-      <HiddenUseField key="Index" path="index" />
-      <HiddenUseField key="EqlOptions" path="eqlOptions" />
+      <UseField key="Index" path="index" className={hiddenUseFieldClassName} />
+      <UseField key="EqlOptions" path="eqlOptions" className={hiddenUseFieldClassName} />
       <UseField
         key="EqlQueryBar"
         path="eqlQueryBar"
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/query_bar/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/query_bar/index.test.tsx
index cd0a21d99cdfed..fa221798853137 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/query_bar/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/query_bar/index.test.tsx
@@ -17,10 +17,10 @@ import { QueryBar } from '../../../../common/components/query_bar';
 import { FilterStateStore } from '@kbn/es-query';
 import { FilterManager } from '@kbn/data-plugin/public';
 import { mockDataProviders } from '../data_providers/mock/mock_data_providers';
-import { buildGlobalQuery } from '../helpers';
+import { TIMELINE_FILTER_DROP_AREA, buildGlobalQuery } from '../helpers';
 
 import type { QueryBarTimelineComponentProps } from '.';
-import { QueryBarTimeline, getDataProviderFilter, TIMELINE_FILTER_DROP_AREA } from '.';
+import { QueryBarTimeline, getDataProviderFilter } from '.';
 import { waitFor } from '@testing-library/react';
 
 const mockUiSettingsForFilterManager = coreMock.createStart().uiSettings;
@@ -84,7 +84,6 @@ describe('Timeline QueryBar ', () => {
           isRefreshPaused={true}
           refreshInterval={3000}
           savedQueryId={null}
-          setFilters={mockSetFilters}
           setSavedQueryId={mockSetSavedQueryId}
           timelineId="timline-real-id"
           updateReduxTime={mockUpdateReduxTime}
@@ -123,7 +122,6 @@ describe('Timeline QueryBar ', () => {
           isRefreshPaused={true}
           refreshInterval={3000}
           savedQueryId={null}
-          setFilters={mockSetFilters}
           setSavedQueryId={mockSetSavedQueryId}
           timelineId="timeline-real-id"
           updateReduxTime={mockUpdateReduxTime}
@@ -161,7 +159,6 @@ describe('Timeline QueryBar ', () => {
           isRefreshPaused={true}
           refreshInterval={3000}
           savedQueryId={null}
-          setFilters={mockSetFilters}
           setSavedQueryId={mockSetSavedQueryId}
           timelineId="timeline-real-id"
           updateReduxTime={mockUpdateReduxTime}
@@ -201,7 +198,6 @@ describe('Timeline QueryBar ', () => {
           isRefreshPaused={true}
           refreshInterval={3000}
           savedQueryId={null}
-          setFilters={mockSetFilters}
           setSavedQueryId={mockSetSavedQueryId}
           timelineId="timeline-real-id"
           updateReduxTime={mockUpdateReduxTime}
@@ -239,7 +235,6 @@ describe('Timeline QueryBar ', () => {
           isRefreshPaused={true}
           refreshInterval={3000}
           savedQueryId={null}
-          setFilters={mockSetFilters}
           setSavedQueryId={mockSetSavedQueryId}
           timelineId="timeline-real-id"
           updateReduxTime={mockUpdateReduxTime}
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/query_bar/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/query_bar/index.tsx
index 73d83469413c49..749c3512cbd20e 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/query_bar/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/query_bar/index.tsx
@@ -6,10 +6,8 @@
  */
 
 import { isEmpty } from 'lodash/fp';
-import React, { memo, useCallback, useState, useEffect } from 'react';
+import React, { memo, useCallback, useState, useEffect, useMemo } from 'react';
 import { useDispatch } from 'react-redux';
-import { Subscription } from 'rxjs';
-import deepEqual from 'fast-deep-equal';
 
 import type { Filter, Query } from '@kbn/es-query';
 import { FilterStateStore } from '@kbn/es-query';
@@ -25,7 +23,7 @@ import { useSavedQueryServices } from '../../../../common/utils/saved_query_serv
 import type { DispatchUpdateReduxTime } from '../../../../common/components/super_date_picker';
 import { QueryBar } from '../../../../common/components/query_bar';
 import type { DataProvider } from '../data_providers/data_provider';
-import { buildGlobalQuery } from '../helpers';
+import { TIMELINE_FILTER_DROP_AREA, buildGlobalQuery, getNonDropAreaFilters } from '../helpers';
 import { timelineActions } from '../../../store';
 import type { KueryFilterQuery, KueryFilterQueryKind } from '../../../../../common/types/timeline';
 
@@ -40,7 +38,6 @@ export interface QueryBarTimelineComponentProps {
   isRefreshPaused: boolean;
   refreshInterval: number;
   savedQueryId: string | null;
-  setFilters: (filters: Filter[]) => void;
   setSavedQueryId: (savedQueryId: string | null) => void;
   timelineId: string;
   to: string;
@@ -84,11 +81,6 @@ const SearchBarContainer = styled.div`
   }
 `;
 
-export const TIMELINE_FILTER_DROP_AREA = 'timeline-filter-drop-area';
-
-const getNonDropAreaFilters = (filters: Filter[] = []) =>
-  filters.filter((f: Filter) => f.meta.controlledBy !== TIMELINE_FILTER_DROP_AREA);
-
 // eslint-disable-next-line react/display-name
 export const QueryBarTimeline = memo<QueryBarTimelineComponentProps>(
   ({
@@ -101,7 +93,6 @@ export const QueryBarTimeline = memo<QueryBarTimelineComponentProps>(
     kqlMode,
     isRefreshPaused,
     savedQueryId,
-    setFilters,
     setSavedQueryId,
     refreshInterval,
     timelineId,
@@ -122,9 +113,8 @@ export const QueryBarTimeline = memo<QueryBarTimelineComponentProps>(
       query: filterQuery != null ? filterQuery.expression : '',
       language: filterQuery != null ? filterQuery.kind : 'kuery',
     });
-    const [queryBarFilters, setQueryBarFilters] = useState<Filter[]>(
-      getNonDropAreaFilters(filters)
-    );
+    const queryBarFilters = useMemo(() => getNonDropAreaFilters(filters), [filters]);
+
     const [dataProvidersDsl, setDataProvidersDsl] = useState<string>(
       convertKueryToElasticSearchQuery(buildGlobalQuery(dataProviders, browserFields), indexPattern)
     );
@@ -147,38 +137,6 @@ export const QueryBarTimeline = memo<QueryBarTimelineComponentProps>(
       [dispatch, indexPattern, timelineId]
     );
 
-    useEffect(() => {
-      let isSubscribed = true;
-      const subscriptions = new Subscription();
-      filterManager.setFilters(filters);
-
-      subscriptions.add(
-        filterManager.getUpdates$().subscribe({
-          next: () => {
-            if (isSubscribed) {
-              const filterWithoutDropArea = getNonDropAreaFilters(filterManager.getFilters());
-              setFilters(filterWithoutDropArea);
-              setQueryBarFilters(filterWithoutDropArea);
-            }
-          },
-        })
-      );
-
-      return () => {
-        isSubscribed = false;
-        subscriptions.unsubscribe();
-      };
-      // eslint-disable-next-line react-hooks/exhaustive-deps
-    }, []);
-
-    useEffect(() => {
-      const filterWithoutDropArea = getNonDropAreaFilters(filterManager.getFilters());
-      if (!deepEqual(filters, filterWithoutDropArea)) {
-        filterManager.setFilters(filters);
-      }
-      // eslint-disable-next-line react-hooks/exhaustive-deps
-    }, [filters]);
-
     useEffect(() => {
       setFilterQueryConverted({
         query: filterQuery != null ? filterQuery.expression : '',
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/search_or_filter/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/search_or_filter/index.tsx
index cdd6fc793082f8..da31436193a2e8 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/search_or_filter/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/search_or_filter/index.tsx
@@ -17,7 +17,6 @@ import type { FilterManager } from '@kbn/data-plugin/public';
 import type { DataView } from '@kbn/data-views-plugin/common';
 import { FilterItems } from '@kbn/unified-search-plugin/public';
 import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
-import styled from 'styled-components';
 import { useAppToasts } from '../../../../common/hooks/use_app_toasts';
 import { useDeepEqualSelector } from '../../../../common/hooks/use_selector';
 import { useKibana } from '../../../../common/lib/kibana';
@@ -31,10 +30,9 @@ import { timelineDefaults } from '../../../store/defaults';
 import { dispatchUpdateReduxTime } from '../../../../common/components/super_date_picker';
 import { SearchOrFilter } from './search_or_filter';
 import { setDataProviderVisibility } from '../../../store/actions';
+import { getNonDropAreaFilters } from '../helpers';
 import * as i18n from './translations';
 
-const FilterItemsContainer = styled(EuiFlexGroup)``;
-
 interface OwnProps {
   filterManager: FilterManager;
   timelineId: string;
@@ -110,19 +108,37 @@ const StatefulSearchOrFilterComponent = React.memo<Props>(
 
     const arrDataView = useMemo(() => (dataView != null ? [dataView] : []), [dataView]);
 
+    // Keep filter manager in sync with redux filters
+    useEffect(() => {
+      if (!deepEqual(filterManager.getFilters(), filters)) {
+        filterManager.setFilters(filters);
+      }
+    }, [filterManager, filters]);
+
+    // When a filter update comes in through the filter manager, update redux
+    useEffect(() => {
+      const subscription = filterManager.getUpdates$().subscribe(() => {
+        const filtersWithoutDropArea = getNonDropAreaFilters(filterManager.getFilters());
+        if (!deepEqual(filtersWithoutDropArea, filters)) {
+          setFilters({
+            id: timelineId,
+            filters: filtersWithoutDropArea,
+          });
+        }
+      });
+      return () => {
+        subscription.unsubscribe();
+      };
+    }, [filterManager, timelineId, setFilters, filters]);
+
+    // Sync redux filters with updated from <FilterItems />
     const onFiltersUpdated = useCallback(
       (newFilters: Filter[]) => {
-        filterManager.setFilters(newFilters);
-      },
-      [filterManager]
-    );
-
-    const setFiltersInTimeline = useCallback(
-      (newFilters: Filter[]) =>
         setFilters({
           id: timelineId,
           filters: newFilters,
-        }),
+        });
+      },
       [timelineId, setFilters]
     );
 
@@ -180,7 +196,6 @@ const StatefulSearchOrFilterComponent = React.memo<Props>(
                 kqlMode={kqlMode}
                 refreshInterval={refreshInterval}
                 savedQueryId={savedQueryId}
-                setFilters={setFiltersInTimeline}
                 setSavedQueryId={setSavedQueryInTimeline}
                 timelineId={timelineId}
                 to={to}
@@ -196,7 +211,7 @@ const StatefulSearchOrFilterComponent = React.memo<Props>(
         </EuiFlexItem>
         {filters && filters.length > 0 ? (
           <EuiFlexItem>
-            <FilterItemsContainer
+            <EuiFlexGroup
               data-test-subj="timeline-filters-container"
               direction="row"
               gutterSize="xs"
@@ -208,7 +223,7 @@ const StatefulSearchOrFilterComponent = React.memo<Props>(
                 onFiltersUpdated={onFiltersUpdated}
                 indexPatterns={arrDataView}
               />
-            </FilterItemsContainer>
+            </EuiFlexGroup>
           </EuiFlexItem>
         ) : null}
       </EuiFlexGroup>
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/search_or_filter/search_or_filter.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/search_or_filter/search_or_filter.tsx
index 16f053b4abb75b..e6c8d403d4cce5 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/search_or_filter/search_or_filter.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/search_or_filter/search_or_filter.tsx
@@ -41,7 +41,6 @@ interface Props {
   timelineId: string;
   updateKqlMode: ({ id, kqlMode }: { id: string; kqlMode: KqlMode }) => void;
   refreshInterval: number;
-  setFilters: (filters: Filter[]) => void;
   setSavedQueryId: (savedQueryId: string | null) => void;
   filters: Filter[];
   savedQueryId: string | null;
@@ -79,7 +78,6 @@ export const SearchOrFilter = React.memo<Props>(
     timelineId,
     refreshInterval,
     savedQueryId,
-    setFilters,
     setSavedQueryId,
     to,
     toStr,
@@ -129,7 +127,6 @@ export const SearchOrFilter = React.memo<Props>(
                 isRefreshPaused={isRefreshPaused}
                 refreshInterval={refreshInterval}
                 savedQueryId={savedQueryId}
-                setFilters={setFilters}
                 setSavedQueryId={setSavedQueryId}
                 timelineId={timelineId}
                 to={to}
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/esql/customizations/use_histogram_customizations.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/esql/customizations/use_histogram_customizations.tsx
index 493e5b1bd0338b..783c667ee7207a 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/esql/customizations/use_histogram_customizations.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/esql/customizations/use_histogram_customizations.tsx
@@ -14,7 +14,7 @@ import type { CustomizationCallback } from '@kbn/discover-plugin/public';
 import type { UnifiedHistogramContainerProps } from '@kbn/unified-histogram-plugin/public';
 import { ACTION_GLOBAL_APPLY_FILTER } from '@kbn/unified-search-plugin/public';
 import { useCallback } from 'react';
-import { EsqlInTimelineTrigger } from '../../../../../../actions/constants';
+import { EsqlInTimelineTrigger } from '../../../../../../app/actions/constants';
 import { useKibana } from '../../../../../../common/lib/kibana';
 
 export type WithPreventableEvent<T> = T & {
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/esql/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/esql/index.tsx
index 4f1127e9beef4f..1567c8b2e2e0a5 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/esql/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/esql/index.tsx
@@ -18,6 +18,7 @@ import { isEqualWith } from 'lodash';
 import type { SavedSearch } from '@kbn/saved-search-plugin/common';
 import type { TimeRange } from '@kbn/es-query';
 import { useDispatch } from 'react-redux';
+import { updateSavedSearchId } from '../../../../store/actions';
 import { useDiscoverInTimelineContext } from '../../../../../common/components/discover_in_timeline/use_discover_in_timeline_context';
 import { useSourcererDataView } from '../../../../../common/containers/sourcerer';
 import { useKibana } from '../../../../../common/lib/kibana';
@@ -89,7 +90,11 @@ export const DiscoverTabContent: FC<DiscoverTabContentProps> = ({ timelineId })
   );
   const { status, savedSearchId, activeTab, savedObjectId, title, description } = timeline;
 
-  const { data: savedSearchById, isFetching } = useQuery({
+  const {
+    data: savedSearchById,
+    isFetching,
+    status: savedSearchByIdStatus,
+  } = useQuery({
     queryKey: ['savedSearchById', savedSearchId ?? ''],
     queryFn: () => (savedSearchId ? savedSearchService.get(savedSearchId) : Promise.resolve(null)),
   });
@@ -117,6 +122,12 @@ export const DiscoverTabContent: FC<DiscoverTabContentProps> = ({ timelineId })
 
   useEffect(() => {
     if (isFetching) return;
+    if (savedSearchByIdStatus === 'error' && savedSearchId) {
+      // when a timeline json is uploaded with a saved search Id that not longer
+      // exists, we need to reset the saved search Id in the timeline and remove th saved search
+      dispatch(updateSavedSearchId({ id: timelineId, savedSearchId: null }));
+      return;
+    }
     if (!savedObjectId) return;
     if (!status || status === 'draft') return;
     const latestState = getCombinedDiscoverSavedSearchState();
@@ -126,8 +137,9 @@ export const DiscoverTabContent: FC<DiscoverTabContentProps> = ({ timelineId })
     if (!index) return;
     if (!latestState || combinedDiscoverSavedSearchStateRef.current === latestState) return;
     if (isEqualWith(latestState, savedSearchById, savedSearchComparator)) return;
-    updateSavedSearch(latestState, timelineId);
-    combinedDiscoverSavedSearchStateRef.current = latestState;
+    updateSavedSearch(latestState, timelineId, function onUpdate() {
+      combinedDiscoverSavedSearchStateRef.current = latestState;
+    });
   }, [
     getCombinedDiscoverSavedSearchState,
     savedSearchById,
@@ -139,6 +151,8 @@ export const DiscoverTabContent: FC<DiscoverTabContentProps> = ({ timelineId })
     isFetching,
     timelineId,
     dispatch,
+    savedSearchId,
+    savedSearchByIdStatus,
   ]);
 
   useEffect(() => {
@@ -166,9 +180,14 @@ export const DiscoverTabContent: FC<DiscoverTabContentProps> = ({ timelineId })
       setDiscoverStateContainer(stateContainer);
       let savedSearchAppState;
       if (savedSearchId) {
-        const localSavedSearch = await savedSearchService.get(savedSearchId);
-        initializeLocalSavedSearch(localSavedSearch, timelineId);
-        savedSearchAppState = getAppStateFromSavedSearch(localSavedSearch);
+        try {
+          const localSavedSearch = await savedSearchService.get(savedSearchId);
+          initializeLocalSavedSearch(localSavedSearch, timelineId);
+          savedSearchAppState = getAppStateFromSavedSearch(localSavedSearch);
+        } catch (e) {
+          // eslint-disable-next-line no-console
+          console.error('Stale Saved search Id which no longer exists', e);
+        }
       }
 
       const finalAppState =
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/esql/mocks/index.ts b/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/esql/mocks/index.ts
index 176d6d3c56d388..90358b0f07f90b 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/esql/mocks/index.ts
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/esql/mocks/index.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { EsqlInTimelineTrigger } from '../../../../../../actions/constants';
+import { EsqlInTimelineTrigger } from '../../../../../../app/actions/constants';
 export { MockEsqlTabContent } from './esql_tab_content';
 
 export const mockApplyFilterTrigger = {
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/esql/styles.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/esql/styles.tsx
index 0a779a3b8e3a95..6e82809231828a 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/esql/styles.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/esql/styles.tsx
@@ -21,4 +21,9 @@ export const TimelineESQLGlobalStyles = createGlobalStyle`
   body:has(.timeline-portal-overlay-mask) .DiscoverFlyout {
     z-index: 1002; // For its usage in the Security Solution timeline, we need Discover flyout to be above the timeline flyout (which has a z-index of 1001)
   }
+
+  // TODO this should be removed when we change the ES|QL tab to be our own component instead of Discover (hopefully 8.15)
+  .unifiedDataTable__fullScreen .dscPageBody * {
+    z-index: unset !important;
+  }
 `;
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/index.test.tsx
index 7f399aa095a8a2..a3048347a6b7f5 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/index.test.tsx
@@ -16,9 +16,18 @@ import { TimelineType } from '../../../../../common/api/timeline';
 import { useEsqlAvailability } from '../../../../common/hooks/esql/use_esql_availability';
 import { render, screen, waitFor } from '@testing-library/react';
 
+jest.mock('react-router-dom', () => {
+  const original = jest.requireActual('react-router-dom');
+  return {
+    ...original,
+    useLocation: () => ({}),
+  };
+});
+
 jest.mock('../../../../common/hooks/esql/use_esql_availability', () => ({
   useEsqlAvailability: jest.fn().mockReturnValue({
-    isESQLTabInTimelineEnabled: true,
+    isEsqlAdvancedSettingEnabled: true,
+    isTimelineEsqlEnabledByFeatureFlag: true,
   }),
 }));
 
@@ -44,38 +53,79 @@ describe('Timeline', () => {
       expect(screen.getByTestId(esqlTabSubj)).toBeVisible();
     });
 
-    it('should not show the esql tab when the advanced setting is disabled', async () => {
-      useEsqlAvailabilityMock.mockReturnValue({
-        isESQLTabInTimelineEnabled: false,
+    describe('no existing esql query is present', () => {
+      it('should not show the esql tab when the advanced setting is disabled', async () => {
+        useEsqlAvailabilityMock.mockReturnValue({
+          isEsqlAdvancedSettingEnabled: false,
+          isTimelineEsqlEnabledByFeatureFlag: true,
+        });
+        render(
+          <TestProviders>
+            <TabsContent {...defaultProps} />
+          </TestProviders>
+        );
+
+        await waitFor(() => {
+          expect(screen.queryByTestId(esqlTabSubj)).toBeNull();
+        });
       });
-      render(
-        <TestProviders>
-          <TabsContent {...defaultProps} />
-        </TestProviders>
-      );
+      it('should not show the esql tab when the esql is disabled by feature flag', async () => {
+        useEsqlAvailabilityMock.mockReturnValue({
+          isEsqlAdvancedSettingEnabled: false,
+          isTimelineEsqlEnabledByFeatureFlag: false,
+        });
+        render(
+          <TestProviders>
+            <TabsContent {...defaultProps} />
+          </TestProviders>
+        );
 
-      await waitFor(() => {
-        expect(screen.queryByTestId(esqlTabSubj)).toBeNull();
+        await waitFor(() => {
+          expect(screen.queryByTestId(esqlTabSubj)).toBeNull();
+        });
       });
     });
 
-    it('should show the esql tab when the advanced setting is disabled, but an esql query is present', async () => {
-      useEsqlAvailabilityMock.mockReturnValue({
-        isESQLTabInTimelineEnabled: false,
+    describe('existing esql query is present', () => {
+      let mockStore: ReturnType<typeof createMockStore>;
+      beforeEach(() => {
+        const stateWithSavedSearchId = structuredClone(mockGlobalState);
+        stateWithSavedSearchId.timeline.timelineById[TimelineId.test].savedSearchId = 'test-id';
+        mockStore = createMockStore(stateWithSavedSearchId);
       });
 
-      const stateWithSavedSearchId = structuredClone(mockGlobalState);
-      stateWithSavedSearchId.timeline.timelineById[TimelineId.test].savedSearchId = 'test-id';
-      const mockStore = createMockStore(stateWithSavedSearchId);
+      it('should show the esql tab when the advanced setting is disabled', async () => {
+        useEsqlAvailabilityMock.mockReturnValue({
+          isESQLTabInTimelineEnabled: false,
+          isTimelineEsqlEnabledByFeatureFlag: true,
+        });
 
-      render(
-        <TestProviders store={mockStore}>
-          <TabsContent {...defaultProps} />
-        </TestProviders>
-      );
+        render(
+          <TestProviders store={mockStore}>
+            <TabsContent {...defaultProps} />
+          </TestProviders>
+        );
+
+        await waitFor(() => {
+          expect(screen.queryByTestId(esqlTabSubj)).toBeVisible();
+        });
+      });
+
+      it('should not show the esql tab when the esql is disabled by the feature flag', async () => {
+        useEsqlAvailabilityMock.mockReturnValue({
+          isESQLTabInTimelineEnabled: true,
+          isTimelineEsqlEnabledByFeatureFlag: false,
+        });
+
+        render(
+          <TestProviders store={mockStore}>
+            <TabsContent {...defaultProps} />
+          </TestProviders>
+        );
 
-      await waitFor(() => {
-        expect(screen.queryByTestId(esqlTabSubj)).toBeVisible();
+        await waitFor(() => {
+          expect(screen.queryByTestId(esqlTabSubj)).toBeNull();
+        });
       });
     });
   });
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/index.tsx
index 2e164677735dd4..643a5b54be415c 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/index.tsx
@@ -110,11 +110,20 @@ const ActiveTimelineTab = memo<ActiveTimelineTabProps>(
     showTimeline,
   }) => {
     const { hasAssistantPrivilege } = useAssistantAvailability();
-    const { isESQLTabInTimelineEnabled } = useEsqlAvailability();
+    const { isTimelineEsqlEnabledByFeatureFlag, isEsqlAdvancedSettingEnabled } =
+      useEsqlAvailability();
     const timelineESQLSavedSearch = useShallowEqualSelector((state) =>
       selectTimelineESQLSavedSearchId(state, timelineId)
     );
-    const shouldShowESQLTab = isESQLTabInTimelineEnabled || timelineESQLSavedSearch != null;
+    const shouldShowESQLTab = useMemo(() => {
+      // disabling esql feature from feature flag should unequivocally hide the tab
+      // irrespective of the fact that the advanced setting is enabled or
+      // not or existing esql query is present or not
+      if (!isTimelineEsqlEnabledByFeatureFlag) {
+        return false;
+      }
+      return isEsqlAdvancedSettingEnabled || timelineESQLSavedSearch != null;
+    }, [isEsqlAdvancedSettingEnabled, isTimelineEsqlEnabledByFeatureFlag, timelineESQLSavedSearch]);
     const aiAssistantFlyoutMode = useIsExperimentalFeatureEnabled('aiAssistantFlyoutMode');
     const getTab = useCallback(
       (tab: TimelineTabs) => {
@@ -271,14 +280,24 @@ const TabsContentComponent: React.FC<BasicTimelineTab> = ({
   const getAppNotes = useMemo(() => getNotesSelector(), []);
   const getTimelineNoteIds = useMemo(() => getNoteIdsSelector(), []);
   const getTimelinePinnedEventNotes = useMemo(() => getEventIdToNoteIdsSelector(), []);
-  const { isESQLTabInTimelineEnabled } = useEsqlAvailability();
+  const { isEsqlAdvancedSettingEnabled, isTimelineEsqlEnabledByFeatureFlag } =
+    useEsqlAvailability();
+
   const timelineESQLSavedSearch = useShallowEqualSelector((state) =>
     selectTimelineESQLSavedSearchId(state, timelineId)
   );
 
   const activeTab = useShallowEqualSelector((state) => getActiveTab(state, timelineId));
   const showTimeline = useShallowEqualSelector((state) => getShowTimeline(state, timelineId));
-  const shouldShowESQLTab = isESQLTabInTimelineEnabled || timelineESQLSavedSearch != null;
+  const shouldShowESQLTab = useMemo(() => {
+    // disabling esql feature from feature flag should unequivocally hide the tab
+    // irrespective of the fact that the advanced setting is enabled or
+    // not or existing esql query is present or not
+    if (!isTimelineEsqlEnabledByFeatureFlag) {
+      return false;
+    }
+    return isEsqlAdvancedSettingEnabled || timelineESQLSavedSearch != null;
+  }, [isEsqlAdvancedSettingEnabled, isTimelineEsqlEnabledByFeatureFlag, timelineESQLSavedSearch]);
 
   const numberOfPinnedEvents = useShallowEqualSelector((state) =>
     getNumberOfPinnedEvents(state, timelineId)
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/notes/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/notes/index.tsx
index 1f958bfa4c43f8..b2f87bd22e66ce 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/notes/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/notes/index.tsx
@@ -44,7 +44,7 @@ import { useScrollToTop } from '../../../../../common/components/scroll_to_top';
 import { useUserPrivileges } from '../../../../../common/components/user_privileges';
 import { FullWidthFlexGroup, VerticalRule } from '../shared/layout';
 
-const ScrollableFlexItem = styled(EuiFlexItem)`
+const ScrollableDiv = styled.div`
   overflow-x: hidden;
   overflow-y: auto;
   padding-inline: ${({ theme }) => (theme as EuiTheme).eui.euiSizeM};
@@ -210,7 +210,7 @@ const NotesTabContentComponent: React.FC<NotesTabContentProps> = ({ timelineId }
 
   return (
     <FullWidthFlexGroup gutterSize="none">
-      <ScrollableFlexItem grow={2} id="scrollableNotes">
+      <EuiFlexItem component={ScrollableDiv} grow={2} id="scrollableNotes">
         <StyledPanel paddingSize="none">
           <EuiTitle>
             <h3>{NOTES}</h3>
@@ -226,9 +226,11 @@ const NotesTabContentComponent: React.FC<NotesTabContentProps> = ({ timelineId }
             />
           )}
         </StyledPanel>
-      </ScrollableFlexItem>
+      </EuiFlexItem>
       <VerticalRule />
-      <ScrollableFlexItem grow={1}>{DetailsPanelContent ?? SidebarContent}</ScrollableFlexItem>
+      <EuiFlexItem component={ScrollableDiv} grow={1}>
+        {DetailsPanelContent ?? SidebarContent}
+      </EuiFlexItem>
     </FullWidthFlexGroup>
   );
 };
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/query/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/query/index.test.tsx
index ff95229f9dc60f..0dcbe36e09769d 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/query/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/query/index.test.tsx
@@ -55,6 +55,10 @@ mockUseResizeObserver.mockImplementation(() => ({}));
 
 jest.mock('../../../../../common/lib/kibana');
 
+jest.mock('../../../../containers/use_timeline_data_filters', () => ({
+  useTimelineDataFilters: jest.fn().mockReturnValue({ from: 'now-15m', to: 'now' }),
+}));
+
 describe('Timeline', () => {
   let props = {} as QueryTabContentComponentProps;
   const sort: Sort[] = [
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/query/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/query/index.tsx
index d557116ea6bf2a..ed3cd153144448 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/query/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/query/index.tsx
@@ -16,6 +16,7 @@ import { getEsQueryConfig } from '@kbn/data-plugin/common';
 import { DataLoadingState } from '@kbn/unified-data-table';
 import { useDeepEqualSelector } from '../../../../../common/hooks/use_selector';
 import { useIsExperimentalFeatureEnabled } from '../../../../../common/hooks/use_experimental_features';
+import { useTimelineDataFilters } from '../../../../containers/use_timeline_data_filters';
 import { InputsModelId } from '../../../../../common/store/inputs/constants';
 import { useInvalidFilterQuery } from '../../../../../common/hooks/use_invalid_filter_query';
 import { timelineActions, timelineSelectors } from '../../../../store';
@@ -40,6 +41,8 @@ import { inputsSelectors } from '../../../../../common/store';
 import { SourcererScopeName } from '../../../../../common/store/sourcerer/model';
 import { timelineDefaults } from '../../../../store/defaults';
 import { useSourcererDataView } from '../../../../../common/containers/sourcerer';
+import { isActiveTimeline } from '../../../../../helpers';
+
 import type { TimelineModel } from '../../../../store/model';
 import { DetailsPanel } from '../../../side_panel';
 import { UnifiedTimelineBody } from '../../body/unified_timeline_body';
@@ -105,7 +108,11 @@ export const QueryTabContentComponent: React.FC<Props> = ({
     selectedPatterns,
   } = useSourcererDataView(SourcererScopeName.timeline);
 
-  const { uiSettings, timelineFilterManager } = useKibana().services;
+  const { uiSettings, timelineDataService } = useKibana().services;
+  const {
+    query: { filterManager: timelineFilterManager },
+  } = timelineDataService;
+
   const unifiedComponentsInTimelineEnabled = useIsExperimentalFeatureEnabled(
     'unifiedComponentsInTimelineEnabled'
   );
@@ -127,15 +134,17 @@ export const QueryTabContentComponent: React.FC<Props> = ({
     [kqlQueryExpression, kqlQueryLanguage]
   );
 
-  const combinedQueries = combineQueries({
-    config: esQueryConfig,
-    dataProviders,
-    indexPattern,
-    browserFields,
-    filters,
-    kqlQuery,
-    kqlMode,
-  });
+  const combinedQueries = useMemo(() => {
+    return combineQueries({
+      config: esQueryConfig,
+      dataProviders,
+      indexPattern,
+      browserFields,
+      filters,
+      kqlQuery,
+      kqlMode,
+    });
+  }, [esQueryConfig, dataProviders, indexPattern, browserFields, filters, kqlQuery, kqlMode]);
 
   useInvalidFilterQuery({
     id: timelineId,
@@ -163,12 +172,14 @@ export const QueryTabContentComponent: React.FC<Props> = ({
     [combinedQueries, end, loadingSourcerer, start]
   );
 
-  const timelineQuerySortField = sort.map(({ columnId, columnType, esTypes, sortDirection }) => ({
-    field: columnId,
-    direction: sortDirection as Direction,
-    esTypes: esTypes ?? [],
-    type: columnType,
-  }));
+  const timelineQuerySortField = useMemo(() => {
+    return sort.map(({ columnId, columnType, esTypes, sortDirection }) => ({
+      field: columnId,
+      direction: sortDirection as Direction,
+      esTypes: esTypes ?? [],
+      type: columnType,
+    }));
+  }, [sort]);
 
   const { augmentedColumnHeaders, defaultColumns, timelineQueryFieldsFromColumns } =
     useTimelineColumns(columns);
@@ -226,6 +237,26 @@ export const QueryTabContentComponent: React.FC<Props> = ({
   // is not getting refreshed when using browser navigation.
   const showEventsCountBadge = !isBlankTimeline && totalCount >= 0;
 
+  // <Synchronisation of the timeline data service>
+  // Sync the timerange
+  const timelineFilters = useTimelineDataFilters(isActiveTimeline(timelineId));
+  useEffect(() => {
+    timelineDataService.query.timefilter.timefilter.setTime({
+      from: timelineFilters.from,
+      to: timelineFilters.to,
+    });
+  }, [timelineDataService.query.timefilter.timefilter, timelineFilters.from, timelineFilters.to]);
+
+  // Sync the base query
+  useEffect(() => {
+    timelineDataService.query.queryString.setQuery(
+      // We're using the base query of all combined queries here, to account for all
+      // of timeline's query dependencies (data providers, query etc.)
+      combinedQueries?.baseKqlQuery || { language: kqlQueryLanguage, query: '' }
+    );
+  }, [timelineDataService, combinedQueries, kqlQueryLanguage]);
+  // </Synchronisation of the timeline data service>
+
   if (unifiedComponentsInTimelineEnabled) {
     return (
       <UnifiedTimelineBody
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/unified_components/data_table/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/unified_components/data_table/index.tsx
index e49549d30b244a..1c9a6a91c0aacb 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/unified_components/data_table/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/unified_components/data_table/index.tsx
@@ -35,7 +35,7 @@ import { SourcererScopeName } from '../../../../../common/store/sourcerer/model'
 import { useSourcererDataView } from '../../../../../common/containers/sourcerer';
 import { activeTimeline } from '../../../../containers/active_timeline_context';
 import { DetailsPanel } from '../../../side_panel';
-import { SecurityCellActionsTrigger } from '../../../../../actions/constants';
+import { SecurityCellActionsTrigger } from '../../../../../app/actions/constants';
 import { getFormattedFields } from '../../body/renderers/formatted_field_udt';
 import ToolbarAdditionalControls from './toolbar_additional_controls';
 import { StyledTimelineUnifiedDataTable, StyledEuiProgress } from '../styles';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/unified_components/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/unified_components/index.test.tsx
index 00f745e9620667..2f874c4714ebf6 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/unified_components/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/unified_components/index.test.tsx
@@ -31,7 +31,6 @@ import { allowedExperimentalValues } from '../../../../../common';
 import { useIsExperimentalFeatureEnabled } from '../../../../common/hooks/use_experimental_features';
 import { TimelineTabs } from '@kbn/securitysolution-data-table';
 import { DataLoadingState } from '@kbn/unified-data-table';
-import { createFilterManagerMock } from '@kbn/data-plugin/public/query/filter_manager/filter_manager.mock';
 import { getColumnHeaders } from '../body/column_headers/helpers';
 import { defaultUdtHeaders } from './default_headers';
 import type { ColumnHeaderType } from '../../../../../common/types';
@@ -174,13 +173,11 @@ const useSourcererDataViewMocked = jest.fn().mockReturnValue({
 });
 
 const { storage: storageMock } = createSecuritySolutionStorageMock();
-const mockTimelineFilterManager = createFilterManagerMock();
 
 describe('unified timeline', () => {
   const kibanaServiceMock: StartServices = {
     ...createStartServicesMock(),
     storage: storageMock,
-    timelineFilterManager: mockTimelineFilterManager,
   };
 
   afterEach(() => {
@@ -571,7 +568,9 @@ describe('unified timeline', () => {
 
         fireEvent.click(screen.getByTestId(`timelineFieldListPanelAddExistFilter-${field.name}`));
         await waitFor(() => {
-          expect(mockTimelineFilterManager.addFilters).toHaveBeenNthCalledWith(
+          expect(
+            kibanaServiceMock.timelineDataService.query.filterManager.addFilters
+          ).toHaveBeenNthCalledWith(
             1,
             expect.arrayContaining([
               expect.objectContaining({
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/unified_components/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/unified_components/index.tsx
index fcdbb347fa9fce..b4daa07f11c406 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/unified_components/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/unified_components/index.tsx
@@ -158,14 +158,17 @@ const UnifiedTimelineComponent: React.FC<Props> = ({
       dataViews,
       dataViewFieldEditor,
       application: { capabilities },
-      data: dataPluginContract,
       uiActions,
       charts,
       docLinks,
       analytics,
-      timelineFilterManager,
+      timelineDataService,
     },
   } = useKibana();
+  const {
+    query: { filterManager: timelineFilterManager },
+  } = timelineDataService;
+
   const [eventIdsAddingNotes, setEventIdsAddingNotes] = useState<Set<string>>(new Set());
   const onToggleShowNotes = useCallback(
     (eventId: string) => {
@@ -179,12 +182,13 @@ const UnifiedTimelineComponent: React.FC<Props> = ({
     },
     [eventIdsAddingNotes]
   );
+
   const fieldListSidebarServices: UnifiedFieldListSidebarContainerProps['services'] = useMemo(
     () => ({
       fieldFormats,
       dataViews,
       dataViewFieldEditor,
-      data: dataPluginContract,
+      data: timelineDataService,
       uiActions,
       charts,
       core: {
@@ -197,7 +201,7 @@ const UnifiedTimelineComponent: React.FC<Props> = ({
       fieldFormats,
       dataViews,
       dataViewFieldEditor,
-      dataPluginContract,
+      timelineDataService,
       uiActions,
       charts,
       uiSettings,
diff --git a/x-pack/plugins/security_solution/public/timelines/store/actions.ts b/x-pack/plugins/security_solution/public/timelines/store/actions.ts
index bb38d56773d151..ca247c855a06cc 100644
--- a/x-pack/plugins/security_solution/public/timelines/store/actions.ts
+++ b/x-pack/plugins/security_solution/public/timelines/store/actions.ts
@@ -272,7 +272,7 @@ export const updateTotalCount = actionCreator<{ id: string; totalCount: number }
 
 export const updateSavedSearchId = actionCreator<{
   id: string;
-  savedSearchId: string;
+  savedSearchId: string | null;
 }>('UPDATE_DISCOVER_SAVED_SEARCH_ID');
 
 export const initializeSavedSearch = actionCreator<{
diff --git a/x-pack/plugins/security_solution/public/types.ts b/x-pack/plugins/security_solution/public/types.ts
index 1bd539bd52b6c4..eb891e3145dd2e 100644
--- a/x-pack/plugins/security_solution/public/types.ts
+++ b/x-pack/plugins/security_solution/public/types.ts
@@ -9,7 +9,7 @@ import type { Observable } from 'rxjs';
 
 import type { CoreStart, AppMountParameters, AppLeaveHandler } from '@kbn/core/public';
 import type { HomePublicPluginSetup } from '@kbn/home-plugin/public';
-import type { DataPublicPluginStart, FilterManager } from '@kbn/data-plugin/public';
+import type { DataPublicPluginStart } from '@kbn/data-plugin/public';
 import type { FieldFormatsStartCommon } from '@kbn/field-formats-plugin/common';
 import type { EmbeddableStart } from '@kbn/embeddable-plugin/public';
 import type { LensPublicStart } from '@kbn/lens-plugin/public';
@@ -185,7 +185,7 @@ export type StartServices = CoreStart &
     telemetry: TelemetryClientStart;
     customDataService: DataPublicPluginStart;
     topValuesPopover: TopValuesPopoverService;
-    timelineFilterManager: FilterManager;
+    timelineDataService: DataPublicPluginStart;
   };
 
 export type StartRenderServices = Pick<
diff --git a/x-pack/plugins/security_solution/scripts/endpoint/api_emulator/README.md b/x-pack/plugins/security_solution/scripts/endpoint/api_emulator/README.md
new file mode 100644
index 00000000000000..48e1da2ef442fb
--- /dev/null
+++ b/x-pack/plugins/security_solution/scripts/endpoint/api_emulator/README.md
@@ -0,0 +1,67 @@
+# API Emulator
+
+API Emulator is a framework wrapped around [Hapi](https://hapi.dev/) that enables developer to quickly create API interfaces for development and testing purposes. Emulator plugins (a wrapper around [Hapi plugins](https://hapi.dev/api/?v=21.3.3#plugins)) is the mechanism used to create an given set of APIs for emulation, and these are then added to the server framework which makes them available via the server's routes.  
+
+The following script can be used to start the External EDR Server Emulator from the command line:
+
+```shell
+node x-pack/plugins/security_solution/scripts/endpoint/start_external_edr_server_emulator.js
+```
+
+Use the `--help` option to view what arguments can be used
+
+For usages other than the command line, see the Development section below.
+
+
+
+## Development
+
+### Adding an new Plugin
+
+Plugins are the mechanism for adding API emulators into this framework. Each plugin is defined via an object that includes at a minimum the `name` and a `register()` callback. This callback for registering the plugin will be provided with an interface that allows the plugin to interact with the HTTP server and provide access to "core" services available at the server level for use by all plugins. 
+
+Example: A method that returns the definition for a plugin
+
+```typescript
+
+export const getFooPluginRegistration = () => {
+  return {
+    name: 'foo',                // [1]
+    register(server) {
+      // register routes
+      server.router.route({
+        path: '/api/get',       // [2]
+        method: 'GET',
+        handler: async (req, h) => {
+          return 'alive!';
+        }
+      })
+    }
+  }
+}
+```
+
+In the above example:
+
+1. a plugin with the name `foo` [1] will be registered. The name of the plugin will also be the default `prefix` to all API routes (an optional attributed named `prefix` is also available if wanting to use a different value for the namespacing the routes).
+2. the `register()` callback will be given a `server` argument that provides access to server level services like the HTTP `router`
+3. a new route is registered [2], which will be mounted at `/foo/api/get` - note the use of the plugin name as the route prefix
+
+
+#### Plugin HTTP routes
+
+HTTP route handlers work very similar to the route handlers in Kibana today. You are given a `Request` and a Response Factory by the Hapi framework - see the [HAPI docs on Lifecycle Methods](https://hapi.dev/api/?v=21.3.3#lifecycle-methods) for more details.
+
+This emulator framework will expose the core services (ex. for the EDR server emulator, this would include Kibana and Elasticsearch clients) to each route under `request.pre` (pre-handler methods).
+
+Example: a route handler under the EDR server emulator that returns the version of kibana
+
+```typescript
+
+const handler = async (req, h) => {
+  const kbnStatus = await req.pre.services.kbnClient.status.get();
+  
+  return kbnStatus.version.number;
+}
+
+```
diff --git a/x-pack/plugins/security_solution/scripts/endpoint/api_emulator/emulator_plugins/crowdstrike/index.ts b/x-pack/plugins/security_solution/scripts/endpoint/api_emulator/emulator_plugins/crowdstrike/index.ts
new file mode 100644
index 00000000000000..cdfbdff81c84be
--- /dev/null
+++ b/x-pack/plugins/security_solution/scripts/endpoint/api_emulator/emulator_plugins/crowdstrike/index.ts
@@ -0,0 +1,25 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { EmulatorServerPlugin } from '../../lib/emulator_server.types';
+
+export const getCrowdstrikeEmulator = () => {
+  const plugin: EmulatorServerPlugin = {
+    name: 'crowdstrike',
+    register({ router }) {
+      router.route({
+        path: '/',
+        method: 'GET',
+        handler: () => {
+          return { message: `Live! But not implemented` };
+        },
+      });
+    },
+  };
+
+  return plugin;
+};
diff --git a/x-pack/plugins/security_solution/scripts/endpoint/api_emulator/emulator_plugins/sentinelone/index.ts b/x-pack/plugins/security_solution/scripts/endpoint/api_emulator/emulator_plugins/sentinelone/index.ts
new file mode 100644
index 00000000000000..fcc7f4373cea1d
--- /dev/null
+++ b/x-pack/plugins/security_solution/scripts/endpoint/api_emulator/emulator_plugins/sentinelone/index.ts
@@ -0,0 +1,27 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { ExternalEdrServerEmulatorCoreServices } from '../..';
+import { getSentinelOneRouteDefinitions } from './routes';
+import type { EmulatorServerPlugin } from '../../lib/emulator_server.types';
+
+export const getSentinelOneEmulator =
+  (): EmulatorServerPlugin<ExternalEdrServerEmulatorCoreServices> => {
+    const plugin: EmulatorServerPlugin<ExternalEdrServerEmulatorCoreServices> = {
+      name: 'sentinelone',
+      register({ router, expose, services }) {
+        router.route(getSentinelOneRouteDefinitions());
+
+        // TODO:PT define the interface for programmatically interact with sentinelone api emulator
+        expose('setResponse', () => {
+          services.logger.info('setResponse() is available');
+        });
+      },
+    };
+
+    return plugin;
+  };
diff --git a/x-pack/plugins/security_solution/scripts/endpoint/api_emulator/emulator_plugins/sentinelone/routes/activities_route.ts b/x-pack/plugins/security_solution/scripts/endpoint/api_emulator/emulator_plugins/sentinelone/routes/activities_route.ts
new file mode 100644
index 00000000000000..4eecf26de67c44
--- /dev/null
+++ b/x-pack/plugins/security_solution/scripts/endpoint/api_emulator/emulator_plugins/sentinelone/routes/activities_route.ts
@@ -0,0 +1,44 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type {
+  SentinelOneActivityRecord,
+  SentinelOneGetActivitiesParams,
+} from '@kbn/stack-connectors-plugin/common/sentinelone/types';
+import type { DeepPartial, Mutable } from 'utility-types';
+import { SentinelOneDataGenerator } from '../../../../../../common/endpoint/data_generators/sentinelone_data_generator';
+import { buildSentinelOneRoutePath } from './utils';
+import type { ExternalEdrServerEmulatorRouteHandlerMethod } from '../../../external_edr_server_emulator.types';
+import type { EmulatorServerRouteDefinition } from '../../../lib/emulator_server.types';
+
+const generator = new SentinelOneDataGenerator();
+
+export const getActivitiesRouteDefinition = (): EmulatorServerRouteDefinition => {
+  return {
+    path: buildSentinelOneRoutePath('/activities'),
+    method: 'GET',
+    handler: activitiesRouteHandler,
+  };
+};
+
+const activitiesRouteHandler: ExternalEdrServerEmulatorRouteHandlerMethod<
+  {},
+  NonNullable<SentinelOneGetActivitiesParams>
+> = async (request) => {
+  const queryParams = request.query;
+  const activityOverrides: DeepPartial<Mutable<SentinelOneActivityRecord>> = {};
+
+  if (queryParams?.activityTypes) {
+    activityOverrides.activityType = Number(queryParams.activityTypes.split(',').at(0));
+  }
+
+  if (queryParams?.agentIds) {
+    activityOverrides.agentId = queryParams.agentIds.split(',').at(0);
+  }
+
+  return generator.generateSentinelOneApiActivityResponse(activityOverrides);
+};
diff --git a/x-pack/plugins/security_solution/scripts/endpoint/api_emulator/emulator_plugins/sentinelone/routes/agent_action_connect_route.ts b/x-pack/plugins/security_solution/scripts/endpoint/api_emulator/emulator_plugins/sentinelone/routes/agent_action_connect_route.ts
new file mode 100644
index 00000000000000..7716b52caa2560
--- /dev/null
+++ b/x-pack/plugins/security_solution/scripts/endpoint/api_emulator/emulator_plugins/sentinelone/routes/agent_action_connect_route.ts
@@ -0,0 +1,34 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { ExternalEdrServerEmulatorRouteHandlerMethod } from '../../..';
+import { buildSentinelOneRoutePath } from './utils';
+import type { EmulatorServerRouteDefinition } from '../../../lib/emulator_server.types';
+
+export const getAgentActionConnectRouteDefinition = (): EmulatorServerRouteDefinition => {
+  return {
+    path: buildSentinelOneRoutePath('/agents/actions/connect'),
+    method: 'POST',
+    handler: connectActionRouteHandler,
+  };
+};
+
+const connectActionRouteHandler: ExternalEdrServerEmulatorRouteHandlerMethod<
+  {},
+  {},
+  {
+    filter: {
+      ids: string;
+    };
+  }
+> = async (request) => {
+  return {
+    data: {
+      affected: request.payload.filter.ids.split(',').length,
+    },
+  };
+};
diff --git a/x-pack/plugins/security_solution/scripts/endpoint/api_emulator/emulator_plugins/sentinelone/routes/agent_action_disconnect_route.ts b/x-pack/plugins/security_solution/scripts/endpoint/api_emulator/emulator_plugins/sentinelone/routes/agent_action_disconnect_route.ts
new file mode 100644
index 00000000000000..dbcf0fcfe22c2c
--- /dev/null
+++ b/x-pack/plugins/security_solution/scripts/endpoint/api_emulator/emulator_plugins/sentinelone/routes/agent_action_disconnect_route.ts
@@ -0,0 +1,34 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { ExternalEdrServerEmulatorRouteHandlerMethod } from '../../..';
+import { buildSentinelOneRoutePath } from './utils';
+import type { EmulatorServerRouteDefinition } from '../../../lib/emulator_server.types';
+
+export const getAgentActionDisconnectRouteDefinition = (): EmulatorServerRouteDefinition => {
+  return {
+    path: buildSentinelOneRoutePath('/agents/actions/disconnect'),
+    method: 'POST',
+    handler: disconnectActionRouteHandler,
+  };
+};
+
+const disconnectActionRouteHandler: ExternalEdrServerEmulatorRouteHandlerMethod<
+  {},
+  {},
+  {
+    filter: {
+      ids: string;
+    };
+  }
+> = async (request) => {
+  return {
+    data: {
+      affected: request.payload.filter.ids.split(',').length,
+    },
+  };
+};
diff --git a/x-pack/plugins/security_solution/scripts/endpoint/api_emulator/emulator_plugins/sentinelone/routes/agents_route.ts b/x-pack/plugins/security_solution/scripts/endpoint/api_emulator/emulator_plugins/sentinelone/routes/agents_route.ts
new file mode 100644
index 00000000000000..6316e68636cb9d
--- /dev/null
+++ b/x-pack/plugins/security_solution/scripts/endpoint/api_emulator/emulator_plugins/sentinelone/routes/agents_route.ts
@@ -0,0 +1,44 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type {
+  SentinelOneGetAgentsParams,
+  SentinelOneGetAgentsResponse,
+} from '@kbn/stack-connectors-plugin/common/sentinelone/types';
+import type { DeepPartial, Mutable } from 'utility-types';
+import { SentinelOneDataGenerator } from '../../../../../../common/endpoint/data_generators/sentinelone_data_generator';
+import { buildSentinelOneRoutePath } from './utils';
+import type { ExternalEdrServerEmulatorRouteHandlerMethod } from '../../../external_edr_server_emulator.types';
+import type { EmulatorServerRouteDefinition } from '../../../lib/emulator_server.types';
+
+const generator = new SentinelOneDataGenerator();
+
+export const getAgentsRouteDefinition = (): EmulatorServerRouteDefinition => {
+  return {
+    path: buildSentinelOneRoutePath('/agents'),
+    method: 'GET',
+    handler: agentsRouteHandler,
+  };
+};
+
+const agentsRouteHandler: ExternalEdrServerEmulatorRouteHandlerMethod<
+  {},
+  SentinelOneGetAgentsParams
+> = async (request) => {
+  const queryParams = request.query;
+  const agent: Mutable<DeepPartial<SentinelOneGetAgentsResponse['data'][number]>> = {};
+
+  if (queryParams.uuid) {
+    agent.uuid = queryParams.uuid;
+  }
+
+  if (queryParams.ids) {
+    agent.id = queryParams.ids.split(',').at(0);
+  }
+
+  return generator.generateSentinelOneApiAgentsResponse(agent);
+};
diff --git a/x-pack/plugins/security_solution/scripts/endpoint/api_emulator/emulator_plugins/sentinelone/routes/index.ts b/x-pack/plugins/security_solution/scripts/endpoint/api_emulator/emulator_plugins/sentinelone/routes/index.ts
new file mode 100644
index 00000000000000..0a8e8441b6351c
--- /dev/null
+++ b/x-pack/plugins/security_solution/scripts/endpoint/api_emulator/emulator_plugins/sentinelone/routes/index.ts
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { getAgentActionConnectRouteDefinition } from './agent_action_connect_route';
+import { getAgentActionDisconnectRouteDefinition } from './agent_action_disconnect_route';
+import { getActivitiesRouteDefinition } from './activities_route';
+import { getAgentsRouteDefinition } from './agents_route';
+import type { EmulatorServerRouteDefinition } from '../../../lib/emulator_server.types';
+
+export const getSentinelOneRouteDefinitions = (): EmulatorServerRouteDefinition[] => {
+  return [
+    getAgentsRouteDefinition(),
+    getActivitiesRouteDefinition(),
+    getAgentActionConnectRouteDefinition(),
+    getAgentActionDisconnectRouteDefinition(),
+  ];
+};
diff --git a/x-pack/plugins/security_solution/scripts/endpoint/api_emulator/emulator_plugins/sentinelone/routes/utils.ts b/x-pack/plugins/security_solution/scripts/endpoint/api_emulator/emulator_plugins/sentinelone/routes/utils.ts
new file mode 100644
index 00000000000000..d2b6f293764233
--- /dev/null
+++ b/x-pack/plugins/security_solution/scripts/endpoint/api_emulator/emulator_plugins/sentinelone/routes/utils.ts
@@ -0,0 +1,18 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+// The base API path for the API requests for sentinelone. Value is the same as the one defined here:
+// `x-pack/plugins/stack_connectors/server/connector_types/sentinelone/sentinelone.ts:50`
+const BASE_API_PATH = '/web/api/v2.1';
+
+export const buildSentinelOneRoutePath = (path: string): string => {
+  if (!path.startsWith('/')) {
+    throw new Error(`'path' must start with '/'!`);
+  }
+
+  return `${BASE_API_PATH}${path}`;
+};
diff --git a/x-pack/plugins/security_solution/scripts/endpoint/api_emulator/external_edr_server_emulator.ts b/x-pack/plugins/security_solution/scripts/endpoint/api_emulator/external_edr_server_emulator.ts
new file mode 100644
index 00000000000000..270272de77d582
--- /dev/null
+++ b/x-pack/plugins/security_solution/scripts/endpoint/api_emulator/external_edr_server_emulator.ts
@@ -0,0 +1,65 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { getCrowdstrikeEmulator } from './emulator_plugins/crowdstrike';
+import { handleProcessInterruptions } from '../common/nodejs_utils';
+import { EmulatorServer } from './lib/emulator_server';
+import type { ExternalEdrServerEmulatorCoreServices } from './external_edr_server_emulator.types';
+import { getSentinelOneEmulator } from './emulator_plugins/sentinelone';
+
+export interface StartExternalEdrServerEmulatorOptions {
+  coreServices: ExternalEdrServerEmulatorCoreServices;
+  /**
+   * The port where the server should listen on. Default is `0` which means an available port is
+   * auto-assigned.
+   */
+  port?: number;
+}
+
+/**
+ * Starts a server that provides API emulator for external EDR systems in support of bi-directional
+ * response actions.
+ *
+ * After staring the server, the `emulatorServer.stopped` property provides a way to `await` until it
+ * is stopped
+ *
+ * @param options
+ */
+export const startExternalEdrServerEmulator = async ({
+  port,
+  coreServices,
+}: StartExternalEdrServerEmulatorOptions): Promise<EmulatorServer> => {
+  const emulator = new EmulatorServer<ExternalEdrServerEmulatorCoreServices>({
+    logger: coreServices.logger,
+    port: port ?? 0,
+    services: coreServices,
+  });
+
+  // Register all emulators
+  await emulator.register(getSentinelOneEmulator());
+  await emulator.register(getCrowdstrikeEmulator());
+
+  let wasStartedPromise: ReturnType<EmulatorServer['start']>;
+
+  handleProcessInterruptions(
+    async () => {
+      wasStartedPromise = emulator.start();
+      await wasStartedPromise;
+      await emulator.stopped;
+    },
+    () => {
+      coreServices.logger.warning(
+        `Process was interrupted. Shutting down External EDR Server Emulator`
+      );
+      emulator.stop();
+    }
+  );
+
+  // @ts-expect-error TS2454: Variable 'wasStartedPromise' is used before being assigned.
+  await wasStartedPromise;
+  return emulator;
+};
diff --git a/x-pack/plugins/security_solution/scripts/endpoint/api_emulator/external_edr_server_emulator.types.ts b/x-pack/plugins/security_solution/scripts/endpoint/api_emulator/external_edr_server_emulator.types.ts
new file mode 100644
index 00000000000000..9773af6aae1bfd
--- /dev/null
+++ b/x-pack/plugins/security_solution/scripts/endpoint/api_emulator/external_edr_server_emulator.types.ts
@@ -0,0 +1,35 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+/* eslint-disable @typescript-eslint/no-explicit-any */
+
+import type { KbnClient } from '@kbn/test';
+import type { Client } from '@elastic/elasticsearch';
+import type { ToolingLog } from '@kbn/tooling-log';
+import type HapiTypes from '@hapi/hapi';
+import type { EmulatorServerRouteHandlerMethod } from './lib/emulator_server.types';
+
+/**
+ * Core services that will be made available to all emulator plugin routes via `Request.pre.services`.
+ *
+ * **NOTE**:  Only services that are emulator agnostic should be added here. Any service that is specific
+ *            for only a given emulator should instead be added to the route registration via
+ *            `route.options.pre`. See {@link https://hapi.dev/api/?v=21.3.3#-routeoptionspre|Hapi Route Options}
+ *            for more on how to use `pre`requisites option
+ */
+export interface ExternalEdrServerEmulatorCoreServices {
+  readonly kbnClient: KbnClient;
+  readonly esClient: Client;
+  readonly logger: ToolingLog;
+}
+
+export type ExternalEdrServerEmulatorRouteHandlerMethod<
+  TParams extends HapiTypes.Request['params'] = any,
+  TQuery extends HapiTypes.Request['query'] = any,
+  TPayload extends HapiTypes.Request['payload'] = any,
+  TPre extends HapiTypes.Request['pre'] = { services: ExternalEdrServerEmulatorCoreServices }
+> = EmulatorServerRouteHandlerMethod<TParams, TQuery, TPayload, TPre>;
diff --git a/x-pack/plugins/security_solution/scripts/endpoint/api_emulator/index.ts b/x-pack/plugins/security_solution/scripts/endpoint/api_emulator/index.ts
new file mode 100644
index 00000000000000..15a48654f29632
--- /dev/null
+++ b/x-pack/plugins/security_solution/scripts/endpoint/api_emulator/index.ts
@@ -0,0 +1,105 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { RunFn } from '@kbn/dev-cli-runner';
+import { run } from '@kbn/dev-cli-runner';
+import { dump } from '../common/utils';
+import { startExternalEdrServerEmulator } from './external_edr_server_emulator';
+import type { ExternalEdrServerEmulatorCoreServices } from './external_edr_server_emulator.types';
+import { createRuntimeServices } from '../common/stack_services';
+import { createToolingLogger } from '../../../common/endpoint/data_loaders/utils';
+
+export {
+  startExternalEdrServerEmulator,
+  type StartExternalEdrServerEmulatorOptions,
+} from './external_edr_server_emulator';
+export * from './external_edr_server_emulator.types';
+
+export const cli = () => {
+  run(
+    cliRunner,
+
+    // Options
+    {
+      description: `Start external API emulator`,
+      flags: {
+        string: ['kibana', 'elastic', 'username', 'password', 'apiKey'],
+        boolean: ['asSuperuser'],
+        default: {
+          kibana: 'http://127.0.0.1:5601',
+          elasticsearch: 'http://127.0.0.1:9200',
+          username: 'elastic',
+          password: 'changeme',
+          apiKey: '',
+          asSuperuser: false,
+          port: 0,
+        },
+        help: `
+        --port              The port number where the server should listen on
+                            (Default is 0 - which means an available port is assigned randomly)
+        --username          User name to be used for auth against elasticsearch and
+                            kibana (Default: elastic).
+                            **IMPORTANT:** if 'asSuperuser' option is not used, then the
+                            user defined here MUST have 'superuser' AND 'kibana_system' roles
+        --password          User name Password (Default: changeme)
+        --apiKey            An API key to use for communication with Kibana/Elastisearch. Would be
+                            used instead of username/password
+        --asSuperuser       If defined, then a Security super user will be created using the
+                            the credentials defined via 'username' and 'password' options. This
+                            new user will then be used to run this utility.
+        --kibana            The url to Kibana (Default: http://127.0.0.1:5601)
+        --elasticsearch     The url to Elasticsearch (Default: http://127.0.0.1:9200)
+      `,
+      },
+    }
+  );
+};
+
+const cliRunner: RunFn = async (cliContext) => {
+  const username = cliContext.flags.username as string;
+  const password = cliContext.flags.password as string;
+  const apiKey = cliContext.flags.apiKey as string;
+  const kibanaUrl = cliContext.flags.kibana as string;
+  const elasticsearchUrl = cliContext.flags.elasticsearch as string;
+  const asSuperuser = cliContext.flags.asSuperuser as boolean;
+  const log = cliContext.log;
+  const port = Number(cliContext.flags.port as string);
+
+  createToolingLogger.setDefaultLogLevelFromCliFlags(cliContext.flags);
+
+  const { kbnClient, esClient } = await createRuntimeServices({
+    username,
+    password,
+    apiKey,
+    kibanaUrl,
+    elasticsearchUrl,
+    asSuperuser,
+    log,
+    noCertForSsl: true,
+  });
+
+  const coreServices: ExternalEdrServerEmulatorCoreServices = {
+    get kbnClient() {
+      return kbnClient;
+    },
+    get esClient() {
+      return esClient;
+    },
+    get logger() {
+      return log;
+    },
+  };
+
+  const emulatorServer = await startExternalEdrServerEmulator({
+    port,
+    coreServices,
+  });
+
+  log.debug(`Server info:\n${dump(emulatorServer.info)}`);
+
+  await emulatorServer.stopped;
+};
diff --git a/x-pack/plugins/security_solution/scripts/endpoint/api_emulator/lib/emulator_server.ts b/x-pack/plugins/security_solution/scripts/endpoint/api_emulator/lib/emulator_server.ts
new file mode 100644
index 00000000000000..cfffe0b942a805
--- /dev/null
+++ b/x-pack/plugins/security_solution/scripts/endpoint/api_emulator/lib/emulator_server.ts
@@ -0,0 +1,214 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+/* eslint-disable @typescript-eslint/no-explicit-any */
+
+import type { ServerRoute } from '@hapi/hapi';
+import Hapi from '@hapi/hapi';
+import type { ToolingLog } from '@kbn/tooling-log';
+import type {
+  EmulatorServerPlugin,
+  EmulatorServerPluginRegisterOptions,
+  EmulatorServerRouteDefinition,
+} from './emulator_server.types';
+import type { DeferredPromiseInterface } from '../../common/utils';
+import { getDeferredPromise, prefixedOutputLogger } from '../../common/utils';
+import { createToolingLogger } from '../../../../common/endpoint/data_loaders/utils';
+
+interface EmulatorServerOptions<TServices extends {} = {}> {
+  /**
+   * An object that contains services to be exposed
+   */
+  services?: TServices;
+  logger?: ToolingLog;
+  logPrefix?: string;
+  port?: number;
+}
+
+/**
+ * An HTTP server module wrapped around Hapi
+ */
+export class EmulatorServer<TServices extends {} = {}> {
+  protected readonly server: Hapi.Server & { app: { services: TServices | {} } };
+  protected log: ToolingLog;
+  private stoppedDeferred: DeferredPromiseInterface;
+  private wasStarted: boolean = false;
+
+  constructor(protected readonly options: EmulatorServerOptions<TServices> = {}) {
+    this.log = prefixedOutputLogger(
+      (this.options.logPrefix || this.constructor.name) ?? 'EmulatorServer',
+      options.logger ?? createToolingLogger()
+    );
+
+    // @ts-expect-error
+    this.server = Hapi.server({
+      port: this.options.port ?? 0,
+    });
+    this.server.app.services = this.options.services ?? {};
+    this.stoppedDeferred = getDeferredPromise();
+    this.stoppedDeferred.resolve();
+
+    this.server.events.on('route', (route) => {
+      this.log.info(
+        `added route: [${route.realm.plugin ?? 'CORE'}] ${route.method.toUpperCase()} ${route.path}`
+      );
+    });
+
+    this.registerInternalRoutes();
+    this.log.verbose(`Instance created`);
+  }
+
+  protected registerInternalRoutes() {
+    this.server.route({
+      method: 'GET',
+      path: '/_status',
+      handler: async (req) => ({
+        status: 'ok',
+        started: new Date(req.server.info.started).toISOString(),
+        uri: req.server.info.uri,
+        plugins: Object.keys(req.server.registrations),
+        routes: req.server.table().map((route) => `${route.method.toUpperCase()} ${route.path}`),
+      }),
+    });
+  }
+
+  /**
+   * Utility that creates a Hapi Route definition based on the Route Definition defined for this framework
+   * @param routesToRegister
+   * @protected
+   */
+  protected createHapiRouteDefinition(
+    routesToRegister: EmulatorServerRouteDefinition | EmulatorServerRouteDefinition[]
+  ): ServerRoute[] {
+    const routes = Array.isArray(routesToRegister) ? routesToRegister : [routesToRegister];
+
+    for (const routeDefinition of routes) {
+      if (typeof routeDefinition.options === 'function') {
+        throw new Error(`a callback function for 'route.options' is not currently supported!`);
+      }
+
+      // Inject `services` to every request under `request.pre.services`
+      routeDefinition.options = routeDefinition.options ?? {};
+      routeDefinition.options.pre = routeDefinition.options.pre ?? [];
+      routeDefinition.options.pre.unshift({
+        method: () => this.server.app.services,
+        assign: 'services',
+      });
+    }
+
+    return routes;
+  }
+
+  /**
+   * Access information about the running server
+   */
+  public get info(): Hapi.ServerInfo {
+    return this.server.info;
+  }
+
+  /**
+   * A promise that resolves when the server is stopped
+   *
+   * **IMPORTANT**: Only use this property after server has been started!
+   */
+  public get stopped(): Promise<void> {
+    if (!this.wasStarted) {
+      this.log.warning(`Can not access 'stopped' promise. Server not started`);
+      return Promise.resolve();
+    }
+
+    return this.stoppedDeferred.promise;
+  }
+
+  /**
+   * Register a plugin with the server
+   * @param register
+   * @param prefix
+   * @param options
+   */
+  public async register({ register, prefix, ...options }: EmulatorServerPlugin) {
+    const createHapiRouteDefinition = this.createHapiRouteDefinition.bind(this);
+    const services = this.server.app.services;
+
+    await this.server.register(
+      {
+        ...options,
+        register(pluginScopedServer) {
+          const scopedServer: EmulatorServerPluginRegisterOptions = {
+            router: {
+              route: (routesToRegister) => {
+                return pluginScopedServer.route(createHapiRouteDefinition(routesToRegister));
+              },
+            },
+
+            expose: (key: string, value: any): void => {
+              pluginScopedServer.expose(key, value);
+            },
+
+            services,
+          };
+
+          return register(scopedServer);
+        },
+      },
+      {
+        routes: {
+          // All plugin routes are namespaced by `prefix` or the plugin name if `prefix` not defined
+          prefix: prefix || `/${options.name}`,
+        },
+      }
+    );
+  }
+
+  /**
+   * Register a route with the root server (non-plugin scoped)
+   * @param routesToRegister
+   */
+  public route(
+    routesToRegister: EmulatorServerRouteDefinition | EmulatorServerRouteDefinition[]
+  ): void {
+    return this.server.route(this.createHapiRouteDefinition(routesToRegister));
+  }
+
+  public async start() {
+    if (this.wasStarted) {
+      this.log.warning(`Can not start server - it already has been started and is running`);
+    }
+
+    this.stoppedDeferred = getDeferredPromise();
+    await this.server.start();
+    this.wasStarted = true;
+
+    this.server.events.once('stop', () => {
+      this.log.verbose(`Hapi server was stopped!`);
+      this.wasStarted = false;
+      this.stoppedDeferred.resolve();
+    });
+
+    this.log.info(`Server started and available at: ${this.server.info.uri}`);
+  }
+
+  public async stop() {
+    this.log.debug(`Stopping Hapi server: ${this.server.info.uri}`);
+    await this.server.stop();
+  }
+
+  /**
+   * Returns a plugin client that enables interactions with the given plugin emulator.
+   * Plugins can expose interfaces via the `expose()` method that is available to the plugin's
+   * `register()` method.
+   */
+  public getClient<TClient extends {} = {}>(pluginName: string): TClient {
+    const pluginExposedInterface = this.server.plugins[pluginName as keyof Hapi.PluginProperties];
+
+    if (!pluginExposedInterface) {
+      throw new Error(`No plugin named [${pluginName}] registered!`);
+    }
+
+    return pluginExposedInterface as TClient;
+  }
+}
diff --git a/x-pack/plugins/security_solution/scripts/endpoint/api_emulator/lib/emulator_server.types.ts b/x-pack/plugins/security_solution/scripts/endpoint/api_emulator/lib/emulator_server.types.ts
new file mode 100644
index 00000000000000..5d8cb5c1ee595d
--- /dev/null
+++ b/x-pack/plugins/security_solution/scripts/endpoint/api_emulator/lib/emulator_server.types.ts
@@ -0,0 +1,73 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+/* eslint-disable @typescript-eslint/no-explicit-any */
+
+import type HapiTypes from '@hapi/hapi';
+
+export interface EmulatorServerPluginRegisterOptions<TServices extends Record<string, any> = {}> {
+  router: {
+    route(route: EmulatorServerRouteDefinition | EmulatorServerRouteDefinition[]): void;
+  };
+
+  /**
+   * Expose content on the server related to the plugin
+   *
+   * @param key
+   * @param value
+   *
+   * @see https://hapi.dev/api/?v=21.3.3#-serverexposekey-value-options
+   */
+  expose: (key: string, value: any) => void;
+
+  /**
+   * Core services defined at the server level
+   */
+  services: TServices;
+}
+
+export interface EmulatorServerPlugin<TServices extends Record<string, any> = any>
+  extends Omit<HapiTypes.PluginBase<unknown>, 'register'> {
+  register: (options: EmulatorServerPluginRegisterOptions<TServices>) => void | Promise<void>;
+  name: string;
+  /**
+   * A prefix for the routes that will be registered via this plugin. Default is the plugin's `name`
+   */
+  prefix?: Required<HapiTypes.ServerRegisterOptions>['routes']['prefix'];
+}
+
+export interface EmulatorServerRequest<
+  TParams extends HapiTypes.Request['params'] = any,
+  TQuery extends HapiTypes.Request['query'] = any,
+  TPayload extends HapiTypes.Request['payload'] = any,
+  TPre extends HapiTypes.Request['pre'] = any
+> extends HapiTypes.Request {
+  params: TParams;
+  query: TQuery;
+  payload: TPayload;
+  pre: TPre;
+}
+
+export type EmulatorServerRouteHandlerMethod<
+  TParams extends HapiTypes.Request['params'] = any,
+  TQuery extends HapiTypes.Request['query'] = any,
+  TPayload extends HapiTypes.Request['payload'] = any,
+  TPre extends HapiTypes.Request['pre'] = any
+> = (
+  request: EmulatorServerRequest<TParams, TQuery, TPayload, TPre>,
+  h: HapiTypes.ResponseToolkit,
+  err?: Error
+) => HapiTypes.Lifecycle.ReturnValue;
+
+export interface EmulatorServerRouteDefinition<
+  TParams extends HapiTypes.Request['params'] = any,
+  TQuery extends HapiTypes.Request['query'] = any,
+  TPayload extends HapiTypes.Request['payload'] = any,
+  TPre extends HapiTypes.Request['pre'] = any
+> extends Omit<HapiTypes.ServerRoute, 'handler'> {
+  handler: EmulatorServerRouteHandlerMethod<TParams, TQuery, TPayload, TPre>;
+}
diff --git a/x-pack/plugins/security_solution/scripts/endpoint/common/agent_downloads_service.ts b/x-pack/plugins/security_solution/scripts/endpoint/common/agent_downloads_service.ts
index 5e2e003b6096b8..488e1b10160e8e 100644
--- a/x-pack/plugins/security_solution/scripts/endpoint/common/agent_downloads_service.ts
+++ b/x-pack/plugins/security_solution/scripts/endpoint/common/agent_downloads_service.ts
@@ -10,6 +10,7 @@ import { join } from 'path';
 import fs from 'fs';
 import nodeFetch from 'node-fetch';
 import { finished } from 'stream/promises';
+import { handleProcessInterruptions } from './nodejs_utils';
 import { createToolingLogger } from '../../../common/endpoint/data_loaders/utils';
 import { SettingsStorage } from './settings_storage';
 
@@ -173,43 +174,6 @@ class AgentDownloadStorage extends SettingsStorage<AgentDownloadStorageSettings>
   }
 }
 
-const handleProcessInterruptions = async <T>(
-  runFn: (() => T) | (() => Promise<T>),
-  /** The synchronous cleanup callback */
-  cleanup: () => void
-): Promise<T> => {
-  const eventNames = ['SIGINT', 'exit', 'uncaughtException', 'unhandledRejection'];
-  const stopListeners = () => {
-    for (const eventName of eventNames) {
-      process.off(eventName, cleanup);
-    }
-  };
-
-  for (const eventName of eventNames) {
-    process.on(eventName, cleanup);
-  }
-
-  let runnerResponse: T | Promise<T>;
-
-  try {
-    runnerResponse = runFn();
-  } catch (e) {
-    stopListeners();
-    throw e;
-  }
-
-  // @ts-expect-error upgrade typescript v4.9.5
-  if ('finally' in runnerResponse) {
-    (runnerResponse as Promise<T>).finally(() => {
-      stopListeners();
-    });
-  } else {
-    stopListeners();
-  }
-
-  return runnerResponse;
-};
-
 const agentDownloadsClient = new AgentDownloadStorage();
 
 export interface DownloadAndStoreAgentResponse extends DownloadedAgentInfo {
diff --git a/x-pack/plugins/security_solution/scripts/endpoint/common/nodejs_utils.ts b/x-pack/plugins/security_solution/scripts/endpoint/common/nodejs_utils.ts
new file mode 100644
index 00000000000000..ca204d2a74ff61
--- /dev/null
+++ b/x-pack/plugins/security_solution/scripts/endpoint/common/nodejs_utils.ts
@@ -0,0 +1,49 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+/**
+ * Executes/Runs the provided function and sets up event listeners for NodeJs process interruptions so
+ * that a `cleanup()` method can executed if an interruption is caught
+ * @param runFn
+ * @param cleanup
+ */
+export const handleProcessInterruptions = async <T>(
+  runFn: (() => T) | (() => Promise<T>),
+  /** The synchronous cleanup callback */
+  cleanup: () => void
+): Promise<T> => {
+  const eventNames = ['SIGINT', 'exit', 'uncaughtException', 'unhandledRejection'];
+  const stopListeners = () => {
+    for (const eventName of eventNames) {
+      process.off(eventName, cleanup);
+    }
+  };
+
+  for (const eventName of eventNames) {
+    process.on(eventName, cleanup);
+  }
+
+  let runnerResponse: T | Promise<T>;
+
+  try {
+    runnerResponse = runFn();
+  } catch (e) {
+    stopListeners();
+    throw e;
+  }
+
+  // @ts-expect-error upgrade typescript v4.9.5
+  if ('finally' in runnerResponse) {
+    (runnerResponse as Promise<T>).finally(() => {
+      stopListeners();
+    });
+  } else {
+    stopListeners();
+  }
+
+  return runnerResponse;
+};
diff --git a/x-pack/plugins/security_solution/scripts/endpoint/common/utils.ts b/x-pack/plugins/security_solution/scripts/endpoint/common/utils.ts
index 72a59743d4435a..0161c3470716d4 100644
--- a/x-pack/plugins/security_solution/scripts/endpoint/common/utils.ts
+++ b/x-pack/plugins/security_solution/scripts/endpoint/common/utils.ts
@@ -71,3 +71,26 @@ export const prefixedOutputLogger = (prefix: string, log: ToolingLog): ToolingLo
 export const dump = (content: any, depth: number = 5): string => {
   return inspect(content, { depth });
 };
+
+export interface DeferredPromiseInterface<T = void> {
+  promise: Promise<T>;
+  resolve: (data: T) => void;
+  reject: (e: Error) => void;
+}
+
+/**
+ * Returns back an interface that provide a Promise along with exposed method to resolve it and reject it
+ * from outside of the actual Promise executor
+ */
+export const getDeferredPromise = function <T = void>(): DeferredPromiseInterface<T> {
+  let resolve: DeferredPromiseInterface<T>['resolve'];
+  let reject: DeferredPromiseInterface<T>['reject'];
+
+  const promise = new Promise<T>((_resolve, _reject) => {
+    resolve = _resolve;
+    reject = _reject;
+  });
+
+  // @ts-ignore
+  return { promise, resolve, reject };
+};
diff --git a/x-pack/plugins/security_solution/scripts/endpoint/sentinelone_host/index.ts b/x-pack/plugins/security_solution/scripts/endpoint/sentinelone_host/index.ts
index d2f41908214130..2c179f6e853ab2 100644
--- a/x-pack/plugins/security_solution/scripts/endpoint/sentinelone_host/index.ts
+++ b/x-pack/plugins/security_solution/scripts/endpoint/sentinelone_host/index.ts
@@ -111,6 +111,7 @@ const runCli: RunFn = async ({ log, flags }) => {
     url: kibanaUrl,
     username,
     password,
+    noCertForSsl: true,
   });
 
   const runningS1VMs = (
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/context/experimental_onboarding_enabled.ts b/x-pack/plugins/security_solution/scripts/endpoint/start_external_edr_server_emulator.js
similarity index 69%
rename from x-pack/plugins/observability_solution/observability_onboarding/public/context/experimental_onboarding_enabled.ts
rename to x-pack/plugins/security_solution/scripts/endpoint/start_external_edr_server_emulator.js
index 8e817d992ab25c..5874264a85e2bb 100644
--- a/x-pack/plugins/observability_solution/observability_onboarding/public/context/experimental_onboarding_enabled.ts
+++ b/x-pack/plugins/security_solution/scripts/endpoint/start_external_edr_server_emulator.js
@@ -5,6 +5,5 @@
  * 2.0.
  */
 
-import { createContext } from 'react';
-
-export const ExperimentalOnboardingFeatureFlag = createContext(false);
+require('../../../../../src/setup_node_env');
+require('./api_emulator').cli();
diff --git a/x-pack/plugins/security_solution/scripts/openapi/bundle.js b/x-pack/plugins/security_solution/scripts/openapi/bundle.js
index 6cfa1507ea9ee9..82280d0ef0ebfd 100644
--- a/x-pack/plugins/security_solution/scripts/openapi/bundle.js
+++ b/x-pack/plugins/security_solution/scripts/openapi/bundle.js
@@ -7,12 +7,14 @@
 
 require('../../../../../src/setup_node_env');
 const { bundle } = require('@kbn/openapi-bundler');
-const { resolve } = require('path');
+const { join, resolve } = require('path');
 
 const SECURITY_SOLUTION_ROOT = resolve(__dirname, '../..');
 
 bundle({
-  rootDir: SECURITY_SOLUTION_ROOT,
-  sourceGlob: './common/api/**/*.schema.yaml',
-  outputFilePath: './target/openapi/security_solution.bundled.schema.yaml',
+  sourceGlob: join(SECURITY_SOLUTION_ROOT, 'common/api/**/*.schema.yaml'),
+  outputFilePath: join(
+    SECURITY_SOLUTION_ROOT,
+    'target/openapi/security_solution-{version}.bundled.schema.yaml'
+  ),
 });
diff --git a/x-pack/plugins/security_solution/server/assistant/tools/attack_discovery/attack_discovery_tool.test.ts b/x-pack/plugins/security_solution/server/assistant/tools/attack_discovery/attack_discovery_tool.test.ts
new file mode 100644
index 00000000000000..bd67b002577213
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/assistant/tools/attack_discovery/attack_discovery_tool.test.ts
@@ -0,0 +1,337 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { ElasticsearchClient } from '@kbn/core-elasticsearch-server';
+import type { KibanaRequest } from '@kbn/core-http-server';
+import type { AttackDiscoveryPostRequestBody } from '@kbn/elastic-assistant-common';
+import type { ActionsClientLlm } from '@kbn/elastic-assistant-common/impl/language_models';
+import type { DynamicTool } from '@langchain/core/tools';
+
+import { ATTACK_DISCOVERY_TOOL } from './attack_discovery_tool';
+import { mockAnonymizationFields } from '../mock/mock_anonymization_fields';
+import { mockEmptyOpenAndAcknowledgedAlertsQueryResults } from '../mock/mock_empty_open_and_acknowledged_alerts_qery_results';
+import { mockOpenAndAcknowledgedAlertsQueryResults } from '../mock/mock_open_and_acknowledged_alerts_query_results';
+
+jest.mock('langchain/chains', () => {
+  const mockLLMChain = jest.fn().mockImplementation(() => ({
+    call: jest.fn().mockResolvedValue({
+      records: [
+        {
+          alertIds: [
+            'b6e883c29b32571aaa667fa13e65bbb4f95172a2b84bdfb85d6f16c72b2d2560',
+            '0215a6c5cc9499dd0290cd69a4947efb87d3ddd8b6385a766d122c2475be7367',
+            '600eb9eca925f4c5b544b4e9d3cf95d83b7829f8f74c5bd746369cb4c2968b9a',
+            'e1f4a4ed70190eb4bd256c813029a6a9101575887cdbfa226ac330fbd3063f0c',
+            '2a7a4809ca625dfe22ccd35fbef7a7ba8ed07f109e5cbd17250755cfb0bc615f',
+          ],
+          detailsMarkdown:
+            '- Malicious Go application named "My Go Application.app" is being executed from temporary directories, likely indicating malware delivery\n- The malicious application is spawning child processes like `osascript` to display fake system dialogs and attempt to phish user credentials ({{ host.name 6c57a4f7-b30b-465d-a670-47377655b1bb }}, {{ user.name 639fab6d-369b-4879-beae-7767a7145c7f }})\n- The malicious application is also executing `chmod` to make the file `unix1` executable ({{ file.path /Users/james/unix1 }})\n- `unix1` is a potentially malicious executable that is being run with suspicious arguments related to the macOS keychain ({{ process.command_line /Users/james/unix1 /Users/james/library/Keychains/login.keychain-db TempTemp1234!! }})\n- Multiple detections indicate the presence of malware on the host attempting credential access and execution of malicious payloads',
+          entitySummaryMarkdown:
+            'Malicious activity detected on {{ host.name 6c57a4f7-b30b-465d-a670-47377655b1bb }} involving user {{ user.name 639fab6d-369b-4879-beae-7767a7145c7f }}.',
+          mitreAttackTactics: ['Credential Access', 'Execution'],
+          summaryMarkdown:
+            'Multiple detections indicate the presence of malware on a macOS host {{ host.name 6c57a4f7-b30b-465d-a670-47377655b1bb }} attempting credential theft and execution of malicious payloads targeting the user {{ user.name 639fab6d-369b-4879-beae-7767a7145c7f }}.',
+          title: 'Malware Delivering Malicious Payloads on macOS',
+        },
+      ],
+    }),
+  }));
+
+  return {
+    LLMChain: mockLLMChain,
+  };
+});
+
+describe('AttackDiscoveryTool', () => {
+  const alertsIndexPattern = '.alerts-security.alerts-default';
+  const replacements = { uuid: 'original_value' };
+  const size = 20;
+  const request = {
+    body: {
+      actionTypeId: '.bedrock',
+      alertsIndexPattern,
+      anonymizationFields: mockAnonymizationFields,
+      connectorId: 'test-connector-id',
+      replacements,
+      size,
+      subAction: 'invokeAI',
+    },
+  } as unknown as KibanaRequest<unknown, unknown, AttackDiscoveryPostRequestBody>;
+
+  const esClient = {
+    search: jest.fn(),
+  } as unknown as ElasticsearchClient;
+  const llm = jest.fn() as unknown as ActionsClientLlm;
+
+  const rest = {
+    anonymizationFields: mockAnonymizationFields,
+    isEnabledKnowledgeBase: false,
+    llm,
+    modelExists: false,
+    onNewReplacements: jest.fn(),
+    size,
+  };
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+
+    (esClient.search as jest.Mock).mockResolvedValue(mockOpenAndAcknowledgedAlertsQueryResults);
+  });
+
+  describe('isSupported', () => {
+    it('returns false when the request is missing required anonymization parameters', () => {
+      const requestMissingAnonymizationParams = {
+        body: {
+          isEnabledKnowledgeBase: false,
+          alertsIndexPattern: '.alerts-security.alerts-default',
+          size: 20,
+        },
+      } as unknown as KibanaRequest<unknown, unknown, AttackDiscoveryPostRequestBody>;
+
+      const params = {
+        alertsIndexPattern,
+        esClient,
+        request: requestMissingAnonymizationParams, // <-- request is missing required anonymization parameters
+        ...rest,
+      };
+
+      expect(ATTACK_DISCOVERY_TOOL.isSupported(params)).toBe(false);
+    });
+
+    it('returns false when the alertsIndexPattern is undefined', () => {
+      const params = {
+        esClient,
+        request,
+        ...rest,
+        alertsIndexPattern: undefined, // <-- alertsIndexPattern is undefined
+      };
+
+      expect(ATTACK_DISCOVERY_TOOL.isSupported(params)).toBe(false);
+    });
+
+    it('returns false when size is undefined', () => {
+      const params = {
+        alertsIndexPattern,
+        esClient,
+        request,
+        ...rest,
+        size: undefined, // <-- size is undefined
+      };
+
+      expect(ATTACK_DISCOVERY_TOOL.isSupported(params)).toBe(false);
+    });
+
+    it('returns false when size is out of range', () => {
+      const params = {
+        alertsIndexPattern,
+        esClient,
+        request,
+        ...rest,
+        size: 0, // <-- size is out of range
+      };
+
+      expect(ATTACK_DISCOVERY_TOOL.isSupported(params)).toBe(false);
+    });
+
+    it('returns false when llm is undefined', () => {
+      const params = {
+        alertsIndexPattern,
+        esClient,
+        request,
+        ...rest,
+        llm: undefined, // <-- llm is undefined
+      };
+
+      expect(ATTACK_DISCOVERY_TOOL.isSupported(params)).toBe(false);
+    });
+
+    it('returns true if all required params are provided', () => {
+      const params = {
+        alertsIndexPattern,
+        esClient,
+        request,
+        ...rest,
+      };
+
+      expect(ATTACK_DISCOVERY_TOOL.isSupported(params)).toBe(true);
+    });
+  });
+
+  describe('getTool', () => {
+    it('returns null when llm is undefined', () => {
+      const tool = ATTACK_DISCOVERY_TOOL.getTool({
+        alertsIndexPattern,
+        esClient,
+        replacements,
+        request,
+        ...rest,
+        llm: undefined, // <-- llm is undefined
+      });
+
+      expect(tool).toBeNull();
+    });
+
+    it('returns a `DynamicTool` with a `func` that calls `esClient.search()` with the expected alerts query', async () => {
+      const tool: DynamicTool = ATTACK_DISCOVERY_TOOL.getTool({
+        alertsIndexPattern,
+        esClient,
+        replacements,
+        request,
+        ...rest,
+      }) as DynamicTool;
+
+      await tool.func('');
+
+      expect(esClient.search).toHaveBeenCalledWith({
+        allow_no_indices: true,
+        body: {
+          _source: false,
+          fields: mockAnonymizationFields.map(({ field }) => ({
+            field,
+            include_unmapped: true,
+          })),
+          query: {
+            bool: {
+              filter: [
+                {
+                  bool: {
+                    filter: [
+                      {
+                        bool: {
+                          minimum_should_match: 1,
+                          should: [
+                            {
+                              match_phrase: {
+                                'kibana.alert.workflow_status': 'open',
+                              },
+                            },
+                            {
+                              match_phrase: {
+                                'kibana.alert.workflow_status': 'acknowledged',
+                              },
+                            },
+                          ],
+                        },
+                      },
+                      {
+                        range: {
+                          '@timestamp': {
+                            format: 'strict_date_optional_time',
+                            gte: 'now-24h',
+                            lte: 'now',
+                          },
+                        },
+                      },
+                    ],
+                    must: [],
+                    must_not: [
+                      {
+                        exists: {
+                          field: 'kibana.alert.building_block_type',
+                        },
+                      },
+                    ],
+                    should: [],
+                  },
+                },
+              ],
+            },
+          },
+          runtime_mappings: {},
+          size,
+          sort: [
+            {
+              'kibana.alert.risk_score': {
+                order: 'desc',
+              },
+            },
+            {
+              '@timestamp': {
+                order: 'desc',
+              },
+            },
+          ],
+        },
+        ignore_unavailable: true,
+        index: [alertsIndexPattern],
+      });
+    });
+
+    it('returns a `DynamicTool` with a `func` returns an empty attack discoveries array when getAnonymizedAlerts returns no alerts', async () => {
+      (esClient.search as jest.Mock).mockResolvedValue(
+        mockEmptyOpenAndAcknowledgedAlertsQueryResults // <-- no alerts
+      );
+
+      const tool: DynamicTool = ATTACK_DISCOVERY_TOOL.getTool({
+        alertsIndexPattern,
+        esClient,
+        replacements,
+        request,
+        ...rest,
+      }) as DynamicTool;
+
+      const result = await tool.func('');
+      const expected = JSON.stringify({ alertsContextCount: 0, attackDiscoveries: [] }, null, 2); // <-- empty attack discoveries array
+
+      expect(result).toEqual(expected);
+    });
+
+    it('returns a `DynamicTool` with a `func` that returns the expected results', async () => {
+      const tool: DynamicTool = ATTACK_DISCOVERY_TOOL.getTool({
+        alertsIndexPattern,
+        esClient,
+        replacements,
+        request,
+        ...rest,
+      }) as DynamicTool;
+
+      await tool.func('');
+
+      const result = await tool.func('');
+      const expected = JSON.stringify(
+        {
+          alertsContextCount: 20,
+          attackDiscoveries: [
+            {
+              alertIds: [
+                'b6e883c29b32571aaa667fa13e65bbb4f95172a2b84bdfb85d6f16c72b2d2560',
+                '0215a6c5cc9499dd0290cd69a4947efb87d3ddd8b6385a766d122c2475be7367',
+                '600eb9eca925f4c5b544b4e9d3cf95d83b7829f8f74c5bd746369cb4c2968b9a',
+                'e1f4a4ed70190eb4bd256c813029a6a9101575887cdbfa226ac330fbd3063f0c',
+                '2a7a4809ca625dfe22ccd35fbef7a7ba8ed07f109e5cbd17250755cfb0bc615f',
+              ],
+              detailsMarkdown:
+                '- Malicious Go application named "My Go Application.app" is being executed from temporary directories, likely indicating malware delivery\n- The malicious application is spawning child processes like `osascript` to display fake system dialogs and attempt to phish user credentials ({{ host.name 6c57a4f7-b30b-465d-a670-47377655b1bb }}, {{ user.name 639fab6d-369b-4879-beae-7767a7145c7f }})\n- The malicious application is also executing `chmod` to make the file `unix1` executable ({{ file.path /Users/james/unix1 }})\n- `unix1` is a potentially malicious executable that is being run with suspicious arguments related to the macOS keychain ({{ process.command_line /Users/james/unix1 /Users/james/library/Keychains/login.keychain-db TempTemp1234!! }})\n- Multiple detections indicate the presence of malware on the host attempting credential access and execution of malicious payloads',
+              entitySummaryMarkdown:
+                'Malicious activity detected on {{ host.name 6c57a4f7-b30b-465d-a670-47377655b1bb }} involving user {{ user.name 639fab6d-369b-4879-beae-7767a7145c7f }}.',
+              mitreAttackTactics: ['Credential Access', 'Execution'],
+              summaryMarkdown:
+                'Multiple detections indicate the presence of malware on a macOS host {{ host.name 6c57a4f7-b30b-465d-a670-47377655b1bb }} attempting credential theft and execution of malicious payloads targeting the user {{ user.name 639fab6d-369b-4879-beae-7767a7145c7f }}.',
+              title: 'Malware Delivering Malicious Payloads on macOS',
+            },
+          ],
+        },
+        null,
+        2
+      );
+
+      expect(result).toEqual(expected);
+    });
+
+    it('returns a tool instance with the expected tags', () => {
+      const tool = ATTACK_DISCOVERY_TOOL.getTool({
+        alertsIndexPattern,
+        esClient,
+        replacements,
+        request,
+        ...rest,
+      }) as DynamicTool;
+
+      expect(tool.tags).toEqual(['attack-discovery']);
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/server/assistant/tools/attack_discovery/attack_discovery_tool.ts b/x-pack/plugins/security_solution/server/assistant/tools/attack_discovery/attack_discovery_tool.ts
index e2b03c53473763..0d321e7402400b 100644
--- a/x-pack/plugins/security_solution/server/assistant/tools/attack_discovery/attack_discovery_tool.ts
+++ b/x-pack/plugins/security_solution/server/assistant/tools/attack_discovery/attack_discovery_tool.ts
@@ -37,6 +37,7 @@ export const ATTACK_DISCOVERY_TOOL: AssistantTool = {
   sourceRegister: APP_UI_ID,
   isSupported: (params: AssistantToolParams): params is AttackDiscoveryToolParams => {
     const { alertsIndexPattern, llm, request, size } = params;
+
     return (
       requestHasRequiredAnonymizationParams(request) &&
       alertsIndexPattern != null &&
@@ -75,6 +76,12 @@ export const ATTACK_DISCOVERY_TOOL: AssistantTool = {
           size,
         });
 
+        const alertsContextCount = anonymizedAlerts.length;
+        if (alertsContextCount === 0) {
+          // No alerts to analyze, so return an empty attack discoveries array
+          return JSON.stringify({ alertsContextCount, attackDiscoveries: [] }, null, 2);
+        }
+
         const outputParser = getOutputParser();
         const outputFixingParser = OutputFixingParser.fromLLM(llm, outputParser);
 
@@ -96,8 +103,9 @@ export const ATTACK_DISCOVERY_TOOL: AssistantTool = {
         const result = await answerFormattingChain.call({
           query: getAttackDiscoveryPrompt({ anonymizedAlerts }),
         });
+        const attackDiscoveries = result.records;
 
-        return JSON.stringify(result.records, null, 2);
+        return JSON.stringify({ alertsContextCount, attackDiscoveries }, null, 2);
       },
       tags: ['attack-discovery'],
     });
diff --git a/x-pack/plugins/security_solution/server/assistant/tools/mock/mock_anonymization_fields.ts b/x-pack/plugins/security_solution/server/assistant/tools/mock/mock_anonymization_fields.ts
new file mode 100644
index 00000000000000..541fb78b17c5dc
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/assistant/tools/mock/mock_anonymization_fields.ts
@@ -0,0 +1,911 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { AnonymizationFieldResponse } from '@kbn/elastic-assistant-common/impl/schemas/anonymization_fields/bulk_crud_anonymization_fields_route.gen';
+
+export const mockAnonymizationFields: AnonymizationFieldResponse[] = [
+  {
+    id: '9f95b649-f20e-4edf-bd76-1d21ab6f8e2e',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: '_id',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '13aae62e-e8d1-42a5-b369-38406de9de27',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: '@timestamp',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: 'ecf8f8f0-955a-4fd1-b11a-e997c3f70c60',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'cloud.availability_zone',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '5ea31dc8-a43f-4b79-8cb7-5eddef99e52e',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'cloud.provider',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '85f18a84-ea74-47ac-89e1-a25d78122229',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'cloud.region',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '0059af85-f6de-4500-aca7-196aa5e9b4e8',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'destination.ip',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '55d5f500-cd79-4809-ac40-507756f2188b',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'dns.question.name',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '71d4b104-277d-4c83-bb8a-26833cbcb620',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'dns.question.type',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '706b6fe4-0834-4d37-b9da-351a17683a80',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'event.category',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '6b8f7793-77e8-4ef6-bd92-573eafc71385',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'event.dataset',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '0851d53d-da3e-4c5a-8b9e-ed9c8fdf990b',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'event.module',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '373d9cf5-77b4-4dea-a2b6-82ea90bcf1a7',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'event.outcome',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: 'e50e603c-e8f2-43cb-86a5-2b01cde43fa9',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'file.Ext.original.path',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '63b56dc8-c395-4ad6-b92e-f2a5d16de84d',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'file.hash.sha256',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '8e2ca725-a8a4-4e18-8ed7-8e7815400217',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'file.name',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '9d5ead5e-7929-4923-a37a-c763127e189f',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'file.path',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '8d5c4c4d-6af6-4784-8046-20531e633bab',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'group.id',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '5f89fd96-f133-4b93-b54c-7bb91f9bbeb0',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'group.name',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '199e4a4e-9224-4e20-a397-63fec38ecb0b',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'host.asset.criticality',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '22f23471-4f6a-4cec-9b2a-cf270ffb53d5',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'host.name',
+    allowed: true,
+    anonymized: true,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '671f9bd2-d2c8-4637-baee-6a64cfebd518',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'host.os.name',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '660f9d45-9050-405d-adce-2dd597abb2ea',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'host.os.version',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: 'cb971f55-0f80-407a-9924-56751301e884',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'host.risk.calculated_level',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '0a8a078c-8812-4f2e-83c5-804bff42519a',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'host.risk.calculated_score_norm',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '34cf8706-366e-49e6-81a8-6d27175b1776',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'kibana.alert.original_time',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '10f1bcf5-c7f2-4570-a799-7d865be761d6',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'kibana.alert.risk_score',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: 'e06f542c-f9a0-4916-a426-142775cdfb6e',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'kibana.alert.rule.description',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '5bb110d1-b652-4c92-b7ec-9f0bf32532af',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'kibana.alert.rule.name',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '4166edab-6f9a-4de0-9a03-4be8f41c1902',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'kibana.alert.rule.references',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '39d8cdc3-4e30-4a5c-81f9-fc0172b7571f',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'kibana.alert.rule.threat.framework',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '9aa16534-a81b-41e6-808e-73b771774630',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'kibana.alert.rule.threat.tactic.id',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: 'fbd77d15-0fe0-4601-b84a-c44341102d3f',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'kibana.alert.rule.threat.tactic.name',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: 'ba18a341-1603-4cc0-adfe-3c2507a71b72',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'kibana.alert.rule.threat.tactic.reference',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '7ccbee93-0b1b-4d3b-8706-f4fd0f6695f1',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'kibana.alert.rule.threat.technique.id',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: 'b4b56b1f-ea5b-4f57-ab28-038d65dc1153',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'kibana.alert.rule.threat.technique.name',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '06e18204-4b84-43bb-b20e-f2a109afafd8',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'kibana.alert.rule.threat.technique.reference',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '0cb32f1a-532f-40d1-8ca5-92debeaee618',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'kibana.alert.rule.threat.technique.subtechnique.id',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '53f75a04-5535-4f0c-8591-379a7391c636',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'kibana.alert.rule.threat.technique.subtechnique.name',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: 'ccbd069a-c640-497f-9de6-6d8ad5a1f55d',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'kibana.alert.rule.threat.technique.subtechnique.reference',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: 'cefb5f12-6de2-403c-bc0a-518ab25ae354',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'kibana.alert.severity',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: 'a8c7e1cd-5837-4254-b151-a1fca47aba20',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'kibana.alert.workflow_status',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: 'e3fb3a83-da33-4ffb-b111-992b8ac070f7',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'message',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '5177f9a4-672d-4aaf-afcd-cbc8003de954',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'network.protocol',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '01c5b596-8164-49cf-ae7d-df14822b0cfd',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'process.args',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: 'aa460567-f3f2-460e-8917-7272c1d01bcb',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'process.code_signature.exists',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '566bd237-5b9d-4ecd-b9fb-8d11c50dbe7c',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'process.code_signature.signing_id',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '2e572530-943c-4800-9150-ae80eb0751fc',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'process.code_signature.status',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '08a36abe-f2f6-4fab-9ac8-3194f84ffc8f',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'process.code_signature.subject_name',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: 'c6697286-21e5-41a1-8572-4fd85a8893d5',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'process.code_signature.trusted',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '48ae58e0-196b-4fe5-907f-30322f9d4bfb',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'process.command_line',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: 'f69a4487-770f-4c8b-8c01-b0c8e44e5d8c',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'process.executable',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '7eb80322-eacc-499f-a0e5-4e2eedadd669',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'process.exit_code',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: 'c4ca5831-820c-474e-bfcb-f9bb887f7f2c',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'process.Ext.memory_region.bytes_compressed_present',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: 'c84ede38-f079-4ce5-a1de-33ce676e05a0',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'process.Ext.memory_region.malware_signature.all_names',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '7208f10d-7d02-4edd-9e03-26252b8ea17d',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'process.Ext.memory_region.malware_signature.primary.matches',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '62669a22-b51c-4f8b-95af-62ac81e092d8',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'process.Ext.memory_region.malware_signature.primary.signature.name',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '35c3fb06-5224-4616-82a8-20a56440e3a9',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'process.Ext.token.integrity_level_name',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '74c88612-0565-4015-8b41-866b78077e04',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'process.hash.md5',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '4e7d5890-0d28-4768-8f84-d2317b3d846a',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'process.hash.sha1',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '419a59ab-bf92-45fa-a627-87662b22c624',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'process.hash.sha256',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '36d85f0b-aada-4df8-979a-5fb7fbd94d90',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'process.name',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '12e00c31-df09-4136-ad40-663c32f8fff4',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'process.parent.args',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: 'dbbe7fba-efda-4e0e-8fdb-754d6793ab1a',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'process.parent.args_count',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: 'e4b2b245-0505-44a3-90dd-d508098a17b7',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'process.parent.code_signature.exists',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: 'cc808e37-cbe7-44c2-bf25-127b7f7a19b1',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'process.parent.code_signature.status',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '69002247-abdf-4f08-b5cd-d29527b69eaf',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'process.parent.code_signature.subject_name',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: 'fce068a6-1110-47d7-9f85-4677aed52d67',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'process.parent.code_signature.trusted',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '1085b328-9c7d-44a1-b0b1-637d37a48cac',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'process.parent.command_line',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: 'dae6a0cd-e07e-42da-8302-b03c626e6ca1',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'process.parent.executable',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '4acfb8c2-5e98-468f-b4b6-1be365a911e4',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'process.parent.name',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: 'b8bfba60-46f3-4997-9b8a-5914623bd9df',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'process.pe.original_file_name',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '37e14145-addc-4873-9d54-e5fda145eedf',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'process.pid',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '10691388-3b28-49b3-9f8d-fab62ecd054a',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'process.working_directory',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '46273311-2ada-46df-945b-e227d2412301',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'Ransomware.feature',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '0d2d0b0b-2aa5-4ec1-80f8-1eb178884c41',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'Ransomware.files.data',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '5fa6395f-e4db-44f4-a7a3-d41ce765b4ce',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'Ransomware.files.entropy',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '5838f1ca-e077-49a8-af9d-f315e0c11012',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'Ransomware.files.extension',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: 'cf69671a-a1e9-4824-a666-d480e74f8ada',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'Ransomware.files.metrics',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '2558d47b-a9fe-46d0-9997-6c1eb63604e4',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'Ransomware.files.operation',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: 'a9555faf-8870-4dd2-9580-f34fb8ee4e31',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'Ransomware.files.path',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '360cd306-e37c-4fec-8491-f8d4fed20d1b',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'Ransomware.files.score',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: 'ea2d8983-59ee-46a6-9959-bb2fb3f6de77',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'Ransomware.version',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: 'bfcf60dc-2aa8-4ab0-a8fe-00b03c3ad804',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'rule.name',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: 'cc26349e-d9d0-44b2-92b9-dad614ab16fa',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'rule.reference',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '867fe8ec-5e9c-4956-b183-86034b7381ee',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'source.ip',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: 'd6a3024d-aa82-4202-a783-0edab7cec7cf',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'threat.framework',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: 'e5cdbc2a-0c7d-401b-ade1-ac5469f7c3b1',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'threat.tactic.id',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '1252bbb4-3cc3-4e44-944b-750ad32e2425',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'threat.tactic.name',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '28111355-baca-4bb2-a75a-c3f67c211a24',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'threat.tactic.reference',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: 'e16b78b8-87e3-488a-b4df-881f799003b2',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'threat.technique.id',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: 'fb444fcb-453d-42a0-a3d7-185e9f5e0b97',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'threat.technique.name',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '6d972ebc-015a-43a0-bab0-ca35d8780a88',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'threat.technique.reference',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: 'a609aa63-bbb5-4ef8-ae4a-61c6eb958663',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'threat.technique.subtechnique.id',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: 'edf1957a-675a-4c47-8237-d6f460683858',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'threat.technique.subtechnique.name',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: 'a729bd68-f9a2-409a-88d9-e9b704ab5c1f',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'threat.technique.subtechnique.reference',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: 'cfb37a11-0d68-49ec-95b0-d095a97703fe',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'user.asset.criticality',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '3147ffe8-a7ae-480e-b8b2-ad6e4dd4c949',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'user.domain',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '72b2e896-61b9-46c7-b1bc-66eec416a6e0',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'user.name',
+    allowed: true,
+    anonymized: true,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '35f6df7f-b6f0-4971-a0c2-110411dbb9db',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'user.risk.calculated_level',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+  {
+    id: '3db78c6d-4d42-4aa1-bc61-44dea34a1615',
+    timestamp: '2024-05-06T22:16:48.489Z',
+    field: 'user.risk.calculated_score_norm',
+    allowed: true,
+    anonymized: false,
+    createdAt: '2024-05-06T22:16:48.489Z',
+    namespace: 'default',
+  },
+];
diff --git a/x-pack/plugins/security_solution/server/assistant/tools/mock/mock_attack_discovery_chain_result.ts b/x-pack/plugins/security_solution/server/assistant/tools/mock/mock_attack_discovery_chain_result.ts
new file mode 100644
index 00000000000000..7a859a093f4325
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/assistant/tools/mock/mock_attack_discovery_chain_result.ts
@@ -0,0 +1,64 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export const mockAttackDiscoveryChainResult = {
+  records: [
+    {
+      alertIds: [
+        'b6e883c29b32571aaa667fa13e65bbb4f95172a2b84bdfb85d6f16c72b2d2560',
+        '0215a6c5cc9499dd0290cd69a4947efb87d3ddd8b6385a766d122c2475be7367',
+        '600eb9eca925f4c5b544b4e9d3cf95d83b7829f8f74c5bd746369cb4c2968b9a',
+        'e1f4a4ed70190eb4bd256c813029a6a9101575887cdbfa226ac330fbd3063f0c',
+        '2a7a4809ca625dfe22ccd35fbef7a7ba8ed07f109e5cbd17250755cfb0bc615f',
+      ],
+      detailsMarkdown:
+        '- Malicious Go application named "My Go Application.app" is being executed from temporary directories, likely indicating malware delivery\n- The malicious application is spawning child processes like `osascript` to display fake system dialogs and attempt to phish user credentials ({{ host.name 6c57a4f7-b30b-465d-a670-47377655b1bb }}, {{ user.name 639fab6d-369b-4879-beae-7767a7145c7f }})\n- The malicious application is also executing `chmod` to make the file `unix1` executable ({{ file.path /Users/james/unix1 }})\n- `unix1` is a potentially malicious executable that is being run with suspicious arguments related to the macOS keychain ({{ process.command_line /Users/james/unix1 /Users/james/library/Keychains/login.keychain-db TempTemp1234!! }})\n- Multiple detections indicate the presence of malware on the host attempting credential access and execution of malicious payloads',
+      entitySummaryMarkdown:
+        'Malicious activity detected on {{ host.name 6c57a4f7-b30b-465d-a670-47377655b1bb }} involving user {{ user.name 639fab6d-369b-4879-beae-7767a7145c7f }}.',
+      mitreAttackTactics: ['Credential Access', 'Execution'],
+      summaryMarkdown:
+        'Multiple detections indicate the presence of malware on a macOS host {{ host.name 6c57a4f7-b30b-465d-a670-47377655b1bb }} attempting credential theft and execution of malicious payloads targeting the user {{ user.name 639fab6d-369b-4879-beae-7767a7145c7f }}.',
+      title: 'Malware Delivering Malicious Payloads on macOS',
+    },
+    {
+      alertIds: [
+        'f465ca9fbfc8bc3b1871e965c9e111cac76ff3f4076fed6bc9da88d49fb43014',
+        'ce110da958fe0cf0c07599a21c68d90a64c93b7607aa27970a614c7f49598316',
+        'dd9e4ea23961ccfdb7a9c760ee6bedd19a013beac3b0d38227e7ae77ba4ce515',
+        'f30d55e503b1d848b34ee57741b203d8052360dd873ea34802f3fa7a9ef34d0a',
+        '6f8cd5e8021dbb64598f2b7ec56bee21fd00d1e62d4e08905f86bf234873ee66',
+        'aa283e6a13be77b533eceffb09e48254c8f91feeccc39f7eed80fd3881d053f4',
+        '7b4f49f21cf141e67856d3207fb4ea069c8035b41f0ea501970694cf8bd43cbe',
+        'ea81d79104cbd442236b5bcdb7a3331de897aa4ce1523e622068038d048d0a9e',
+        '0866787b0027b4d908767ac16e35a1da00970c83632ba85be65f2ad371132b4f',
+        'b0fdf96721e361e1137d49a67e26d92f96b146392d7f44322bddc3d660abaef1',
+      ],
+      detailsMarkdown:
+        '- A malicious executable named `d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e.exe` is being executed from `C:\\Users\\Administrator\\Desktop\\8813719803\\` ({{ file.path C:\\Users\\Administrator\\Desktop\\8813719803\\d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e.exe }})\n- The malicious executable is injecting shellcode into the legitimate Windows process `MsMpEng.exe` ({{ process.name MsMpEng.exe }})\n- Signatures indicate the shellcode is related to ransomware\n- The malicious executable is also loading and manipulating the Windows library `mpsvc.dll` ({{ file.path C:\\Windows\\mpsvc.dll }})\n- Ransomware artifacts like text files with the extension `.txt` are being created, indicating potential ransomware execution ({{ Ransomware.files.path c:\\hd3vuk19y-readme.txt }})\n- The activity is occurring for the user `f02a851c-9e18-4501-97d3-61d1b0c4c55b` on the host `61af21b2-33ff-4a78-81a1-40fb979da0bb`',
+      entitySummaryMarkdown:
+        'Ransomware activity detected on {{ host.name 61af21b2-33ff-4a78-81a1-40fb979da0bb }} involving user {{ user.name f02a851c-9e18-4501-97d3-61d1b0c4c55b }}.',
+      mitreAttackTactics: ['Execution', 'Defense Evasion'],
+      summaryMarkdown:
+        'Ransomware has been detected executing on the Windows host {{ host.name 61af21b2-33ff-4a78-81a1-40fb979da0bb }} and impacting the user {{ user.name f02a851c-9e18-4501-97d3-61d1b0c4c55b }}. The malware is injecting shellcode, loading malicious libraries, and creating ransomware artifacts.',
+      title: 'Ransomware Executing on Windows Host',
+    },
+    {
+      alertIds: [
+        'cdf3b5510bb5ed622e8cefd1ce6bedc52bdd99a4c1ead537af0603469e713c8b',
+        '6abe81eb6350fb08031761be029e7ab19f7e577a7c17a9c5ea1ed010ba1620e3',
+      ],
+      detailsMarkdown:
+        '- A malicious DLL named `cdnver.dll` is being loaded by the Windows process `rundll32.exe` with suspicious arguments ({{ process.command_line "C:\\Windows\\System32\\rundll32.exe" "C:\\Users\\Administrator\\AppData\\Local\\cdnver.dll",#1 }})\n- The malicious DLL is likely being used for execution of malicious code on the host `feb0c555-7572-4427-9475-2052d15373f9`\n- The activity is occurring for the user `f02a851c-9e18-4501-97d3-61d1b0c4c55b`',
+      entitySummaryMarkdown:
+        'Malicious DLL execution detected on {{ host.name feb0c555-7572-4427-9475-2052d15373f9 }} involving user {{ user.name f02a851c-9e18-4501-97d3-61d1b0c4c55b }}.',
+      mitreAttackTactics: ['Defense Evasion', 'Execution'],
+      summaryMarkdown:
+        'A malicious DLL named `cdnver.dll` is being loaded by `rundll32.exe` on the Windows host {{ host.name feb0c555-7572-4427-9475-2052d15373f9 }} likely for execution of malicious code. The activity involves the user {{ user.name f02a851c-9e18-4501-97d3-61d1b0c4c55b }}.',
+      title: 'Malicious DLL Loaded via Rundll32 on Windows',
+    },
+  ],
+};
diff --git a/x-pack/plugins/security_solution/server/assistant/tools/mock/mock_empty_open_and_acknowledged_alerts_qery_results.ts b/x-pack/plugins/security_solution/server/assistant/tools/mock/mock_empty_open_and_acknowledged_alerts_qery_results.ts
new file mode 100644
index 00000000000000..ed5549acc586a2
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/assistant/tools/mock/mock_empty_open_and_acknowledged_alerts_qery_results.ts
@@ -0,0 +1,25 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export const mockEmptyOpenAndAcknowledgedAlertsQueryResults = {
+  took: 0,
+  timed_out: false,
+  _shards: {
+    total: 1,
+    successful: 1,
+    skipped: 0,
+    failed: 0,
+  },
+  hits: {
+    total: {
+      value: 0,
+      relation: 'eq',
+    },
+    max_score: null,
+    hits: [],
+  },
+};
diff --git a/x-pack/plugins/security_solution/server/assistant/tools/mock/mock_open_and_acknowledged_alerts_query_results.ts b/x-pack/plugins/security_solution/server/assistant/tools/mock/mock_open_and_acknowledged_alerts_query_results.ts
new file mode 100644
index 00000000000000..3f22f787f54f8e
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/assistant/tools/mock/mock_open_and_acknowledged_alerts_query_results.ts
@@ -0,0 +1,1396 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export const mockOpenAndAcknowledgedAlertsQueryResults = {
+  took: 13,
+  timed_out: false,
+  _shards: {
+    total: 1,
+    successful: 1,
+    skipped: 0,
+    failed: 0,
+  },
+  hits: {
+    total: {
+      value: 31,
+      relation: 'eq',
+    },
+    max_score: null,
+    hits: [
+      {
+        _index: '.internal.alerts-security.alerts-default-000001',
+        _id: 'b6e883c29b32571aaa667fa13e65bbb4f95172a2b84bdfb85d6f16c72b2d2560',
+        _score: null,
+        fields: {
+          'kibana.alert.severity': ['critical'],
+          'file.path': ['/Users/james/unix1'],
+          'process.hash.md5': ['85caafe3d324e3287b85348fa2fae492'],
+          'event.category': ['malware', 'intrusion_detection', 'process'],
+          'host.risk.calculated_score_norm': [73.02488],
+          'process.parent.command_line': [
+            '/Users/james/unix1 /Users/james/library/Keychains/login.keychain-db TempTemp1234!!',
+          ],
+          'process.parent.name': ['unix1'],
+          'user.name': ['james'],
+          'user.risk.calculated_level': ['Moderate'],
+          'kibana.alert.rule.description': [
+            'Generates a detection alert each time an Elastic Endpoint Security alert is received. Enabling this rule allows you to immediately begin investigating your Endpoint alerts.',
+          ],
+          'process.hash.sha256': [
+            '0b18d6880dc9670ab2b955914598c96fc3d0097dc40ea61157b8c79e75edf231',
+          ],
+          'process.code_signature.signing_id': ['nans-55554944e5f232edcf023cf68e8e5dac81584f78'],
+          'process.pid': [1227],
+          'process.code_signature.exists': [true],
+          'process.parent.code_signature.exists': [true],
+          'process.parent.code_signature.status': [
+            'code failed to satisfy specified code requirement(s)',
+          ],
+          'event.module': ['endpoint'],
+          'process.code_signature.subject_name': [''],
+          'host.os.version': ['13.4'],
+          'file.hash.sha256': ['0b18d6880dc9670ab2b955914598c96fc3d0097dc40ea61157b8c79e75edf231'],
+          'kibana.alert.risk_score': [99],
+          'user.risk.calculated_score_norm': [66.72442],
+          'host.os.name': ['macOS'],
+          'kibana.alert.rule.name': ['Malware Detection Alert'],
+          'host.name': ['SRVMAC08'],
+          'process.executable': ['/Users/james/unix1'],
+          'event.outcome': ['success'],
+          'process.code_signature.trusted': [false],
+          'process.parent.code_signature.subject_name': [''],
+          'process.parent.executable': ['/Users/james/unix1'],
+          'kibana.alert.workflow_status': ['open'],
+          'file.name': ['unix1'],
+          'process.args': [
+            '/Users/james/unix1',
+            '/Users/james/library/Keychains/login.keychain-db',
+            'TempTemp1234!!',
+          ],
+          'process.code_signature.status': ['code failed to satisfy specified code requirement(s)'],
+          message: ['Malware Detection Alert'],
+          'process.parent.args_count': [3],
+          'process.name': ['unix1'],
+          'process.parent.args': [
+            '/Users/james/unix1',
+            '/Users/james/library/Keychains/login.keychain-db',
+            'TempTemp1234!!',
+          ],
+          '@timestamp': ['2024-05-07T12:48:45.032Z'],
+          'process.parent.code_signature.trusted': [false],
+          'process.command_line': [
+            '/Users/james/unix1 /Users/james/library/Keychains/login.keychain-db TempTemp1234!!',
+          ],
+          'host.risk.calculated_level': ['High'],
+          _id: ['b6e883c29b32571aaa667fa13e65bbb4f95172a2b84bdfb85d6f16c72b2d2560'],
+          'process.hash.sha1': ['4ca549355736e4af6434efc4ec9a044ceb2ae3c3'],
+          'event.dataset': ['endpoint.alerts'],
+          'kibana.alert.original_time': ['2023-06-19T00:28:39.368Z'],
+        },
+        sort: [99, 1715086125032],
+      },
+      {
+        _index: '.internal.alerts-security.alerts-default-000001',
+        _id: '0215a6c5cc9499dd0290cd69a4947efb87d3ddd8b6385a766d122c2475be7367',
+        _score: null,
+        fields: {
+          'kibana.alert.severity': ['critical'],
+          'file.path': ['/Users/james/unix1'],
+          'process.hash.md5': ['e62bdd3eaf2be436fca2e67b7eede603'],
+          'event.category': ['malware', 'intrusion_detection', 'file'],
+          'host.risk.calculated_score_norm': [73.02488],
+          'process.parent.command_line': [
+            '/private/var/folders/_b/rmcpc65j6nv11ygrs50ctcjr0000gn/T/AppTranslocation/6D63F08A-011C-4511-8556-EAEF9AFD6340/d/Setup.app/Contents/MacOS/My Go Application.app',
+          ],
+          'process.parent.name': ['My Go Application.app'],
+          'user.name': ['james'],
+          'user.risk.calculated_level': ['Moderate'],
+          'kibana.alert.rule.description': [
+            'Generates a detection alert each time an Elastic Endpoint Security alert is received. Enabling this rule allows you to immediately begin investigating your Endpoint alerts.',
+          ],
+          'process.hash.sha256': [
+            '2c63ba2b1a5131b80e567b7a1a93997a2de07ea20d0a8f5149701c67b832c097',
+          ],
+          'process.code_signature.signing_id': ['a.out'],
+          'process.pid': [1220],
+          'process.code_signature.exists': [true],
+          'process.parent.code_signature.exists': [true],
+          'process.parent.code_signature.status': [
+            'code failed to satisfy specified code requirement(s)',
+          ],
+          'event.module': ['endpoint'],
+          'process.code_signature.subject_name': [''],
+          'host.os.version': ['13.4'],
+          'file.hash.sha256': ['0b18d6880dc9670ab2b955914598c96fc3d0097dc40ea61157b8c79e75edf231'],
+          'kibana.alert.risk_score': [99],
+          'user.risk.calculated_score_norm': [66.72442],
+          'host.os.name': ['macOS'],
+          'kibana.alert.rule.name': ['Malware Detection Alert'],
+          'host.name': ['SRVMAC08'],
+          'process.executable': [
+            '/private/var/folders/_b/rmcpc65j6nv11ygrs50ctcjr0000gn/T/AppTranslocation/6D63F08A-011C-4511-8556-EAEF9AFD6340/d/Setup.app/Contents/MacOS/My Go Application.app',
+          ],
+          'event.outcome': ['success'],
+          'process.code_signature.trusted': [false],
+          'process.parent.code_signature.subject_name': [''],
+          'process.parent.executable': [
+            '/private/var/folders/_b/rmcpc65j6nv11ygrs50ctcjr0000gn/T/AppTranslocation/6D63F08A-011C-4511-8556-EAEF9AFD6340/d/Setup.app/Contents/MacOS/My Go Application.app',
+          ],
+          'kibana.alert.workflow_status': ['open'],
+          'file.name': ['unix1'],
+          'process.args': [
+            '/private/var/folders/_b/rmcpc65j6nv11ygrs50ctcjr0000gn/T/AppTranslocation/6D63F08A-011C-4511-8556-EAEF9AFD6340/d/Setup.app/Contents/MacOS/My Go Application.app',
+          ],
+          'process.code_signature.status': ['code failed to satisfy specified code requirement(s)'],
+          message: ['Malware Detection Alert'],
+          'process.parent.args_count': [1],
+          'process.name': ['My Go Application.app'],
+          'process.parent.args': [
+            '/private/var/folders/_b/rmcpc65j6nv11ygrs50ctcjr0000gn/T/AppTranslocation/6D63F08A-011C-4511-8556-EAEF9AFD6340/d/Setup.app/Contents/MacOS/My Go Application.app',
+          ],
+          '@timestamp': ['2024-05-07T12:48:45.030Z'],
+          'process.parent.code_signature.trusted': [false],
+          'process.command_line': [
+            '/private/var/folders/_b/rmcpc65j6nv11ygrs50ctcjr0000gn/T/AppTranslocation/6D63F08A-011C-4511-8556-EAEF9AFD6340/d/Setup.app/Contents/MacOS/My Go Application.app',
+          ],
+          'host.risk.calculated_level': ['High'],
+          _id: ['0215a6c5cc9499dd0290cd69a4947efb87d3ddd8b6385a766d122c2475be7367'],
+          'process.hash.sha1': ['58a3bddbc7c45193ecbefa22ad0496b60a29dff2'],
+          'event.dataset': ['endpoint.alerts'],
+          'kibana.alert.original_time': ['2023-06-19T00:28:38.061Z'],
+        },
+        sort: [99, 1715086125030],
+      },
+      {
+        _index: '.internal.alerts-security.alerts-default-000001',
+        _id: '600eb9eca925f4c5b544b4e9d3cf95d83b7829f8f74c5bd746369cb4c2968b9a',
+        _score: null,
+        fields: {
+          'kibana.alert.severity': ['critical'],
+          'file.path': ['/Users/james/unix1'],
+          'process.hash.md5': ['85caafe3d324e3287b85348fa2fae492'],
+          'event.category': ['malware', 'intrusion_detection', 'process'],
+          'host.risk.calculated_score_norm': [73.02488],
+          'process.parent.command_line': [
+            '/private/var/folders/_b/rmcpc65j6nv11ygrs50ctcjr0000gn/T/AppTranslocation/6D63F08A-011C-4511-8556-EAEF9AFD6340/d/Setup.app/Contents/MacOS/My Go Application.app',
+          ],
+          'process.parent.name': ['My Go Application.app'],
+          'user.name': ['james'],
+          'user.risk.calculated_level': ['Moderate'],
+          'kibana.alert.rule.description': [
+            'Generates a detection alert each time an Elastic Endpoint Security alert is received. Enabling this rule allows you to immediately begin investigating your Endpoint alerts.',
+          ],
+          'process.hash.sha256': [
+            '0b18d6880dc9670ab2b955914598c96fc3d0097dc40ea61157b8c79e75edf231',
+          ],
+          'process.code_signature.signing_id': ['nans-55554944e5f232edcf023cf68e8e5dac81584f78'],
+          'process.pid': [1220],
+          'process.code_signature.exists': [true],
+          'process.parent.code_signature.exists': [true],
+          'process.parent.code_signature.status': [
+            'code failed to satisfy specified code requirement(s)',
+          ],
+          'event.module': ['endpoint'],
+          'process.code_signature.subject_name': [''],
+          'host.os.version': ['13.4'],
+          'file.hash.sha256': ['0b18d6880dc9670ab2b955914598c96fc3d0097dc40ea61157b8c79e75edf231'],
+          'kibana.alert.risk_score': [99],
+          'user.risk.calculated_score_norm': [66.72442],
+          'host.os.name': ['macOS'],
+          'kibana.alert.rule.name': ['Malware Detection Alert'],
+          'host.name': ['SRVMAC08'],
+          'process.executable': ['/Users/james/unix1'],
+          'event.outcome': ['success'],
+          'process.code_signature.trusted': [false],
+          'process.parent.code_signature.subject_name': [''],
+          'process.parent.executable': [
+            '/private/var/folders/_b/rmcpc65j6nv11ygrs50ctcjr0000gn/T/AppTranslocation/6D63F08A-011C-4511-8556-EAEF9AFD6340/d/Setup.app/Contents/MacOS/My Go Application.app',
+          ],
+          'kibana.alert.workflow_status': ['open'],
+          'file.name': ['unix1'],
+          'process.args': [
+            '/private/var/folders/_b/rmcpc65j6nv11ygrs50ctcjr0000gn/T/AppTranslocation/6D63F08A-011C-4511-8556-EAEF9AFD6340/d/Setup.app/Contents/MacOS/My Go Application.app',
+          ],
+          'process.code_signature.status': ['code failed to satisfy specified code requirement(s)'],
+          message: ['Malware Detection Alert'],
+          'process.parent.args_count': [1],
+          'process.name': ['unix1'],
+          'process.parent.args': [
+            '/private/var/folders/_b/rmcpc65j6nv11ygrs50ctcjr0000gn/T/AppTranslocation/6D63F08A-011C-4511-8556-EAEF9AFD6340/d/Setup.app/Contents/MacOS/My Go Application.app',
+          ],
+          '@timestamp': ['2024-05-07T12:48:45.029Z'],
+          'process.parent.code_signature.trusted': [false],
+          'process.command_line': [
+            '/private/var/folders/_b/rmcpc65j6nv11ygrs50ctcjr0000gn/T/AppTranslocation/6D63F08A-011C-4511-8556-EAEF9AFD6340/d/Setup.app/Contents/MacOS/My Go Application.app',
+          ],
+          'host.risk.calculated_level': ['High'],
+          _id: ['600eb9eca925f4c5b544b4e9d3cf95d83b7829f8f74c5bd746369cb4c2968b9a'],
+          'process.hash.sha1': ['4ca549355736e4af6434efc4ec9a044ceb2ae3c3'],
+          'event.dataset': ['endpoint.alerts'],
+          'kibana.alert.original_time': ['2023-06-19T00:28:37.881Z'],
+        },
+        sort: [99, 1715086125029],
+      },
+      {
+        _index: '.internal.alerts-security.alerts-default-000001',
+        _id: 'e1f4a4ed70190eb4bd256c813029a6a9101575887cdbfa226ac330fbd3063f0c',
+        _score: null,
+        fields: {
+          'kibana.alert.severity': ['critical'],
+          'file.path': ['/Users/james/unix1'],
+          'process.hash.md5': ['3f19892ab44eb9bc7bc03f438944301e'],
+          'event.category': ['malware', 'intrusion_detection', 'file'],
+          'host.risk.calculated_score_norm': [73.02488],
+          'process.parent.command_line': [
+            '/private/var/folders/_b/rmcpc65j6nv11ygrs50ctcjr0000gn/T/AppTranslocation/6D63F08A-011C-4511-8556-EAEF9AFD6340/d/Setup.app/Contents/MacOS/My Go Application.app',
+          ],
+          'process.parent.name': ['My Go Application.app'],
+          'user.name': ['james'],
+          'user.risk.calculated_level': ['Moderate'],
+          'kibana.alert.rule.description': [
+            'Generates a detection alert each time an Elastic Endpoint Security alert is received. Enabling this rule allows you to immediately begin investigating your Endpoint alerts.',
+          ],
+          'process.hash.sha256': [
+            'f80234ff6fed2c62d23f37443f2412fbe806711b6add2ac126e03e282082c8f5',
+          ],
+          'process.code_signature.signing_id': ['com.apple.chmod'],
+          'process.pid': [1219],
+          'process.code_signature.exists': [true],
+          'process.parent.code_signature.exists': [true],
+          'process.parent.code_signature.status': [
+            'code failed to satisfy specified code requirement(s)',
+          ],
+          'event.module': ['endpoint'],
+          'process.code_signature.subject_name': ['Software Signing'],
+          'host.os.version': ['13.4'],
+          'file.hash.sha256': ['0b18d6880dc9670ab2b955914598c96fc3d0097dc40ea61157b8c79e75edf231'],
+          'kibana.alert.risk_score': [99],
+          'user.risk.calculated_score_norm': [66.72442],
+          'host.os.name': ['macOS'],
+          'kibana.alert.rule.name': ['Malware Detection Alert'],
+          'host.name': ['SRVMAC08'],
+          'process.executable': ['/bin/chmod'],
+          'event.outcome': ['success'],
+          'process.code_signature.trusted': [true],
+          'process.parent.code_signature.subject_name': [''],
+          'process.parent.executable': [
+            '/private/var/folders/_b/rmcpc65j6nv11ygrs50ctcjr0000gn/T/AppTranslocation/6D63F08A-011C-4511-8556-EAEF9AFD6340/d/Setup.app/Contents/MacOS/My Go Application.app',
+          ],
+          'kibana.alert.workflow_status': ['open'],
+          'file.name': ['unix1'],
+          'process.args': ['chmod', '777', '/Users/james/unix1'],
+          'process.code_signature.status': ['No error.'],
+          message: ['Malware Detection Alert'],
+          'process.parent.args_count': [1],
+          'process.name': ['chmod'],
+          'process.parent.args': [
+            '/private/var/folders/_b/rmcpc65j6nv11ygrs50ctcjr0000gn/T/AppTranslocation/6D63F08A-011C-4511-8556-EAEF9AFD6340/d/Setup.app/Contents/MacOS/My Go Application.app',
+          ],
+          '@timestamp': ['2024-05-07T12:48:45.028Z'],
+          'process.parent.code_signature.trusted': [false],
+          'process.command_line': ['chmod 777 /Users/james/unix1'],
+          'host.risk.calculated_level': ['High'],
+          _id: ['e1f4a4ed70190eb4bd256c813029a6a9101575887cdbfa226ac330fbd3063f0c'],
+          'process.hash.sha1': ['217490d4f51717aa3b301abec96be08602370d2d'],
+          'event.dataset': ['endpoint.alerts'],
+          'kibana.alert.original_time': ['2023-06-19T00:28:37.869Z'],
+        },
+        sort: [99, 1715086125028],
+      },
+      {
+        _index: '.internal.alerts-security.alerts-default-000001',
+        _id: '2a7a4809ca625dfe22ccd35fbef7a7ba8ed07f109e5cbd17250755cfb0bc615f',
+        _score: null,
+        fields: {
+          'kibana.alert.severity': ['critical'],
+          'process.hash.md5': ['643dddff1a57cbf70594854b44eb1a1d'],
+          'event.category': ['malware', 'intrusion_detection'],
+          'host.risk.calculated_score_norm': [73.02488],
+          'rule.reference': [
+            'https://github.com/EmpireProject/EmPyre/blob/master/lib/modules/collection/osx/prompt.py',
+            'https://ss64.com/osx/osascript.html',
+          ],
+          'process.parent.name': ['My Go Application.app'],
+          'user.risk.calculated_level': ['Moderate'],
+          'kibana.alert.rule.description': [
+            'Generates a detection alert each time an Elastic Endpoint Security alert is received. Enabling this rule allows you to immediately begin investigating your Endpoint alerts.',
+          ],
+          'process.hash.sha256': [
+            'bab17feba710b469e5d96820f0cb7ed511d983e5817f374ec3cb46462ac5b794',
+          ],
+          'process.pid': [1206],
+          'process.code_signature.exists': [true],
+          'process.code_signature.subject_name': ['Software Signing'],
+          'host.os.version': ['13.4'],
+          'kibana.alert.risk_score': [99],
+          'user.risk.calculated_score_norm': [66.72442],
+          'host.os.name': ['macOS'],
+          'kibana.alert.rule.name': [
+            'Malicious Behavior Detection Alert: Potential Credentials Phishing via OSASCRIPT',
+          ],
+          'host.name': ['SRVMAC08'],
+          'event.outcome': ['success'],
+          'process.code_signature.trusted': [true],
+          'group.name': ['staff'],
+          'kibana.alert.workflow_status': ['open'],
+          'rule.name': ['Potential Credentials Phishing via OSASCRIPT'],
+          'threat.tactic.id': ['TA0006'],
+          'threat.tactic.name': ['Credential Access'],
+          'threat.technique.id': ['T1056'],
+          'process.parent.args_count': [0],
+          'threat.technique.subtechnique.reference': [
+            'https://attack.mitre.org/techniques/T1056/002/',
+          ],
+          'process.name': ['osascript'],
+          'threat.technique.subtechnique.name': ['GUI Input Capture'],
+          'process.parent.code_signature.trusted': [false],
+          _id: ['2a7a4809ca625dfe22ccd35fbef7a7ba8ed07f109e5cbd17250755cfb0bc615f'],
+          'threat.technique.name': ['Input Capture'],
+          'group.id': ['20'],
+          'threat.tactic.reference': ['https://attack.mitre.org/tactics/TA0006/'],
+          'user.name': ['james'],
+          'threat.framework': ['MITRE ATT&CK'],
+          'process.code_signature.signing_id': ['com.apple.osascript'],
+          'process.parent.code_signature.exists': [true],
+          'process.parent.code_signature.status': [
+            'code failed to satisfy specified code requirement(s)',
+          ],
+          'event.module': ['endpoint'],
+          'process.executable': ['/usr/bin/osascript'],
+          'process.parent.executable': [
+            '/private/var/folders/_b/rmcpc65j6nv11ygrs50ctcjr0000gn/T/AppTranslocation/6D63F08A-011C-4511-8556-EAEF9AFD6340/d/Setup.app/Contents/MacOS/My Go Application.app',
+          ],
+          'process.args': [
+            'osascript',
+            '-e',
+            'display dialog "MacOS wants to access System Preferences\n\t\t\nPlease enter your password." with title "System Preferences" with icon file "System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:ToolbarAdvanced.icns" default answer "" giving up after 30 with hidden answer ¬',
+          ],
+          'process.code_signature.status': ['No error.'],
+          message: [
+            'Malicious Behavior Detection Alert: Potential Credentials Phishing via OSASCRIPT',
+          ],
+          '@timestamp': ['2024-05-07T12:48:45.027Z'],
+          'threat.technique.subtechnique.id': ['T1056.002'],
+          'threat.technique.reference': ['https://attack.mitre.org/techniques/T1056/'],
+          'process.command_line': [
+            'osascript -e display dialog "MacOS wants to access System Preferences\n\t\t\nPlease enter your password." with title "System Preferences" with icon file "System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:ToolbarAdvanced.icns" default answer "" giving up after 30 with hidden answer ¬',
+          ],
+          'host.risk.calculated_level': ['High'],
+          'process.hash.sha1': ['0568baae15c752208ae56d8f9c737976d6de2e3a'],
+          'event.dataset': ['endpoint.alerts'],
+          'kibana.alert.original_time': ['2023-06-19T00:28:09.909Z'],
+        },
+        sort: [99, 1715086125027],
+      },
+      {
+        _index: '.internal.alerts-security.alerts-default-000001',
+        _id: '2a9f7602de8656d30dda0ddcf79e78037ac2929780e13d5b2047b3bedc40bb69',
+        _score: null,
+        fields: {
+          'kibana.alert.severity': ['critical'],
+          'file.path': [
+            '/private/var/folders/_b/rmcpc65j6nv11ygrs50ctcjr0000gn/T/AppTranslocation/6D63F08A-011C-4511-8556-EAEF9AFD6340/d/Setup.app/Contents/MacOS/My Go Application.app',
+          ],
+          'process.hash.md5': ['e62bdd3eaf2be436fca2e67b7eede603'],
+          'event.category': ['malware', 'intrusion_detection', 'process'],
+          'host.risk.calculated_score_norm': [73.02488],
+          'process.parent.command_line': ['/sbin/launchd'],
+          'process.parent.name': ['launchd'],
+          'user.name': ['root'],
+          'user.risk.calculated_level': ['Moderate'],
+          'kibana.alert.rule.description': [
+            'Generates a detection alert each time an Elastic Endpoint Security alert is received. Enabling this rule allows you to immediately begin investigating your Endpoint alerts.',
+          ],
+          'process.hash.sha256': [
+            '2c63ba2b1a5131b80e567b7a1a93997a2de07ea20d0a8f5149701c67b832c097',
+          ],
+          'process.code_signature.signing_id': ['a.out'],
+          'process.pid': [1200],
+          'process.code_signature.exists': [true],
+          'process.parent.code_signature.exists': [true],
+          'process.parent.code_signature.status': ['No error.'],
+          'event.module': ['endpoint'],
+          'process.code_signature.subject_name': [''],
+          'host.os.version': ['13.4'],
+          'file.hash.sha256': ['2c63ba2b1a5131b80e567b7a1a93997a2de07ea20d0a8f5149701c67b832c097'],
+          'kibana.alert.risk_score': [99],
+          'user.risk.calculated_score_norm': [66.491455],
+          'host.os.name': ['macOS'],
+          'kibana.alert.rule.name': ['Malware Detection Alert'],
+          'host.name': ['SRVMAC08'],
+          'process.executable': [
+            '/private/var/folders/_b/rmcpc65j6nv11ygrs50ctcjr0000gn/T/AppTranslocation/6D63F08A-011C-4511-8556-EAEF9AFD6340/d/Setup.app/Contents/MacOS/My Go Application.app',
+          ],
+          'event.outcome': ['success'],
+          'process.code_signature.trusted': [false],
+          'process.parent.code_signature.subject_name': ['Software Signing'],
+          'process.parent.executable': ['/sbin/launchd'],
+          'kibana.alert.workflow_status': ['open'],
+          'file.name': ['My Go Application.app'],
+          'process.args': ['xpcproxy', 'application.Appify by Machine Box.My Go Application.20.23'],
+          'process.code_signature.status': ['code failed to satisfy specified code requirement(s)'],
+          message: ['Malware Detection Alert'],
+          'process.parent.args_count': [1],
+          'process.name': ['My Go Application.app'],
+          'process.parent.args': ['/sbin/launchd'],
+          '@timestamp': ['2024-05-07T12:48:45.023Z'],
+          'process.parent.code_signature.trusted': [true],
+          'process.command_line': [
+            'xpcproxy application.Appify by Machine Box.My Go Application.20.23',
+          ],
+          'host.risk.calculated_level': ['High'],
+          _id: ['2a9f7602de8656d30dda0ddcf79e78037ac2929780e13d5b2047b3bedc40bb69'],
+          'process.hash.sha1': ['58a3bddbc7c45193ecbefa22ad0496b60a29dff2'],
+          'event.dataset': ['endpoint.alerts'],
+          'kibana.alert.original_time': ['2023-06-19T00:28:06.888Z'],
+        },
+        sort: [99, 1715086125023],
+      },
+      {
+        _index: '.internal.alerts-security.alerts-default-000001',
+        _id: '4615c3a90e8057ae5cc9b358bbbf4298e346277a2f068dda052b0b43ef6d5bbd',
+        _score: null,
+        fields: {
+          'kibana.alert.severity': ['critical'],
+          'file.path': [
+            '/private/var/folders/_b/rmcpc65j6nv11ygrs50ctcjr0000gn/T/AppTranslocation/3C4D44B9-4838-4613-BACC-BD00A9CE4025/d/Setup.app/Contents/MacOS/My Go Application.app',
+          ],
+          'process.hash.md5': ['e62bdd3eaf2be436fca2e67b7eede603'],
+          'event.category': ['malware', 'intrusion_detection', 'process'],
+          'host.risk.calculated_score_norm': [73.02488],
+          'process.parent.command_line': ['/sbin/launchd'],
+          'process.parent.name': ['launchd'],
+          'user.name': ['root'],
+          'user.risk.calculated_level': ['Moderate'],
+          'kibana.alert.rule.description': [
+            'Generates a detection alert each time an Elastic Endpoint Security alert is received. Enabling this rule allows you to immediately begin investigating your Endpoint alerts.',
+          ],
+          'process.hash.sha256': [
+            '2c63ba2b1a5131b80e567b7a1a93997a2de07ea20d0a8f5149701c67b832c097',
+          ],
+          'process.code_signature.signing_id': ['a.out'],
+          'process.pid': [1169],
+          'process.code_signature.exists': [true],
+          'process.parent.code_signature.exists': [true],
+          'process.parent.code_signature.status': ['No error.'],
+          'event.module': ['endpoint'],
+          'process.code_signature.subject_name': [''],
+          'host.os.version': ['13.4'],
+          'file.hash.sha256': ['2c63ba2b1a5131b80e567b7a1a93997a2de07ea20d0a8f5149701c67b832c097'],
+          'kibana.alert.risk_score': [99],
+          'user.risk.calculated_score_norm': [66.491455],
+          'host.os.name': ['macOS'],
+          'kibana.alert.rule.name': ['Malware Detection Alert'],
+          'host.name': ['SRVMAC08'],
+          'process.executable': [
+            '/private/var/folders/_b/rmcpc65j6nv11ygrs50ctcjr0000gn/T/AppTranslocation/3C4D44B9-4838-4613-BACC-BD00A9CE4025/d/Setup.app/Contents/MacOS/My Go Application.app',
+          ],
+          'event.outcome': ['success'],
+          'process.code_signature.trusted': [false],
+          'process.parent.code_signature.subject_name': ['Software Signing'],
+          'process.parent.executable': ['/sbin/launchd'],
+          'kibana.alert.workflow_status': ['open'],
+          'file.name': ['My Go Application.app'],
+          'process.args': ['xpcproxy', 'application.Appify by Machine Box.My Go Application.20.23'],
+          'process.code_signature.status': ['code failed to satisfy specified code requirement(s)'],
+          message: ['Malware Detection Alert'],
+          'process.parent.args_count': [1],
+          'process.name': ['My Go Application.app'],
+          'process.parent.args': ['/sbin/launchd'],
+          '@timestamp': ['2024-05-07T12:48:45.022Z'],
+          'process.parent.code_signature.trusted': [true],
+          'process.command_line': [
+            'xpcproxy application.Appify by Machine Box.My Go Application.20.23',
+          ],
+          'host.risk.calculated_level': ['High'],
+          _id: ['4615c3a90e8057ae5cc9b358bbbf4298e346277a2f068dda052b0b43ef6d5bbd'],
+          'process.hash.sha1': ['58a3bddbc7c45193ecbefa22ad0496b60a29dff2'],
+          'event.dataset': ['endpoint.alerts'],
+          'kibana.alert.original_time': ['2023-06-19T00:27:47.362Z'],
+        },
+        sort: [99, 1715086125022],
+      },
+      {
+        _index: '.internal.alerts-security.alerts-default-000001',
+        _id: '449322a72d3f19efbdf983935a1bdd21ebd6b9c761ce31e8b252003017d7e5db',
+        _score: null,
+        fields: {
+          'kibana.alert.severity': ['critical'],
+          'file.path': [
+            '/private/var/folders/_b/rmcpc65j6nv11ygrs50ctcjr0000gn/T/AppTranslocation/37D933EC-334D-410A-A741-0F730D6AE3FD/d/Setup.app/Contents/MacOS/My Go Application.app',
+          ],
+          'process.hash.md5': ['e62bdd3eaf2be436fca2e67b7eede603'],
+          'event.category': ['malware', 'intrusion_detection', 'process'],
+          'host.risk.calculated_score_norm': [73.02488],
+          'process.parent.command_line': ['/sbin/launchd'],
+          'process.parent.name': ['launchd'],
+          'user.name': ['root'],
+          'user.risk.calculated_level': ['Moderate'],
+          'kibana.alert.rule.description': [
+            'Generates a detection alert each time an Elastic Endpoint Security alert is received. Enabling this rule allows you to immediately begin investigating your Endpoint alerts.',
+          ],
+          'process.hash.sha256': [
+            '2c63ba2b1a5131b80e567b7a1a93997a2de07ea20d0a8f5149701c67b832c097',
+          ],
+          'process.code_signature.signing_id': ['a.out'],
+          'process.pid': [1123],
+          'process.code_signature.exists': [true],
+          'process.parent.code_signature.exists': [true],
+          'process.parent.code_signature.status': ['No error.'],
+          'event.module': ['endpoint'],
+          'process.code_signature.subject_name': [''],
+          'host.os.version': ['13.4'],
+          'file.hash.sha256': ['2c63ba2b1a5131b80e567b7a1a93997a2de07ea20d0a8f5149701c67b832c097'],
+          'kibana.alert.risk_score': [99],
+          'user.risk.calculated_score_norm': [66.491455],
+          'host.os.name': ['macOS'],
+          'kibana.alert.rule.name': ['Malware Detection Alert'],
+          'host.name': ['SRVMAC08'],
+          'process.executable': [
+            '/private/var/folders/_b/rmcpc65j6nv11ygrs50ctcjr0000gn/T/AppTranslocation/37D933EC-334D-410A-A741-0F730D6AE3FD/d/Setup.app/Contents/MacOS/My Go Application.app',
+          ],
+          'event.outcome': ['success'],
+          'process.code_signature.trusted': [false],
+          'process.parent.code_signature.subject_name': ['Software Signing'],
+          'process.parent.executable': ['/sbin/launchd'],
+          'kibana.alert.workflow_status': ['open'],
+          'file.name': ['My Go Application.app'],
+          'process.args': ['xpcproxy', 'application.Appify by Machine Box.My Go Application.20.23'],
+          'process.code_signature.status': ['code failed to satisfy specified code requirement(s)'],
+          message: ['Malware Detection Alert'],
+          'process.parent.args_count': [1],
+          'process.name': ['My Go Application.app'],
+          'process.parent.args': ['/sbin/launchd'],
+          '@timestamp': ['2024-05-07T12:48:45.020Z'],
+          'process.parent.code_signature.trusted': [true],
+          'process.command_line': [
+            'xpcproxy application.Appify by Machine Box.My Go Application.20.23',
+          ],
+          'host.risk.calculated_level': ['High'],
+          _id: ['449322a72d3f19efbdf983935a1bdd21ebd6b9c761ce31e8b252003017d7e5db'],
+          'process.hash.sha1': ['58a3bddbc7c45193ecbefa22ad0496b60a29dff2'],
+          'event.dataset': ['endpoint.alerts'],
+          'kibana.alert.original_time': ['2023-06-19T00:25:24.716Z'],
+        },
+        sort: [99, 1715086125020],
+      },
+      {
+        _index: '.internal.alerts-security.alerts-default-000001',
+        _id: 'f465ca9fbfc8bc3b1871e965c9e111cac76ff3f4076fed6bc9da88d49fb43014',
+        _score: null,
+        fields: {
+          'kibana.alert.severity': ['critical'],
+          'process.hash.md5': ['8cc83221870dd07144e63df594c391d9'],
+          'event.category': ['malware', 'intrusion_detection'],
+          'host.risk.calculated_score_norm': [75.62723],
+          'process.parent.command_line': [
+            '"C:\\Users\\Administrator\\Desktop\\8813719803\\d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e.exe" ',
+          ],
+          'process.parent.name': [
+            'd55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e.exe',
+          ],
+          'user.name': ['Administrator'],
+          'user.risk.calculated_level': ['High'],
+          'kibana.alert.rule.description': [
+            'Generates a detection alert each time an Elastic Endpoint Security alert is received. Enabling this rule allows you to immediately begin investigating your Endpoint alerts.',
+          ],
+          'process.hash.sha256': [
+            '33bc14d231a4afaa18f06513766d5f69d8b88f1e697cd127d24fb4b72ad44c7a',
+          ],
+          'process.pid': [8708],
+          'process.code_signature.exists': [true],
+          'process.parent.code_signature.exists': [true],
+          'process.parent.code_signature.status': ['errorExpired'],
+          'process.pe.original_file_name': ['MsMpEng.exe'],
+          'event.module': ['endpoint'],
+          'process.code_signature.subject_name': ['Microsoft Corporation'],
+          'host.os.version': ['21H2 (10.0.20348.1366)'],
+          'kibana.alert.risk_score': [99],
+          'user.risk.calculated_score_norm': [82.16188],
+          'host.os.name': ['Windows'],
+          'kibana.alert.rule.name': ['Memory Threat Detection Alert: Shellcode Injection'],
+          'host.name': ['SRVWIN02'],
+          'user.domain': ['OMM-WIN-DETECT'],
+          'process.executable': ['C:\\Windows\\MsMpEng.exe'],
+          'process.code_signature.trusted': [true],
+          'process.Ext.token.integrity_level_name': ['high'],
+          'process.parent.code_signature.subject_name': ['PB03 TRANSPORT LTD.'],
+          'process.parent.executable': [
+            'C:\\Users\\Administrator\\Desktop\\8813719803\\d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e.exe',
+          ],
+          'kibana.alert.workflow_status': ['open'],
+          'process.args': ['C:\\Windows\\MsMpEng.exe'],
+          'process.code_signature.status': ['trusted'],
+          message: ['Memory Threat Detection Alert: Shellcode Injection'],
+          'process.parent.args_count': [1],
+          'process.name': ['MsMpEng.exe'],
+          'process.parent.args': [
+            'C:\\Users\\Administrator\\Desktop\\8813719803\\d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e.exe',
+          ],
+          '@timestamp': ['2024-05-07T12:48:45.017Z'],
+          'process.parent.code_signature.trusted': [false],
+          'process.command_line': ['"C:\\Windows\\MsMpEng.exe"'],
+          'host.risk.calculated_level': ['High'],
+          _id: ['f465ca9fbfc8bc3b1871e965c9e111cac76ff3f4076fed6bc9da88d49fb43014'],
+          'process.hash.sha1': ['3d409b39b8502fcd23335a878f2cbdaf6d721995'],
+          'event.dataset': ['endpoint.alerts'],
+          'kibana.alert.original_time': ['2023-01-20T23:38:22.051Z'],
+        },
+        sort: [99, 1715086125017],
+      },
+      {
+        _index: '.internal.alerts-security.alerts-default-000001',
+        _id: 'aa283e6a13be77b533eceffb09e48254c8f91feeccc39f7eed80fd3881d053f4',
+        _score: null,
+        fields: {
+          'kibana.alert.severity': ['critical'],
+          'file.path': ['C:\\Windows\\mpsvc.dll'],
+          'process.hash.md5': ['8cc83221870dd07144e63df594c391d9'],
+          'event.category': ['malware', 'intrusion_detection', 'library'],
+          'host.risk.calculated_score_norm': [75.62723],
+          'process.parent.command_line': [
+            '"C:\\Users\\Administrator\\Desktop\\8813719803\\d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e.exe" ',
+          ],
+          'process.parent.name': [
+            'd55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e.exe',
+          ],
+          'user.name': ['Administrator'],
+          'user.risk.calculated_level': ['High'],
+          'kibana.alert.rule.description': [
+            'Generates a detection alert each time an Elastic Endpoint Security alert is received. Enabling this rule allows you to immediately begin investigating your Endpoint alerts.',
+          ],
+          'process.hash.sha256': [
+            '33bc14d231a4afaa18f06513766d5f69d8b88f1e697cd127d24fb4b72ad44c7a',
+          ],
+          'process.pid': [8708],
+          'process.code_signature.exists': [true],
+          'process.parent.code_signature.exists': [true],
+          'process.parent.code_signature.status': ['errorExpired'],
+          'process.pe.original_file_name': ['MsMpEng.exe'],
+          'event.module': ['endpoint'],
+          'process.code_signature.subject_name': ['Microsoft Corporation'],
+          'host.os.version': ['21H2 (10.0.20348.1366)'],
+          'file.hash.sha256': ['8dd620d9aeb35960bb766458c8890ede987c33d239cf730f93fe49d90ae759dd'],
+          'kibana.alert.risk_score': [99],
+          'user.risk.calculated_score_norm': [82.16188],
+          'host.os.name': ['Windows'],
+          'kibana.alert.rule.name': ['Malware Detection Alert'],
+          'host.name': ['SRVWIN02'],
+          'user.domain': ['OMM-WIN-DETECT'],
+          'process.executable': ['C:\\Windows\\MsMpEng.exe'],
+          'event.outcome': ['success'],
+          'process.code_signature.trusted': [true],
+          'process.Ext.token.integrity_level_name': ['high'],
+          'process.parent.code_signature.subject_name': ['PB03 TRANSPORT LTD.'],
+          'process.parent.executable': [
+            'C:\\Users\\Administrator\\Desktop\\8813719803\\d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e.exe',
+          ],
+          'kibana.alert.workflow_status': ['open'],
+          'file.name': ['mpsvc.dll'],
+          'process.args': ['C:\\Windows\\MsMpEng.exe'],
+          'process.code_signature.status': ['trusted'],
+          message: ['Malware Detection Alert'],
+          'process.parent.args_count': [1],
+          'process.name': ['MsMpEng.exe'],
+          'process.parent.args': [
+            'C:\\Users\\Administrator\\Desktop\\8813719803\\d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e.exe',
+          ],
+          '@timestamp': ['2024-05-07T12:48:45.008Z'],
+          'process.parent.code_signature.trusted': [false],
+          'process.command_line': ['"C:\\Windows\\MsMpEng.exe"'],
+          'host.risk.calculated_level': ['High'],
+          _id: ['aa283e6a13be77b533eceffb09e48254c8f91feeccc39f7eed80fd3881d053f4'],
+          'process.hash.sha1': ['3d409b39b8502fcd23335a878f2cbdaf6d721995'],
+          'event.dataset': ['endpoint.alerts'],
+          'kibana.alert.original_time': ['2023-01-20T23:38:18.093Z'],
+        },
+        sort: [99, 1715086125008],
+      },
+      {
+        _index: '.internal.alerts-security.alerts-default-000001',
+        _id: 'dd9e4ea23961ccfdb7a9c760ee6bedd19a013beac3b0d38227e7ae77ba4ce515',
+        _score: null,
+        fields: {
+          'kibana.alert.severity': ['critical'],
+          'file.path': ['C:\\Windows\\mpsvc.dll'],
+          'process.hash.md5': ['561cffbaba71a6e8cc1cdceda990ead4'],
+          'event.category': ['malware', 'intrusion_detection', 'file'],
+          'host.risk.calculated_score_norm': [75.62723],
+          'process.parent.command_line': ['C:\\Windows\\Explorer.EXE'],
+          'process.parent.name': ['explorer.exe'],
+          'user.name': ['Administrator'],
+          'user.risk.calculated_level': ['High'],
+          'kibana.alert.rule.description': [
+            'Generates a detection alert each time an Elastic Endpoint Security alert is received. Enabling this rule allows you to immediately begin investigating your Endpoint alerts.',
+          ],
+          'process.hash.sha256': [
+            'd55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e',
+          ],
+          'process.pid': [1008],
+          'process.code_signature.exists': [true],
+          'process.parent.code_signature.exists': [true],
+          'process.parent.code_signature.status': ['trusted'],
+          'event.module': ['endpoint'],
+          'process.code_signature.subject_name': ['PB03 TRANSPORT LTD.'],
+          'host.os.version': ['21H2 (10.0.20348.1366)'],
+          'file.hash.sha256': ['8dd620d9aeb35960bb766458c8890ede987c33d239cf730f93fe49d90ae759dd'],
+          'kibana.alert.risk_score': [99],
+          'user.risk.calculated_score_norm': [82.16188],
+          'host.os.name': ['Windows'],
+          'kibana.alert.rule.name': ['Malware Detection Alert'],
+          'host.name': ['SRVWIN02'],
+          'user.domain': ['OMM-WIN-DETECT'],
+          'process.executable': [
+            'C:\\Users\\Administrator\\Desktop\\8813719803\\d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e.exe',
+          ],
+          'event.outcome': ['success'],
+          'process.code_signature.trusted': [false],
+          'process.Ext.token.integrity_level_name': ['high'],
+          'process.parent.code_signature.subject_name': ['Microsoft Windows'],
+          'process.parent.executable': ['C:\\Windows\\explorer.exe'],
+          'kibana.alert.workflow_status': ['open'],
+          'file.name': ['mpsvc.dll'],
+          'process.args': [
+            'C:\\Users\\Administrator\\Desktop\\8813719803\\d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e.exe',
+          ],
+          'process.code_signature.status': ['errorExpired'],
+          message: ['Malware Detection Alert'],
+          'process.parent.args_count': [1],
+          'process.name': ['d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e.exe'],
+          'process.parent.args': ['C:\\Windows\\Explorer.EXE'],
+          '@timestamp': ['2024-05-07T12:48:45.007Z'],
+          'process.parent.code_signature.trusted': [true],
+          'process.command_line': [
+            '"C:\\Users\\Administrator\\Desktop\\8813719803\\d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e.exe" ',
+          ],
+          'host.risk.calculated_level': ['High'],
+          _id: ['dd9e4ea23961ccfdb7a9c760ee6bedd19a013beac3b0d38227e7ae77ba4ce515'],
+          'process.hash.sha1': ['5162f14d75e96edb914d1756349d6e11583db0b0'],
+          'event.dataset': ['endpoint.alerts'],
+          'kibana.alert.original_time': ['2023-01-20T23:38:17.887Z'],
+        },
+        sort: [99, 1715086125007],
+      },
+      {
+        _index: '.internal.alerts-security.alerts-default-000001',
+        _id: 'f30d55e503b1d848b34ee57741b203d8052360dd873ea34802f3fa7a9ef34d0a',
+        _score: null,
+        fields: {
+          'kibana.alert.severity': ['critical'],
+          'file.path': [
+            'C:\\Users\\Administrator\\Desktop\\8813719803\\d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e.exe',
+          ],
+          'process.hash.md5': ['561cffbaba71a6e8cc1cdceda990ead4'],
+          'event.category': ['malware', 'intrusion_detection', 'process'],
+          'host.risk.calculated_score_norm': [75.62723],
+          'process.parent.command_line': ['C:\\Windows\\Explorer.EXE'],
+          'process.parent.name': ['explorer.exe'],
+          'user.name': ['Administrator'],
+          'user.risk.calculated_level': ['High'],
+          'kibana.alert.rule.description': [
+            'Generates a detection alert each time an Elastic Endpoint Security alert is received. Enabling this rule allows you to immediately begin investigating your Endpoint alerts.',
+          ],
+          'process.hash.sha256': [
+            'd55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e',
+          ],
+          'process.pid': [1008],
+          'process.code_signature.exists': [true],
+          'process.parent.code_signature.exists': [true],
+          'process.parent.code_signature.status': ['trusted'],
+          'event.module': ['endpoint'],
+          'process.code_signature.subject_name': ['PB03 TRANSPORT LTD.'],
+          'host.os.version': ['21H2 (10.0.20348.1366)'],
+          'file.hash.sha256': ['d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e'],
+          'kibana.alert.risk_score': [99],
+          'user.risk.calculated_score_norm': [82.16188],
+          'host.os.name': ['Windows'],
+          'kibana.alert.rule.name': ['Malware Detection Alert'],
+          'host.name': ['SRVWIN02'],
+          'user.domain': ['OMM-WIN-DETECT'],
+          'process.executable': [
+            'C:\\Users\\Administrator\\Desktop\\8813719803\\d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e.exe',
+          ],
+          'event.outcome': ['success'],
+          'process.code_signature.trusted': [false],
+          'process.Ext.token.integrity_level_name': ['high'],
+          'process.parent.code_signature.subject_name': ['Microsoft Windows'],
+          'process.parent.executable': ['C:\\Windows\\explorer.exe'],
+          'kibana.alert.workflow_status': ['open'],
+          'file.name': ['d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e.exe'],
+          'process.args': [
+            'C:\\Users\\Administrator\\Desktop\\8813719803\\d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e.exe',
+          ],
+          'process.code_signature.status': ['errorExpired'],
+          message: ['Malware Detection Alert'],
+          'process.parent.args_count': [1],
+          'process.name': ['d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e.exe'],
+          'process.parent.args': ['C:\\Windows\\Explorer.EXE'],
+          '@timestamp': ['2024-05-07T12:48:45.006Z'],
+          'process.parent.code_signature.trusted': [true],
+          'process.command_line': [
+            '"C:\\Users\\Administrator\\Desktop\\8813719803\\d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e.exe" ',
+          ],
+          'host.risk.calculated_level': ['High'],
+          _id: ['f30d55e503b1d848b34ee57741b203d8052360dd873ea34802f3fa7a9ef34d0a'],
+          'process.hash.sha1': ['5162f14d75e96edb914d1756349d6e11583db0b0'],
+          'event.dataset': ['endpoint.alerts'],
+          'kibana.alert.original_time': ['2023-01-20T23:38:17.544Z'],
+        },
+        sort: [99, 1715086125006],
+      },
+      {
+        _index: '.internal.alerts-security.alerts-default-000001',
+        _id: '6f8cd5e8021dbb64598f2b7ec56bee21fd00d1e62d4e08905f86bf234873ee66',
+        _score: null,
+        fields: {
+          'kibana.alert.severity': ['critical'],
+          'file.path': [
+            'C:\\Users\\Administrator\\Desktop\\8813719803\\d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e.exe',
+          ],
+          'process.hash.md5': ['f070b5cf25febb9a88a168efd87c6112'],
+          'event.category': ['malware', 'intrusion_detection', 'file'],
+          'host.risk.calculated_score_norm': [75.62723],
+          'process.parent.command_line': [''],
+          'process.parent.name': ['userinit.exe'],
+          'user.name': ['Administrator'],
+          'user.risk.calculated_level': ['High'],
+          'kibana.alert.rule.description': [
+            'Generates a detection alert each time an Elastic Endpoint Security alert is received. Enabling this rule allows you to immediately begin investigating your Endpoint alerts.',
+          ],
+          'process.hash.sha256': [
+            '567be4d1e15f4ff96d92e7d28e191076f5813f50be96bf4c3916e4ecf53f66cd',
+          ],
+          'process.pid': [6228],
+          'process.code_signature.exists': [true],
+          'process.parent.code_signature.exists': [true],
+          'process.parent.code_signature.status': ['trusted'],
+          'process.pe.original_file_name': ['EXPLORER.EXE'],
+          'event.module': ['endpoint'],
+          'process.code_signature.subject_name': ['Microsoft Windows'],
+          'host.os.version': ['21H2 (10.0.20348.1366)'],
+          'file.hash.sha256': ['d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e'],
+          'kibana.alert.risk_score': [99],
+          'user.risk.calculated_score_norm': [82.16188],
+          'host.os.name': ['Windows'],
+          'kibana.alert.rule.name': ['Malware Detection Alert'],
+          'host.name': ['SRVWIN02'],
+          'user.domain': ['OMM-WIN-DETECT'],
+          'process.executable': ['C:\\Windows\\explorer.exe'],
+          'event.outcome': ['success'],
+          'process.code_signature.trusted': [true],
+          'process.Ext.token.integrity_level_name': ['high'],
+          'process.parent.code_signature.subject_name': ['Microsoft Windows'],
+          'process.parent.executable': ['C:\\Windows\\System32\\userinit.exe'],
+          'kibana.alert.workflow_status': ['open'],
+          'file.name': ['d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e.exe'],
+          'process.args': ['C:\\Windows\\Explorer.EXE'],
+          'process.code_signature.status': ['trusted'],
+          message: ['Malware Detection Alert'],
+          'process.name': ['explorer.exe'],
+          '@timestamp': ['2024-05-07T12:48:45.004Z'],
+          'process.parent.code_signature.trusted': [true],
+          'process.command_line': ['C:\\Windows\\Explorer.EXE'],
+          'host.risk.calculated_level': ['High'],
+          _id: ['6f8cd5e8021dbb64598f2b7ec56bee21fd00d1e62d4e08905f86bf234873ee66'],
+          'process.hash.sha1': ['94518c310478e494082418ed295466f5aea26eea'],
+          'event.dataset': ['endpoint.alerts'],
+          'kibana.alert.original_time': ['2023-01-20T23:37:18.152Z'],
+        },
+        sort: [99, 1715086125004],
+      },
+      {
+        _index: '.internal.alerts-security.alerts-default-000001',
+        _id: 'ce110da958fe0cf0c07599a21c68d90a64c93b7607aa27970a614c7f49598316',
+        _score: null,
+        fields: {
+          'kibana.alert.severity': ['critical'],
+          'file.path': [
+            'C:\\Users\\Administrator\\Desktop\\8813719803\\d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e',
+          ],
+          'process.hash.md5': ['f070b5cf25febb9a88a168efd87c6112'],
+          'event.category': ['malware', 'intrusion_detection', 'file'],
+          'host.risk.calculated_score_norm': [75.62723],
+          'process.parent.command_line': [''],
+          'process.parent.name': ['userinit.exe'],
+          'user.name': ['Administrator'],
+          'user.risk.calculated_level': ['High'],
+          'kibana.alert.rule.description': [
+            'Generates a detection alert each time an Elastic Endpoint Security alert is received. Enabling this rule allows you to immediately begin investigating your Endpoint alerts.',
+          ],
+          'process.hash.sha256': [
+            '567be4d1e15f4ff96d92e7d28e191076f5813f50be96bf4c3916e4ecf53f66cd',
+          ],
+          'process.pid': [6228],
+          'process.code_signature.exists': [true],
+          'process.parent.code_signature.exists': [true],
+          'process.parent.code_signature.status': ['trusted'],
+          'process.pe.original_file_name': ['EXPLORER.EXE'],
+          'event.module': ['endpoint'],
+          'process.code_signature.subject_name': ['Microsoft Windows'],
+          'host.os.version': ['21H2 (10.0.20348.1366)'],
+          'file.hash.sha256': ['d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e'],
+          'kibana.alert.risk_score': [99],
+          'user.risk.calculated_score_norm': [82.16188],
+          'host.os.name': ['Windows'],
+          'kibana.alert.rule.name': ['Malware Detection Alert'],
+          'host.name': ['SRVWIN02'],
+          'user.domain': ['OMM-WIN-DETECT'],
+          'process.executable': ['C:\\Windows\\explorer.exe'],
+          'event.outcome': ['success'],
+          'process.code_signature.trusted': [true],
+          'process.Ext.token.integrity_level_name': ['high'],
+          'process.parent.code_signature.subject_name': ['Microsoft Windows'],
+          'process.parent.executable': ['C:\\Windows\\System32\\userinit.exe'],
+          'kibana.alert.workflow_status': ['open'],
+          'file.name': ['d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e'],
+          'process.args': ['C:\\Windows\\Explorer.EXE'],
+          'process.code_signature.status': ['trusted'],
+          message: ['Malware Detection Alert'],
+          'process.name': ['explorer.exe'],
+          '@timestamp': ['2024-05-07T12:48:45.001Z'],
+          'process.parent.code_signature.trusted': [true],
+          'process.command_line': ['C:\\Windows\\Explorer.EXE'],
+          'host.risk.calculated_level': ['High'],
+          _id: ['ce110da958fe0cf0c07599a21c68d90a64c93b7607aa27970a614c7f49598316'],
+          'process.hash.sha1': ['94518c310478e494082418ed295466f5aea26eea'],
+          'event.dataset': ['endpoint.alerts'],
+          'kibana.alert.original_time': ['2023-01-20T23:36:43.813Z'],
+        },
+        sort: [99, 1715086125001],
+      },
+      {
+        _index: '.internal.alerts-security.alerts-default-000001',
+        _id: '0866787b0027b4d908767ac16e35a1da00970c83632ba85be65f2ad371132b4f',
+        _score: null,
+        fields: {
+          'kibana.alert.severity': ['critical'],
+          'process.hash.md5': ['8cc83221870dd07144e63df594c391d9'],
+          'event.category': ['malware', 'intrusion_detection', 'process', 'file'],
+          'host.risk.calculated_score_norm': [75.62723],
+          'process.parent.command_line': [
+            '"C:\\Users\\Administrator\\Desktop\\8813719803\\d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e.exe" ',
+          ],
+          'process.parent.name': [
+            'd55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e.exe',
+          ],
+          'user.risk.calculated_level': ['High'],
+          'kibana.alert.rule.description': [
+            'Generates a detection alert each time an Elastic Endpoint Security alert is received. Enabling this rule allows you to immediately begin investigating your Endpoint alerts.',
+          ],
+          'process.hash.sha256': [
+            '33bc14d231a4afaa18f06513766d5f69d8b88f1e697cd127d24fb4b72ad44c7a',
+          ],
+          'process.pid': [8708],
+          'process.code_signature.exists': [true],
+          'process.code_signature.subject_name': ['Microsoft Corporation'],
+          'host.os.version': ['21H2 (10.0.20348.1366)'],
+          'kibana.alert.risk_score': [99],
+          'user.risk.calculated_score_norm': [82.16188],
+          'host.os.name': ['Windows'],
+          'kibana.alert.rule.name': ['Ransomware Detection Alert'],
+          'host.name': ['SRVWIN02'],
+          'Ransomware.files.data': [
+            '2D002D002D003D003D003D0020005700',
+            '2D002D002D003D003D003D0020005700',
+            '2D002D002D003D003D003D0020005700',
+          ],
+          'process.code_signature.trusted': [true],
+          'Ransomware.files.metrics': ['CANARY_ACTIVITY'],
+          'kibana.alert.workflow_status': ['open'],
+          'process.parent.args_count': [1],
+          'process.name': ['MsMpEng.exe'],
+          'Ransomware.files.score': [0, 0, 0],
+          'process.parent.code_signature.trusted': [false],
+          _id: ['0866787b0027b4d908767ac16e35a1da00970c83632ba85be65f2ad371132b4f'],
+          'Ransomware.version': ['1.6.0'],
+          'user.name': ['Administrator'],
+          'process.parent.code_signature.exists': [true],
+          'process.parent.code_signature.status': ['errorExpired'],
+          'Ransomware.files.operation': ['creation', 'creation', 'creation'],
+          'process.pe.original_file_name': ['MsMpEng.exe'],
+          'event.module': ['endpoint'],
+          'user.domain': ['OMM-WIN-DETECT'],
+          'process.executable': ['C:\\Windows\\MsMpEng.exe'],
+          'process.Ext.token.integrity_level_name': ['high'],
+          'Ransomware.files.path': [
+            'c:\\hd3vuk19y-readme.txt',
+            'c:\\$winreagent\\hd3vuk19y-readme.txt',
+            'c:\\aaantiransomelastic-do-not-touch-dab6d40c-a6a1-442c-adc4-9d57a47e58d7\\hd3vuk19y-readme.txt',
+          ],
+          'process.parent.code_signature.subject_name': ['PB03 TRANSPORT LTD.'],
+          'process.parent.executable': [
+            'C:\\Users\\Administrator\\Desktop\\8813719803\\d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e.exe',
+          ],
+          'Ransomware.files.entropy': [3.629971457026797, 3.629971457026797, 3.629971457026797],
+          'Ransomware.feature': ['canary'],
+          'Ransomware.files.extension': ['txt', 'txt', 'txt'],
+          'process.args': ['C:\\Windows\\MsMpEng.exe'],
+          'process.code_signature.status': ['trusted'],
+          message: ['Ransomware Detection Alert'],
+          'process.parent.args': [
+            'C:\\Users\\Administrator\\Desktop\\8813719803\\d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e.exe',
+          ],
+          '@timestamp': ['2024-05-07T12:48:45.000Z'],
+          'process.command_line': ['"C:\\Windows\\MsMpEng.exe"'],
+          'host.risk.calculated_level': ['High'],
+          'process.hash.sha1': ['3d409b39b8502fcd23335a878f2cbdaf6d721995'],
+          'event.dataset': ['endpoint.alerts'],
+          'kibana.alert.original_time': ['2023-01-20T23:38:22.964Z'],
+        },
+        sort: [99, 1715086125000],
+      },
+      {
+        _index: '.internal.alerts-security.alerts-default-000001',
+        _id: 'b0fdf96721e361e1137d49a67e26d92f96b146392d7f44322bddc3d660abaef1',
+        _score: null,
+        fields: {
+          'kibana.alert.severity': ['critical'],
+          'process.hash.md5': ['8cc83221870dd07144e63df594c391d9'],
+          'event.category': ['malware', 'intrusion_detection'],
+          'host.risk.calculated_score_norm': [75.62723],
+          'process.parent.command_line': [
+            '"C:\\Users\\Administrator\\Desktop\\8813719803\\d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e.exe" ',
+          ],
+          'process.parent.name': [
+            'd55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e.exe',
+          ],
+          'user.name': ['Administrator'],
+          'user.risk.calculated_level': ['High'],
+          'kibana.alert.rule.description': [
+            'Generates a detection alert each time an Elastic Endpoint Security alert is received. Enabling this rule allows you to immediately begin investigating your Endpoint alerts.',
+          ],
+          'process.hash.sha256': [
+            '33bc14d231a4afaa18f06513766d5f69d8b88f1e697cd127d24fb4b72ad44c7a',
+          ],
+          'process.pid': [8708],
+          'process.code_signature.exists': [true],
+          'process.parent.code_signature.exists': [true],
+          'process.parent.code_signature.status': ['errorExpired'],
+          'process.pe.original_file_name': ['MsMpEng.exe'],
+          'event.module': ['endpoint'],
+          'process.code_signature.subject_name': ['Microsoft Corporation'],
+          'host.os.version': ['21H2 (10.0.20348.1366)'],
+          'kibana.alert.risk_score': [99],
+          'user.risk.calculated_score_norm': [82.16188],
+          'host.os.name': ['Windows'],
+          'kibana.alert.rule.name': ['Memory Threat Detection Alert: Shellcode Injection'],
+          'host.name': ['SRVWIN02'],
+          'user.domain': ['OMM-WIN-DETECT'],
+          'process.executable': ['C:\\Windows\\MsMpEng.exe'],
+          'process.code_signature.trusted': [true],
+          'process.Ext.token.integrity_level_name': ['high'],
+          'process.parent.code_signature.subject_name': ['PB03 TRANSPORT LTD.'],
+          'process.parent.executable': [
+            'C:\\Users\\Administrator\\Desktop\\8813719803\\d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e.exe',
+          ],
+          'kibana.alert.workflow_status': ['open'],
+          'process.args': ['C:\\Windows\\MsMpEng.exe'],
+          'process.code_signature.status': ['trusted'],
+          message: ['Memory Threat Detection Alert: Shellcode Injection'],
+          'process.parent.args_count': [1],
+          'process.name': ['MsMpEng.exe'],
+          'process.parent.args': [
+            'C:\\Users\\Administrator\\Desktop\\8813719803\\d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e.exe',
+          ],
+          '@timestamp': ['2024-05-07T12:48:44.996Z'],
+          'process.parent.code_signature.trusted': [false],
+          'process.command_line': ['"C:\\Windows\\MsMpEng.exe"'],
+          'host.risk.calculated_level': ['High'],
+          _id: ['b0fdf96721e361e1137d49a67e26d92f96b146392d7f44322bddc3d660abaef1'],
+          'process.hash.sha1': ['3d409b39b8502fcd23335a878f2cbdaf6d721995'],
+          'event.dataset': ['endpoint.alerts'],
+          'kibana.alert.original_time': ['2023-01-20T23:38:22.174Z'],
+        },
+        sort: [99, 1715086124996],
+      },
+      {
+        _index: '.internal.alerts-security.alerts-default-000001',
+        _id: '7b4f49f21cf141e67856d3207fb4ea069c8035b41f0ea501970694cf8bd43cbe',
+        _score: null,
+        fields: {
+          'kibana.alert.severity': ['critical'],
+          'process.hash.md5': ['8cc83221870dd07144e63df594c391d9'],
+          'event.category': ['malware', 'intrusion_detection'],
+          'host.risk.calculated_score_norm': [75.62723],
+          'process.parent.command_line': [
+            '"C:\\Users\\Administrator\\Desktop\\8813719803\\d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e.exe" ',
+          ],
+          'process.parent.name': [
+            'd55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e.exe',
+          ],
+          'user.name': ['Administrator'],
+          'user.risk.calculated_level': ['High'],
+          'kibana.alert.rule.description': [
+            'Generates a detection alert each time an Elastic Endpoint Security alert is received. Enabling this rule allows you to immediately begin investigating your Endpoint alerts.',
+          ],
+          'process.hash.sha256': [
+            '33bc14d231a4afaa18f06513766d5f69d8b88f1e697cd127d24fb4b72ad44c7a',
+          ],
+          'process.pid': [8708],
+          'process.code_signature.exists': [true],
+          'process.parent.code_signature.exists': [true],
+          'process.parent.code_signature.status': ['errorExpired'],
+          'process.pe.original_file_name': ['MsMpEng.exe'],
+          'event.module': ['endpoint'],
+          'process.code_signature.subject_name': ['Microsoft Corporation'],
+          'host.os.version': ['21H2 (10.0.20348.1366)'],
+          'kibana.alert.risk_score': [99],
+          'user.risk.calculated_score_norm': [82.16188],
+          'host.os.name': ['Windows'],
+          'kibana.alert.rule.name': ['Memory Threat Detection Alert: Shellcode Injection'],
+          'host.name': ['SRVWIN02'],
+          'user.domain': ['OMM-WIN-DETECT'],
+          'process.executable': ['C:\\Windows\\MsMpEng.exe'],
+          'process.code_signature.trusted': [true],
+          'process.Ext.token.integrity_level_name': ['high'],
+          'process.parent.code_signature.subject_name': ['PB03 TRANSPORT LTD.'],
+          'process.parent.executable': [
+            'C:\\Users\\Administrator\\Desktop\\8813719803\\d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e.exe',
+          ],
+          'kibana.alert.workflow_status': ['open'],
+          'process.args': ['C:\\Windows\\MsMpEng.exe'],
+          'process.code_signature.status': ['trusted'],
+          message: ['Memory Threat Detection Alert: Shellcode Injection'],
+          'process.parent.args_count': [1],
+          'process.name': ['MsMpEng.exe'],
+          'process.parent.args': [
+            'C:\\Users\\Administrator\\Desktop\\8813719803\\d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e.exe',
+          ],
+          '@timestamp': ['2024-05-07T12:48:44.986Z'],
+          'process.parent.code_signature.trusted': [false],
+          'process.command_line': ['"C:\\Windows\\MsMpEng.exe"'],
+          'host.risk.calculated_level': ['High'],
+          _id: ['7b4f49f21cf141e67856d3207fb4ea069c8035b41f0ea501970694cf8bd43cbe'],
+          'process.hash.sha1': ['3d409b39b8502fcd23335a878f2cbdaf6d721995'],
+          'event.dataset': ['endpoint.alerts'],
+          'kibana.alert.original_time': ['2023-01-20T23:38:22.066Z'],
+        },
+        sort: [99, 1715086124986],
+      },
+      {
+        _index: '.internal.alerts-security.alerts-default-000001',
+        _id: 'ea81d79104cbd442236b5bcdb7a3331de897aa4ce1523e622068038d048d0a9e',
+        _score: null,
+        fields: {
+          'kibana.alert.severity': ['critical'],
+          'process.hash.md5': ['8cc83221870dd07144e63df594c391d9'],
+          'event.category': ['malware', 'intrusion_detection', 'process'],
+          'host.risk.calculated_score_norm': [75.62723],
+          'process.parent.command_line': [
+            '"C:\\Users\\Administrator\\Desktop\\8813719803\\d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e.exe" ',
+          ],
+          'process.parent.name': [
+            'd55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e.exe',
+          ],
+          'user.risk.calculated_level': ['High'],
+          'kibana.alert.rule.description': [
+            'Generates a detection alert each time an Elastic Endpoint Security alert is received. Enabling this rule allows you to immediately begin investigating your Endpoint alerts.',
+          ],
+          'process.hash.sha256': [
+            '33bc14d231a4afaa18f06513766d5f69d8b88f1e697cd127d24fb4b72ad44c7a',
+          ],
+          'process.Ext.memory_region.malware_signature.primary.matches': [
+            'WVmF9nQli1UIg2YEAIk+iwoLSgQ=',
+            'dQxy0zPAQF9eW4vlXcMzwOv1VYvsgw==',
+            'DIsEsIN4BAV1HP9wCP9wDP91DP8=',
+            '+4tF/FCLCP9RCF6Lx19bi+Vdw1U=',
+            'vAAAADPSi030i/GLRfAPpMEBwe4f',
+            'VIvO99GLwiNN3PfQM030I8czReiJ',
+            'DIlGDIXAdSozwOtsi0YIhcB0Yms=',
+          ],
+          'process.pid': [8708],
+          'process.code_signature.exists': [true],
+          'process.code_signature.subject_name': ['Microsoft Corporation'],
+          'host.os.version': ['21H2 (10.0.20348.1366)'],
+          'kibana.alert.risk_score': [99],
+          'user.risk.calculated_score_norm': [82.16188],
+          'host.os.name': ['Windows'],
+          'kibana.alert.rule.name': [
+            'Memory Threat Detection Alert: Windows.Ransomware.Sodinokibi',
+          ],
+          'host.name': ['SRVWIN02'],
+          'event.outcome': ['success'],
+          'process.code_signature.trusted': [true],
+          'kibana.alert.workflow_status': ['open'],
+          'rule.name': ['Windows.Ransomware.Sodinokibi'],
+          'process.parent.args_count': [1],
+          'process.Ext.memory_region.bytes_compressed_present': [false],
+          'process.name': ['MsMpEng.exe'],
+          'process.parent.code_signature.trusted': [false],
+          _id: ['ea81d79104cbd442236b5bcdb7a3331de897aa4ce1523e622068038d048d0a9e'],
+          'user.name': ['Administrator'],
+          'process.parent.code_signature.exists': [true],
+          'process.parent.code_signature.status': ['errorExpired'],
+          'process.pe.original_file_name': ['MsMpEng.exe'],
+          'event.module': ['endpoint'],
+          'process.Ext.memory_region.malware_signature.all_names': [
+            'Windows.Ransomware.Sodinokibi',
+          ],
+          'user.domain': ['OMM-WIN-DETECT'],
+          'process.executable': ['C:\\Windows\\MsMpEng.exe'],
+          'process.Ext.memory_region.malware_signature.primary.signature.name': [
+            'Windows.Ransomware.Sodinokibi',
+          ],
+          'process.Ext.token.integrity_level_name': ['high'],
+          'process.parent.code_signature.subject_name': ['PB03 TRANSPORT LTD.'],
+          'process.parent.executable': [
+            'C:\\Users\\Administrator\\Desktop\\8813719803\\d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e.exe',
+          ],
+          'process.args': ['C:\\Windows\\MsMpEng.exe'],
+          'process.code_signature.status': ['trusted'],
+          message: ['Memory Threat Detection Alert: Windows.Ransomware.Sodinokibi'],
+          'process.parent.args': [
+            'C:\\Users\\Administrator\\Desktop\\8813719803\\d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e.exe',
+          ],
+          '@timestamp': ['2024-05-07T12:48:44.975Z'],
+          'process.command_line': ['"C:\\Windows\\MsMpEng.exe"'],
+          'host.risk.calculated_level': ['High'],
+          'process.hash.sha1': ['3d409b39b8502fcd23335a878f2cbdaf6d721995'],
+          'event.dataset': ['endpoint.alerts'],
+          'kibana.alert.original_time': ['2023-01-20T23:38:25.169Z'],
+        },
+        sort: [99, 1715086124975],
+      },
+      {
+        _index: '.internal.alerts-security.alerts-default-000001',
+        _id: 'cdf3b5510bb5ed622e8cefd1ce6bedc52bdd99a4c1ead537af0603469e713c8b',
+        _score: null,
+        fields: {
+          'kibana.alert.severity': ['critical'],
+          'file.path': ['C:\\Users\\Administrator\\AppData\\Local\\cdnver.dll'],
+          'process.hash.md5': ['4bfef0b578515c16b9582e32b78d2594'],
+          'event.category': ['malware', 'intrusion_detection', 'library'],
+          'host.risk.calculated_score_norm': [73.02488],
+          'process.parent.command_line': ['C:\\Programdata\\Q3C7N1V8.exe'],
+          'process.parent.name': ['Q3C7N1V8.exe'],
+          'user.name': ['Administrator'],
+          'user.risk.calculated_level': ['High'],
+          'kibana.alert.rule.description': [
+            'Generates a detection alert each time an Elastic Endpoint Security alert is received. Enabling this rule allows you to immediately begin investigating your Endpoint alerts.',
+          ],
+          'process.hash.sha256': [
+            '70d21cbdc527559c4931421e66aa819b86d5af5535445ace467e74518164c46a',
+          ],
+          'process.pid': [7824],
+          'process.code_signature.exists': [true],
+          'process.parent.code_signature.exists': [false],
+          'process.pe.original_file_name': ['RUNDLL32.EXE'],
+          'event.module': ['endpoint'],
+          'process.code_signature.subject_name': ['Microsoft Windows'],
+          'host.os.version': ['21H2 (10.0.20348.1366)'],
+          'file.hash.sha256': ['12e6642cf6413bdf5388bee663080fa299591b2ba023d069286f3be9647547c8'],
+          'kibana.alert.risk_score': [99],
+          'user.risk.calculated_score_norm': [82.16188],
+          'host.os.name': ['Windows'],
+          'kibana.alert.rule.name': ['Malware Detection Alert'],
+          'host.name': ['SRVWIN01'],
+          'user.domain': ['OMM-WIN-DETECT'],
+          'process.executable': ['C:\\Windows\\SysWOW64\\rundll32.exe'],
+          'event.outcome': ['success'],
+          'process.code_signature.trusted': [true],
+          'process.Ext.token.integrity_level_name': ['high'],
+          'process.parent.executable': ['C:\\ProgramData\\Q3C7N1V8.exe'],
+          'kibana.alert.workflow_status': ['open'],
+          'file.name': ['cdnver.dll'],
+          'process.args': [
+            'C:\\Windows\\System32\\rundll32.exe',
+            'C:\\Users\\Administrator\\AppData\\Local\\cdnver.dll,#1',
+          ],
+          'process.code_signature.status': ['trusted'],
+          message: ['Malware Detection Alert'],
+          'process.parent.args_count': [1],
+          'process.name': ['rundll32.exe'],
+          'process.parent.args': ['C:\\Programdata\\Q3C7N1V8.exe'],
+          '@timestamp': ['2024-05-07T12:47:32.838Z'],
+          'process.command_line': [
+            '"C:\\Windows\\System32\\rundll32.exe" "C:\\Users\\Administrator\\AppData\\Local\\cdnver.dll",#1',
+          ],
+          'host.risk.calculated_level': ['High'],
+          _id: ['cdf3b5510bb5ed622e8cefd1ce6bedc52bdd99a4c1ead537af0603469e713c8b'],
+          'process.hash.sha1': ['9b16507aaf10a0aafa0df2ba83e8eb2708d83a02'],
+          'event.dataset': ['endpoint.alerts'],
+          'kibana.alert.original_time': ['2023-01-16T01:51:26.472Z'],
+        },
+        sort: [99, 1715086052838],
+      },
+      {
+        _index: '.internal.alerts-security.alerts-default-000001',
+        _id: '6abe81eb6350fb08031761be029e7ab19f7e577a7c17a9c5ea1ed010ba1620e3',
+        _score: null,
+        fields: {
+          'kibana.alert.severity': ['critical'],
+          'process.hash.md5': ['4bfef0b578515c16b9582e32b78d2594'],
+          'event.category': ['malware', 'intrusion_detection'],
+          'host.risk.calculated_score_norm': [73.02488],
+          'process.parent.command_line': ['C:\\Programdata\\Q3C7N1V8.exe'],
+          'process.parent.name': ['Q3C7N1V8.exe'],
+          'user.risk.calculated_level': ['High'],
+          'kibana.alert.rule.description': [
+            'Generates a detection alert each time an Elastic Endpoint Security alert is received. Enabling this rule allows you to immediately begin investigating your Endpoint alerts.',
+          ],
+          'process.hash.sha256': [
+            '70d21cbdc527559c4931421e66aa819b86d5af5535445ace467e74518164c46a',
+          ],
+          'process.pid': [7824],
+          'process.code_signature.exists': [true],
+          'process.code_signature.subject_name': ['Microsoft Windows'],
+          'host.os.version': ['21H2 (10.0.20348.1366)'],
+          'kibana.alert.risk_score': [99],
+          'user.risk.calculated_score_norm': [82.16188],
+          'host.os.name': ['Windows'],
+          'kibana.alert.rule.name': [
+            'Malicious Behavior Detection Alert: RunDLL32 with Unusual Arguments',
+          ],
+          'host.name': ['SRVWIN01'],
+          'event.outcome': ['success'],
+          'process.code_signature.trusted': [true],
+          'kibana.alert.workflow_status': ['open'],
+          'rule.name': ['RunDLL32 with Unusual Arguments'],
+          'threat.tactic.id': ['TA0005'],
+          'threat.tactic.name': ['Defense Evasion'],
+          'threat.technique.id': ['T1218'],
+          'process.parent.args_count': [1],
+          'threat.technique.subtechnique.reference': [
+            'https://attack.mitre.org/techniques/T1218/011/',
+          ],
+          'process.name': ['rundll32.exe'],
+          'threat.technique.subtechnique.name': ['Rundll32'],
+          _id: ['6abe81eb6350fb08031761be029e7ab19f7e577a7c17a9c5ea1ed010ba1620e3'],
+          'threat.technique.name': ['System Binary Proxy Execution'],
+          'threat.tactic.reference': ['https://attack.mitre.org/tactics/TA0005/'],
+          'user.name': ['Administrator'],
+          'threat.framework': ['MITRE ATT&CK'],
+          'process.working_directory': ['C:\\Users\\Administrator\\Documents\\'],
+          'process.pe.original_file_name': ['RUNDLL32.EXE'],
+          'event.module': ['endpoint'],
+          'user.domain': ['OMM-WIN-DETECT'],
+          'process.executable': ['C:\\Windows\\SysWOW64\\rundll32.exe'],
+          'process.Ext.token.integrity_level_name': ['high'],
+          'process.parent.executable': ['C:\\ProgramData\\Q3C7N1V8.exe'],
+          'process.args': [
+            'C:\\Windows\\System32\\rundll32.exe',
+            'C:\\Users\\Administrator\\AppData\\Local\\cdnver.dll,#1',
+          ],
+          'process.code_signature.status': ['trusted'],
+          message: ['Malicious Behavior Detection Alert: RunDLL32 with Unusual Arguments'],
+          'process.parent.args': ['C:\\Programdata\\Q3C7N1V8.exe'],
+          '@timestamp': ['2024-05-07T12:47:32.836Z'],
+          'threat.technique.subtechnique.id': ['T1218.011'],
+          'threat.technique.reference': ['https://attack.mitre.org/techniques/T1218/'],
+          'process.command_line': [
+            '"C:\\Windows\\System32\\rundll32.exe" "C:\\Users\\Administrator\\AppData\\Local\\cdnver.dll",#1',
+          ],
+          'host.risk.calculated_level': ['High'],
+          'process.hash.sha1': ['9b16507aaf10a0aafa0df2ba83e8eb2708d83a02'],
+          'event.dataset': ['endpoint.alerts'],
+          'kibana.alert.original_time': ['2023-01-16T01:51:26.348Z'],
+        },
+        sort: [99, 1715086052836],
+      },
+    ],
+  },
+};
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/entity/utils/supported_schemas.ts b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/entity/utils/supported_schemas.ts
index 766a92904f4bc0..ba3c9b64ea32c5 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/entity/utils/supported_schemas.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/entity/utils/supported_schemas.ts
@@ -36,12 +36,18 @@ export const getSupportedSchemas = (
 ): SupportedSchema[] => {
   const sentinelOneDataInAnalyzerEnabled = experimentalFeatures?.sentinelOneDataInAnalyzerEnabled;
   const crowdstrikeDataInAnalyzerEnabled = experimentalFeatures?.crowdstrikeDataInAnalyzerEnabled;
+  const jamfDataInAnalyzerEnabled = experimentalFeatures?.jamfDataInAnalyzerEnabled;
 
   const supportedFileBeatDataSets = [
     ...(sentinelOneDataInAnalyzerEnabled
       ? ['sentinel_one_cloud_funnel.event', 'sentinel_one.alert']
       : []),
-    ...(crowdstrikeDataInAnalyzerEnabled ? ['crowdstrike.falcon', 'crowdstrike.fdr'] : []),
+    ...(crowdstrikeDataInAnalyzerEnabled
+      ? ['crowdstrike.falcon', 'crowdstrike.fdr', 'crowdstrike.alert']
+      : []),
+    ...(jamfDataInAnalyzerEnabled
+      ? ['jamf_protect.alerts', 'jamf_protect.web-threat-events', 'jamf_protect.web-traffic-events']
+      : []),
   ];
 
   return [
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/tree/queries/descendants.ts b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/tree/queries/descendants.ts
index aa6547506b3666..58eda02ee9289a 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/tree/queries/descendants.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/tree/queries/descendants.ts
@@ -65,10 +65,10 @@ export class DescendantsQuery extends BaseResolverQuery {
               },
             },
             {
-              term: { 'event.category': 'process' },
+              terms: { 'event.category': ['process'] },
             },
             {
-              term: { 'event.kind': 'event' },
+              terms: { 'event.kind': ['event', 'alert'] },
             },
           ],
         },
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/tree/queries/lifecycle.ts b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/tree/queries/lifecycle.ts
index 84ebd8b4ae5327..ca1578e071626b 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/tree/queries/lifecycle.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/tree/queries/lifecycle.ts
@@ -58,10 +58,10 @@ export class LifecycleQuery extends BaseResolverQuery {
               },
             },
             {
-              term: { 'event.category': 'process' },
+              terms: { 'event.category': ['process'] },
             },
             {
-              term: { 'event.kind': 'event' },
+              terms: { 'event.kind': ['event', 'alert'] },
             },
           ],
         },
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_response_actions/types.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_response_actions/types.ts
index 9d8f4b02461296..d34d2eba9e5ab9 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_response_actions/types.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_response_actions/types.ts
@@ -11,6 +11,7 @@ import type { CommonResponseActionMethodOptions } from '../../../endpoint/servic
 
 export type Alert = ParsedTechnicalFields & {
   _id: string;
+  _index: string;
   agent?: AlertAgent;
   host?: {
     name: string;
diff --git a/x-pack/plugins/security_solution/server/lib/entity_analytics/asset_criticality/asset_criticality_data_client.ts b/x-pack/plugins/security_solution/server/lib/entity_analytics/asset_criticality/asset_criticality_data_client.ts
index 81f0386a6c96c0..fd5c2921972f35 100644
--- a/x-pack/plugins/security_solution/server/lib/entity_analytics/asset_criticality/asset_criticality_data_client.ts
+++ b/x-pack/plugins/security_solution/server/lib/entity_analytics/asset_criticality/asset_criticality_data_client.ts
@@ -141,7 +141,10 @@ export class AssetCriticalityDataClient {
     }
   }
 
-  public async upsert(record: AssetCriticalityUpsert): Promise<AssetCriticalityRecord> {
+  public async upsert(
+    record: AssetCriticalityUpsert,
+    refresh = 'wait_for' as const
+  ): Promise<AssetCriticalityRecord> {
     const id = createId(record);
     const doc = {
       id_field: record.idField,
@@ -153,6 +156,7 @@ export class AssetCriticalityDataClient {
     await this.options.esClient.update({
       id,
       index: this.getIndex(),
+      refresh: refresh ?? false,
       body: {
         doc,
         doc_as_upsert: true,
@@ -240,10 +244,11 @@ export class AssetCriticalityDataClient {
     return { errors, stats };
   };
 
-  public async delete(idParts: AssetCriticalityIdParts) {
+  public async delete(idParts: AssetCriticalityIdParts, refresh = 'wait_for' as const) {
     await this.options.esClient.delete({
       id: createId(idParts),
       index: this.getIndex(),
+      refresh: refresh ?? false,
     });
   }
 }
diff --git a/x-pack/plugins/security_solution/server/lib/entity_analytics/asset_criticality/routes/delete.ts b/x-pack/plugins/security_solution/server/lib/entity_analytics/asset_criticality/routes/delete.ts
index f9630542283ef6..6f1d677d414c56 100644
--- a/x-pack/plugins/security_solution/server/lib/entity_analytics/asset_criticality/routes/delete.ts
+++ b/x-pack/plugins/security_solution/server/lib/entity_analytics/asset_criticality/routes/delete.ts
@@ -12,7 +12,7 @@ import {
   APP_ID,
   ENABLE_ASSET_CRITICALITY_SETTING,
 } from '../../../../../common/constants';
-import { AssetCriticalityRecordIdParts } from '../../../../../common/api/entity_analytics/asset_criticality';
+import { DeleteAssetCriticalityRecord } from '../../../../../common/api/entity_analytics/asset_criticality';
 import { buildRouteValidationWithZod } from '../../../../utils/build_validation/route_validation';
 import { checkAndInitAssetCriticalityResources } from '../check_and_init_asset_criticality_resources';
 import { assertAdvancedSettingsEnabled } from '../../utils/assert_advanced_setting_enabled';
@@ -36,7 +36,7 @@ export const assetCriticalityDeleteRoute = (
         version: '1',
         validate: {
           request: {
-            query: buildRouteValidationWithZod(AssetCriticalityRecordIdParts),
+            query: buildRouteValidationWithZod(DeleteAssetCriticalityRecord),
           },
         },
       },
@@ -59,10 +59,13 @@ export const assetCriticalityDeleteRoute = (
           await checkAndInitAssetCriticalityResources(context, logger);
 
           const assetCriticalityClient = securitySolution.getAssetCriticalityDataClient();
-          await assetCriticalityClient.delete({
-            idField: request.query.id_field,
-            idValue: request.query.id_value,
-          });
+          await assetCriticalityClient.delete(
+            {
+              idField: request.query.id_field,
+              idValue: request.query.id_value,
+            },
+            request.query.refresh
+          );
 
           return response.ok();
         } catch (e) {
diff --git a/x-pack/plugins/security_solution/server/lib/entity_analytics/asset_criticality/routes/upsert.ts b/x-pack/plugins/security_solution/server/lib/entity_analytics/asset_criticality/routes/upsert.ts
index 3e460b3f4e5430..8a6d4756959624 100644
--- a/x-pack/plugins/security_solution/server/lib/entity_analytics/asset_criticality/routes/upsert.ts
+++ b/x-pack/plugins/security_solution/server/lib/entity_analytics/asset_criticality/routes/upsert.ts
@@ -55,7 +55,10 @@ export const assetCriticalityUpsertRoute = (
             criticalityLevel: request.body.criticality_level,
           };
 
-          const result = await assetCriticalityClient.upsert(assetCriticalityRecord);
+          const result = await assetCriticalityClient.upsert(
+            assetCriticalityRecord,
+            request.body.refresh
+          );
 
           securitySolution.getAuditLogger()?.log({
             message: 'User attempted to assign the asset criticality level for an entity',
diff --git a/x-pack/plugins/security_solution/server/lib/entity_analytics/risk_score/calculate_and_persist_risk_scores.ts b/x-pack/plugins/security_solution/server/lib/entity_analytics/risk_score/calculate_and_persist_risk_scores.ts
index 09fe204fe69e13..aa67d4abf78bac 100644
--- a/x-pack/plugins/security_solution/server/lib/entity_analytics/risk_score/calculate_and_persist_risk_scores.ts
+++ b/x-pack/plugins/security_solution/server/lib/entity_analytics/risk_score/calculate_and_persist_risk_scores.ts
@@ -21,7 +21,7 @@ export const calculateAndPersistRiskScores = async (
     riskScoreDataClient: RiskScoreDataClient;
   }
 ): Promise<CalculateAndPersistScoresResponse> => {
-  const { riskScoreDataClient, spaceId, returnScores, ...rest } = params;
+  const { riskScoreDataClient, spaceId, returnScores, refresh, ...rest } = params;
 
   const writer = await riskScoreDataClient.getWriter({
     namespace: spaceId,
@@ -40,7 +40,7 @@ export const calculateAndPersistRiskScores = async (
     );
   }
 
-  const { errors, docs_written: scoresWritten } = await writer.bulk(scores);
+  const { errors, docs_written: scoresWritten } = await writer.bulk({ ...scores, refresh });
 
   const result = { after_keys: afterKeys, errors, scores_written: scoresWritten };
 
diff --git a/x-pack/plugins/security_solution/server/lib/entity_analytics/risk_score/risk_engine_data_writer.ts b/x-pack/plugins/security_solution/server/lib/entity_analytics/risk_score/risk_engine_data_writer.ts
index e43b44ab018941..e140090ea55e41 100644
--- a/x-pack/plugins/security_solution/server/lib/entity_analytics/risk_score/risk_engine_data_writer.ts
+++ b/x-pack/plugins/security_solution/server/lib/entity_analytics/risk_score/risk_engine_data_writer.ts
@@ -18,6 +18,7 @@ interface WriterBulkResponse {
 interface BulkParams {
   host?: RiskScore[];
   user?: RiskScore[];
+  refresh?: 'wait_for';
 }
 
 export interface RiskEngineDataWriter {
@@ -42,6 +43,7 @@ export class RiskEngineDataWriter implements RiskEngineDataWriter {
 
       const { errors, items, took } = await this.options.esClient.bulk({
         operations: this.buildBulkOperations(params),
+        refresh: params.refresh ?? false,
       });
 
       return {
diff --git a/x-pack/plugins/security_solution/server/lib/entity_analytics/risk_score/risk_score_service.ts b/x-pack/plugins/security_solution/server/lib/entity_analytics/risk_score/risk_score_service.ts
index bfc86643a6fd05..b326f50f767a40 100644
--- a/x-pack/plugins/security_solution/server/lib/entity_analytics/risk_score/risk_score_service.ts
+++ b/x-pack/plugins/security_solution/server/lib/entity_analytics/risk_score/risk_score_service.ts
@@ -44,6 +44,7 @@ export interface RiskScoreServiceFactoryParams {
   riskEngineDataClient: RiskEngineDataClient;
   riskScoreDataClient: RiskScoreDataClient;
   spaceId: string;
+  refresh?: 'wait_for';
 }
 
 export const riskScoreServiceFactory = ({
diff --git a/x-pack/plugins/security_solution/server/lib/entity_analytics/risk_score/routes/entity_calculation.test.ts b/x-pack/plugins/security_solution/server/lib/entity_analytics/risk_score/routes/entity_calculation.test.ts
index 1ba609e885ddaa..dbb8459d0ae42a 100644
--- a/x-pack/plugins/security_solution/server/lib/entity_analytics/risk_score/routes/entity_calculation.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/entity_analytics/risk_score/routes/entity_calculation.test.ts
@@ -92,7 +92,9 @@ describe('entity risk score calculation route', () => {
 
     expect(response.status).toEqual(200);
     expect(mockRiskScoreService.calculateAndPersistScores).toHaveBeenCalledWith(
-      expect.objectContaining({ filter: [{ term: { 'host.name': 'test-host-name' } }] })
+      expect.objectContaining({
+        filter: { bool: { filter: [{ term: { 'host.name': 'test-host-name' } }] } },
+      })
     );
   });
 
@@ -118,9 +120,9 @@ describe('entity risk score calculation route', () => {
 
       expect(response.body).toEqual({
         message: 'No Risk engine configuration found',
-        status_code: 405,
+        status_code: 400,
       });
-      expect(response.status).toEqual(405);
+      expect(response.status).toEqual(400);
     });
 
     it('returns an error if the risk engine is disabled', async () => {
@@ -133,9 +135,9 @@ describe('entity risk score calculation route', () => {
 
       expect(response.body).toEqual({
         message: 'Risk engine is disabled',
-        status_code: 405,
+        status_code: 400,
       });
-      expect(response.status).toEqual(405);
+      expect(response.status).toEqual(400);
     });
 
     it('filter by user provided filter when it is defined', async () => {
@@ -149,7 +151,9 @@ describe('entity risk score calculation route', () => {
 
       expect(response.status).toEqual(200);
       expect(mockRiskScoreService.calculateAndPersistScores).toHaveBeenCalledWith(
-        expect.objectContaining({ filter: expect.arrayContaining([userFilter]) })
+        expect.objectContaining({
+          filter: { bool: { filter: expect.arrayContaining([userFilter]) } },
+        })
       );
     });
   });
diff --git a/x-pack/plugins/security_solution/server/lib/entity_analytics/risk_score/routes/entity_calculation.ts b/x-pack/plugins/security_solution/server/lib/entity_analytics/risk_score/routes/entity_calculation.ts
index 497e9ac189100c..98b4149f702307 100644
--- a/x-pack/plugins/security_solution/server/lib/entity_analytics/risk_score/routes/entity_calculation.ts
+++ b/x-pack/plugins/security_solution/server/lib/entity_analytics/risk_score/routes/entity_calculation.ts
@@ -69,7 +69,7 @@ export const riskScoreEntityCalculationRoute = (
           logger
         );
 
-        const { identifier_type: identifierType, identifier } = request.body;
+        const { identifier_type: identifierType, identifier, refresh } = request.body;
 
         try {
           const entityAnalyticsConfig = await riskScoreService.getConfigurationWithDefaults(
@@ -78,7 +78,7 @@ export const riskScoreEntityCalculationRoute = (
 
           if (entityAnalyticsConfig == null) {
             return siemResponse.error({
-              statusCode: 405,
+              statusCode: 400,
               body: 'No Risk engine configuration found',
             });
           }
@@ -94,7 +94,7 @@ export const riskScoreEntityCalculationRoute = (
 
           if (!enabled) {
             return siemResponse.error({
-              statusCode: 405,
+              statusCode: 400,
               body: 'Risk engine is disabled',
             });
           }
@@ -112,6 +112,7 @@ export const riskScoreEntityCalculationRoute = (
           const identifierFilter = {
             term: { [getFieldForIdentifier(identifierType)]: identifier },
           };
+
           const filter = isEmpty(userFilter) ? [identifierFilter] : [userFilter, identifierFilter];
 
           const result: CalculateAndPersistScoresResponse =
@@ -119,13 +120,18 @@ export const riskScoreEntityCalculationRoute = (
               pageSize,
               identifierType,
               index,
-              filter,
+              filter: {
+                bool: {
+                  filter,
+                },
+              },
               range,
               runtimeMappings,
               weights: [],
               alertSampleSizePerShard,
               afterKeys,
               returnScores: true,
+              refresh,
             });
 
           if (result.errors.length) {
diff --git a/x-pack/plugins/security_solution/server/lib/entity_analytics/types.ts b/x-pack/plugins/security_solution/server/lib/entity_analytics/types.ts
index d41edbd2156424..a71912d2dffa46 100644
--- a/x-pack/plugins/security_solution/server/lib/entity_analytics/types.ts
+++ b/x-pack/plugins/security_solution/server/lib/entity_analytics/types.ts
@@ -52,6 +52,7 @@ export interface CalculateAndPersistScoresParams {
   weights?: RiskWeights;
   alertSampleSizePerShard?: number;
   returnScores?: boolean;
+  refresh?: 'wait_for';
 }
 
 export interface CalculateAndPersistScoresResponse {
diff --git a/x-pack/plugins/security_solution/server/plugin.ts b/x-pack/plugins/security_solution/server/plugin.ts
index 6fc4d52b9719ab..a2440482f537e4 100644
--- a/x-pack/plugins/security_solution/server/plugin.ts
+++ b/x-pack/plugins/security_solution/server/plugin.ts
@@ -567,7 +567,6 @@ export class Plugin implements ISecuritySolutionPlugin {
     plugins.elasticAssistant.registerTools(APP_UI_ID, getAssistantTools());
     plugins.elasticAssistant.registerFeatures(APP_UI_ID, {
       assistantModelEvaluation: config.experimentalFeatures.assistantModelEvaluation,
-      attackDiscoveryEnabled: config.experimentalFeatures.attackDiscoveryEnabled,
     });
     plugins.elasticAssistant.registerFeatures('management', {
       assistantModelEvaluation: config.experimentalFeatures.assistantModelEvaluation,
diff --git a/x-pack/plugins/security_solution/tsconfig.json b/x-pack/plugins/security_solution/tsconfig.json
index dd625a978f3167..b5778dbf20e395 100644
--- a/x-pack/plugins/security_solution/tsconfig.json
+++ b/x-pack/plugins/security_solution/tsconfig.json
@@ -154,7 +154,6 @@
     "@kbn/expressions-plugin",
     "@kbn/dev-proc-runner",
     "@kbn/alerts-ui-shared",
-    "@kbn/text-based-editor",
     "@kbn/security-solution-navigation",
     "@kbn/security-solution-upselling",
     "@kbn/discover-plugin",
diff --git a/x-pack/plugins/stack_alerts/public/rule_types/es_query/expression/esql_query_expression.tsx b/x-pack/plugins/stack_alerts/public/rule_types/es_query/expression/esql_query_expression.tsx
index 7b5220906610e1..febae77ad0f22a 100644
--- a/x-pack/plugins/stack_alerts/public/rule_types/es_query/expression/esql_query_expression.tsx
+++ b/x-pack/plugins/stack_alerts/public/rule_types/es_query/expression/esql_query_expression.tsx
@@ -16,6 +16,7 @@ import {
   EuiSelect,
   EuiSpacer,
 } from '@elastic/eui';
+import { getESQLQueryColumns } from '@kbn/esql-utils';
 import { getFields, RuleTypeParamsExpressionProps } from '@kbn/triggers-actions-ui-plugin/public';
 import { TextBasedLangEditor } from '@kbn/text-based-languages/public';
 import { fetchFieldsFromESQL } from '@kbn/text-based-editor';
@@ -41,7 +42,7 @@ import { rowToDocument, toEsQueryHits, transformDatatableToEsqlTable } from '../
 export const EsqlQueryExpression: React.FC<
   RuleTypeParamsExpressionProps<EsQueryRuleParams<SearchType.esqlQuery>, EsQueryRuleMetaData>
 > = ({ ruleParams, setRuleParams, setRuleProperty, errors }) => {
-  const { expressions, http, fieldFormats, isServerless } = useTriggerUiActionServices();
+  const { expressions, http, fieldFormats, isServerless, data } = useTriggerUiActionServices();
   const { esqlQuery, timeWindowSize, timeWindowUnit, timeField, sourceFields } = ruleParams;
 
   const [currentRuleParams, setCurrentRuleParams] = useState<
@@ -182,9 +183,12 @@ export const EsqlQueryExpression: React.FC<
   const refreshEsFields = async (q: AggregateQuery, resetSourceFields: boolean = true) => {
     let fields: FieldOption[] = [];
     try {
-      const table = await fetchFieldsFromESQL({ esql: `${get(q, 'esql')} | limit 0` }, expressions);
-      if (table) {
-        fields = table.columns.map((c) => ({
+      const columns = await getESQLQueryColumns({
+        esqlQuery: `${get(q, 'esql')}`,
+        search: data.search.search,
+      });
+      if (columns.length) {
+        fields = columns.map((c) => ({
           name: c.id,
           type: c.meta.type,
           normalizedType: c.meta.type,
diff --git a/x-pack/plugins/stack_alerts/server/rule_types/es_query/lib/fetch_search_source_query.test.ts b/x-pack/plugins/stack_alerts/server/rule_types/es_query/lib/fetch_search_source_query.test.ts
index 2a44ffcb69fef5..f20492c37e911c 100644
--- a/x-pack/plugins/stack_alerts/server/rule_types/es_query/lib/fetch_search_source_query.test.ts
+++ b/x-pack/plugins/stack_alerts/server/rule_types/es_query/lib/fetch_search_source_query.test.ts
@@ -59,7 +59,8 @@ const defaultParams: OnlySearchSourceRuleParams = {
   excludeHitsFromPreviousRun: true,
   aggType: 'count',
   groupBy: 'all',
-  timeField: 'time',
+  // this should be ignored when using a data view
+  timeField: 'timeFieldNotFromDataView',
 };
 
 describe('fetchSearchSourceQuery', () => {
diff --git a/x-pack/plugins/stack_alerts/server/rule_types/es_query/lib/fetch_search_source_query.ts b/x-pack/plugins/stack_alerts/server/rule_types/es_query/lib/fetch_search_source_query.ts
index f413d345d616d3..29564ad4b38633 100644
--- a/x-pack/plugins/stack_alerts/server/rule_types/es_query/lib/fetch_search_source_query.ts
+++ b/x-pack/plugins/stack_alerts/server/rule_types/es_query/lib/fetch_search_source_query.ts
@@ -112,18 +112,17 @@ export function updateSearchSource(
   alertLimit?: number
 ): { searchSource: ISearchSource; filterToExcludeHitsFromPreviousRun: Filter | null } {
   const isGroupAgg = isGroupAggregation(params.termField);
-  const timeFieldName = params.timeField || index.timeFieldName;
+  const timeField = index.getTimeField();
 
-  if (!timeFieldName) {
-    throw new Error('Invalid data view without timeFieldName.');
+  if (!timeField) {
+    throw new Error(`Data view with ID ${index.id} no longer contains a time field.`);
   }
 
   searchSource.setField('size', isGroupAgg ? 0 : params.size);
 
-  const field = index.fields.find((f) => f.name === timeFieldName);
   const filters = [
     buildRangeFilter(
-      field!,
+      timeField,
       { lte: dateEnd, gte: dateStart, format: 'strict_date_optional_time' },
       index
     ),
@@ -135,7 +134,7 @@ export function updateSearchSource(
       // add additional filter for documents with a timestamp greater than
       // the timestamp of the previous run, so that those documents are not counted twice
       filterToExcludeHitsFromPreviousRun = buildRangeFilter(
-        field!,
+        timeField,
         { gt: latestTimestamp, format: 'strict_date_optional_time' },
         index
       );
@@ -150,7 +149,7 @@ export function updateSearchSource(
   searchSourceChild.setField('filter', filters as Filter[]);
   searchSourceChild.setField('sort', [
     {
-      [timeFieldName]: {
+      [timeField.name]: {
         order: SortDirection.desc,
         format: 'strict_date_optional_time||epoch_millis',
       },
diff --git a/x-pack/plugins/stack_alerts/server/rule_types/es_query/rule_type.test.ts b/x-pack/plugins/stack_alerts/server/rule_types/es_query/rule_type.test.ts
index 781bf37da84e3e..e89734bafb828a 100644
--- a/x-pack/plugins/stack_alerts/server/rule_types/es_query/rule_type.test.ts
+++ b/x-pack/plugins/stack_alerts/server/rule_types/es_query/rule_type.test.ts
@@ -633,6 +633,7 @@ describe('ruleType', () => {
       toSpec: () => {
         return { id: 'test-id', title: 'test-title', timeFieldName: 'timestamp', fields: [] };
       },
+      getTimeField: () => dataViewMock.fields[1],
     };
     const defaultParams: OnlySearchSourceRuleParams = {
       size: 100,
@@ -701,12 +702,12 @@ describe('ruleType', () => {
 
       (searchSourceInstanceMock.getField as jest.Mock).mockImplementationOnce((name: string) => {
         if (name === 'index') {
-          return { dataViewMock, timeFieldName: undefined };
+          return { dataViewMock, getTimeField: () => undefined, id: 1234 };
         }
       });
 
       await expect(invokeExecutor({ params, ruleServices })).rejects.toThrow(
-        'Invalid data view without timeFieldName.'
+        'Data view with ID 1234 no longer contains a time field.'
       );
     });
 
@@ -717,6 +718,7 @@ describe('ruleType', () => {
       (ruleServices.dataViews.create as jest.Mock).mockResolvedValueOnce({
         ...dataViewMock.toSpec(),
         toSpec: () => dataViewMock.toSpec(),
+        getTimeField: () => dataViewMock.fields[1],
         toMinimalSpec: () => dataViewMock.toSpec(),
       });
       (searchSourceInstanceMock.getField as jest.Mock).mockImplementation((name: string) => {
diff --git a/x-pack/plugins/stack_connectors/public/connector_types/jira/jira_params.tsx b/x-pack/plugins/stack_connectors/public/connector_types/jira/jira_params.tsx
index 5846014979ee95..6946fd4363661b 100644
--- a/x-pack/plugins/stack_connectors/public/connector_types/jira/jira_params.tsx
+++ b/x-pack/plugins/stack_connectors/public/connector_types/jira/jira_params.tsx
@@ -417,7 +417,7 @@ const JiraParamsFields: React.FunctionComponent<ActionParamsProps<JiraActionPara
                     'xpack.stackConnectors.components.jira.otherFieldsHelpText',
                     {
                       defaultMessage:
-                        'Custom fields are not validated by the connector. To avoid failed actions, ensure compliance with your Jira policies.',
+                        'Additional fields are not validated by the connector. To avoid failed actions, ensure compliance with your Jira policies.',
                     }
                   )}
                 />
diff --git a/x-pack/plugins/task_manager/server/task_scheduling.test.ts b/x-pack/plugins/task_manager/server/task_scheduling.test.ts
index 36de95416e1ca9..df5f93a50ec8bb 100644
--- a/x-pack/plugins/task_manager/server/task_scheduling.test.ts
+++ b/x-pack/plugins/task_manager/server/task_scheduling.test.ts
@@ -6,7 +6,7 @@
  */
 
 import sinon from 'sinon';
-import { Subject } from 'rxjs';
+import { BehaviorSubject, Observable, Subject } from 'rxjs';
 import moment from 'moment';
 
 import { asTaskRunEvent, TaskPersistence } from './task_events';
@@ -836,16 +836,15 @@ describe('TaskScheduling', () => {
   });
 
   describe('ephemeralRunNow', () => {
-    // https://github.com/elastic/kibana/issues/181847
-    test.skip('runs a task ephemerally', async () => {
-      const ephemeralEvents$ = new Subject<TaskLifecycleEvent>();
+    test('runs a task ephemerally', async () => {
+      const ephemeralEvents$ = new BehaviorSubject<Partial<TaskLifecycleEvent>>({});
       const ephemeralTask = taskManagerMock.createTask({
         state: {
           foo: 'bar',
         },
       });
       const customEphemeralTaskLifecycleMock = ephemeralTaskLifecycleMock.create({
-        events$: ephemeralEvents$,
+        events$: ephemeralEvents$ as Observable<TaskLifecycleEvent>,
       });
 
       customEphemeralTaskLifecycleMock.attemptToRun.mockImplementation((value) => {
@@ -880,7 +879,6 @@ describe('TaskScheduling', () => {
           })
         )
       );
-
       await expect(result).resolves.toEqual({ id: 'v4uuid', state: { foo: 'bar' } });
     });
 
diff --git a/x-pack/plugins/task_manager/server/task_scheduling.ts b/x-pack/plugins/task_manager/server/task_scheduling.ts
index c57e54c76a98d4..bc04b6da221257 100644
--- a/x-pack/plugins/task_manager/server/task_scheduling.ts
+++ b/x-pack/plugins/task_manager/server/task_scheduling.ts
@@ -390,8 +390,8 @@ export class TaskScheduling {
             (taskInstance: OkResultOf<TaskLifecycleEvent>) => {
               // resolve if the task has run sucessfully
               if (isTaskRunEvent(taskEvent)) {
-                subscription.unsubscribe();
                 resolve(pick((taskInstance as RanTask).task, ['id', 'state']));
+                subscription.unsubscribe();
               }
             },
             async (errorResult: ErrResultOf<TaskLifecycleEvent>) => {
diff --git a/x-pack/plugins/timelines/public/types.ts b/x-pack/plugins/timelines/public/types.ts
index a91d8669debc7e..4dabbe9ceb5121 100644
--- a/x-pack/plugins/timelines/public/types.ts
+++ b/x-pack/plugins/timelines/public/types.ts
@@ -17,6 +17,9 @@ import { HoverActionsConfig } from './components/hover_actions';
 import { LastUpdatedAtProps } from './components/last_updated';
 import { LoadingPanelProps } from './components/loading';
 export interface TimelinesUIStart {
+  /**
+   * @deprecated Use cell-actions package instead
+   */
   getHoverActions: () => HoverActionsConfig;
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   getTimelineReducer: () => any;
diff --git a/x-pack/plugins/transform/server/lib/alerting/transform_health_rule_type/transform_health_service.test.ts b/x-pack/plugins/transform/server/lib/alerting/transform_health_rule_type/transform_health_service.test.ts
new file mode 100644
index 00000000000000..cbe68b096e09d2
--- /dev/null
+++ b/x-pack/plugins/transform/server/lib/alerting/transform_health_rule_type/transform_health_service.test.ts
@@ -0,0 +1,128 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { transformHealthServiceProvider } from './transform_health_service';
+import type { ElasticsearchClient } from '@kbn/core/server';
+import type { RulesClient } from '@kbn/alerting-plugin/server';
+import type { FieldFormatsRegistry } from '@kbn/field-formats-plugin/common';
+import { elasticsearchServiceMock } from '@kbn/core-elasticsearch-server-mocks';
+import { rulesClientMock } from '@kbn/alerting-plugin/server/rules_client.mock';
+import type {
+  TransformGetTransformResponse,
+  TransformGetTransformStatsResponse,
+} from '@elastic/elasticsearch/lib/api/types';
+
+describe('transformHealthServiceProvider', () => {
+  let esClient: jest.Mocked<ElasticsearchClient>;
+  let rulesClient: jest.Mocked<RulesClient>;
+  let fieldFormatsRegistry: jest.Mocked<FieldFormatsRegistry>;
+
+  beforeEach(() => {
+    esClient = elasticsearchServiceMock.createClusterClient().asInternalUser;
+
+    (esClient.transform.getTransform as jest.Mock).mockResolvedValue({
+      count: 3,
+      transforms: [
+        // Mock continuous transforms
+        ...new Array(102).fill(null).map((_, i) => ({
+          id: `transform${i}`,
+          sync: true,
+        })),
+        {
+          id: 'transform102',
+          sync: false,
+        },
+      ],
+    } as unknown as TransformGetTransformResponse);
+    (esClient.transform.getTransformStats as jest.Mock).mockResolvedValue({
+      count: 2,
+      transforms: [{}],
+    } as unknown as TransformGetTransformStatsResponse);
+
+    rulesClient = rulesClientMock.create();
+    fieldFormatsRegistry = {
+      deserialize: jest.fn(),
+    } as unknown as jest.Mocked<FieldFormatsRegistry>;
+  });
+
+  afterEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('should fetch transform stats by transform IDs if the length does not exceed the URL limit', async () => {
+    const service = transformHealthServiceProvider({ esClient, rulesClient, fieldFormatsRegistry });
+    const result = await service.getHealthChecksResults({
+      includeTransforms: ['*'],
+      excludeTransforms: ['transform4', 'transform6', 'transform62'],
+      testsConfig: null,
+    });
+
+    expect(esClient.transform.getTransform).toHaveBeenCalledWith({
+      allow_no_match: true,
+      size: 1000,
+    });
+    expect(esClient.transform.getTransformStats).toHaveBeenCalledTimes(1);
+    expect(esClient.transform.getTransformStats).toHaveBeenNthCalledWith(1, {
+      basic: true,
+      transform_id:
+        'transform0,transform1,transform2,transform3,transform5,transform7,transform8,transform9,transform10,transform11,transform12,transform13,transform14,transform15,transform16,transform17,transform18,transform19,transform20,transform21,transform22,transform23,transform24,transform25,transform26,transform27,transform28,transform29,transform30,transform31,transform32,transform33,transform34,transform35,transform36,transform37,transform38,transform39,transform40,transform41,transform42,transform43,transform44,transform45,transform46,transform47,transform48,transform49,transform50,transform51,transform52,transform53,transform54,transform55,transform56,transform57,transform58,transform59,transform60,transform61,transform63,transform64,transform65,transform66,transform67,transform68,transform69,transform70,transform71,transform72,transform73,transform74,transform75,transform76,transform77,transform78,transform79,transform80,transform81,transform82,transform83,transform84,transform85,transform86,transform87,transform88,transform89,transform90,transform91,transform92,transform93,transform94,transform95,transform96,transform97,transform98,transform99,transform100,transform101',
+    });
+
+    expect(result).toBeDefined();
+  });
+
+  it('should fetch all transform stats and filter by transform IDs if the length exceeds the URL limit', async () => {
+    const transformIdPrefix = 'transform_with_a_very_long_id_that_result_in_long_url_for_sure_';
+
+    (esClient.transform.getTransform as jest.Mock).mockResolvedValue({
+      count: 3,
+      transforms: [
+        // Mock continuous transforms
+        ...new Array(102).fill(null).map((_, i) => ({
+          id: `${transformIdPrefix}${i}`,
+          sync: true,
+        })),
+        {
+          id: 'transform102',
+          sync: false,
+        },
+      ],
+    } as unknown as TransformGetTransformResponse);
+
+    (esClient.transform.getTransformStats as jest.Mock).mockResolvedValue({
+      count: 2,
+      transforms: [
+        ...new Array(200).fill(null).map((_, i) => ({
+          id: `${transformIdPrefix}${i}`,
+          transform_state: 'stopped',
+        })),
+      ],
+    } as unknown as TransformGetTransformStatsResponse);
+
+    const service = transformHealthServiceProvider({ esClient, rulesClient, fieldFormatsRegistry });
+    const result = await service.getHealthChecksResults({
+      includeTransforms: ['*'],
+      excludeTransforms: new Array(50).fill(null).map((_, i) => `${transformIdPrefix}${i + 60}`),
+      testsConfig: null,
+    });
+
+    expect(esClient.transform.getTransform).toHaveBeenCalledWith({
+      allow_no_match: true,
+      size: 1000,
+    });
+    expect(esClient.transform.getTransformStats).toHaveBeenCalledTimes(1);
+    expect(esClient.transform.getTransformStats).toHaveBeenNthCalledWith(1, {
+      basic: true,
+    });
+
+    const notStarted = result[0];
+
+    expect(notStarted.context.message).toEqual(
+      'Transform transform_with_a_very_long_id_that_result_in_long_url_for_sure_0, transform_with_a_very_long_id_that_result_in_long_url_for_sure_1, transform_with_a_very_long_id_that_result_in_long_url_for_sure_2, transform_with_a_very_long_id_that_result_in_long_url_for_sure_3, transform_with_a_very_long_id_that_result_in_long_url_for_sure_4, transform_with_a_very_long_id_that_result_in_long_url_for_sure_5, transform_with_a_very_long_id_that_result_in_long_url_for_sure_6, transform_with_a_very_long_id_that_result_in_long_url_for_sure_7, transform_with_a_very_long_id_that_result_in_long_url_for_sure_8, transform_with_a_very_long_id_that_result_in_long_url_for_sure_9, transform_with_a_very_long_id_that_result_in_long_url_for_sure_10, transform_with_a_very_long_id_that_result_in_long_url_for_sure_11, transform_with_a_very_long_id_that_result_in_long_url_for_sure_12, transform_with_a_very_long_id_that_result_in_long_url_for_sure_13, transform_with_a_very_long_id_that_result_in_long_url_for_sure_14, transform_with_a_very_long_id_that_result_in_long_url_for_sure_15, transform_with_a_very_long_id_that_result_in_long_url_for_sure_16, transform_with_a_very_long_id_that_result_in_long_url_for_sure_17, transform_with_a_very_long_id_that_result_in_long_url_for_sure_18, transform_with_a_very_long_id_that_result_in_long_url_for_sure_19, transform_with_a_very_long_id_that_result_in_long_url_for_sure_20, transform_with_a_very_long_id_that_result_in_long_url_for_sure_21, transform_with_a_very_long_id_that_result_in_long_url_for_sure_22, transform_with_a_very_long_id_that_result_in_long_url_for_sure_23, transform_with_a_very_long_id_that_result_in_long_url_for_sure_24, transform_with_a_very_long_id_that_result_in_long_url_for_sure_25, transform_with_a_very_long_id_that_result_in_long_url_for_sure_26, transform_with_a_very_long_id_that_result_in_long_url_for_sure_27, transform_with_a_very_long_id_that_result_in_long_url_for_sure_28, transform_with_a_very_long_id_that_result_in_long_url_for_sure_29, transform_with_a_very_long_id_that_result_in_long_url_for_sure_30, transform_with_a_very_long_id_that_result_in_long_url_for_sure_31, transform_with_a_very_long_id_that_result_in_long_url_for_sure_32, transform_with_a_very_long_id_that_result_in_long_url_for_sure_33, transform_with_a_very_long_id_that_result_in_long_url_for_sure_34, transform_with_a_very_long_id_that_result_in_long_url_for_sure_35, transform_with_a_very_long_id_that_result_in_long_url_for_sure_36, transform_with_a_very_long_id_that_result_in_long_url_for_sure_37, transform_with_a_very_long_id_that_result_in_long_url_for_sure_38, transform_with_a_very_long_id_that_result_in_long_url_for_sure_39, transform_with_a_very_long_id_that_result_in_long_url_for_sure_40, transform_with_a_very_long_id_that_result_in_long_url_for_sure_41, transform_with_a_very_long_id_that_result_in_long_url_for_sure_42, transform_with_a_very_long_id_that_result_in_long_url_for_sure_43, transform_with_a_very_long_id_that_result_in_long_url_for_sure_44, transform_with_a_very_long_id_that_result_in_long_url_for_sure_45, transform_with_a_very_long_id_that_result_in_long_url_for_sure_46, transform_with_a_very_long_id_that_result_in_long_url_for_sure_47, transform_with_a_very_long_id_that_result_in_long_url_for_sure_48, transform_with_a_very_long_id_that_result_in_long_url_for_sure_49, transform_with_a_very_long_id_that_result_in_long_url_for_sure_50, transform_with_a_very_long_id_that_result_in_long_url_for_sure_51, transform_with_a_very_long_id_that_result_in_long_url_for_sure_52, transform_with_a_very_long_id_that_result_in_long_url_for_sure_53, transform_with_a_very_long_id_that_result_in_long_url_for_sure_54, transform_with_a_very_long_id_that_result_in_long_url_for_sure_55, transform_with_a_very_long_id_that_result_in_long_url_for_sure_56, transform_with_a_very_long_id_that_result_in_long_url_for_sure_57, transform_with_a_very_long_id_that_result_in_long_url_for_sure_58, transform_with_a_very_long_id_that_result_in_long_url_for_sure_59 are not started.'
+    );
+  });
+});
diff --git a/x-pack/plugins/transform/server/lib/alerting/transform_health_rule_type/transform_health_service.ts b/x-pack/plugins/transform/server/lib/alerting/transform_health_rule_type/transform_health_service.ts
index 48d411feeae785..7ad2fdde6057dc 100644
--- a/x-pack/plugins/transform/server/lib/alerting/transform_health_rule_type/transform_health_service.ts
+++ b/x-pack/plugins/transform/server/lib/alerting/transform_health_rule_type/transform_health_service.ts
@@ -13,21 +13,21 @@ import type { RulesClient } from '@kbn/alerting-plugin/server';
 import type { FieldFormatsRegistry } from '@kbn/field-formats-plugin/common';
 import { FIELD_FORMAT_IDS } from '@kbn/field-formats-plugin/common';
 import type { TransformStats } from '../../../../common/types/transform_stats';
-import { TRANSFORM_HEALTH_STATUS } from '../../../../common/constants';
-import type { TransformHealthRuleParams } from './schema';
 import {
-  mapEsHealthStatus2TransformHealthStatus,
   ALL_TRANSFORMS_SELECTION,
+  mapEsHealthStatus2TransformHealthStatus,
   TRANSFORM_HEALTH_CHECK_NAMES,
+  TRANSFORM_HEALTH_STATUS,
   TRANSFORM_NOTIFICATIONS_INDEX,
   TRANSFORM_RULE_TYPE,
   TRANSFORM_STATE,
 } from '../../../../common/constants';
+import type { TransformHealthRuleParams } from './schema';
 import { getResultTestConfig } from '../../../../common/utils/alerts';
 import type {
   ErrorMessagesTransformResponse,
-  TransformStateReportResponse,
   TransformHealthAlertContext,
+  TransformStateReportResponse,
 } from './register_transform_health_rule_type';
 import type { TransformHealthAlertRule } from '../../../../common/types/alerting';
 import { isContinuousTransform } from '../../../../common/types/transform';
@@ -46,6 +46,8 @@ type Transform = estypes.TransformGetTransformTransformSummary & {
 
 type TransformWithAlertingRules = Transform & { alerting_rules: TransformHealthAlertRule[] };
 
+const maxPathComponentLength = 2000;
+
 export function transformHealthServiceProvider({
   esClient,
   rulesClient,
@@ -58,7 +60,7 @@ export function transformHealthServiceProvider({
   const transformsDict = new Map<string, Transform>();
 
   /**
-   * Resolves result transform selection.
+   * Resolves result transform selection. Only continuously running transforms are included.
    * @param includeTransforms
    * @param excludeTransforms
    * @param skipIDsCheck
@@ -67,7 +69,7 @@ export function transformHealthServiceProvider({
     includeTransforms: string[],
     excludeTransforms: string[] | null,
     skipIDsCheck = false
-  ): Promise<string[]> => {
+  ): Promise<Set<string>> => {
     const includeAll = includeTransforms.some((id) => id === ALL_TRANSFORMS_SELECTION);
 
     let resultTransformIds: string[] = [];
@@ -86,6 +88,7 @@ export function transformHealthServiceProvider({
 
       transformsResponse.forEach((t) => {
         transformsDict.set(t.id, t);
+        // Include only continuously running transforms.
         if (t.sync) {
           resultTransformIds.push(t.id);
         }
@@ -97,16 +100,34 @@ export function transformHealthServiceProvider({
       resultTransformIds = resultTransformIds.filter((id) => !excludeIdsSet.has(id));
     }
 
-    return resultTransformIds;
+    return new Set(resultTransformIds);
   };
 
-  const getTransformStats = memoize(async (transformIds: string[]): Promise<TransformStats[]> => {
-    return (
-      await esClient.transform.getTransformStats({
-        transform_id: transformIds.join(','),
-      })
-    ).transforms as TransformStats[];
-  });
+  const getTransformStats = memoize(
+    async (transformIds: Set<string>): Promise<TransformStats[]> => {
+      const transformIdsString = Array.from(transformIds).join(',');
+
+      if (transformIdsString.length < maxPathComponentLength) {
+        return (
+          await esClient.transform.getTransformStats({
+            transform_id: transformIdsString,
+            // @ts-expect-error `basic` query option not yet in @elastic/elasticsearch
+            basic: true,
+          })
+        ).transforms as TransformStats[];
+      } else {
+        // Fetch all transforms and filter out the ones that are not in the list.
+        return (
+          (
+            await esClient.transform.getTransformStats({
+              // @ts-expect-error `basic` query option not yet in @elastic/elasticsearch
+              basic: true,
+            })
+          ).transforms as TransformStats[]
+        ).filter((t) => transformIds.has(t.id));
+      }
+    }
+  );
 
   function baseTransformAlertResponseFormatter(
     transformStats: TransformStats
@@ -144,7 +165,7 @@ export function transformHealthServiceProvider({
      * @return - Partitions with not started and started transforms
      */
     async getTransformsStateReport(
-      transformIds: string[]
+      transformIds: Set<string>
     ): Promise<[TransformStateReportResponse[], TransformStateReportResponse[]]> {
       const transformsStats = await getTransformStats(transformIds);
 
@@ -161,7 +182,7 @@ export function transformHealthServiceProvider({
      * @param transformIds
      */
     async getErrorMessagesReport(
-      transformIds: string[]
+      transformIds: Set<string>
     ): Promise<ErrorMessagesTransformResponse[]> {
       interface TransformErrorsBucket {
         key: string;
@@ -185,7 +206,7 @@ export function transformHealthServiceProvider({
               },
               {
                 terms: {
-                  transform_id: transformIds,
+                  transform_id: Array.from(transformIds),
                 },
               },
             ],
@@ -195,7 +216,7 @@ export function transformHealthServiceProvider({
           by_transform: {
             terms: {
               field: 'transform_id',
-              size: transformIds.length,
+              size: transformIds.size,
             },
             aggs: {
               error_messages: {
@@ -212,11 +233,7 @@ export function transformHealthServiceProvider({
       });
 
       // If transform contains errors, it's in a failed state
-      const transformsStats = (
-        await esClient.transform.getTransformStats({
-          transform_id: transformIds.join(','),
-        })
-      ).transforms;
+      const transformsStats = await getTransformStats(transformIds);
       const failedTransforms = new Set(
         transformsStats.filter((t) => t.state === TRANSFORM_STATE.FAILED).map((t) => t.id)
       );
@@ -235,7 +252,7 @@ export function transformHealthServiceProvider({
      * @param transformIds
      */
     async getUnhealthyTransformsReport(
-      transformIds: string[]
+      transformIds: Set<string>
     ): Promise<TransformStateReportResponse[]> {
       const transformsStats = await getTransformStats(transformIds);
 
@@ -314,7 +331,7 @@ export function transformHealthServiceProvider({
                   {
                     defaultMessage:
                       'No errors in the {count, plural, one {transform} other {transforms}} messages.',
-                    values: { count: transformIds.length },
+                    values: { count: transformIds.size },
                   }
                 )
               : i18n.translate('xpack.transform.alertTypes.transformHealth.errorMessagesMessage', {
@@ -380,7 +397,7 @@ export function transformHealthServiceProvider({
 
       for (const ruleInstance of transformAlertingRules.data) {
         // Retrieve result transform IDs
-        const resultTransformIds: string[] = await getResultsTransformIds(
+        const resultTransformIds = await getResultsTransformIds(
           ruleInstance.params.includeTransforms.includes(ALL_TRANSFORMS_SELECTION)
             ? Object.keys(transformMap)
             : ruleInstance.params.includeTransforms,
diff --git a/x-pack/plugins/transform/tsconfig.json b/x-pack/plugins/transform/tsconfig.json
index 3164ed3a06c04b..ad4ae492171bd7 100644
--- a/x-pack/plugins/transform/tsconfig.json
+++ b/x-pack/plugins/transform/tsconfig.json
@@ -76,7 +76,8 @@
     "@kbn/code-editor",
     "@kbn/rule-data-utils",
     "@kbn/react-kibana-context-render",
-    "@kbn/search-types"
+    "@kbn/search-types",
+    "@kbn/core-elasticsearch-server-mocks"
   ],
   "exclude": [
     "target/**/*",
diff --git a/x-pack/plugins/translations/translations/fr-FR.json b/x-pack/plugins/translations/translations/fr-FR.json
index c5a3f25e771975..d487a14632c737 100644
--- a/x-pack/plugins/translations/translations/fr-FR.json
+++ b/x-pack/plugins/translations/translations/fr-FR.json
@@ -2474,7 +2474,6 @@
     "discover.noResults.suggestion.syntaxPopoverDescriptionHeader": "Description",
     "discover.noResults.suggestion.syntaxPopoverExampleHeader": "Exemple",
     "discover.noResults.suggestion.tryText": "Voici quelques solutions à essayer :",
-    "discover.noResults.suggestion.viewAllMatchesButtonText": "Afficher toutes les correspondances",
     "discover.notifications.invalidTimeRangeText": "La plage temporelle spécifiée n'est pas valide (de : \"{from}\" à \"{to}\").",
     "discover.notifications.invalidTimeRangeTitle": "Plage temporelle non valide",
     "discover.notifications.notSavedSearchTitle": "La recherche \"{savedSearchTitle}\" n'a pas été enregistrée.",
@@ -8780,7 +8779,6 @@
     "xpack.apm.serviceNodeMetrics.unidentifiedServiceNodesWarningText": "Nous n'avons pas pu déterminer à quelles JVM ces indicateurs correspondent. Cela provient probablement du fait que vous exécutez une version du serveur APM antérieure à 7.5. La mise à niveau du serveur APM vers la version 7.5 ou supérieure devrait résoudre le problème. Pour plus d'informations sur la mise à niveau, consultez {link}. Vous pouvez également utiliser la barre de recherche de Kibana pour filtrer par nom d'hôte, par ID de conteneur ou en fonction d'autres champs.",
     "xpack.apm.serviceOveriew.errorsTableOccurrences": "{occurrences} occ.",
     "xpack.apm.serviceOverview.crashTableOccurrences": "{occurrences} occ.",
-    "xpack.apm.serviceOverview.embeddedMap.error.toastDescription": "L'usine incorporable ayant l'ID \"{embeddableFactoryId}\" est introuvable.",
     "xpack.apm.serviceOverview.embeddedMap.subtitle": "Carte affichant le nombre total de {currentMap} en fonction du pays et de la région",
     "xpack.apm.serviceOverview.errorsTableOccurrences": "{occurrences} occ.",
     "xpack.apm.serviceOverview.instancesTableTitle": "{count} le plus élevé {count, plural, one {instance} other {instances}}",
@@ -9926,8 +9924,6 @@
     "xpack.apm.serviceOverview.embeddedMap.dropdown.http.requests.subtitle": "HTTP définit un ensemble de méthodes de requête pour indiquer l'action souhaitée à effectuer pour une ressource donnée",
     "xpack.apm.serviceOverview.embeddedMap.dropdown.sessions": "Sessions",
     "xpack.apm.serviceOverview.embeddedMap.dropdown.sessions.subtitle": "Une session d'application commence lorsqu'un utilisateur démarre une application et se termine lorsque l'application est fermée.",
-    "xpack.apm.serviceOverview.embeddedMap.error": "Impossible de charger la carte",
-    "xpack.apm.serviceOverview.embeddedMap.error.toastTitle": "Une erreur s'est produite lors de l'ajout de l'incorporation de la carte",
     "xpack.apm.serviceOverview.embeddedMap.httpRequests.country.label": "Requêtes HTTP par pays",
     "xpack.apm.serviceOverview.embeddedMap.httpRequests.metric.label": "Requêtes HTTP",
     "xpack.apm.serviceOverview.embeddedMap.httpRequests.region.label": "Requêtes HTTP par région",
@@ -13188,9 +13184,7 @@
     "xpack.datasetQuality.expandLabel": "Développer",
     "xpack.datasetQuality.fetchDatasetDetailsFailed": "Nous n'avons pas pu obtenir les détails de votre ensemble de données.",
     "xpack.datasetQuality.fetchDatasetDetailsFailed.noDatasetSelected": "Vous n'avez sélectionné aucun ensemble de données",
-    "xpack.datasetQuality.fetchDatasetsActivityFailed": "Nous n'avons pas pu obtenir les détails de vos ensembles de données actifs ou inactifs. Les valeurs par défaut sont affichées.",
     "xpack.datasetQuality.fetchDatasetsEstimatedDataFailed": "Nous n'avons pas pu obtenir les données estimées de vos ensembles de données. Les valeurs par défaut sont affichées.",
-    "xpack.datasetQuality.fetchDatasetsQualityDetailsFailed": "Nous n'avons pas pu obtenir de détails concernant la qualité de vos ensembles de données. Les valeurs par défaut sont affichées.",
     "xpack.datasetQuality.fetchDatasetStatsFailed": "Nous n'avons pas pu obtenir vos ensembles de données.",
     "xpack.datasetQuality.fetchDegradedStatsFailed": "Nous n'avons pas pu obtenir d'informations sur vos documents dégradés.",
     "xpack.datasetQuality.flyoutCancelText": "Annuler",
@@ -13521,8 +13515,6 @@
     "xpack.dataVisualizer.index.actionsPanel.discoverAppTitle": "Discover",
     "xpack.dataVisualizer.index.actionsPanel.exploreTitle": "Explorer vos données",
     "xpack.dataVisualizer.index.actionsPanel.viewIndexInDiscoverDescription": "Explorez les documents de votre index.",
-    "xpack.dataVisualizer.index.components.grid.description": "Visualiser les données",
-    "xpack.dataVisualizer.index.components.grid.displayName": "Grille du visualiseur de données",
     "xpack.dataVisualizer.index.dataGrid.actionsColumnLabel": "Actions",
     "xpack.dataVisualizer.index.dataGrid.deleteDataViewFieldTitle": "Supprimer le champ de la vue de données",
     "xpack.dataVisualizer.index.dataGrid.deleteIndexPatternFieldDescription": "Supprimer le champ de la vue de données",
@@ -17662,7 +17654,6 @@
     "xpack.fleet.fleetServerSetupPermissionDeniedErrorMessage": "Le serveur Fleet doit être configuré. Pour cela, le privilège de cluster {roleName} est requis. Contactez votre administrateur.",
     "xpack.fleet.googleCloudShell.guide.description": "La commande Google Cloud Shell ci-dessous permet de créer toutes les ressources nécessaires à l'évaluation de la sécurité de vos projets GCP. En savoir plus sur {learnMore}.",
     "xpack.fleet.homeIntegration.tutorialModule.noticeText": "{notePrefix} Une version plus récente de ce module est {availableAsIntegrationLink}. Pour en savoir plus sur les intégrations et le nouvel agent Elastic Agent, lisez notre {blogPostLink}.",
-    "xpack.fleet.integration.settings.versionInfo.updatesAvailableBody": "Passez à la version {latestVersion} pour bénéficier des fonctionnalités les plus récentes.",
     "xpack.fleet.integrations.confirmUpdateModal.body.agentCount": "{agentCount, plural, one {# agent} other {# agents}}",
     "xpack.fleet.integrations.confirmUpdateModal.body.policyCount": "{packagePolicyCount, plural, one {# politique d’intégration} other {# politiques d’intégration}}",
     "xpack.fleet.integrations.installPackage.installingPackageButtonLabel": "Installation des ressources {title} en cours",
@@ -18080,7 +18071,6 @@
     "xpack.fleet.agentPolicyList.addButton": "Créer une stratégie d'agent",
     "xpack.fleet.agentPolicyList.agentsColumnTitle": "Agents",
     "xpack.fleet.agentPolicyList.clearFiltersLinkText": "Effacer les filtres",
-    "xpack.fleet.agentPolicyList.descriptionColumnTitle": "Description",
     "xpack.fleet.agentPolicyList.loadingAgentPoliciesMessage": "Chargement des stratégies d'agent en cours…",
     "xpack.fleet.agentPolicyList.nameColumnTitle": "Nom",
     "xpack.fleet.agentPolicyList.noAgentPoliciesPrompt": "Aucune stratégie d'agent",
@@ -24333,7 +24323,6 @@
     "xpack.maps.source.esGrid.compositePaginationErrorMessage": "{layerName} génère trop de requêtes. Réduisez \"Résolution de la grille\" et/ou réduisez le nombre d'indicateurs de premier terme.",
     "xpack.maps.source.esGrid.resolutionParamErrorMessage": "Paramètre de résolution de grille non reconnu : {resolution}",
     "xpack.maps.source.esJoin.countLabel": "compte de {indexPatternLabel}",
-    "xpack.maps.source.esql.getColumnsErrorMsg": "Impossible de charger les colonnes. {errorMessage}",
     "xpack.maps.source.esql.multipleGeometryColumnErrorMsg": "La requête Elasticsearch ES|QL comporte {count} colonnes géométriques alors qu'une seule est autorisée. Utilisez 'DROP' (abandonner) ou 'KEEP' (conserver) pour réduire les colonnes.",
     "xpack.maps.source.esSearch.clusterScalingLabel": "Afficher les clusters lorsque les résultats dépassent {maxResultWindow}",
     "xpack.maps.source.esSearch.convertToGeoJsonErrorMsg": "Impossible de convertir la réponse de la recherche à la collecte de fonctionnalités geoJson, erreur : {errorMsg}",
@@ -25596,7 +25585,6 @@
     "xpack.ml.actions.createADJobFromLens": "Créer une tâche de détection des anomalies",
     "xpack.ml.actions.createADJobFromPatternAnalysis": "Créer une tâche de catégorisation et de détection des anomalies",
     "xpack.ml.actions.editAnomalyChartsTitle": "Modifier les graphiques d'anomalies",
-    "xpack.ml.actions.editSwimlaneTitle": "Modifier le couloir",
     "xpack.ml.actions.openInAnomalyExplorerTitle": "Ouvrir dans Anomaly Explorer",
     "xpack.ml.actions.runPatternAnalysis.description": "Déclenché lorsque l'utilisateur souhaite effectuer une analyse du modèle sur un champ.",
     "xpack.ml.actions.runPatternAnalysis.title": "Exécuter l'analyse du modèle",
@@ -29861,32 +29849,12 @@
     "xpack.observability_onboarding.apiKeyBanner.field.label": "Clé d'API",
     "xpack.observability_onboarding.apiKeyBanner.loading": "Création d’une clé d’API",
     "xpack.observability_onboarding.apiKeyBanner.noPermissions": "L’utilisateur ne dispose pas d’autorisations pour créer une clé d’API.",
-    "xpack.observability_onboarding.breadcrumbs.customLogs": "Diffuser des fichiers log",
     "xpack.observability_onboarding.breadcrumbs.onboarding": "Intégration",
-    "xpack.observability_onboarding.breadcrumbs.systemLogs": "Logs système",
-    "xpack.observability_onboarding.card.apm.description": "Collecter des traces, des logs et des indicateurs depuis un agent personnalisé d'OpenTelemetry ou APM.",
-    "xpack.observability_onboarding.card.apm.title": "Collecter des données de performances applicatives",
-    "xpack.observability_onboarding.card.customLogs.description.text": "Diffuser facilement n'importe quels logs dans Elastic et explorer leurs données.",
-    "xpack.observability_onboarding.card.customLogs.title": "Diffuser des fichiers log",
-    "xpack.observability_onboarding.card.elasticAgent": "Elastic Agent",
-    "xpack.observability_onboarding.card.getStarted": "Démarrer",
-    "xpack.observability_onboarding.card.integrations.awsFirehose": "Firehose AWS",
-    "xpack.observability_onboarding.card.integrations.quickLinks": "Liens rapides :",
-    "xpack.observability_onboarding.card.integrations.sampleData": "Utiliser un exemple de données",
-    "xpack.observability_onboarding.card.integrations.start": "Lancer l'exploration",
-    "xpack.observability_onboarding.card.integrations.title": "Explorez plus de 300 façons d'ingérer des données avec nos intégrations",
-    "xpack.observability_onboarding.card.integrations.uploadFile": "Charger un fichier",
-    "xpack.observability_onboarding.card.k8s.description": "Collecter des logs et des indicateurs depuis les clusters Kubernetes grâce à Elastic Agent.",
-    "xpack.observability_onboarding.card.k8s.title": "Collecter les données de clusters Kubernetes",
-    "xpack.observability_onboarding.card.systemLogs.description1": "La voie la plus courte pour intégrer des données de log depuis votre machine ou votre serveur.",
-    "xpack.observability_onboarding.card.systemLogs.quickstartBadge": "Démarrage rapide",
-    "xpack.observability_onboarding.card.systemLogs.title": "Diffuser les logs système de l'hôte",
     "xpack.observability_onboarding.configureLogs.advancedSettings": "Paramètres avancés",
     "xpack.observability_onboarding.configureLogs.customConfig": "Configurations personnalisées",
     "xpack.observability_onboarding.configureLogs.description": "Configurer les entrées",
     "xpack.observability_onboarding.configureLogs.learnMore": "En savoir plus",
     "xpack.observability_onboarding.configureLogs.logFile.addRow": "Ajouter une ligne",
-    "xpack.observability_onboarding.configureLogs.logFile.helper": "Vous pouvez utiliser un chemin de fichier log ou un modèle de log.",
     "xpack.observability_onboarding.configureLogs.logFile.path": "Chemin de fichier log",
     "xpack.observability_onboarding.configureLogs.logFile.placeholder": "Exemple : /var/log/application.*",
     "xpack.observability_onboarding.configureLogs.namespace": "Espace de nom",
@@ -29898,14 +29866,11 @@
     "xpack.observability_onboarding.configureLogs.serviceName.tooltip": "Fournir un nom de service permet aux services distribués qui tournent sur plusieurs hôtes de mettre en corrélation les instances liées.",
     "xpack.observability_onboarding.configureLogsContent.euiButtonIcon.deleteLabel": "Supprimer",
     "xpack.observability_onboarding.customLogs.installShipper.title": "Installer l'agent de transfert pour collecter les logs",
-    "xpack.observability_onboarding.exploreOtherIntegrations": "Explorer d’autres intégrations",
     "xpack.observability_onboarding.fetcher.error.status": "Erreur",
     "xpack.observability_onboarding.fetcher.error.title": "Erreur lors de la récupération des ressources",
     "xpack.observability_onboarding.fetcher.error.url": "URL",
     "xpack.observability_onboarding.form.optional": "Facultatif",
     "xpack.observability_onboarding.header.feedback": "Donner un retour",
-    "xpack.observability_onboarding.home.description": "Sélectionner la méthode de votre choix pour collecter les données dans Observability.",
-    "xpack.observability_onboarding.home.title": "Collectez et analysez les logs",
     "xpack.observability_onboarding.inspect.h3.pathLabel": "Chemin",
     "xpack.observability_onboarding.inspect.h3.stateLabel": "État",
     "xpack.observability_onboarding.inspect.h3.usageLabel": "Utilisation",
@@ -29940,19 +29905,6 @@
     "xpack.observability_onboarding.installElasticAgent.progress.logsIngest.incompleteTitle": "Transfert des logs dans Elastic Observability",
     "xpack.observability_onboarding.installElasticAgent.progress.logsIngest.loadingTitle": "En attente du transfert des logs…",
     "xpack.observability_onboarding.installElasticAgent.troubleshooting": "Résolution des problèmes",
-    "xpack.observability_onboarding.selectLogs.chooseType": "Quels logs voulez-vous collecter ?",
-    "xpack.observability_onboarding.selectLogs.httpEndpointLogs": "Point de terminaison HTTP",
-    "xpack.observability_onboarding.selectLogs.httpEndpointLogs.description": "Collecter des données JSON du port HTTP à l’écoute.",
-    "xpack.observability_onboarding.selectLogs.networkStreamingLogs": "Logs de diffusion du réseau",
-    "xpack.observability_onboarding.selectLogs.other": "Autre",
-    "xpack.observability_onboarding.selectLogs.streamLogFiles": "Diffuser des fichiers log",
-    "xpack.observability_onboarding.selectLogs.streamLogFiles.description": "Diffusez votre fichier log ou votre répertoire.",
-    "xpack.observability_onboarding.selectLogs.sysLog": "TCP/UDP/Syslog",
-    "xpack.observability_onboarding.selectLogs.sysLog.description": "Diffusez des logs sur des ports TCP, UDP, ou depuis votre serveur syslog.",
-    "xpack.observability_onboarding.selectLogs.uploadLogFiles": "Chargez des fichiers log",
-    "xpack.observability_onboarding.selectLogs.uploadLogFiles.description": "Téléchargez les données d'un fichier CSV, TSV, JSON ou d’un autre type de fichier log pour analyse.",
-    "xpack.observability_onboarding.selectLogs.useOwnShipper": "Obtenir une clé d’API",
-    "xpack.observability_onboarding.selectLogs.useOwnShipper.description": "Utilisez votre propre agent de transfert pour collecter des données de logs en générant une clé d’API.",
     "xpack.observability_onboarding.steps.back": "Retour",
     "xpack.observability_onboarding.steps.exploreLogs": "Explorer les logs",
     "xpack.observability_onboarding.systemIntegration.installed.tooltip.description": "Les intégrations rationalisent la connexion de vos donnés avec la Suite Elastic.",
@@ -29965,8 +29917,6 @@
     "xpack.observability_onboarding.systemLogs.installElasticAgent.progress.logsIngest.incompleteTitle": "Transfert des logs dans Elastic Observability",
     "xpack.observability_onboarding.systemLogs.installElasticAgent.progress.logsIngest.loadingTitle": "En attente du transfert des logs…",
     "xpack.observability_onboarding.systemLogs.installShipper.title": "Installer l'agent de transfert pour collecter les logs système",
-    "xpack.observability_onboarding.title.collectCustomLogs": "Transmettre des fichiers log à Elastic",
-    "xpack.observability_onboarding.title.collectSystemLogs": "Installer l'agent de transfert pour collecter les logs système",
     "xpack.observability_onboarding.windows.installStep.description": "Cette intégration n'est actuellement disponible que sur les systèmes Linux et MacOS. Consultez notre documentation pour en savoir plus sur la diffusion de fichiers de log vers Elastic depuis un système Windows.",
     "xpack.observability_onboarding.windows.installStep.link.label": "Lire la documentation",
     "xpack.observability.alerts.untrackConfirmation.errorNotification.descriptionText": "Impossible d'arrêter le suivi pour {uuidsCount, plural, one {alerte} other {alertes}}",
@@ -33072,7 +33022,6 @@
     "xpack.securitySolution.detectionResponse.noDataCurrent": "Aucune donnée {dataType} à comparer à partir de la plage temporelle actuelle",
     "xpack.securitySolution.detectionResponse.timeDifference": "Votre {statType} est {upOrDown} de {percentageChange} par rapport à {stat}",
     "xpack.securitySolution.detections.hostIsolation.impactedCases": "Cette action sera ajoutée aux {cases}.",
-    "xpack.securitySolution.dragAndDrop.youAreInADialogContainingOptionsScreenReaderOnly": "Vous êtes dans une boîte de dialogue contenant des options pour le champ {fieldName}. Appuyez sur Tab pour naviguer entre les options. Appuyez sur Échap pour quitter.",
     "xpack.securitySolution.editDataProvider.unavailableOperator": "L'opérateur {operator} n'est pas disponible avec les modèles",
     "xpack.securitySolution.enableRiskScore.enableRiskScore": "Activer le score de risque de {riskEntity}",
     "xpack.securitySolution.enableRiskScore.enableRiskScoreDescription": "Une fois que vous avez activé cette fonctionnalité, vous pouvez obtenir un accès rapide aux scores de risque de {riskEntity} dans cette section. Les données pourront prendre jusqu'à une heure pour être générées après l'activation du module.",
@@ -33265,7 +33214,6 @@
     "xpack.securitySolution.hoverActions.investigateInResolverForRowAriaLabel": "Analyser l'alerte ou l'événement de la ligne {ariaRowindex}, avec les colonnes {columnValues}",
     "xpack.securitySolution.hoverActions.moreActionsForRowAriaLabel": "Sélectionner davantage d'actions pour l'alerte ou l'événement de la ligne {ariaRowindex}, avec les colonnes {columnValues}",
     "xpack.securitySolution.hoverActions.sendAlertToTimelineForRowAriaLabel": "Envoyer l'alerte de la ligne {ariaRowindex} à la chronologie, avec les colonnes {columnValues}",
-    "xpack.securitySolution.hoverActions.showTopTooltip": "Afficher les premiers {fieldName}",
     "xpack.securitySolution.hoverActions.viewDetailsForRowAriaLabel": "Afficher les détails pour l'alerte ou l'événement de la ligne {ariaRowindex}, avec les colonnes {columnValues}",
     "xpack.securitySolution.indexPatterns.failureToastText": "Une erreur inattendue s'est produite lors de la mise à jour. Si vous souhaitez modifier vos données, vous pouvez sélectionner manuellement une vue de données {link}.",
     "xpack.securitySolution.indexPatterns.missingPatterns": "La vue de données Security ne contient pas les modèles d'indexation suivants nécessaires pour recréer la vue de données de la chronologie précédente : {callout}",
@@ -45164,4 +45112,4 @@
     "xpack.serverlessObservability.nav.projectSettings": "Paramètres de projet",
     "xpack.serverlessObservability.nav.synthetics": "Synthetics"
   }
-}
+}
\ No newline at end of file
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index c319d13c704d81..c48ac5918ab0c0 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -2472,7 +2472,6 @@
     "discover.noResults.suggestion.syntaxPopoverDescriptionHeader": "説明",
     "discover.noResults.suggestion.syntaxPopoverExampleHeader": "例",
     "discover.noResults.suggestion.tryText": "次の方法を試してください：",
-    "discover.noResults.suggestion.viewAllMatchesButtonText": "すべての一致を表示",
     "discover.notifications.invalidTimeRangeText": "指定された時間範囲が無効です。（開始：'{from}'、終了：'{to}'）",
     "discover.notifications.invalidTimeRangeTitle": "無効な時間範囲",
     "discover.notifications.notSavedSearchTitle": "検索「{savedSearchTitle}」は保存されませんでした。",
@@ -8762,7 +8761,6 @@
     "xpack.apm.serviceNodeMetrics.unidentifiedServiceNodesWarningText": "これらのメトリックが所属する JVM を特定できませんでした。7.5 よりも古い APM Server を実行していることが原因である可能性が高いです。この問題は APM Server 7.5 以降にアップグレードすることで解決されます。アップグレードに関する詳細は、{link} をご覧ください。代わりに Kibana クエリバーを使ってホスト名、コンテナー ID、またはその他フィールドでフィルタリングすることもできます。",
     "xpack.apm.serviceOveriew.errorsTableOccurrences": "{occurrences}件",
     "xpack.apm.serviceOverview.crashTableOccurrences": "{occurrences}件",
-    "xpack.apm.serviceOverview.embeddedMap.error.toastDescription": "id \"{embeddableFactoryId}\"の埋め込み可能ファクトリが見つかりました。",
     "xpack.apm.serviceOverview.embeddedMap.subtitle": "国と地域別に基づく{currentMap}の総数を示した地図",
     "xpack.apm.serviceOverview.errorsTableOccurrences": "{occurrences}件",
     "xpack.apm.serviceOverview.instancesTableTitle": "上位{count} {count, plural, other {件のインスタンス}}",
@@ -9906,8 +9904,6 @@
     "xpack.apm.serviceOverview.embeddedMap.dropdown.http.requests.subtitle": "HTTPは、特定のリソースに対して実行させたい任意のアクションを指示する一連のリクエストメソッドを定義します。",
     "xpack.apm.serviceOverview.embeddedMap.dropdown.sessions": "セッション",
     "xpack.apm.serviceOverview.embeddedMap.dropdown.sessions.subtitle": "ユーザーがアプリケーションを起動すると、アプリケーションセッションが開始します。アプリケーションが終了すると、アプリケーションセッションも終了します。",
-    "xpack.apm.serviceOverview.embeddedMap.error": "マップを読み込めませんでした",
-    "xpack.apm.serviceOverview.embeddedMap.error.toastTitle": "埋め込み可能なマップの追加中にエラーが発生しました",
     "xpack.apm.serviceOverview.embeddedMap.httpRequests.country.label": "国別HTTPリクエスト",
     "xpack.apm.serviceOverview.embeddedMap.httpRequests.metric.label": "HTTPリクエスト",
     "xpack.apm.serviceOverview.embeddedMap.httpRequests.region.label": "地域別HTTPリクエスト",
@@ -13168,9 +13164,7 @@
     "xpack.datasetQuality.expandLabel": "拡張",
     "xpack.datasetQuality.fetchDatasetDetailsFailed": "データセット詳細を取得できませんでした。",
     "xpack.datasetQuality.fetchDatasetDetailsFailed.noDatasetSelected": "データセットが選択されていません",
-    "xpack.datasetQuality.fetchDatasetsActivityFailed": "アクティブ/非アクティブなデータセット詳細を取得できませんでした。デフォルト値が表示されます。",
     "xpack.datasetQuality.fetchDatasetsEstimatedDataFailed": "データセット推定データを取得できませんでした。デフォルト値が表示されます。",
-    "xpack.datasetQuality.fetchDatasetsQualityDetailsFailed": "データセット品質詳細を取得できませんでした。デフォルト値が表示されます。",
     "xpack.datasetQuality.fetchDatasetStatsFailed": "データセットを取得できませんでした。",
     "xpack.datasetQuality.fetchDegradedStatsFailed": "劣化したドキュメント情報を取得できませんでした。",
     "xpack.datasetQuality.flyoutCancelText": "キャンセル",
@@ -13500,8 +13494,6 @@
     "xpack.dataVisualizer.index.actionsPanel.discoverAppTitle": "Discover",
     "xpack.dataVisualizer.index.actionsPanel.exploreTitle": "データの調査",
     "xpack.dataVisualizer.index.actionsPanel.viewIndexInDiscoverDescription": "インデックスのドキュメントを調査します。",
-    "xpack.dataVisualizer.index.components.grid.description": "データの可視化",
-    "xpack.dataVisualizer.index.components.grid.displayName": "データビジュアライザーグリッド",
     "xpack.dataVisualizer.index.dataGrid.actionsColumnLabel": "アクション",
     "xpack.dataVisualizer.index.dataGrid.deleteDataViewFieldTitle": "データビューフィールドを削除",
     "xpack.dataVisualizer.index.dataGrid.deleteIndexPatternFieldDescription": "データビューフィールドを削除",
@@ -17639,7 +17631,6 @@
     "xpack.fleet.fleetServerSetupPermissionDeniedErrorMessage": "Fleetサーバーを設定する必要があります。これには{roleName}クラスター権限が必要です。管理者にお問い合わせください。",
     "xpack.fleet.googleCloudShell.guide.description": "以下のGoogle Cloud Shellコマンドは、GCPプロジェクトのセキュリティ態勢を評価するために必要なすべてのリソースを作成します。{learnMore}の詳細をご覧ください。",
     "xpack.fleet.homeIntegration.tutorialModule.noticeText": "{notePrefix}このモジュールの新しいバージョンは{availableAsIntegrationLink}です。統合と新しいElasticエージェントの詳細については、{blogPostLink}をお読みください。",
-    "xpack.fleet.integration.settings.versionInfo.updatesAvailableBody": "バージョン{latestVersion}にアップグレードして最新の機能を入手してください。",
     "xpack.fleet.integrations.confirmUpdateModal.body.agentCount": "{agentCount, plural, other  {# 個のエージェント}}",
     "xpack.fleet.integrations.confirmUpdateModal.body.policyCount": "{packagePolicyCount, plural, other  {# 個の統合ポリシー}}",
     "xpack.fleet.integrations.installPackage.installingPackageButtonLabel": "{title} アセットをインストールしています",
@@ -18057,7 +18048,6 @@
     "xpack.fleet.agentPolicyList.addButton": "エージェントポリシーを作成",
     "xpack.fleet.agentPolicyList.agentsColumnTitle": "エージェント",
     "xpack.fleet.agentPolicyList.clearFiltersLinkText": "フィルターを消去",
-    "xpack.fleet.agentPolicyList.descriptionColumnTitle": "説明",
     "xpack.fleet.agentPolicyList.loadingAgentPoliciesMessage": "エージェントポリシーの読み込み中…",
     "xpack.fleet.agentPolicyList.nameColumnTitle": "名前",
     "xpack.fleet.agentPolicyList.noAgentPoliciesPrompt": "エージェントポリシーがありません",
@@ -24308,7 +24298,6 @@
     "xpack.maps.source.esGrid.compositePaginationErrorMessage": "{layerName} はリクエスト過多の原因になります。「グリッド解像度」を下げるか、またはトップ用語「メトリック」の数を減らしてください。",
     "xpack.maps.source.esGrid.resolutionParamErrorMessage": "グリッド解像度パラメーターが認識されません：{resolution}",
     "xpack.maps.source.esJoin.countLabel": "{indexPatternLabel}の数",
-    "xpack.maps.source.esql.getColumnsErrorMsg": "列を読み込めません。{errorMessage}",
     "xpack.maps.source.esql.multipleGeometryColumnErrorMsg": "1のみが許可されているときには、Elasticsearch ES|QLクエリには{count}ジオメトリ列があります。DROPまたはKEEPを使用して、列を絞り込んでください。",
     "xpack.maps.source.esSearch.clusterScalingLabel": "結果が{maxResultWindow}を超えたらクラスターを表示",
     "xpack.maps.source.esSearch.convertToGeoJsonErrorMsg": "検索への応答を geoJson 機能コレクションに変換できません。エラー：{errorMsg}",
@@ -25569,7 +25558,6 @@
     "xpack.ml.actions.createADJobFromLens": "異常検知ジョブの作成",
     "xpack.ml.actions.createADJobFromPatternAnalysis": "分類異常検知ジョブを作成",
     "xpack.ml.actions.editAnomalyChartsTitle": "異常グラフを編集",
-    "xpack.ml.actions.editSwimlaneTitle": "スイムレーンの編集",
     "xpack.ml.actions.openInAnomalyExplorerTitle": "異常エクスプローラーで開く",
     "xpack.ml.actions.runPatternAnalysis.description": "ユーザーがフィールドに対してパターン分析を実行する場合にトリガーされます。",
     "xpack.ml.actions.runPatternAnalysis.title": "パターン分析を実行",
@@ -29832,32 +29820,12 @@
     "xpack.observability_onboarding.apiKeyBanner.field.label": "APIキー",
     "xpack.observability_onboarding.apiKeyBanner.loading": "APIキーを作成中",
     "xpack.observability_onboarding.apiKeyBanner.noPermissions": "ユーザーにはAPIキーを作成する権限がありません。",
-    "xpack.observability_onboarding.breadcrumbs.customLogs": "ログファイルを配信",
     "xpack.observability_onboarding.breadcrumbs.onboarding": "オンボーディング",
-    "xpack.observability_onboarding.breadcrumbs.systemLogs": "システムログ",
-    "xpack.observability_onboarding.card.apm.description": "OpenTelemetryまたはAPMカスタムエージェントからトレース、ログ、メトリックを収集します。",
-    "xpack.observability_onboarding.card.apm.title": "アプリケーションパフォーマンスデータを収集",
-    "xpack.observability_onboarding.card.customLogs.description.text": "あらゆるログをシンプルな方法でElasticにストリーミングし、データを探索します。",
-    "xpack.observability_onboarding.card.customLogs.title": "ログファイルを配信",
-    "xpack.observability_onboarding.card.elasticAgent": "Elasticエージェント",
-    "xpack.observability_onboarding.card.getStarted": "使ってみる",
-    "xpack.observability_onboarding.card.integrations.awsFirehose": "AWS Firehose",
-    "xpack.observability_onboarding.card.integrations.quickLinks": "クイックリンク：",
-    "xpack.observability_onboarding.card.integrations.sampleData": "サンプルデータを使用",
-    "xpack.observability_onboarding.card.integrations.start": "探索を開始",
-    "xpack.observability_onboarding.card.integrations.title": "Elasticの統合による300以上のデータインジェスト方法を見る",
-    "xpack.observability_onboarding.card.integrations.uploadFile": "ファイルをアップロード",
-    "xpack.observability_onboarding.card.k8s.description": "Elasticエージェントを使用して、Kubernetesクラスターからログとメトリックを収集します。",
-    "xpack.observability_onboarding.card.k8s.title": "Kubernetesクラスターデータを収集",
-    "xpack.observability_onboarding.card.systemLogs.description1": "お客様のコンピューターやサーバーからログデータをオンボードする最短の方法。",
-    "xpack.observability_onboarding.card.systemLogs.quickstartBadge": "クイックスタート",
-    "xpack.observability_onboarding.card.systemLogs.title": "ホストシステムログをストリーム",
     "xpack.observability_onboarding.configureLogs.advancedSettings": "高度な設定",
     "xpack.observability_onboarding.configureLogs.customConfig": "カスタム構成",
     "xpack.observability_onboarding.configureLogs.description": "入力を構成",
     "xpack.observability_onboarding.configureLogs.learnMore": "詳細",
     "xpack.observability_onboarding.configureLogs.logFile.addRow": "行の追加",
-    "xpack.observability_onboarding.configureLogs.logFile.helper": "ログファイルのパスまたはログパターンを使用できます。",
     "xpack.observability_onboarding.configureLogs.logFile.path": "ログファイルパス",
     "xpack.observability_onboarding.configureLogs.logFile.placeholder": "例：/var/log/application.*",
     "xpack.observability_onboarding.configureLogs.namespace": "名前空間",
@@ -29869,14 +29837,11 @@
     "xpack.observability_onboarding.configureLogs.serviceName.tooltip": "複数のホスト上で実行される分散サービスが関連するインスタンスを関連付けることができるように、サービス名を指定します。",
     "xpack.observability_onboarding.configureLogsContent.euiButtonIcon.deleteLabel": "削除",
     "xpack.observability_onboarding.customLogs.installShipper.title": "ログを収集するためのシッパーをインストール",
-    "xpack.observability_onboarding.exploreOtherIntegrations": "その他の統合を見る",
     "xpack.observability_onboarding.fetcher.error.status": "エラー",
     "xpack.observability_onboarding.fetcher.error.title": "リソースの取得中にエラーが発生しました",
     "xpack.observability_onboarding.fetcher.error.url": "URL",
     "xpack.observability_onboarding.form.optional": "オプション",
     "xpack.observability_onboarding.header.feedback": "フィードバックを作成する",
-    "xpack.observability_onboarding.home.description": "オブザーバビリティにデータを収集する方法を選択します。",
-    "xpack.observability_onboarding.home.title": "ログを収集して分析",
     "xpack.observability_onboarding.inspect.h3.pathLabel": "パス",
     "xpack.observability_onboarding.inspect.h3.stateLabel": "ステータス",
     "xpack.observability_onboarding.inspect.h3.usageLabel": "使用方法",
@@ -29911,19 +29876,6 @@
     "xpack.observability_onboarding.installElasticAgent.progress.logsIngest.incompleteTitle": "Elasticオブザーバビリティにログを送信",
     "xpack.observability_onboarding.installElasticAgent.progress.logsIngest.loadingTitle": "ログの送信を待機中...",
     "xpack.observability_onboarding.installElasticAgent.troubleshooting": "トラブルシューティング",
-    "xpack.observability_onboarding.selectLogs.chooseType": "どのログを収集しますか？",
-    "xpack.observability_onboarding.selectLogs.httpEndpointLogs": "HTTPエンドポイント",
-    "xpack.observability_onboarding.selectLogs.httpEndpointLogs.description": "待機中のHTTPポートからJSONデータを収集します。",
-    "xpack.observability_onboarding.selectLogs.networkStreamingLogs": "ネットワークストリーミングログ",
-    "xpack.observability_onboarding.selectLogs.other": "その他",
-    "xpack.observability_onboarding.selectLogs.streamLogFiles": "ログファイルを配信",
-    "xpack.observability_onboarding.selectLogs.streamLogFiles.description": "ログファイルまたはディレクトリを配信",
-    "xpack.observability_onboarding.selectLogs.sysLog": "TCP/UDP/Syslog",
-    "xpack.observability_onboarding.selectLogs.sysLog.description": "TCPまたはUDPポート経由またはsyslogサーバーからログを配信します。",
-    "xpack.observability_onboarding.selectLogs.uploadLogFiles": "ログファイルをアップロード",
-    "xpack.observability_onboarding.selectLogs.uploadLogFiles.description": "分析するため、CSV、TSV、JSON、他のログファイルタイプからアップロードします。",
-    "xpack.observability_onboarding.selectLogs.useOwnShipper": "APIキーを取得",
-    "xpack.observability_onboarding.selectLogs.useOwnShipper.description": "APIキーを生成し、ログデータを収集するために独自のシッパーを使用します。",
     "xpack.observability_onboarding.steps.back": "戻る",
     "xpack.observability_onboarding.steps.exploreLogs": "ログを探索",
     "xpack.observability_onboarding.systemIntegration.installed.tooltip.description": "統合により、Elastic Stackへのデータ接続が効率化されます。",
@@ -29936,8 +29888,6 @@
     "xpack.observability_onboarding.systemLogs.installElasticAgent.progress.logsIngest.incompleteTitle": "Elasticオブザーバビリティにログを送信",
     "xpack.observability_onboarding.systemLogs.installElasticAgent.progress.logsIngest.loadingTitle": "ログの送信を待機中...",
     "xpack.observability_onboarding.systemLogs.installShipper.title": "システムログを収集するためのシッパーをインストール",
-    "xpack.observability_onboarding.title.collectCustomLogs": "Elasticにログファイルを配信",
-    "xpack.observability_onboarding.title.collectSystemLogs": "システムログを収集するためのシッパーをインストール",
     "xpack.observability_onboarding.windows.installStep.description": "現在、このオンボーディングはLinuxとMacOSシステムでのみ利用可能です。WindowsシステムからElasticにログファイルをストリーミングする方法については、当社のドキュメントをご覧ください。",
     "xpack.observability_onboarding.windows.installStep.link.label": "ドキュメントを読む",
     "xpack.observability.alerts.untrackConfirmation.errorNotification.descriptionText": "{uuidsCount, plural, other {アラート}}を追跡解除できませんでした",
@@ -33040,7 +32990,6 @@
     "xpack.securitySolution.detectionResponse.noDataCurrent": "現在の時間範囲から比較する{dataType}データがありません",
     "xpack.securitySolution.detectionResponse.timeDifference": "ご使用の{statType}は{stat}から{percentageChange}{upOrDown}",
     "xpack.securitySolution.detections.hostIsolation.impactedCases": "このアクションは{cases}に追加されます。",
-    "xpack.securitySolution.dragAndDrop.youAreInADialogContainingOptionsScreenReaderOnly": "フィールド {fieldName} のオプションを含む、ダイアログを表示しています。Tab を押すと、オプションを操作します。Escape を押すと、終了します。",
     "xpack.securitySolution.editDataProvider.unavailableOperator": "{operator}演算子はテンプレートで使用できません",
     "xpack.securitySolution.enableRiskScore.enableRiskScore": "{riskEntity}リスクスコアを有効化",
     "xpack.securitySolution.enableRiskScore.enableRiskScoreDescription": "この機能を有効化すると、このセクションで{riskEntity}リスクスコアにすばやくアクセスできます。モジュールを有効化した後、データの生成までに1時間かかる場合があります。",
@@ -33232,7 +33181,6 @@
     "xpack.securitySolution.hoverActions.investigateInResolverForRowAriaLabel": "行 {ariaRowindex}、列 {columnValues} のアラートまたはイベントを分析",
     "xpack.securitySolution.hoverActions.moreActionsForRowAriaLabel": "行 {ariaRowindex}、列 {columnValues} のアラートまたはイベントのその他のアクションを選択",
     "xpack.securitySolution.hoverActions.sendAlertToTimelineForRowAriaLabel": "行 {ariaRowindex}、列 {columnValues} のイベントのアラートを送信",
-    "xpack.securitySolution.hoverActions.showTopTooltip": "上位の{fieldName}を表示",
     "xpack.securitySolution.hoverActions.viewDetailsForRowAriaLabel": "行 {ariaRowindex}、列 {columnValues} のアラートまたはイベントの詳細を表示",
     "xpack.securitySolution.indexPatterns.failureToastText": "更新時に予期しないエラーが発生しました。データを変更する場合は、手動でデータビュー{link}を選択できます。",
     "xpack.securitySolution.indexPatterns.missingPatterns": "以前のタイムラインのデータビューを再作成するには、セキュリティデータビューに次のインデックスパターンがありません：{callout}",
@@ -45134,4 +45082,4 @@
     "xpack.serverlessObservability.nav.projectSettings": "プロジェクト設定",
     "xpack.serverlessObservability.nav.synthetics": "Synthetics"
   }
-}
+}
\ No newline at end of file
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index 7264328c582f7d..a6c1ce697da77f 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -2476,7 +2476,6 @@
     "discover.noResults.suggestion.syntaxPopoverDescriptionHeader": "描述",
     "discover.noResults.suggestion.syntaxPopoverExampleHeader": "示例",
     "discover.noResults.suggestion.tryText": "这里是要尝试的一些内容：",
-    "discover.noResults.suggestion.viewAllMatchesButtonText": "查看所有匹配项",
     "discover.notifications.invalidTimeRangeText": "提供的时间范围无效。（自：“{from}”，至：“{to}”）",
     "discover.notifications.invalidTimeRangeTitle": "时间范围无效",
     "discover.notifications.notSavedSearchTitle": "搜索“{savedSearchTitle}”未保存。",
@@ -8783,7 +8782,6 @@
     "xpack.apm.serviceNodeMetrics.unidentifiedServiceNodesWarningText": "无法识别这些指标属于哪些 JVM。这可能因为运行的 APM Server 版本低于 7.5。如果升级到 APM Server 7.5 或更高版本，应可解决此问题。有关升级的详细信息，请参阅 {link}。或者，也可以使用 Kibana 查询栏按主机名、容器 ID 或其他字段筛选。",
     "xpack.apm.serviceOveriew.errorsTableOccurrences": "{occurrences} 次",
     "xpack.apm.serviceOverview.crashTableOccurrences": "{occurrences} 次",
-    "xpack.apm.serviceOverview.embeddedMap.error.toastDescription": "未找到 ID 为“{embeddableFactoryId}”的可嵌入工厂。",
     "xpack.apm.serviceOverview.embeddedMap.subtitle": "根据国家和区域显示 {currentMap} 总数的地图",
     "xpack.apm.serviceOverview.errorsTableOccurrences": "{occurrences} 次",
     "xpack.apm.serviceOverview.instancesTableTitle": "排名前 {count} {count, plural, other {实例}}",
@@ -9929,8 +9927,6 @@
     "xpack.apm.serviceOverview.embeddedMap.dropdown.http.requests.subtitle": "HTTP 定义一组请求方法，以指示要对给定资源执行的所需操作",
     "xpack.apm.serviceOverview.embeddedMap.dropdown.sessions": "会话",
     "xpack.apm.serviceOverview.embeddedMap.dropdown.sessions.subtitle": "用户启动应用程序时，应用程序会话即开始；应用程序退出时会话即结束。",
-    "xpack.apm.serviceOverview.embeddedMap.error": "无法加载地图",
-    "xpack.apm.serviceOverview.embeddedMap.error.toastTitle": "加载地图可嵌入对象时出错",
     "xpack.apm.serviceOverview.embeddedMap.httpRequests.country.label": "按国家/地区的 HTTP 请求",
     "xpack.apm.serviceOverview.embeddedMap.httpRequests.metric.label": "HTTP 请求",
     "xpack.apm.serviceOverview.embeddedMap.httpRequests.region.label": "按区域的 HTTP 请求",
@@ -13193,9 +13189,7 @@
     "xpack.datasetQuality.expandLabel": "展开",
     "xpack.datasetQuality.fetchDatasetDetailsFailed": "无法获取数据集详情。",
     "xpack.datasetQuality.fetchDatasetDetailsFailed.noDatasetSelected": "尚未选择任何数据集",
-    "xpack.datasetQuality.fetchDatasetsActivityFailed": "无法获取活动/非活动数据集详情。将显示默认值。",
     "xpack.datasetQuality.fetchDatasetsEstimatedDataFailed": "无法获取数据集估计数据。将显示默认值。",
-    "xpack.datasetQuality.fetchDatasetsQualityDetailsFailed": "无法获取数据集质量详情。将显示默认值。",
     "xpack.datasetQuality.fetchDatasetStatsFailed": "无法获取数据集。",
     "xpack.datasetQuality.fetchDegradedStatsFailed": "无法获取已降级文档信息。",
     "xpack.datasetQuality.flyoutCancelText": "取消",
@@ -13526,8 +13520,6 @@
     "xpack.dataVisualizer.index.actionsPanel.discoverAppTitle": "Discover",
     "xpack.dataVisualizer.index.actionsPanel.exploreTitle": "浏览您的数据",
     "xpack.dataVisualizer.index.actionsPanel.viewIndexInDiscoverDescription": "浏览您的索引中的文档。",
-    "xpack.dataVisualizer.index.components.grid.description": "可视化数据",
-    "xpack.dataVisualizer.index.components.grid.displayName": "数据可视化工具网格",
     "xpack.dataVisualizer.index.dataGrid.actionsColumnLabel": "操作",
     "xpack.dataVisualizer.index.dataGrid.deleteDataViewFieldTitle": "删除数据视图字段",
     "xpack.dataVisualizer.index.dataGrid.deleteIndexPatternFieldDescription": "删除数据视图字段",
@@ -17667,7 +17659,6 @@
     "xpack.fleet.fleetServerSetupPermissionDeniedErrorMessage": "需要设置 Fleet 服务器。这需要 {roleName} 集群权限。请联系您的管理员。",
     "xpack.fleet.googleCloudShell.guide.description": "以下 Google Cloud Shell 命令将创建所有必要资源来评估您的 GCP 组织的安全态势。详细了解 {learnMore}。",
     "xpack.fleet.homeIntegration.tutorialModule.noticeText": "{notePrefix} 此模块的较新版本为 {availableAsIntegrationLink}。要详细了解集成和新 Elastic 代理，请阅读我们的{blogPostLink}。",
-    "xpack.fleet.integration.settings.versionInfo.updatesAvailableBody": "升级到版本 {latestVersion} 可获取最新功能。",
     "xpack.fleet.integrations.confirmUpdateModal.body.agentCount": "{agentCount, plural, other {# 个代理}}",
     "xpack.fleet.integrations.confirmUpdateModal.body.policyCount": "{packagePolicyCount, plural, other {# 个集成策略}}",
     "xpack.fleet.integrations.installPackage.installingPackageButtonLabel": "正在安装 {title} 资产",
@@ -18086,7 +18077,6 @@
     "xpack.fleet.agentPolicyList.addButton": "创建代理策略",
     "xpack.fleet.agentPolicyList.agentsColumnTitle": "代理",
     "xpack.fleet.agentPolicyList.clearFiltersLinkText": "清除筛选",
-    "xpack.fleet.agentPolicyList.descriptionColumnTitle": "描述",
     "xpack.fleet.agentPolicyList.loadingAgentPoliciesMessage": "正在加载代理策略…...",
     "xpack.fleet.agentPolicyList.nameColumnTitle": "名称",
     "xpack.fleet.agentPolicyList.noAgentPoliciesPrompt": "无代理策略",
@@ -24341,7 +24331,6 @@
     "xpack.maps.source.esGrid.compositePaginationErrorMessage": "{layerName} 正导致过多的请求。降低“网格分辨率”和/或减少热门词“指标”的数量。",
     "xpack.maps.source.esGrid.resolutionParamErrorMessage": "无法识别网格分辨率参数：{resolution}",
     "xpack.maps.source.esJoin.countLabel": "{indexPatternLabel} 的计数",
-    "xpack.maps.source.esql.getColumnsErrorMsg": "无法加载列。{errorMessage}",
     "xpack.maps.source.esql.multipleGeometryColumnErrorMsg": "只允许 1 列时，Elasticsearch ES|QL 查询具有 {count} 个几何图形列。请使用“DROP”或“KEEP”缩小列范围。",
     "xpack.maps.source.esSearch.clusterScalingLabel": "结果超过 {maxResultWindow} 个时显示集群",
     "xpack.maps.source.esSearch.convertToGeoJsonErrorMsg": "无法将搜索响应转换成 geoJson 功能集合，错误：{errorMsg}",
@@ -25607,7 +25596,6 @@
     "xpack.ml.actions.createADJobFromLens": "创建异常检测作业",
     "xpack.ml.actions.createADJobFromPatternAnalysis": "创建归类异常检测作业",
     "xpack.ml.actions.editAnomalyChartsTitle": "编辑异常图表",
-    "xpack.ml.actions.editSwimlaneTitle": "编辑泳道",
     "xpack.ml.actions.openInAnomalyExplorerTitle": "在 Anomaly Explorer 中打开",
     "xpack.ml.actions.runPatternAnalysis.description": "在用户希望对字段运行模式分析时触发。",
     "xpack.ml.actions.runPatternAnalysis.title": "运行模式分析",
@@ -29872,32 +29860,12 @@
     "xpack.observability_onboarding.apiKeyBanner.field.label": "API 密钥",
     "xpack.observability_onboarding.apiKeyBanner.loading": "正在创建 API 密钥",
     "xpack.observability_onboarding.apiKeyBanner.noPermissions": "用户无权创建 API 密钥。",
-    "xpack.observability_onboarding.breadcrumbs.customLogs": "流式传输日志文件",
     "xpack.observability_onboarding.breadcrumbs.onboarding": "载入",
-    "xpack.observability_onboarding.breadcrumbs.systemLogs": "系统日志",
-    "xpack.observability_onboarding.card.apm.description": "从 OpenTelemetry 或 APM 定制代理中收集跟踪、日志和指标。",
-    "xpack.observability_onboarding.card.apm.title": "收集应用程序性能数据",
-    "xpack.observability_onboarding.card.customLogs.description.text": "通过简单的方法将任何日志流式传输到 Elastic，并浏览其数据。",
-    "xpack.observability_onboarding.card.customLogs.title": "流式传输日志文件",
-    "xpack.observability_onboarding.card.elasticAgent": "Elastic 代理",
-    "xpack.observability_onboarding.card.getStarted": "开始使用",
-    "xpack.observability_onboarding.card.integrations.awsFirehose": "AWS Firehose",
-    "xpack.observability_onboarding.card.integrations.quickLinks": "快速链接：",
-    "xpack.observability_onboarding.card.integrations.sampleData": "使用样例数据",
-    "xpack.observability_onboarding.card.integrations.start": "开始浏览",
-    "xpack.observability_onboarding.card.integrations.title": "探索 300 多种利用集成采集数据的方法",
-    "xpack.observability_onboarding.card.integrations.uploadFile": "上传文件",
-    "xpack.observability_onboarding.card.k8s.description": "使用 Elastic 代理从 Kubernetes 集群中收集日志和指标。",
-    "xpack.observability_onboarding.card.k8s.title": "收集 Kubernetes 集群数据",
-    "xpack.observability_onboarding.card.systemLogs.description1": "从您自己的机器或服务器载入日志数据的最快路径。",
-    "xpack.observability_onboarding.card.systemLogs.quickstartBadge": "快速启动",
-    "xpack.observability_onboarding.card.systemLogs.title": "流式传输主机系统日志",
     "xpack.observability_onboarding.configureLogs.advancedSettings": "高级设置",
     "xpack.observability_onboarding.configureLogs.customConfig": "定制配置",
     "xpack.observability_onboarding.configureLogs.description": "配置输入",
     "xpack.observability_onboarding.configureLogs.learnMore": "了解详情",
     "xpack.observability_onboarding.configureLogs.logFile.addRow": "添加行",
-    "xpack.observability_onboarding.configureLogs.logFile.helper": "可以使用日志文件路径或日志模式。",
     "xpack.observability_onboarding.configureLogs.logFile.path": "日志文件路径",
     "xpack.observability_onboarding.configureLogs.logFile.placeholder": "示例：/var/log/application.*",
     "xpack.observability_onboarding.configureLogs.namespace": "命名空间",
@@ -29909,14 +29877,11 @@
     "xpack.observability_onboarding.configureLogs.serviceName.tooltip": "提供服务名称以便在多个主机上运行的分布式服务关联相关实例。",
     "xpack.observability_onboarding.configureLogsContent.euiButtonIcon.deleteLabel": "删除",
     "xpack.observability_onboarding.customLogs.installShipper.title": "安装采集器以收集日志",
-    "xpack.observability_onboarding.exploreOtherIntegrations": "浏览其他集成",
     "xpack.observability_onboarding.fetcher.error.status": "错误",
     "xpack.observability_onboarding.fetcher.error.title": "提取资源时出错",
     "xpack.observability_onboarding.fetcher.error.url": "URL",
     "xpack.observability_onboarding.form.optional": "可选",
     "xpack.observability_onboarding.header.feedback": "反馈",
-    "xpack.observability_onboarding.home.description": "选择用于在 Observability 中收集数据的方法。",
-    "xpack.observability_onboarding.home.title": "收集和分析日志",
     "xpack.observability_onboarding.inspect.h3.pathLabel": "路径",
     "xpack.observability_onboarding.inspect.h3.stateLabel": "状态",
     "xpack.observability_onboarding.inspect.h3.usageLabel": "用法",
@@ -29951,19 +29916,6 @@
     "xpack.observability_onboarding.installElasticAgent.progress.logsIngest.incompleteTitle": "传输日志到 Elastic Observability",
     "xpack.observability_onboarding.installElasticAgent.progress.logsIngest.loadingTitle": "等待传输日志......",
     "xpack.observability_onboarding.installElasticAgent.troubleshooting": "故障排除",
-    "xpack.observability_onboarding.selectLogs.chooseType": "您希望收集哪些日志？",
-    "xpack.observability_onboarding.selectLogs.httpEndpointLogs": "HTTP 终端",
-    "xpack.observability_onboarding.selectLogs.httpEndpointLogs.description": "从正在侦听的 HTTP 端口收集 JSON 数据。",
-    "xpack.observability_onboarding.selectLogs.networkStreamingLogs": "网络流日志",
-    "xpack.observability_onboarding.selectLogs.other": "其他",
-    "xpack.observability_onboarding.selectLogs.streamLogFiles": "流式传输日志文件",
-    "xpack.observability_onboarding.selectLogs.streamLogFiles.description": "流式传输日志文件或目录。",
-    "xpack.observability_onboarding.selectLogs.sysLog": "TCP/UDP/Syslog",
-    "xpack.observability_onboarding.selectLogs.sysLog.description": "通过 TCP 或 UDP 端口或者从 syslog 服务器流式传输日志。",
-    "xpack.observability_onboarding.selectLogs.uploadLogFiles": "上传日志文件",
-    "xpack.observability_onboarding.selectLogs.uploadLogFiles.description": "通过 CSV、TSV、JSON 或其他日志文件类型上传数据以进行分析。",
-    "xpack.observability_onboarding.selectLogs.useOwnShipper": "获取 API 密钥",
-    "xpack.observability_onboarding.selectLogs.useOwnShipper.description": "通过生成 API 密钥使用您自己的采集器来收集日志数据。",
     "xpack.observability_onboarding.steps.back": "返回",
     "xpack.observability_onboarding.steps.exploreLogs": "浏览日志",
     "xpack.observability_onboarding.systemIntegration.installed.tooltip.description": "集成会精简将您的数据连接到 Elastic Stack 的过程。",
@@ -29976,8 +29928,6 @@
     "xpack.observability_onboarding.systemLogs.installElasticAgent.progress.logsIngest.incompleteTitle": "传输日志到 Elastic Observability",
     "xpack.observability_onboarding.systemLogs.installElasticAgent.progress.logsIngest.loadingTitle": "等待传输日志......",
     "xpack.observability_onboarding.systemLogs.installShipper.title": "安装采集器以收集系统日志",
-    "xpack.observability_onboarding.title.collectCustomLogs": "将日志文件流式传输到 Elastic",
-    "xpack.observability_onboarding.title.collectSystemLogs": "安装采集器以收集系统日志",
     "xpack.observability_onboarding.windows.installStep.description": "此载入当前仅可用于 Linux 和 MacOS 系统。请参阅我们的文档了解有关将日志文件从 Windows 系统流式传输到 Elastic 的信息。",
     "xpack.observability_onboarding.windows.installStep.link.label": "阅读文档",
     "xpack.observability.alerts.untrackConfirmation.errorNotification.descriptionText": "无法取消跟踪{uuidsCount, plural, other {告警}}",
@@ -33083,7 +33033,6 @@
     "xpack.securitySolution.detectionResponse.noDataCurrent": "当前时间范围中没有可比较的 {dataType} 数据",
     "xpack.securitySolution.detectionResponse.timeDifference": "您的 {statType} 已从 {stat} {upOrDown} {percentageChange}",
     "xpack.securitySolution.detections.hostIsolation.impactedCases": "此操作将添加到 {cases}。",
-    "xpack.securitySolution.dragAndDrop.youAreInADialogContainingOptionsScreenReaderOnly": "您在对话框中，其中包含 {fieldName} 字段的选项。按 tab 键导航选项。按 escape 退出。",
     "xpack.securitySolution.editDataProvider.unavailableOperator": "{operator} 运算符不可用于模板",
     "xpack.securitySolution.enableRiskScore.enableRiskScore": "启用{riskEntity}风险分数",
     "xpack.securitySolution.enableRiskScore.enableRiskScoreDescription": "一旦启用此功能，您将可以在此部分快速访问{riskEntity}风险分数。启用此模板后，可能需要一小时才能生成数据。",
@@ -33275,7 +33224,6 @@
     "xpack.securitySolution.hoverActions.investigateInResolverForRowAriaLabel": "分析第 {ariaRowindex} 行的告警或事件，其中列为 {columnValues}",
     "xpack.securitySolution.hoverActions.moreActionsForRowAriaLabel": "为第 {ariaRowindex} 行中的告警或事件选择更多操作，其中列为 {columnValues}",
     "xpack.securitySolution.hoverActions.sendAlertToTimelineForRowAriaLabel": "将第 {ariaRowindex} 行的告警发送到时间线，其中列为 {columnValues}",
-    "xpack.securitySolution.hoverActions.showTopTooltip": "显示排名靠前的{fieldName}",
     "xpack.securitySolution.hoverActions.viewDetailsForRowAriaLabel": "查看第 {ariaRowindex} 行的告警或事件的详细信息，其中列为 {columnValues}",
     "xpack.securitySolution.indexPatterns.failureToastText": "更新时发生意外错误。如果要修改数据，您可以手动选择数据视图 {link}。",
     "xpack.securitySolution.indexPatterns.missingPatterns": "要重新创建上一时间线的数据视图，安全数据视图缺少以下索引模式：{callout}",
@@ -45182,4 +45130,4 @@
     "xpack.serverlessObservability.nav.projectSettings": "项目设置",
     "xpack.serverlessObservability.nav.synthetics": "Synthetics"
   }
-}
+}
\ No newline at end of file
diff --git a/x-pack/plugins/triggers_actions_ui/common/data/lib/build_agg.test.ts b/x-pack/plugins/triggers_actions_ui/common/data/lib/build_agg.test.ts
index 08c43eb9f8c0fb..3656fb9ea3469a 100644
--- a/x-pack/plugins/triggers_actions_ui/common/data/lib/build_agg.test.ts
+++ b/x-pack/plugins/triggers_actions_ui/common/data/lib/build_agg.test.ts
@@ -793,6 +793,51 @@ describe('buildAgg', () => {
       });
     });
 
+    it('should create correct aggregation when condition params are defined and multi terms selected', async () => {
+      expect(
+        buildAggregation({
+          aggType: 'sum',
+          aggField: 'avg-field',
+          termField: ['the-term', 'second-term'],
+          termSize: 100,
+          condition: {
+            resultLimit: 1000,
+            conditionScript: `params.compareValue <= 0`,
+          },
+        })
+      ).toEqual({
+        groupAgg: {
+          multi_terms: {
+            size: 100,
+            terms: [{ field: 'the-term' }, { field: 'second-term' }],
+            order: {
+              metricAgg: 'desc',
+            },
+          },
+          aggs: {
+            conditionSelector: {
+              bucket_selector: {
+                buckets_path: {
+                  compareValue: 'metricAgg',
+                },
+                script: `params.compareValue <= 0`,
+              },
+            },
+            metricAgg: {
+              sum: {
+                field: 'avg-field',
+              },
+            },
+          },
+        },
+        groupAggCount: {
+          stats_bucket: {
+            buckets_path: 'groupAgg._count',
+          },
+        },
+      });
+    });
+
     it('should add topHitsAgg if topHitsSize is defined', () => {
       expect(
         buildAggregation({
diff --git a/x-pack/plugins/triggers_actions_ui/common/data/lib/build_agg.ts b/x-pack/plugins/triggers_actions_ui/common/data/lib/build_agg.ts
index dfb141554a9fd8..3c61368543b8c5 100644
--- a/x-pack/plugins/triggers_actions_ui/common/data/lib/build_agg.ts
+++ b/x-pack/plugins/triggers_actions_ui/common/data/lib/build_agg.ts
@@ -46,7 +46,7 @@ export const buildAggregation = ({
   condition,
   topHitsSize,
 }: BuildAggregationOpts): Record<string, AggregationsAggregationContainer> => {
-  const aggContainer = {
+  const aggContainer: AggregationsAggregationContainer = {
     aggs: {},
   };
   const isCountAgg = isCountAggregation(aggType);
@@ -78,7 +78,7 @@ export const buildAggregation = ({
         : terms
       : terms;
 
-  let aggParent: any = aggContainer;
+  let aggParent: AggregationsAggregationContainer = aggContainer;
 
   const getAggName = () => (isDateAgg ? 'sortValueAgg' : 'metricAgg');
 
@@ -114,9 +114,15 @@ export const buildAggregation = ({
     // if not count add an order
     if (!isCountAgg) {
       const sortOrder = aggType === 'min' ? 'asc' : 'desc';
-      aggParent.aggs.groupAgg.terms!.order = {
-        [getAggName()]: sortOrder,
-      };
+      if (isMultiTerms && aggParent.aggs.groupAgg.multi_terms) {
+        aggParent.aggs.groupAgg.multi_terms.order = {
+          [getAggName()]: sortOrder,
+        };
+      } else if (aggParent.aggs.groupAgg.terms) {
+        aggParent.aggs.groupAgg.terms.order = {
+          [getAggName()]: sortOrder,
+        };
+      }
     } else if (includeConditionInQuery) {
       aggParent.aggs.groupAgg.aggs = {
         conditionSelector: {
@@ -193,7 +199,7 @@ export const buildAggregation = ({
   }
 
   if (timeSeries && dateRangeInfo) {
-    aggParent = aggParent.aggs.dateAgg;
+    aggParent = aggParent?.aggs?.dateAgg ?? {};
 
     // finally, the metric aggregation, if requested
     if (!isCountAgg) {
@@ -207,5 +213,5 @@ export const buildAggregation = ({
     }
   }
 
-  return aggContainer.aggs;
+  return aggContainer.aggs ?? {};
 };
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/backfill/api_key.ts b/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/backfill/api_key.ts
index 44e2c3f0252af2..b079571b26224a 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/backfill/api_key.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/backfill/api_key.ts
@@ -6,6 +6,7 @@
  */
 
 import expect from '@kbn/expect';
+import moment from 'moment';
 import { ALERTING_CASES_SAVED_OBJECT_INDEX, SavedObject } from '@kbn/core-saved-objects-server';
 import { AdHocRunSO } from '@kbn/alerting-plugin/server/data/ad_hoc_run/types';
 import { get } from 'lodash';
@@ -119,6 +120,8 @@ export default function apiKeyBackfillTests({ getService }: FtrProviderContext)
     }
 
     it('should wait to invalidate API key until backfill for rule is complete', async () => {
+      const start = moment().utc().startOf('day').subtract(7, 'days').toISOString();
+      const end = moment().utc().startOf('day').subtract(4, 'day').toISOString();
       const spaceId = SuperuserAtSpace1.space.id;
 
       // create 2 rules
@@ -143,14 +146,9 @@ export default function apiKeyBackfillTests({ getService }: FtrProviderContext)
         .post(`${getUrlPrefix(spaceId)}/internal/alerting/rules/backfill/_schedule`)
         .set('kbn-xsrf', 'foo')
         .auth(SuperuserAtSpace1.user.username, SuperuserAtSpace1.user.password)
-        .send([
-          {
-            rule_id: ruleId1,
-            start: '2023-10-19T12:00:00.000Z',
-            end: '2023-10-22T12:00:00.000Z',
-          },
-        ])
+        .send([{ rule_id: ruleId1, start, end }])
         .expect(200);
+
       const result = response.body;
       const backfillId = result[0].id;
       const schedule = result[0].schedule;
@@ -163,43 +161,20 @@ export default function apiKeyBackfillTests({ getService }: FtrProviderContext)
       expect(typeof adHocRun1.createdAt).to.be('string');
       expect(adHocRun1.duration).to.eql('12h');
       expect(adHocRun1.enabled).to.eql(true);
-      expect(adHocRun1.start).to.eql('2023-10-19T12:00:00.000Z');
-      expect(adHocRun1.end).to.eql('2023-10-22T12:00:00.000Z');
+      expect(adHocRun1.start).to.eql(start);
+      expect(adHocRun1.end).to.eql(end);
       expect(adHocRun1.status).to.eql('pending');
       expect(adHocRun1.spaceId).to.eql(spaceId);
       testExpectedRule(adHocRun1, undefined, true);
-      expect(adHocRun1.schedule).to.eql([
-        {
-          runAt: '2023-10-20T00:00:00.000Z',
-          status: 'pending',
-          interval: '12h',
-        },
-        {
-          runAt: '2023-10-20T12:00:00.000Z',
-          status: 'pending',
-          interval: '12h',
-        },
-        {
-          runAt: '2023-10-21T00:00:00.000Z',
-          status: 'pending',
-          interval: '12h',
-        },
-        {
-          runAt: '2023-10-21T12:00:00.000Z',
-          status: 'pending',
-          interval: '12h',
-        },
-        {
-          runAt: '2023-10-22T00:00:00.000Z',
-          status: 'pending',
-          interval: '12h',
-        },
-        {
-          runAt: '2023-10-22T12:00:00.000Z',
-          status: 'pending',
-          interval: '12h',
-        },
-      ]);
+
+      let currentStart = start;
+      adHocRun1.schedule.forEach((sched: any) => {
+        expect(sched.interval).to.eql('12h');
+        expect(sched.status).to.eql('pending');
+        const runAt = moment(currentStart).add(12, 'hours').toISOString();
+        expect(sched.runAt).to.eql(runAt);
+        currentStart = runAt;
+      });
 
       // delete both rules which will mark the api keys for invalidation
       await supertestWithoutAuth
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/backfill/delete.ts b/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/backfill/delete.ts
index d0b48e5753e29e..cc86d9a7d157ef 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/backfill/delete.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/backfill/delete.ts
@@ -6,6 +6,7 @@
  */
 
 import expect from '@kbn/expect';
+import moment from 'moment';
 import { asyncForEach } from '@kbn/std';
 import { GetResponse } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import { UserAtSpaceScenarios } from '../../../../scenarios';
@@ -26,6 +27,8 @@ export default function deleteBackfillTests({ getService }: FtrProviderContext)
   describe('delete backfill', () => {
     let backfillIds: Array<{ id: string; spaceId: string }> = [];
     const objectRemover = new ObjectRemover(supertest);
+    const start = moment().utc().startOf('day').subtract(31, 'days').toISOString();
+    const end = moment().utc().startOf('day').subtract(1, 'day').toISOString();
 
     afterEach(async () => {
       asyncForEach(backfillIds, async ({ id, spaceId }: { id: string; spaceId: string }) => {
@@ -80,19 +83,10 @@ export default function deleteBackfillTests({ getService }: FtrProviderContext)
           const scheduleResponse = await supertest
             .post(`${getUrlPrefix(apiOptions.spaceId)}/internal/alerting/rules/backfill/_schedule`)
             .set('kbn-xsrf', 'foo')
+            // set a long time range so the backfill doesn't finish running and get deleted
             .send([
-              {
-                // set a long time range so the backfill doesn't finish running and get deleted
-                rule_id: ruleId1,
-                start: '2023-10-19T12:00:00.000Z',
-                end: '2023-11-19T12:00:00.000Z',
-              },
-              {
-                // set a long time range so the backfill doesn't finish running and get deleted
-                rule_id: ruleId2,
-                start: '2023-10-19T12:00:00.000Z',
-                end: '2023-11-19T12:00:00.000Z',
-              },
+              { rule_id: ruleId1, start, end },
+              { rule_id: ruleId2, start, end },
             ]);
 
           const scheduleResult = scheduleResponse.body;
@@ -258,7 +252,7 @@ export default function deleteBackfillTests({ getService }: FtrProviderContext)
           }
         });
 
-        it('should not get backfill from another space', async () => {
+        it('should not delete backfill from another space', async () => {
           // create rule
           const rresponse = await supertest
             .post(`${getUrlPrefix(apiOptions.spaceId)}/api/alerting/rule`)
@@ -272,13 +266,7 @@ export default function deleteBackfillTests({ getService }: FtrProviderContext)
           const scheduleResponse = await supertest
             .post(`${getUrlPrefix(apiOptions.spaceId)}/internal/alerting/rules/backfill/_schedule`)
             .set('kbn-xsrf', 'foo')
-            .send([
-              {
-                rule_id: ruleId,
-                start: '2023-10-19T12:00:00.000Z',
-                end: '2023-10-25T12:00:00.000Z',
-              },
-            ]);
+            .send([{ rule_id: ruleId, start, end }]);
 
           const scheduleResult = scheduleResponse.body;
           expect(scheduleResult.length).to.eql(1);
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/backfill/find.ts b/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/backfill/find.ts
index 43fadf5ee04e92..1a6d94a7ffafb5 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/backfill/find.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/backfill/find.ts
@@ -6,6 +6,7 @@
  */
 
 import expect from '@kbn/expect';
+import moment from 'moment';
 import { asyncForEach } from '@kbn/std';
 import { UserAtSpaceScenarios } from '../../../../scenarios';
 import { getTestRuleData, getUrlPrefix, ObjectRemover } from '../../../../../common/lib';
@@ -19,6 +20,10 @@ export default function findBackfillTests({ getService }: FtrProviderContext) {
   describe('find backfill', () => {
     let backfillIds: Array<{ id: string; spaceId: string }> = [];
     const objectRemover = new ObjectRemover(supertest);
+    const start1 = moment().utc().startOf('day').subtract(14, 'days').toISOString();
+    const end1 = moment().utc().startOf('day').subtract(8, 'day').toISOString();
+    const start2 = moment().utc().startOf('day').subtract(12, 'days').toISOString();
+    const end2 = moment().utc().startOf('day').subtract(10, 'day').toISOString();
 
     afterEach(async () => {
       asyncForEach(backfillIds, async ({ id, spaceId }: { id: string; spaceId: string }) => {
@@ -47,50 +52,44 @@ export default function findBackfillTests({ getService }: FtrProviderContext) {
       expect(data.id).to.eql(id);
       expect(data.duration).to.eql('12h');
       expect(data.enabled).to.eql(true);
-      expect(data.start).to.eql('2023-10-19T12:00:00.000Z');
-      expect(data.end).to.eql('2023-10-25T12:00:00.000Z');
+      expect(data.start).to.eql(start1);
+      expect(data.end).to.eql(end1);
       expect(data.status).to.eql('pending');
       expect(data.space_id).to.eql(spaceId);
       expect(typeof data.created_at).to.be('string');
       testExpectedRule(data, ruleId, false);
       expect(data.schedule.length).to.eql(12);
+
+      let currentStart = start1;
       data.schedule.forEach((sched: any) => {
         expect(sched.interval).to.eql('12h');
         expect(sched.status).to.match(/complete|pending|running|error|timeout/);
+        const runAt = moment(currentStart).add(12, 'hours').toISOString();
+        expect(sched.run_at).to.eql(runAt);
+        currentStart = runAt;
       });
-      expect(data.schedule[0].run_at).to.eql('2023-10-20T00:00:00.000Z');
-      expect(data.schedule[1].run_at).to.eql('2023-10-20T12:00:00.000Z');
-      expect(data.schedule[2].run_at).to.eql('2023-10-21T00:00:00.000Z');
-      expect(data.schedule[3].run_at).to.eql('2023-10-21T12:00:00.000Z');
-      expect(data.schedule[4].run_at).to.eql('2023-10-22T00:00:00.000Z');
-      expect(data.schedule[5].run_at).to.eql('2023-10-22T12:00:00.000Z');
-      expect(data.schedule[6].run_at).to.eql('2023-10-23T00:00:00.000Z');
-      expect(data.schedule[7].run_at).to.eql('2023-10-23T12:00:00.000Z');
-      expect(data.schedule[8].run_at).to.eql('2023-10-24T00:00:00.000Z');
-      expect(data.schedule[9].run_at).to.eql('2023-10-24T12:00:00.000Z');
-      expect(data.schedule[10].run_at).to.eql('2023-10-25T00:00:00.000Z');
-      expect(data.schedule[11].run_at).to.eql('2023-10-25T12:00:00.000Z');
     }
 
     function testExpectedBackfill2(data: any, id: string, ruleId: string, spaceId: string) {
       expect(data.id).to.eql(id);
       expect(data.duration).to.eql('12h');
       expect(data.enabled).to.eql(true);
-      expect(data.start).to.eql('2023-10-21T12:00:00.000Z');
-      expect(data.end).to.eql('2023-10-23T12:00:00.000Z');
+      expect(data.start).to.eql(start2);
+      expect(data.end).to.eql(end2);
       expect(data.status).to.eql('pending');
       expect(data.space_id).to.eql(spaceId);
       expect(typeof data.created_at).to.be('string');
       testExpectedRule(data, ruleId, false);
       expect(data.schedule.length).to.eql(4);
+
+      let currentStart = start2;
       data.schedule.forEach((sched: any) => {
         expect(sched.interval).to.eql('12h');
         expect(sched.status).to.match(/complete|pending|running|error|timeout/);
+        const runAt = moment(currentStart).add(12, 'hours').toISOString();
+        expect(sched.run_at).to.eql(runAt);
+        currentStart = runAt;
       });
-      expect(data.schedule[0].run_at).to.eql('2023-10-22T00:00:00.000Z');
-      expect(data.schedule[1].run_at).to.eql('2023-10-22T12:00:00.000Z');
-      expect(data.schedule[2].run_at).to.eql('2023-10-23T00:00:00.000Z');
-      expect(data.schedule[3].run_at).to.eql('2023-10-23T12:00:00.000Z');
     }
 
     function testExpectedRule(result: any, ruleId: string | undefined, isSO: boolean) {
@@ -165,16 +164,8 @@ export default function findBackfillTests({ getService }: FtrProviderContext) {
             .post(`${getUrlPrefix(apiOptions.spaceId)}/internal/alerting/rules/backfill/_schedule`)
             .set('kbn-xsrf', 'foo')
             .send([
-              {
-                rule_id: ruleId1,
-                start: '2023-10-19T12:00:00.000Z',
-                end: '2023-10-25T12:00:00.000Z',
-              },
-              {
-                rule_id: ruleId2,
-                start: '2023-10-21T12:00:00.000Z',
-                end: '2023-10-23T12:00:00.000Z',
-              },
+              { rule_id: ruleId1, start: start1, end: end1 },
+              { rule_id: ruleId2, start: start2, end: end2 },
             ]);
 
           const scheduleResult = scheduleResponse.body;
@@ -235,7 +226,11 @@ export default function findBackfillTests({ getService }: FtrProviderContext) {
             .post(
               `${getUrlPrefix(
                 apiOptions.spaceId
-              )}/internal/alerting/rules/backfill/_find?start=2023-10-19T08:00:00.000Z`
+              )}/internal/alerting/rules/backfill/_find?start=${moment()
+                .utc()
+                .startOf('day')
+                .subtract(15, 'days')
+                .toISOString()}`
             )
             .set('kbn-xsrf', 'foo')
             .auth(apiOptions.username, apiOptions.password);
@@ -245,7 +240,11 @@ export default function findBackfillTests({ getService }: FtrProviderContext) {
             .post(
               `${getUrlPrefix(
                 apiOptions.spaceId
-              )}/internal/alerting/rules/backfill/_find?start=2023-10-20T08:00:00.000Z`
+              )}/internal/alerting/rules/backfill/_find?start=${moment()
+                .utc()
+                .startOf('day')
+                .subtract(13, 'days')
+                .toISOString()}`
             )
             .set('kbn-xsrf', 'foo')
             .auth(apiOptions.username, apiOptions.password);
@@ -255,7 +254,11 @@ export default function findBackfillTests({ getService }: FtrProviderContext) {
             .post(
               `${getUrlPrefix(
                 apiOptions.spaceId
-              )}/internal/alerting/rules/backfill/_find?start=2023-10-22T08:00:00.000Z`
+              )}/internal/alerting/rules/backfill/_find?start=${moment()
+                .utc()
+                .startOf('day')
+                .subtract(5, 'days')
+                .toISOString()}`
             )
             .set('kbn-xsrf', 'foo')
             .auth(apiOptions.username, apiOptions.password);
@@ -265,7 +268,11 @@ export default function findBackfillTests({ getService }: FtrProviderContext) {
             .post(
               `${getUrlPrefix(
                 apiOptions.spaceId
-              )}/internal/alerting/rules/backfill/_find?end=2023-10-26T00:00:00.000Z`
+              )}/internal/alerting/rules/backfill/_find?end=${moment()
+                .utc()
+                .startOf('day')
+                .subtract(5, 'days')
+                .toISOString()}`
             )
             .set('kbn-xsrf', 'foo')
             .auth(apiOptions.username, apiOptions.password);
@@ -275,7 +282,11 @@ export default function findBackfillTests({ getService }: FtrProviderContext) {
             .post(
               `${getUrlPrefix(
                 apiOptions.spaceId
-              )}/internal/alerting/rules/backfill/_find?end=2023-10-24T18:00:00.000Z`
+              )}/internal/alerting/rules/backfill/_find?end=${moment()
+                .utc()
+                .startOf('day')
+                .subtract(9, 'days')
+                .toISOString()}`
             )
             .set('kbn-xsrf', 'foo')
             .auth(apiOptions.username, apiOptions.password);
@@ -285,7 +296,11 @@ export default function findBackfillTests({ getService }: FtrProviderContext) {
             .post(
               `${getUrlPrefix(
                 apiOptions.spaceId
-              )}/internal/alerting/rules/backfill/_find?end=2023-10-18T00:00:00.000Z`
+              )}/internal/alerting/rules/backfill/_find?end=${moment()
+                .utc()
+                .startOf('day')
+                .subtract(15, 'days')
+                .toISOString()}`
             )
             .set('kbn-xsrf', 'foo')
             .auth(apiOptions.username, apiOptions.password);
@@ -295,7 +310,15 @@ export default function findBackfillTests({ getService }: FtrProviderContext) {
             .post(
               `${getUrlPrefix(
                 apiOptions.spaceId
-              )}/internal/alerting/rules/backfill/_find?start=2023-10-19T00:00:00.000Z&end=2023-10-26T00:00:00.000Z`
+              )}/internal/alerting/rules/backfill/_find?start=${moment()
+                .utc()
+                .startOf('day')
+                .subtract(15, 'days')
+                .toISOString()}&end=${moment()
+                .utc()
+                .startOf('day')
+                .subtract(7, 'days')
+                .toISOString()}`
             )
             .set('kbn-xsrf', 'foo')
             .auth(apiOptions.username, apiOptions.password);
@@ -305,7 +328,15 @@ export default function findBackfillTests({ getService }: FtrProviderContext) {
             .post(
               `${getUrlPrefix(
                 apiOptions.spaceId
-              )}/internal/alerting/rules/backfill/_find?start=2023-10-21T00:00:00.000Z&end=2023-10-23T13:00:00.000Z`
+              )}/internal/alerting/rules/backfill/_find?start=${moment()
+                .utc()
+                .startOf('day')
+                .subtract(13, 'days')
+                .toISOString()}&end=${moment()
+                .utc()
+                .startOf('day')
+                .subtract(9, 'days')
+                .toISOString()}`
             )
             .set('kbn-xsrf', 'foo')
             .auth(apiOptions.username, apiOptions.password);
@@ -315,7 +346,15 @@ export default function findBackfillTests({ getService }: FtrProviderContext) {
             .post(
               `${getUrlPrefix(
                 apiOptions.spaceId
-              )}/internal/alerting/rules/backfill/_find?start=2023-10-18T00:00:00.000Z&end=2023-10-19T00:00:00.000Z`
+              )}/internal/alerting/rules/backfill/_find?start=${moment()
+                .utc()
+                .startOf('day')
+                .subtract(20, 'days')
+                .toISOString()}&end=${moment()
+                .utc()
+                .startOf('day')
+                .subtract(15, 'days')
+                .toISOString()}`
             )
             .set('kbn-xsrf', 'foo')
             .auth(apiOptions.username, apiOptions.password);
@@ -625,9 +664,9 @@ export default function findBackfillTests({ getService }: FtrProviderContext) {
                 ruleId2,
                 space.id
               );
-              const start1 = new Date(resultFindWithSort.data[0].start).valueOf();
-              const start2 = new Date(resultFindWithSort.data[1].start).valueOf();
-              expect(start1).to.be.greaterThan(start2);
+              const sortedStart1 = new Date(resultFindWithSort.data[0].start).valueOf();
+              const sortedStart2 = new Date(resultFindWithSort.data[1].start).valueOf();
+              expect(sortedStart1).to.be.greaterThan(sortedStart2);
 
               break;
             default:
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/backfill/get.ts b/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/backfill/get.ts
index cce0e974032a72..7b051df51b2263 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/backfill/get.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/backfill/get.ts
@@ -6,6 +6,7 @@
  */
 
 import expect from '@kbn/expect';
+import moment from 'moment';
 import { asyncForEach } from '@kbn/std';
 import { UserAtSpaceScenarios } from '../../../../scenarios';
 import { getTestRuleData, getUrlPrefix, ObjectRemover } from '../../../../../common/lib';
@@ -19,6 +20,9 @@ export default function getBackfillTests({ getService }: FtrProviderContext) {
   describe('get backfill', () => {
     let backfillIds: Array<{ id: string; spaceId: string }> = [];
     const objectRemover = new ObjectRemover(supertest);
+    const start = moment().utc().startOf('day').subtract(7, 'days').toISOString();
+    const end1 = moment().utc().startOf('day').subtract(1, 'day').toISOString();
+    const end2 = moment().utc().startOf('day').subtract(3, 'day').toISOString();
 
     afterEach(async () => {
       asyncForEach(backfillIds, async ({ id, spaceId }: { id: string; spaceId: string }) => {
@@ -115,16 +119,8 @@ export default function getBackfillTests({ getService }: FtrProviderContext) {
             .post(`${getUrlPrefix(apiOptions.spaceId)}/internal/alerting/rules/backfill/_schedule`)
             .set('kbn-xsrf', 'foo')
             .send([
-              {
-                rule_id: ruleId1,
-                start: '2023-10-19T12:00:00.000Z',
-                end: '2023-10-25T12:00:00.000Z',
-              },
-              {
-                rule_id: ruleId2,
-                start: '2023-10-19T12:00:00.000Z',
-                end: '2023-10-23T12:00:00.000Z',
-              },
+              { rule_id: ruleId1, start, end: end1 },
+              { rule_id: ruleId2, start, end: end2 },
             ]);
 
           const scheduleResult = scheduleResponse.body;
@@ -183,52 +179,42 @@ export default function getBackfillTests({ getService }: FtrProviderContext) {
               expect(getResponse1.body.id).to.eql(backfillId1);
               expect(getResponse1.body.duration).to.eql('12h');
               expect(getResponse1.body.enabled).to.eql(true);
-              expect(getResponse1.body.start).to.eql('2023-10-19T12:00:00.000Z');
-              expect(getResponse1.body.end).to.eql('2023-10-25T12:00:00.000Z');
+              expect(getResponse1.body.start).to.eql(start);
+              expect(getResponse1.body.end).to.eql(end1);
               expect(getResponse1.body.status).to.eql('pending');
               expect(getResponse1.body.space_id).to.eql(space.id);
               expect(typeof getResponse1.body.created_at).to.be('string');
               testExpectedRule(getResponse1.body, ruleId1, false);
               expect(getResponse1.body.schedule.length).to.eql(12);
+
+              let currentStart = start;
               getResponse1.body.schedule.forEach((sched: any) => {
                 expect(sched.interval).to.eql('12h');
                 expect(sched.status).to.match(/complete|pending|running|error|timeout/);
+                const runAt = moment(currentStart).add(12, 'hours').toISOString();
+                expect(sched.run_at).to.eql(runAt);
+                currentStart = runAt;
               });
-              expect(getResponse1.body.schedule[0].run_at).to.eql('2023-10-20T00:00:00.000Z');
-              expect(getResponse1.body.schedule[1].run_at).to.eql('2023-10-20T12:00:00.000Z');
-              expect(getResponse1.body.schedule[2].run_at).to.eql('2023-10-21T00:00:00.000Z');
-              expect(getResponse1.body.schedule[3].run_at).to.eql('2023-10-21T12:00:00.000Z');
-              expect(getResponse1.body.schedule[4].run_at).to.eql('2023-10-22T00:00:00.000Z');
-              expect(getResponse1.body.schedule[5].run_at).to.eql('2023-10-22T12:00:00.000Z');
-              expect(getResponse1.body.schedule[6].run_at).to.eql('2023-10-23T00:00:00.000Z');
-              expect(getResponse1.body.schedule[7].run_at).to.eql('2023-10-23T12:00:00.000Z');
-              expect(getResponse1.body.schedule[8].run_at).to.eql('2023-10-24T00:00:00.000Z');
-              expect(getResponse1.body.schedule[9].run_at).to.eql('2023-10-24T12:00:00.000Z');
-              expect(getResponse1.body.schedule[10].run_at).to.eql('2023-10-25T00:00:00.000Z');
-              expect(getResponse1.body.schedule[11].run_at).to.eql('2023-10-25T12:00:00.000Z');
 
               expect(getResponse2.body.id).to.eql(backfillId2);
               expect(getResponse2.body.duration).to.eql('12h');
               expect(getResponse2.body.enabled).to.eql(true);
-              expect(getResponse2.body.start).to.eql('2023-10-19T12:00:00.000Z');
-              expect(getResponse2.body.end).to.eql('2023-10-23T12:00:00.000Z');
+              expect(getResponse2.body.start).to.eql(start);
+              expect(getResponse2.body.end).to.eql(end2);
               expect(getResponse2.body.status).to.eql('pending');
               expect(getResponse2.body.space_id).to.eql(space.id);
               expect(typeof getResponse2.body.created_at).to.be('string');
               testExpectedRule(getResponse2.body, ruleId2, false);
               expect(getResponse2.body.schedule.length).to.eql(8);
+
+              currentStart = start;
               getResponse2.body.schedule.forEach((sched: any) => {
                 expect(sched.interval).to.eql('12h');
                 expect(sched.status).to.match(/complete|pending|running|error|timeout/);
+                const runAt = moment(currentStart).add(12, 'hours').toISOString();
+                expect(sched.run_at).to.eql(runAt);
+                currentStart = runAt;
               });
-              expect(getResponse2.body.schedule[0].run_at).to.eql('2023-10-20T00:00:00.000Z');
-              expect(getResponse2.body.schedule[1].run_at).to.eql('2023-10-20T12:00:00.000Z');
-              expect(getResponse2.body.schedule[2].run_at).to.eql('2023-10-21T00:00:00.000Z');
-              expect(getResponse2.body.schedule[3].run_at).to.eql('2023-10-21T12:00:00.000Z');
-              expect(getResponse2.body.schedule[4].run_at).to.eql('2023-10-22T00:00:00.000Z');
-              expect(getResponse2.body.schedule[5].run_at).to.eql('2023-10-22T12:00:00.000Z');
-              expect(getResponse2.body.schedule[6].run_at).to.eql('2023-10-23T00:00:00.000Z');
-              expect(getResponse2.body.schedule[7].run_at).to.eql('2023-10-23T12:00:00.000Z');
               break;
             default:
               throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);
@@ -286,13 +272,7 @@ export default function getBackfillTests({ getService }: FtrProviderContext) {
           const scheduleResponse = await supertest
             .post(`${getUrlPrefix(apiOptions.spaceId)}/internal/alerting/rules/backfill/_schedule`)
             .set('kbn-xsrf', 'foo')
-            .send([
-              {
-                rule_id: ruleId,
-                start: '2023-10-19T12:00:00.000Z',
-                end: '2023-10-25T12:00:00.000Z',
-              },
-            ]);
+            .send([{ rule_id: ruleId, start, end: end1 }]);
 
           const scheduleResult = scheduleResponse.body;
           expect(scheduleResult.length).to.eql(1);
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/backfill/schedule.ts b/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/backfill/schedule.ts
index 4bcd91574997b3..d5207718d844a1 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/backfill/schedule.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/backfill/schedule.ts
@@ -6,6 +6,7 @@
  */
 
 import expect from '@kbn/expect';
+import moment from 'moment';
 import { ALERTING_CASES_SAVED_OBJECT_INDEX, SavedObject } from '@kbn/core-saved-objects-server';
 import { AdHocRunSO } from '@kbn/alerting-plugin/server/data/ad_hoc_run/types';
 import { get } from 'lodash';
@@ -127,6 +128,8 @@ export default function scheduleBackfillTests({ getService }: FtrProviderContext
           password: user.password,
         };
         it('should handle scheduling backfill job requests appropriately', async () => {
+          const defaultStart = moment().utc().startOf('day').subtract(7, 'days').toISOString();
+          const defaultEnd = moment().utc().startOf('day').subtract(1, 'day').toISOString();
           // create 2 rules
           const rresponse1 = await supertest
             .post(`${getUrlPrefix(apiOptions.spaceId)}/api/alerting/rule`)
@@ -152,10 +155,10 @@ export default function scheduleBackfillTests({ getService }: FtrProviderContext
             .send([
               {
                 rule_id: ruleId1,
-                start: '2023-10-19T12:00:00.000Z',
-                end: '2023-10-25T12:00:00.000Z',
+                start: defaultStart,
+                end: defaultEnd,
               },
-              { rule_id: ruleId2, start: '2023-10-19T12:00:00.000Z' },
+              { rule_id: ruleId2, start: defaultStart },
             ]);
 
           switch (scenario.id) {
@@ -195,92 +198,37 @@ export default function scheduleBackfillTests({ getService }: FtrProviderContext
               backfillIds.push({ id: result[0].id, spaceId: apiOptions.spaceId });
               expect(result[0].duration).to.eql('12h');
               expect(result[0].enabled).to.eql(true);
-              expect(result[0].start).to.eql('2023-10-19T12:00:00.000Z');
-              expect(result[0].end).to.eql('2023-10-25T12:00:00.000Z');
+              expect(result[0].start).to.eql(defaultStart);
+              expect(result[0].end).to.eql(defaultEnd);
               expect(result[0].status).to.eql('pending');
               expect(result[0].space_id).to.eql(space.id);
               expect(typeof result[0].created_at).to.be('string');
               testExpectedRule(result[0], ruleId1, false);
-              expect(result[0].schedule).to.eql([
-                {
-                  run_at: '2023-10-20T00:00:00.000Z',
-                  status: 'pending',
-                  interval: '12h',
-                },
-                {
-                  run_at: '2023-10-20T12:00:00.000Z',
-                  status: 'pending',
-                  interval: '12h',
-                },
-                {
-                  run_at: '2023-10-21T00:00:00.000Z',
-                  status: 'pending',
-                  interval: '12h',
-                },
-                {
-                  run_at: '2023-10-21T12:00:00.000Z',
-                  status: 'pending',
-                  interval: '12h',
-                },
-                {
-                  run_at: '2023-10-22T00:00:00.000Z',
-                  status: 'pending',
-                  interval: '12h',
-                },
-                {
-                  run_at: '2023-10-22T12:00:00.000Z',
-                  status: 'pending',
-                  interval: '12h',
-                },
-                {
-                  run_at: '2023-10-23T00:00:00.000Z',
-                  status: 'pending',
-                  interval: '12h',
-                },
-                {
-                  run_at: '2023-10-23T12:00:00.000Z',
-                  status: 'pending',
-                  interval: '12h',
-                },
-                {
-                  run_at: '2023-10-24T00:00:00.000Z',
-                  status: 'pending',
-                  interval: '12h',
-                },
-                {
-                  run_at: '2023-10-24T12:00:00.000Z',
-                  status: 'pending',
-                  interval: '12h',
-                },
-                {
-                  run_at: '2023-10-25T00:00:00.000Z',
-                  status: 'pending',
-                  interval: '12h',
-                },
-                {
-                  run_at: '2023-10-25T12:00:00.000Z',
-                  status: 'pending',
-                  interval: '12h',
-                },
-              ]);
+
+              let currentStart = defaultStart;
+              result[0].schedule.forEach((sched: any) => {
+                expect(sched.interval).to.eql('12h');
+                expect(sched.status).to.eql('pending');
+                const runAt = moment(currentStart).add(12, 'hours').toISOString();
+                expect(sched.run_at).to.eql(runAt);
+                currentStart = runAt;
+              });
 
               expect(typeof result[1].id).to.be('string');
               backfillIds.push({ id: result[1].id, spaceId: apiOptions.spaceId });
               expect(result[1].duration).to.eql('12h');
               expect(result[1].enabled).to.eql(true);
-              expect(result[1].start).to.eql('2023-10-19T12:00:00.000Z');
-              expect(result[1].end).to.eql('2023-10-20T00:00:00.000Z');
+              expect(result[1].start).to.eql(defaultStart);
+              expect(result[1].end).to.eql(moment(defaultStart).add(12, 'hours').toISOString());
               expect(result[1].status).to.eql('pending');
               expect(result[1].space_id).to.eql(space.id);
               expect(typeof result[1].created_at).to.be('string');
               testExpectedRule(result[1], ruleId2, false);
-              expect(result[1].schedule).to.eql([
-                {
-                  run_at: '2023-10-20T00:00:00.000Z',
-                  status: 'pending',
-                  interval: '12h',
-                },
-              ]);
+              expect(result[1].schedule[0].interval).to.eql('12h');
+              expect(result[1].schedule[0].status).to.eql('pending');
+              expect(result[1].schedule[0].run_at).to.eql(
+                moment(defaultStart).add(12, 'hours').toISOString()
+              );
 
               // check that the ad hoc run SO was created
               const adHocRunSO1 = (await getAdHocRunSO(result[0].id)) as SavedObject<AdHocRunSO>;
@@ -293,91 +241,35 @@ export default function scheduleBackfillTests({ getService }: FtrProviderContext
               expect(typeof adHocRun1.createdAt).to.be('string');
               expect(adHocRun1.duration).to.eql('12h');
               expect(adHocRun1.enabled).to.eql(true);
-              expect(adHocRun1.start).to.eql('2023-10-19T12:00:00.000Z');
-              expect(adHocRun1.end).to.eql('2023-10-25T12:00:00.000Z');
+              expect(adHocRun1.start).to.eql(defaultStart);
+              expect(adHocRun1.end).to.eql(defaultEnd);
               expect(adHocRun1.status).to.eql('pending');
               expect(adHocRun1.spaceId).to.eql(space.id);
               testExpectedRule(adHocRun1, undefined, true);
-              expect(adHocRun1.schedule).to.eql([
-                {
-                  runAt: '2023-10-20T00:00:00.000Z',
-                  status: 'pending',
-                  interval: '12h',
-                },
-                {
-                  runAt: '2023-10-20T12:00:00.000Z',
-                  status: 'pending',
-                  interval: '12h',
-                },
-                {
-                  runAt: '2023-10-21T00:00:00.000Z',
-                  status: 'pending',
-                  interval: '12h',
-                },
-                {
-                  runAt: '2023-10-21T12:00:00.000Z',
-                  status: 'pending',
-                  interval: '12h',
-                },
-                {
-                  runAt: '2023-10-22T00:00:00.000Z',
-                  status: 'pending',
-                  interval: '12h',
-                },
-                {
-                  runAt: '2023-10-22T12:00:00.000Z',
-                  status: 'pending',
-                  interval: '12h',
-                },
-                {
-                  runAt: '2023-10-23T00:00:00.000Z',
-                  status: 'pending',
-                  interval: '12h',
-                },
-                {
-                  runAt: '2023-10-23T12:00:00.000Z',
-                  status: 'pending',
-                  interval: '12h',
-                },
-                {
-                  runAt: '2023-10-24T00:00:00.000Z',
-                  status: 'pending',
-                  interval: '12h',
-                },
-                {
-                  runAt: '2023-10-24T12:00:00.000Z',
-                  status: 'pending',
-                  interval: '12h',
-                },
-                {
-                  runAt: '2023-10-25T00:00:00.000Z',
-                  status: 'pending',
-                  interval: '12h',
-                },
-                {
-                  runAt: '2023-10-25T12:00:00.000Z',
-                  status: 'pending',
-                  interval: '12h',
-                },
-              ]);
+              currentStart = defaultStart;
+              adHocRun1.schedule.forEach((sched: any) => {
+                expect(sched.interval).to.eql('12h');
+                expect(sched.status).to.eql('pending');
+                const runAt = moment(currentStart).add(12, 'hours').toISOString();
+                expect(sched.runAt).to.eql(runAt);
+                currentStart = runAt;
+              });
 
               expect(typeof adHocRun2.apiKeyId).to.be('string');
               expect(typeof adHocRun2.apiKeyToUse).to.be('string');
               expect(typeof adHocRun2.createdAt).to.be('string');
               expect(adHocRun2.duration).to.eql('12h');
               expect(adHocRun2.enabled).to.eql(true);
-              expect(adHocRun2.start).to.eql('2023-10-19T12:00:00.000Z');
-              expect(adHocRun2.end).to.eql('2023-10-20T00:00:00.000Z');
+              expect(adHocRun2.start).to.eql(defaultStart);
+              expect(adHocRun2.end).to.eql(moment(defaultStart).add(12, 'hours').toISOString());
               expect(adHocRun2.status).to.eql('pending');
               expect(adHocRun2.spaceId).to.eql(space.id);
               testExpectedRule(adHocRun2, undefined, true);
-              expect(adHocRun2.schedule).to.eql([
-                {
-                  runAt: '2023-10-20T00:00:00.000Z',
-                  status: 'pending',
-                  interval: '12h',
-                },
-              ]);
+              expect(adHocRun2.schedule[0].interval).to.eql('12h');
+              expect(adHocRun2.schedule[0].status).to.eql('pending');
+              expect(adHocRun2.schedule[0].runAt).to.eql(
+                moment(defaultStart).add(12, 'hours').toISOString()
+              );
 
               // check references are stored correctly
               expect(adHocRunSO1.references).to.eql([{ id: ruleId1, name: 'rule', type: 'alert' }]);
@@ -423,6 +315,11 @@ export default function scheduleBackfillTests({ getService }: FtrProviderContext
         });
 
         it('should handle scheduling multiple backfill job requests for a single rule appropriately', async () => {
+          const start1 = moment().utc().startOf('day').subtract(7, 'days').toISOString();
+          const end1 = moment().utc().startOf('day').subtract(4, 'days').toISOString();
+          const start2 = moment().utc().startOf('day').subtract(8, 'days').toISOString();
+          const start3 = moment().utc().startOf('day').subtract(14, 'days').toISOString();
+          const end3 = moment().utc().startOf('day').subtract(12, 'days').toISOString();
           // create 1 rule as current user
           const rresponse = await supertest
             .post(`${getUrlPrefix(apiOptions.spaceId)}/api/alerting/rule`)
@@ -438,17 +335,9 @@ export default function scheduleBackfillTests({ getService }: FtrProviderContext
             .set('kbn-xsrf', 'foo')
             .auth(apiOptions.username, apiOptions.password)
             .send([
-              {
-                rule_id: ruleId,
-                start: '2023-10-19T12:00:00.000Z',
-                end: '2023-10-21T12:00:00.000Z',
-              },
-              { rule_id: ruleId, start: '2023-10-18T12:00:00.000Z' },
-              {
-                rule_id: ruleId,
-                start: '2023-12-30T12:00:00.000Z',
-                end: '2024-01-01T12:00:00.000Z',
-              },
+              { rule_id: ruleId, start: start1, end: end1 },
+              { rule_id: ruleId, start: start2 },
+              { rule_id: ruleId, start: start3, end: end3 },
             ]);
 
           switch (scenario.id) {
@@ -488,85 +377,61 @@ export default function scheduleBackfillTests({ getService }: FtrProviderContext
               backfillIds.push({ id: result[0].id, spaceId: apiOptions.spaceId });
               expect(result[0].duration).to.eql('12h');
               expect(result[0].enabled).to.eql(true);
-              expect(result[0].start).to.eql('2023-10-19T12:00:00.000Z');
-              expect(result[0].end).to.eql('2023-10-21T12:00:00.000Z');
+              expect(result[0].start).to.eql(start1);
+              expect(result[0].end).to.eql(end1);
               expect(result[0].status).to.eql('pending');
               expect(result[0].space_id).to.eql(space.id);
               expect(typeof result[0].created_at).to.be('string');
               testExpectedRule(result[0], ruleId, false);
-              expect(result[0].schedule).to.eql([
-                {
-                  interval: '12h',
-                  run_at: '2023-10-20T00:00:00.000Z',
-                  status: 'pending',
-                },
-                {
-                  interval: '12h',
-                  run_at: '2023-10-20T12:00:00.000Z',
-                  status: 'pending',
-                },
-                {
-                  interval: '12h',
-                  run_at: '2023-10-21T00:00:00.000Z',
-                  status: 'pending',
-                },
-                {
-                  interval: '12h',
-                  run_at: '2023-10-21T12:00:00.000Z',
-                  status: 'pending',
-                },
-              ]);
+
+              let currentStart = start1;
+              result[0].schedule.forEach((sched: any) => {
+                expect(sched.interval).to.eql('12h');
+                expect(sched.status).to.eql('pending');
+                const runAt = moment(currentStart).add(12, 'hours').toISOString();
+                expect(sched.run_at).to.eql(runAt);
+                currentStart = runAt;
+              });
 
               expect(typeof result[1].id).to.be('string');
               backfillIds.push({ id: result[1].id, spaceId: apiOptions.spaceId });
               expect(result[1].duration).to.eql('12h');
               expect(result[1].enabled).to.eql(true);
-              expect(result[1].start).to.eql('2023-10-18T12:00:00.000Z');
-              expect(result[1].end).to.eql('2023-10-19T00:00:00.000Z');
+              expect(result[1].start).to.eql(start2);
+              expect(result[1].end).to.eql(moment(start2).add(12, 'hours').toISOString());
               expect(result[1].status).to.eql('pending');
               expect(result[1].space_id).to.eql(space.id);
               expect(typeof result[1].created_at).to.be('string');
               testExpectedRule(result[1], ruleId, false);
-              expect(result[1].schedule).to.eql([
-                {
-                  interval: '12h',
-                  run_at: '2023-10-19T00:00:00.000Z',
-                  status: 'pending',
-                },
-              ]);
+
+              currentStart = start2;
+              result[1].schedule.forEach((sched: any) => {
+                expect(sched.interval).to.eql('12h');
+                expect(sched.status).to.eql('pending');
+                const runAt = moment(currentStart).add(12, 'hours').toISOString();
+                expect(sched.run_at).to.eql(runAt);
+                currentStart = runAt;
+              });
 
               expect(typeof result[2].id).to.be('string');
               backfillIds.push({ id: result[2].id, spaceId: apiOptions.spaceId });
               expect(result[2].duration).to.eql('12h');
               expect(result[2].enabled).to.eql(true);
-              expect(result[2].start).to.eql('2023-12-30T12:00:00.000Z');
-              expect(result[2].end).to.eql('2024-01-01T12:00:00.000Z');
+              expect(result[2].start).to.eql(start3);
+              expect(result[2].end).to.eql(end3);
               expect(result[2].status).to.eql('pending');
               expect(result[2].space_id).to.eql(space.id);
               expect(typeof result[2].created_at).to.be('string');
               testExpectedRule(result[2], ruleId, false);
-              expect(result[2].schedule).to.eql([
-                {
-                  interval: '12h',
-                  run_at: '2023-12-31T00:00:00.000Z',
-                  status: 'pending',
-                },
-                {
-                  interval: '12h',
-                  run_at: '2023-12-31T12:00:00.000Z',
-                  status: 'pending',
-                },
-                {
-                  interval: '12h',
-                  run_at: '2024-01-01T00:00:00.000Z',
-                  status: 'pending',
-                },
-                {
-                  interval: '12h',
-                  run_at: '2024-01-01T12:00:00.000Z',
-                  status: 'pending',
-                },
-              ]);
+
+              currentStart = start3;
+              result[2].schedule.forEach((sched: any) => {
+                expect(sched.interval).to.eql('12h');
+                expect(sched.status).to.eql('pending');
+                const runAt = moment(currentStart).add(12, 'hours').toISOString();
+                expect(sched.run_at).to.eql(runAt);
+                currentStart = runAt;
+              });
 
               // check that the ad hoc run SO was created
               const adHocRunSO1 = (await getAdHocRunSO(result[0].id)) as SavedObject<AdHocRunSO>;
@@ -581,84 +446,60 @@ export default function scheduleBackfillTests({ getService }: FtrProviderContext
               expect(typeof adHocRun1.createdAt).to.be('string');
               expect(adHocRun1.duration).to.eql('12h');
               expect(adHocRun1.enabled).to.eql(true);
-              expect(adHocRun1.start).to.eql('2023-10-19T12:00:00.000Z');
-              expect(adHocRun1.end).to.eql('2023-10-21T12:00:00.000Z');
+              expect(adHocRun1.start).to.eql(start1);
+              expect(adHocRun1.end).to.eql(end1);
               expect(adHocRun1.status).to.eql('pending');
               expect(adHocRun1.spaceId).to.eql(space.id);
               testExpectedRule(adHocRun1, undefined, true);
-              expect(adHocRun1.schedule).to.eql([
-                {
-                  interval: '12h',
-                  runAt: '2023-10-20T00:00:00.000Z',
-                  status: 'pending',
-                },
-                {
-                  interval: '12h',
-                  runAt: '2023-10-20T12:00:00.000Z',
-                  status: 'pending',
-                },
-                {
-                  interval: '12h',
-                  runAt: '2023-10-21T00:00:00.000Z',
-                  status: 'pending',
-                },
-                {
-                  interval: '12h',
-                  runAt: '2023-10-21T12:00:00.000Z',
-                  status: 'pending',
-                },
-              ]);
+
+              currentStart = start1;
+              adHocRun1.schedule.forEach((sched: any) => {
+                expect(sched.interval).to.eql('12h');
+                expect(sched.status).to.eql('pending');
+                const runAt = moment(currentStart).add(12, 'hours').toISOString();
+                expect(sched.runAt).to.eql(runAt);
+                currentStart = runAt;
+              });
 
               expect(typeof adHocRun2.apiKeyId).to.be('string');
               expect(typeof adHocRun2.apiKeyToUse).to.be('string');
               expect(typeof adHocRun2.createdAt).to.be('string');
               expect(adHocRun2.duration).to.eql('12h');
               expect(adHocRun2.enabled).to.eql(true);
-              expect(adHocRun2.start).to.eql('2023-10-18T12:00:00.000Z');
-              expect(adHocRun2.end).to.eql('2023-10-19T00:00:00.000Z');
+              expect(adHocRun2.start).to.eql(start2);
+              expect(adHocRun2.end).to.eql(moment(start2).add(12, 'hours').toISOString());
               expect(adHocRun2.status).to.eql('pending');
               expect(adHocRun2.spaceId).to.eql(space.id);
               testExpectedRule(adHocRun2, undefined, true);
-              expect(adHocRun2.schedule).to.eql([
-                {
-                  interval: '12h',
-                  runAt: '2023-10-19T00:00:00.000Z',
-                  status: 'pending',
-                },
-              ]);
+
+              currentStart = start2;
+              adHocRun2.schedule.forEach((sched: any) => {
+                expect(sched.interval).to.eql('12h');
+                expect(sched.status).to.eql('pending');
+                const runAt = moment(currentStart).add(12, 'hours').toISOString();
+                expect(sched.runAt).to.eql(runAt);
+                currentStart = runAt;
+              });
 
               expect(typeof adHocRun3.apiKeyId).to.be('string');
               expect(typeof adHocRun3.apiKeyToUse).to.be('string');
               expect(typeof adHocRun3.createdAt).to.be('string');
               expect(adHocRun3.duration).to.eql('12h');
               expect(adHocRun3.enabled).to.eql(true);
-              expect(adHocRun3.start).to.eql('2023-12-30T12:00:00.000Z');
-              expect(adHocRun3.end).to.eql('2024-01-01T12:00:00.000Z');
+              expect(adHocRun3.start).to.eql(start3);
+              expect(adHocRun3.end).to.eql(end3);
               expect(adHocRun3.status).to.eql('pending');
               expect(adHocRun3.spaceId).to.eql(space.id);
               testExpectedRule(adHocRun3, undefined, true);
-              expect(adHocRun3.schedule).to.eql([
-                {
-                  interval: '12h',
-                  runAt: '2023-12-31T00:00:00.000Z',
-                  status: 'pending',
-                },
-                {
-                  interval: '12h',
-                  runAt: '2023-12-31T12:00:00.000Z',
-                  status: 'pending',
-                },
-                {
-                  interval: '12h',
-                  runAt: '2024-01-01T00:00:00.000Z',
-                  status: 'pending',
-                },
-                {
-                  interval: '12h',
-                  runAt: '2024-01-01T12:00:00.000Z',
-                  status: 'pending',
-                },
-              ]);
+
+              currentStart = start3;
+              adHocRun3.schedule.forEach((sched: any) => {
+                expect(sched.interval).to.eql('12h');
+                expect(sched.status).to.eql('pending');
+                const runAt = moment(currentStart).add(12, 'hours').toISOString();
+                expect(sched.runAt).to.eql(runAt);
+                currentStart = runAt;
+              });
 
               // check references are stored correctly
               expect(adHocRunSO1.references).to.eql([{ id: ruleId, name: 'rule', type: 'alert' }]);
@@ -726,12 +567,7 @@ export default function scheduleBackfillTests({ getService }: FtrProviderContext
             .post(`${getUrlPrefix(apiOptions.spaceId)}/internal/alerting/rules/backfill/_schedule`)
             .set('kbn-xsrf', 'foo')
             .auth(apiOptions.username, apiOptions.password)
-            .send([
-              {
-                rule_id: 'abc',
-                start: 'foo',
-              },
-            ]);
+            .send([{ rule_id: 'abc', start: 'foo' }]);
 
           // invalid end time
           const response2 = await supertestWithoutAuth
@@ -741,34 +577,58 @@ export default function scheduleBackfillTests({ getService }: FtrProviderContext
             .send([
               {
                 rule_id: 'abc',
-                start: '2023-10-19T12:00:00.000Z',
+                start: moment().utc().startOf('day').subtract(7, 'days').toISOString(),
                 end: 'foo',
               },
             ]);
 
           // end time equals start time
+          const time = moment().utc().startOf('day').subtract(7, 'days').toISOString();
           const response3 = await supertestWithoutAuth
+            .post(`${getUrlPrefix(apiOptions.spaceId)}/internal/alerting/rules/backfill/_schedule`)
+            .set('kbn-xsrf', 'foo')
+            .auth(apiOptions.username, apiOptions.password)
+            .send([{ rule_id: 'abc', start: time, end: time }]);
+
+          // end time is before start time
+          const response4 = await supertestWithoutAuth
             .post(`${getUrlPrefix(apiOptions.spaceId)}/internal/alerting/rules/backfill/_schedule`)
             .set('kbn-xsrf', 'foo')
             .auth(apiOptions.username, apiOptions.password)
             .send([
               {
                 rule_id: 'abc',
-                start: '2023-10-19T12:00:00.000Z',
-                end: '2023-10-19T12:00:00.000Z',
+                start: moment().utc().startOf('day').subtract(7, 'days').toISOString(),
+                end: moment().utc().startOf('day').subtract(8, 'days').toISOString(),
               },
             ]);
 
-          // end time is before start time
-          const response4 = await supertestWithoutAuth
+          // start time is too far in the past
+          const response5 = await supertestWithoutAuth
+            .post(`${getUrlPrefix(apiOptions.spaceId)}/internal/alerting/rules/backfill/_schedule`)
+            .set('kbn-xsrf', 'foo')
+            .auth(apiOptions.username, apiOptions.password)
+            .send([{ rule_id: 'abc', start: '2023-04-30T00:00:00.000Z' }]);
+
+          // start time is in the future
+          const response6 = await supertestWithoutAuth
+            .post(`${getUrlPrefix(apiOptions.spaceId)}/internal/alerting/rules/backfill/_schedule`)
+            .set('kbn-xsrf', 'foo')
+            .auth(apiOptions.username, apiOptions.password)
+            .send([
+              { rule_id: 'abc', start: moment().utc().startOf('day').add(1, 'days').toISOString() },
+            ]);
+
+          // end time is in the future
+          const response7 = await supertestWithoutAuth
             .post(`${getUrlPrefix(apiOptions.spaceId)}/internal/alerting/rules/backfill/_schedule`)
             .set('kbn-xsrf', 'foo')
             .auth(apiOptions.username, apiOptions.password)
             .send([
               {
                 rule_id: 'abc',
-                start: '2023-10-19T12:00:00.000Z',
-                end: '2020-10-19T12:00:00.000Z',
+                start: moment().utc().startOf('day').subtract(1, 'days').toISOString(),
+                end: moment().utc().startOf('day').add(1, 'days').toISOString(),
               },
             ]);
 
@@ -817,6 +677,27 @@ export default function scheduleBackfillTests({ getService }: FtrProviderContext
                 error: 'Bad Request',
                 message: '[request body.0]: Backfill end must be greater than backfill start',
               });
+
+              expect(response5.statusCode).to.eql(400);
+              expect(response5.body).to.eql({
+                statusCode: 400,
+                error: 'Bad Request',
+                message: '[request body.0]: Backfill cannot look back more than 90 days',
+              });
+
+              expect(response6.statusCode).to.eql(400);
+              expect(response6.body).to.eql({
+                statusCode: 400,
+                error: 'Bad Request',
+                message: '[request body.0]: Backfill cannot be scheduled for the future',
+              });
+
+              expect(response7.statusCode).to.eql(400);
+              expect(response7.body).to.eql({
+                statusCode: 400,
+                error: 'Bad Request',
+                message: '[request body.0]: Backfill cannot be scheduled for the future',
+              });
               break;
             default:
               throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);
@@ -832,7 +713,7 @@ export default function scheduleBackfillTests({ getService }: FtrProviderContext
             .send([
               {
                 rule_id: 'ac612b4b-5d0c-46d7-855a-98dd920e3aa6',
-                start: '2023-10-19T12:00:00.000Z',
+                start: moment().utc().startOf('day').subtract(7, 'days').toISOString(),
               },
             ]);
 
@@ -872,6 +753,8 @@ export default function scheduleBackfillTests({ getService }: FtrProviderContext
         });
 
         it('should handle schedule request where some requests succeed and some requests fail appropriately', async () => {
+          const start = moment().utc().startOf('day').subtract(7, 'days').toISOString();
+          const end = moment().utc().startOf('day').subtract(5, 'days').toISOString();
           // create 2 rules
           const rresponse1 = await supertest
             .post(`${getUrlPrefix(apiOptions.spaceId)}/api/alerting/rule`)
@@ -927,16 +810,12 @@ export default function scheduleBackfillTests({ getService }: FtrProviderContext
             .set('kbn-xsrf', 'foo')
             .auth(apiOptions.username, apiOptions.password)
             .send([
-              {
-                rule_id: ruleId1,
-                start: '2023-10-19T12:00:00.000Z',
-                end: '2023-10-21T00:00:00.000Z',
-              },
-              { rule_id: ruleId2, start: '2023-10-19T12:00:00.000Z' },
-              { rule_id: lifecycleRuleId, start: '2023-10-19T12:00:00.000Z' },
-              { rule_id: disabledRuleId, start: '2023-10-19T12:00:00.000Z' },
-              { rule_id: deletedRuleId, start: '2023-10-19T12:00:00.000Z' },
-              { rule_id: ruleId1, start: '2023-10-19T12:00:00.000Z' },
+              { rule_id: ruleId1, start, end },
+              { rule_id: ruleId2, start },
+              { rule_id: lifecycleRuleId, start },
+              { rule_id: disabledRuleId, start },
+              { rule_id: deletedRuleId, start },
+              { rule_id: ruleId1, start },
             ]);
 
           switch (scenario.id) {
@@ -977,48 +856,42 @@ export default function scheduleBackfillTests({ getService }: FtrProviderContext
               backfillIds.push({ id: result[0].id, spaceId: apiOptions.spaceId });
               expect(result[0].duration).to.eql('12h');
               expect(result[0].enabled).to.eql(true);
-              expect(result[0].start).to.eql('2023-10-19T12:00:00.000Z');
-              expect(result[0].end).to.eql('2023-10-21T00:00:00.000Z');
+              expect(result[0].start).to.eql(start);
+              expect(result[0].end).to.eql(end);
               expect(result[0].status).to.eql('pending');
               expect(result[0].space_id).to.eql(space.id);
               expect(typeof result[0].created_at).to.be('string');
               testExpectedRule(result[0], ruleId1, false);
-              expect(result[0].schedule).to.eql([
-                {
-                  interval: '12h',
-                  run_at: '2023-10-20T00:00:00.000Z',
-                  status: 'pending',
-                },
-                {
-                  interval: '12h',
-                  run_at: '2023-10-20T12:00:00.000Z',
-                  status: 'pending',
-                },
-                {
-                  interval: '12h',
-                  run_at: '2023-10-21T00:00:00.000Z',
-                  status: 'pending',
-                },
-              ]);
+
+              let currentStart = start;
+              result[0].schedule.forEach((sched: any) => {
+                expect(sched.interval).to.eql('12h');
+                expect(sched.status).to.eql('pending');
+                const runAt = moment(currentStart).add(12, 'hours').toISOString();
+                expect(sched.run_at).to.eql(runAt);
+                currentStart = runAt;
+              });
 
               // successful schedule
               expect(typeof result[1].id).to.be('string');
               backfillIds.push({ id: result[1].id, spaceId: apiOptions.spaceId });
               expect(result[1].duration).to.eql('12h');
               expect(result[1].enabled).to.eql(true);
-              expect(result[1].start).to.eql('2023-10-19T12:00:00.000Z');
-              expect(result[1].end).to.eql('2023-10-20T00:00:00.000Z');
+              expect(result[1].start).to.eql(start);
+              expect(result[1].end).to.eql(moment(start).add(12, 'hours').toISOString());
               expect(result[1].status).to.eql('pending');
               expect(result[1].space_id).to.eql(space.id);
               expect(typeof result[1].created_at).to.be('string');
               testExpectedRule(result[1], ruleId2, false);
-              expect(result[1].schedule).to.eql([
-                {
-                  interval: '12h',
-                  run_at: '2023-10-20T00:00:00.000Z',
-                  status: 'pending',
-                },
-              ]);
+
+              currentStart = start;
+              result[1].schedule.forEach((sched: any) => {
+                expect(sched.interval).to.eql('12h');
+                expect(sched.status).to.eql('pending');
+                const runAt = moment(currentStart).add(12, 'hours').toISOString();
+                expect(sched.run_at).to.eql(runAt);
+                currentStart = runAt;
+              });
 
               // error scheduling due to unsupported rule type
               expect(result[2]).to.eql({
@@ -1049,19 +922,21 @@ export default function scheduleBackfillTests({ getService }: FtrProviderContext
               backfillIds.push({ id: result[5].id, spaceId: apiOptions.spaceId });
               expect(result[5].duration).to.eql('12h');
               expect(result[5].enabled).to.eql(true);
-              expect(result[5].start).to.eql('2023-10-19T12:00:00.000Z');
-              expect(result[5].end).to.eql('2023-10-20T00:00:00.000Z');
+              expect(result[5].start).to.eql(start);
+              expect(result[5].end).to.eql(moment(start).add(12, 'hours').toISOString());
               expect(result[5].status).to.eql('pending');
               expect(result[5].space_id).to.eql(space.id);
               expect(typeof result[5].created_at).to.be('string');
               testExpectedRule(result[5], ruleId1, false);
-              expect(result[5].schedule).to.eql([
-                {
-                  interval: '12h',
-                  run_at: '2023-10-20T00:00:00.000Z',
-                  status: 'pending',
-                },
-              ]);
+
+              currentStart = start;
+              result[5].schedule.forEach((sched: any) => {
+                expect(sched.interval).to.eql('12h');
+                expect(sched.status).to.eql('pending');
+                const runAt = moment(currentStart).add(12, 'hours').toISOString();
+                expect(sched.run_at).to.eql(runAt);
+                currentStart = runAt;
+              });
 
               // check that the expected ad hoc run SOs were created
               const adHocRunSO1 = (await getAdHocRunSO(result[0].id)) as SavedObject<AdHocRunSO>;
@@ -1076,64 +951,60 @@ export default function scheduleBackfillTests({ getService }: FtrProviderContext
               expect(typeof adHocRun1.createdAt).to.be('string');
               expect(adHocRun1.duration).to.eql('12h');
               expect(adHocRun1.enabled).to.eql(true);
-              expect(adHocRun1.start).to.eql('2023-10-19T12:00:00.000Z');
-              expect(adHocRun1.end).to.eql('2023-10-21T00:00:00.000Z');
+              expect(adHocRun1.start).to.eql(start);
+              expect(adHocRun1.end).to.eql(end);
               expect(adHocRun1.status).to.eql('pending');
               expect(adHocRun1.spaceId).to.eql(space.id);
               testExpectedRule(adHocRun1, undefined, true);
-              expect(adHocRun1.schedule).to.eql([
-                {
-                  interval: '12h',
-                  runAt: '2023-10-20T00:00:00.000Z',
-                  status: 'pending',
-                },
-                {
-                  interval: '12h',
-                  runAt: '2023-10-20T12:00:00.000Z',
-                  status: 'pending',
-                },
-                {
-                  interval: '12h',
-                  runAt: '2023-10-21T00:00:00.000Z',
-                  status: 'pending',
-                },
-              ]);
+
+              currentStart = start;
+              adHocRun1.schedule.forEach((sched: any) => {
+                expect(sched.interval).to.eql('12h');
+                expect(sched.status).to.eql('pending');
+                const runAt = moment(currentStart).add(12, 'hours').toISOString();
+                expect(sched.runAt).to.eql(runAt);
+                currentStart = runAt;
+              });
 
               expect(typeof adHocRun2.apiKeyId).to.be('string');
               expect(typeof adHocRun2.apiKeyToUse).to.be('string');
               expect(typeof adHocRun2.createdAt).to.be('string');
               expect(adHocRun2.duration).to.eql('12h');
               expect(adHocRun2.enabled).to.eql(true);
-              expect(adHocRun2.start).to.eql('2023-10-19T12:00:00.000Z');
-              expect(adHocRun2.end).to.eql('2023-10-20T00:00:00.000Z');
+              expect(adHocRun2.start).to.eql(start);
+              expect(adHocRun2.end).to.eql(moment(start).add(12, 'hours').toISOString());
               expect(adHocRun2.status).to.eql('pending');
               expect(adHocRun2.spaceId).to.eql(space.id);
               testExpectedRule(adHocRun2, undefined, true);
-              expect(adHocRun2.schedule).to.eql([
-                {
-                  runAt: '2023-10-20T00:00:00.000Z',
-                  status: 'pending',
-                  interval: '12h',
-                },
-              ]);
+
+              currentStart = start;
+              adHocRun2.schedule.forEach((sched: any) => {
+                expect(sched.interval).to.eql('12h');
+                expect(sched.status).to.eql('pending');
+                const runAt = moment(currentStart).add(12, 'hours').toISOString();
+                expect(sched.runAt).to.eql(runAt);
+                currentStart = runAt;
+              });
 
               expect(typeof adHocRun3.apiKeyId).to.be('string');
               expect(typeof adHocRun3.apiKeyToUse).to.be('string');
               expect(typeof adHocRun3.createdAt).to.be('string');
               expect(adHocRun3.duration).to.eql('12h');
               expect(adHocRun3.enabled).to.eql(true);
-              expect(adHocRun3.start).to.eql('2023-10-19T12:00:00.000Z');
-              expect(adHocRun3.end).to.eql('2023-10-20T00:00:00.000Z');
+              expect(adHocRun3.start).to.eql(start);
+              expect(adHocRun3.end).to.eql(moment(start).add(12, 'hours').toISOString());
               expect(adHocRun3.status).to.eql('pending');
               expect(adHocRun3.spaceId).to.eql(space.id);
               testExpectedRule(adHocRun3, undefined, true);
-              expect(adHocRun3.schedule).to.eql([
-                {
-                  runAt: '2023-10-20T00:00:00.000Z',
-                  status: 'pending',
-                  interval: '12h',
-                },
-              ]);
+
+              currentStart = start;
+              adHocRun3.schedule.forEach((sched: any) => {
+                expect(sched.interval).to.eql('12h');
+                expect(sched.status).to.eql('pending');
+                const runAt = moment(currentStart).add(12, 'hours').toISOString();
+                expect(sched.runAt).to.eql(runAt);
+                currentStart = runAt;
+              });
 
               // check references are stored correctly
               expect(adHocRunSO1.references).to.eql([{ id: ruleId1, name: 'rule', type: 'alert' }]);
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/backfill/task_runner.ts b/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/backfill/task_runner.ts
index 72635b82c8daf1..6b555198e5effb 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/backfill/task_runner.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/backfill/task_runner.ts
@@ -6,6 +6,7 @@
  */
 
 import expect from '@kbn/expect';
+import moment from 'moment';
 import { SearchHit } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import type { SecurityAlert } from '@kbn/alerts-as-data-utils';
 import {
@@ -61,28 +62,28 @@ export default function createBackfillTaskRunnerTests({ getService }: FtrProvide
   const timestampPattern = /\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d{3}Z/;
   const originalDocTimestamps = [
     // before first backfill run
-    '2023-10-18T10:42:37.452Z',
+    moment().utc().subtract(14, 'days').toISOString(),
 
     // backfill execution set 1
-    '2023-10-19T12:23:54.485Z',
-    '2023-10-19T13:48:11.654Z',
-    '2023-10-19T21:00:03.472Z',
+    moment().utc().startOf('day').subtract(13, 'days').add(64, 'seconds').toISOString(),
+    moment().utc().startOf('day').subtract(13, 'days').add(65, 'seconds').toISOString(),
+    moment().utc().startOf('day').subtract(13, 'days').add(66, 'seconds').toISOString(),
 
     // backfill execution set 2
-    '2023-10-20T08:12:34.954Z',
+    moment().utc().startOf('day').subtract(12, 'days').add(89, 'seconds').toISOString(),
 
     // backfill execution set 3
-    '2023-10-20T14:39:41.457Z',
-    '2023-10-20T14:39:41.457Z',
-    '2023-10-20T16:21:01.004Z',
-    '2023-10-20T19:02:12.475Z',
-    '2023-10-20T23:59:59.999Z',
+    moment().utc().startOf('day').subtract(11, 'days').add(785, 'seconds').toISOString(),
+    moment().utc().startOf('day').subtract(11, 'days').add(888, 'seconds').toISOString(),
+    moment().utc().startOf('day').subtract(11, 'days').add(954, 'seconds').toISOString(),
+    moment().utc().startOf('day').subtract(11, 'days').add(1045, 'seconds').toISOString(),
+    moment().utc().startOf('day').subtract(11, 'days').add(1145, 'seconds').toISOString(),
 
     // backfill execution set 4 purposely left empty
 
     // after last backfill
-    '2023-10-21T13:36:13.175Z',
-    '2023-10-21T15:42:31.145Z',
+    moment().utc().startOf('day').subtract(9, 'days').add(666, 'seconds').toISOString(),
+    moment().utc().startOf('day').subtract(9, 'days').add(667, 'seconds').toISOString(),
   ];
 
   describe('ad hoc backfill task', () => {
@@ -126,7 +127,7 @@ export default function createBackfillTaskRunnerTests({ getService }: FtrProvide
           tags: [],
           rule_type_id: 'siem.queryRule',
           consumer: 'siem',
-          schedule: { interval: '12h' },
+          schedule: { interval: '24h' },
           actions: [],
           params: {
             author: [],
@@ -165,46 +166,30 @@ export default function createBackfillTaskRunnerTests({ getService }: FtrProvide
       const ruleId = response1.body.id;
       objectRemover.add(spaceId, ruleId, 'rule', 'alerting');
 
+      const start = moment().utc().startOf('day').subtract(13, 'days').toISOString();
+      const end = moment().utc().startOf('day').subtract(9, 'days').toISOString();
+
       // Schedule backfill for this rule
       const response2 = await supertestWithoutAuth
         .post(`${getUrlPrefix(spaceId)}/internal/alerting/rules/backfill/_schedule`)
         .set('kbn-xsrf', 'foo')
         .auth(SuperuserAtSpace1.user.username, SuperuserAtSpace1.user.password)
-        .send([
-          {
-            rule_id: ruleId,
-            start: '2023-10-19T12:00:00.000Z',
-            end: '2023-10-21T12:00:00.000Z',
-          },
-        ])
+        .send([{ rule_id: ruleId, start, end }])
         .expect(200);
 
       const scheduleResult = response2.body;
 
       expect(scheduleResult.length).to.eql(1);
       expect(scheduleResult[0].schedule.length).to.eql(4);
-      expect(scheduleResult[0].schedule).to.eql([
-        {
-          interval: '12h',
-          run_at: '2023-10-20T00:00:00.000Z',
-          status: 'pending',
-        },
-        {
-          interval: '12h',
-          run_at: '2023-10-20T12:00:00.000Z',
-          status: 'pending',
-        },
-        {
-          interval: '12h',
-          run_at: '2023-10-21T00:00:00.000Z',
-          status: 'pending',
-        },
-        {
-          interval: '12h',
-          run_at: '2023-10-21T12:00:00.000Z',
-          status: 'pending',
-        },
-      ]);
+
+      let currentStart = start;
+      scheduleResult[0].schedule.forEach((sched: any) => {
+        expect(sched.interval).to.eql('24h');
+        expect(sched.status).to.eql('pending');
+        const runAt = moment(currentStart).add(24, 'hours').toISOString();
+        expect(sched.run_at).to.eql(runAt);
+        currentStart = runAt;
+      });
 
       const backfillId = scheduleResult[0].id;
 
@@ -414,16 +399,12 @@ export default function createBackfillTaskRunnerTests({ getService }: FtrProvide
       objectRemover.add(spaceId, ruleId, 'rule', 'alerting');
 
       // schedule backfill for this rule
+      const start = moment().utc().startOf('day').subtract(13, 'days').toISOString();
       const response2 = await supertestWithoutAuth
         .post(`${getUrlPrefix(spaceId)}/internal/alerting/rules/backfill/_schedule`)
         .set('kbn-xsrf', 'foo')
         .auth(SuperuserAtSpace1.user.username, SuperuserAtSpace1.user.password)
-        .send([
-          {
-            rule_id: ruleId,
-            start: '2023-10-19T12:00:00.000Z',
-          },
-        ])
+        .send([{ rule_id: ruleId, start }])
         .expect(200);
 
       const scheduleResult = response2.body;
@@ -433,7 +414,7 @@ export default function createBackfillTaskRunnerTests({ getService }: FtrProvide
       expect(scheduleResult[0].schedule).to.eql([
         {
           interval: '12h',
-          run_at: '2023-10-20T00:00:00.000Z',
+          run_at: moment(start).add(12, 'hours').toISOString(),
           status: 'pending',
         },
       ]);
@@ -556,45 +537,27 @@ export default function createBackfillTaskRunnerTests({ getService }: FtrProvide
       objectRemover.add(spaceId, ruleId, 'rule', 'alerting');
 
       // schedule backfill for this rule
+      const start = moment().utc().startOf('day').subtract(13, 'days').toISOString();
+      const end = moment().utc().startOf('day').subtract(11, 'days').toISOString();
       const response2 = await supertestWithoutAuth
         .post(`${getUrlPrefix(spaceId)}/internal/alerting/rules/backfill/_schedule`)
         .set('kbn-xsrf', 'foo')
         .auth(SuperuserAtSpace1.user.username, SuperuserAtSpace1.user.password)
-        .send([
-          {
-            rule_id: ruleId,
-            start: '2023-10-19T12:00:00.000Z',
-            end: '2023-10-21T12:00:00.000Z',
-          },
-        ])
+        .send([{ rule_id: ruleId, start, end }])
         .expect(200);
 
       const scheduleResult = response2.body;
 
       expect(scheduleResult.length).to.eql(1);
       expect(scheduleResult[0].schedule.length).to.eql(4);
-      expect(scheduleResult[0].schedule).to.eql([
-        {
-          interval: '12h',
-          run_at: '2023-10-20T00:00:00.000Z',
-          status: 'pending',
-        },
-        {
-          interval: '12h',
-          run_at: '2023-10-20T12:00:00.000Z',
-          status: 'pending',
-        },
-        {
-          interval: '12h',
-          run_at: '2023-10-21T00:00:00.000Z',
-          status: 'pending',
-        },
-        {
-          interval: '12h',
-          run_at: '2023-10-21T12:00:00.000Z',
-          status: 'pending',
-        },
-      ]);
+      let currentStart = start;
+      scheduleResult[0].schedule.forEach((sched: any) => {
+        expect(sched.interval).to.eql('12h');
+        expect(sched.status).to.eql('pending');
+        const runAt = moment(currentStart).add(12, 'hours').toISOString();
+        expect(sched.run_at).to.eql(runAt);
+        currentStart = runAt;
+      });
 
       const backfillId = scheduleResult[0].id;
 
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group2/transform_rule_types/transform_health/rule.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group2/transform_rule_types/transform_health/rule.ts
index 318b8f99a61e0f..d3a3faacf7fdbc 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group2/transform_rule_types/transform_health/rule.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group2/transform_rule_types/transform_health/rule.ts
@@ -30,8 +30,6 @@ const ES_TEST_INDEX_SOURCE = 'transform-alert:transform-health';
 const ES_TEST_INDEX_REFERENCE = '-na-';
 const ES_TEST_OUTPUT_INDEX_NAME = `${ES_TEST_INDEX_NAME}-ts-output`;
 
-const RULE_INTERVAL_SECONDS = 3;
-
 interface CreateRuleParams {
   name: string;
   includeTransforms: string[];
@@ -80,8 +78,7 @@ export default function ruleTests({ getService }: FtrProviderContext) {
     `.internal.alerts-transform.health.alerts-default-000001`
   );
 
-  // Failing: See https://github.com/elastic/kibana/issues/177215
-  describe.skip('rule', async () => {
+  describe('rule', async () => {
     const objectRemover = new ObjectRemover(supertest);
     let connectorId: string;
     const transformId = 'test_transform_01';
@@ -114,13 +111,13 @@ export default function ruleTests({ getService }: FtrProviderContext) {
     });
 
     it('runs correctly', async () => {
+      await stopTransform(transformId);
+
       const ruleId = await createRule({
         name: 'Test all transforms',
         includeTransforms: ['*'],
       });
 
-      await stopTransform(transformId);
-
       log.debug('Checking created alerts...');
 
       const docs = await waitForDocs(1);
@@ -194,7 +191,7 @@ export default function ruleTests({ getService }: FtrProviderContext) {
           consumer: 'alerts',
           enabled: true,
           rule_type_id: RULE_TYPE_ID,
-          schedule: { interval: `${RULE_INTERVAL_SECONDS}s` },
+          schedule: { interval: '1d' },
           actions: [action],
           notify_when: 'onActiveAlert',
           params: {
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group4/alerts_as_data/alerts_as_data_flapping.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group4/alerts_as_data/alerts_as_data_flapping.ts
index 970f3585bb17be..e94720bbc209d7 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group4/alerts_as_data/alerts_as_data_flapping.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group4/alerts_as_data/alerts_as_data_flapping.ts
@@ -32,8 +32,7 @@ export default function createAlertsAsDataFlappingTest({ getService }: FtrProvid
 
   const alertsAsDataIndex = '.alerts-test.patternfiring.alerts-default';
 
-  // FLAKY: https://github.com/elastic/kibana/issues/161477
-  describe.skip('alerts as data flapping', () => {
+  describe('alerts as data flapping', () => {
     beforeEach(async () => {
       await es.deleteByQuery({
         index: alertsAsDataIndex,
@@ -407,10 +406,13 @@ export default function createAlertsAsDataFlappingTest({ getService }: FtrProvid
       await waitForEventLogDocs(ruleId, new Map([['execute', { equal: 1 }]]));
       // Run the rule 6 more times
       for (let i = 0; i < 6; i++) {
-        const response = await supertestWithoutAuth
-          .post(`${getUrlPrefix(Spaces.space1.id)}/internal/alerting/rule/${ruleId}/_run_soon`)
-          .set('kbn-xsrf', 'foo');
-        expect(response.status).to.eql(204);
+        await retry.try(async () => {
+          const response = await supertestWithoutAuth
+            .post(`${getUrlPrefix(Spaces.space1.id)}/internal/alerting/rule/${ruleId}/_run_soon`)
+            .set('kbn-xsrf', 'foo');
+          expect(response.status).to.eql(204);
+        });
+
         await waitForEventLogDocs(ruleId, new Map([['execute', { equal: ++run }]]));
       }
 
diff --git a/x-pack/test/api_integration/apis/ml/index.ts b/x-pack/test/api_integration/apis/ml/index.ts
index 3f9450c50cfaaa..cccc5ee5619841 100644
--- a/x-pack/test/api_integration/apis/ml/index.ts
+++ b/x-pack/test/api_integration/apis/ml/index.ts
@@ -62,7 +62,6 @@ export default function ({ getService, loadTestFile }: FtrProviderContext) {
     loadTestFile(require.resolve('./data_frame_analytics'));
     loadTestFile(require.resolve('./fields_service'));
     loadTestFile(require.resolve('./filters'));
-    loadTestFile(require.resolve('./indices'));
     loadTestFile(require.resolve('./job_validation'));
     loadTestFile(require.resolve('./job_audit_messages'));
     loadTestFile(require.resolve('./jobs'));
diff --git a/x-pack/test/api_integration/apis/ml/indices/field_caps.ts b/x-pack/test/api_integration/apis/ml/indices/field_caps.ts
deleted file mode 100644
index 0baa7e39969c4e..00000000000000
--- a/x-pack/test/api_integration/apis/ml/indices/field_caps.ts
+++ /dev/null
@@ -1,71 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import expect from '@kbn/expect';
-
-import { FtrProviderContext } from '../../../ftr_provider_context';
-import { getCommonRequestHeader } from '../../../../functional/services/ml/common_api';
-import { USER } from '../../../../functional/services/ml/security_common';
-
-export default ({ getService }: FtrProviderContext) => {
-  const supertest = getService('supertestWithoutAuth');
-  const esArchiver = getService('esArchiver');
-  const ml = getService('ml');
-
-  async function runRequest(
-    index: string,
-    fields?: string[]
-  ): Promise<{ indices: string[]; fields: any }> {
-    const { body, status } = await supertest
-      .post(`/internal/ml/indices/field_caps`)
-      .auth(USER.ML_POWERUSER, ml.securityCommon.getPasswordForUser(USER.ML_POWERUSER))
-      .set(getCommonRequestHeader('1'))
-      .send({ index, fields });
-    ml.api.assertResponseStatusCode(200, status, body);
-
-    return body;
-  }
-
-  // Failing ES Promotion: https://github.com/elastic/kibana/issues/182514
-  describe.skip('field_caps', () => {
-    before(async () => {
-      await esArchiver.loadIfNeeded('x-pack/test/functional/es_archives/ml/farequote');
-    });
-
-    after(async () => {
-      await ml.api.cleanMlIndices();
-    });
-
-    it('selected fields in index', async () => {
-      const { indices, fields } = await runRequest('ft_farequote', ['airline', 'responsetime']);
-      expect(indices.length).to.eql(
-        1,
-        `Expected number of indices to be 1, but got ${indices.length}`
-      );
-      const fieldsLength = Object.keys(fields).length;
-      expect(fieldsLength).to.eql(2, `Expected number of fields to be 2, but got ${fieldsLength}`);
-      expect(fields.airline.keyword.type).to.eql('keyword', 'Expected airline type to be keyword');
-      expect(fields.responsetime.float.type).to.eql(
-        'float',
-        'Expected responsetime type to be float'
-      );
-    });
-
-    it('all fields in index', async () => {
-      const { indices, fields } = await runRequest('ft_farequote');
-      expect(indices.length).to.eql(
-        1,
-        `Expected number of indices to be 1, but got ${indices.length}`
-      );
-      const fieldsLength = Object.keys(fields).length;
-      expect(fieldsLength).to.eql(
-        21,
-        `Expected number of fields to be 21, but got ${fieldsLength}`
-      );
-    });
-  });
-};
diff --git a/x-pack/test/api_integration/apis/security/builtin_es_privileges.ts b/x-pack/test/api_integration/apis/security/builtin_es_privileges.ts
index 89587fe2596837..8087ded821b5b0 100644
--- a/x-pack/test/api_integration/apis/security/builtin_es_privileges.ts
+++ b/x-pack/test/api_integration/apis/security/builtin_es_privileges.ts
@@ -24,7 +24,7 @@ export default function ({ getService }: FtrProviderContext) {
             const sampleOfExpectedIndexPrivileges = ['create', 'index', 'delete'];
 
             const payload = response.body;
-            expect(Object.keys(payload).sort()).to.eql(['cluster', 'index']);
+            expect(Object.keys(payload).sort()).to.eql(['cluster', 'index', 'remote_cluster']);
 
             sampleOfExpectedClusterPrivileges.forEach((privilege) =>
               expect(payload.cluster).to.contain(privilege)
diff --git a/x-pack/test/api_integration/apis/security_solution/host_details.ts b/x-pack/test/api_integration/apis/security_solution/host_details.ts
deleted file mode 100644
index 6593636d21998b..00000000000000
--- a/x-pack/test/api_integration/apis/security_solution/host_details.ts
+++ /dev/null
@@ -1,232 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import expect from '@kbn/expect';
-import {
-  HostDetailsStrategyResponse,
-  HostsQueries,
-} from '@kbn/security-solution-plugin/common/search_strategy';
-import { FtrProviderContext } from '../../ftr_provider_context';
-
-export default function ({ getService }: FtrProviderContext) {
-  const esArchiver = getService('esArchiver');
-  const supertest = getService('supertest');
-  const bsearch = getService('bsearch');
-
-  describe('Host Details', () => {
-    describe('With filebeat', () => {
-      before(
-        async () => await esArchiver.load('x-pack/test/functional/es_archives/filebeat/default')
-      );
-      after(
-        async () => await esArchiver.unload('x-pack/test/functional/es_archives/filebeat/default')
-      );
-
-      const FROM = '2000-01-01T00:00:00.000Z';
-      const TO = '3000-01-01T00:00:00.000Z';
-      const expectedResult = {
-        isPartial: false,
-        isRunning: false,
-        rawResponse: {
-          took: 12,
-          timed_out: false,
-          _shards: {
-            total: 1,
-            successful: 1,
-            skipped: 0,
-            failed: 0,
-          },
-          hits: {
-            total: 6157,
-            max_score: null,
-            hits: [],
-          },
-          aggregations: {
-            cloud_instance_id: {
-              doc_count_error_upper_bound: 0,
-              sum_other_doc_count: 0,
-              buckets: [],
-            },
-            host_mac: {
-              doc_count_error_upper_bound: 0,
-              sum_other_doc_count: 0,
-              buckets: [],
-            },
-            host_ip: {
-              doc_count_error_upper_bound: 0,
-              sum_other_doc_count: 0,
-              buckets: [
-                {
-                  key: '151.205.0.17',
-                  doc_count: 1,
-                  timestamp: {
-                    value: 1549766627000,
-                    value_as_string: '2019-02-10T02:43:47.000Z',
-                  },
-                },
-              ],
-            },
-            cloud_machine_type: {
-              doc_count_error_upper_bound: 0,
-              sum_other_doc_count: 0,
-              buckets: [],
-            },
-            cloud_region: {
-              doc_count_error_upper_bound: 0,
-              sum_other_doc_count: 0,
-              buckets: [],
-            },
-            host_os_version: {
-              doc_count_error_upper_bound: 0,
-              sum_other_doc_count: 0,
-              buckets: [
-                {
-                  key: '9 (stretch)',
-                  doc_count: 6157,
-                  timestamp: {
-                    value: 1549767613001,
-                    value_as_string: '2019-02-10T03:00:13.001Z',
-                  },
-                },
-              ],
-            },
-            host_architecture: {
-              doc_count_error_upper_bound: 0,
-              sum_other_doc_count: 0,
-              buckets: [
-                {
-                  key: 'armv7l',
-                  doc_count: 6157,
-                  timestamp: {
-                    value: 1549767613001,
-                    value_as_string: '2019-02-10T03:00:13.001Z',
-                  },
-                },
-              ],
-            },
-            cloud_provider: {
-              doc_count_error_upper_bound: 0,
-              sum_other_doc_count: 0,
-              buckets: [],
-            },
-            host_os_platform: {
-              doc_count_error_upper_bound: 0,
-              sum_other_doc_count: 0,
-              buckets: [
-                {
-                  key: 'raspbian',
-                  doc_count: 6157,
-                  timestamp: {
-                    value: 1549767613001,
-                    value_as_string: '2019-02-10T03:00:13.001Z',
-                  },
-                },
-              ],
-            },
-            host_os_name: {
-              doc_count_error_upper_bound: 0,
-              sum_other_doc_count: 0,
-              buckets: [
-                {
-                  key: 'Raspbian GNU/Linux',
-                  doc_count: 6157,
-                  timestamp: {
-                    value: 1549767613001,
-                    value_as_string: '2019-02-10T03:00:13.001Z',
-                  },
-                },
-              ],
-            },
-            host_os_family: {
-              doc_count_error_upper_bound: 0,
-              sum_other_doc_count: 0,
-              buckets: [
-                {
-                  key: '',
-                  doc_count: 6157,
-                  timestamp: {
-                    value: 1549767613001,
-                    value_as_string: '2019-02-10T03:00:13.001Z',
-                  },
-                },
-              ],
-            },
-            host_name: {
-              doc_count_error_upper_bound: 0,
-              sum_other_doc_count: 0,
-              buckets: [
-                {
-                  key: 'raspberrypi',
-                  doc_count: 6157,
-                  timestamp: {
-                    value: 1549767613001,
-                    value_as_string: '2019-02-10T03:00:13.001Z',
-                  },
-                },
-              ],
-            },
-            host_id: {
-              doc_count_error_upper_bound: 0,
-              sum_other_doc_count: 0,
-              buckets: [
-                {
-                  key: 'b19a781f683541a7a25ee345133aa399',
-                  doc_count: 6157,
-                  timestamp: {
-                    value: 1549767613001,
-                    value_as_string: '2019-02-10T03:00:13.001Z',
-                  },
-                },
-              ],
-            },
-          },
-        },
-        total: 1,
-        loaded: 1,
-        inspect: {
-          dsl: [
-            '{\n  "allowNoIndices": true,\n  "index": [\n    "filebeat-*"\n  ],\n  "ignoreUnavailable": true,\n  "body": {\n    "aggregations": {\n      "host_architecture": {\n        "terms": {\n          "field": "host.architecture",\n          "size": 10,\n          "order": {\n            "timestamp": "desc"\n          }\n        },\n        "aggs": {\n          "timestamp": {\n            "max": {\n              "field": "@timestamp"\n            }\n          }\n        }\n      },\n      "host_id": {\n        "terms": {\n          "field": "host.id",\n          "size": 10,\n          "order": {\n            "timestamp": "desc"\n          }\n        },\n        "aggs": {\n          "timestamp": {\n            "max": {\n              "field": "@timestamp"\n            }\n          }\n        }\n      },\n      "host_ip": {\n        "terms": {\n          "field": "host.ip",\n          "size": 10,\n          "order": {\n            "timestamp": "desc"\n          }\n        },\n        "aggs": {\n          "timestamp": {\n            "max": {\n              "field": "@timestamp"\n            }\n          }\n        }\n      },\n      "host_mac": {\n        "terms": {\n          "field": "host.mac",\n          "size": 10,\n          "order": {\n            "timestamp": "desc"\n          }\n        },\n        "aggs": {\n          "timestamp": {\n            "max": {\n              "field": "@timestamp"\n            }\n          }\n        }\n      },\n      "host_name": {\n        "terms": {\n          "field": "host.name",\n          "size": 10,\n          "order": {\n            "timestamp": "desc"\n          }\n        },\n        "aggs": {\n          "timestamp": {\n            "max": {\n              "field": "@timestamp"\n            }\n          }\n        }\n      },\n      "host_os_family": {\n        "terms": {\n          "field": "host.os.family",\n          "size": 10,\n          "order": {\n            "timestamp": "desc"\n          }\n        },\n        "aggs": {\n          "timestamp": {\n            "max": {\n              "field": "@timestamp"\n            }\n          }\n        }\n      },\n      "host_os_name": {\n        "terms": {\n          "field": "host.os.name",\n          "size": 10,\n          "order": {\n            "timestamp": "desc"\n          }\n        },\n        "aggs": {\n          "timestamp": {\n            "max": {\n              "field": "@timestamp"\n            }\n          }\n        }\n      },\n      "host_os_platform": {\n        "terms": {\n          "field": "host.os.platform",\n          "size": 10,\n          "order": {\n            "timestamp": "desc"\n          }\n        },\n        "aggs": {\n          "timestamp": {\n            "max": {\n              "field": "@timestamp"\n            }\n          }\n        }\n      },\n      "host_os_version": {\n        "terms": {\n          "field": "host.os.version",\n          "size": 10,\n          "order": {\n            "timestamp": "desc"\n          }\n        },\n        "aggs": {\n          "timestamp": {\n            "max": {\n              "field": "@timestamp"\n            }\n          }\n        }\n      },\n      "cloud_instance_id": {\n        "terms": {\n          "field": "cloud.instance.id",\n          "size": 10,\n          "order": {\n            "timestamp": "desc"\n          }\n        },\n        "aggs": {\n          "timestamp": {\n            "max": {\n              "field": "@timestamp"\n            }\n          }\n        }\n      },\n      "cloud_machine_type": {\n        "terms": {\n          "field": "cloud.machine.type",\n          "size": 10,\n          "order": {\n            "timestamp": "desc"\n          }\n        },\n        "aggs": {\n          "timestamp": {\n            "max": {\n              "field": "@timestamp"\n            }\n          }\n        }\n      },\n      "cloud_provider": {\n        "terms": {\n          "field": "cloud.provider",\n          "size": 10,\n          "order": {\n            "timestamp": "desc"\n          }\n        },\n        "aggs": {\n          "timestamp": {\n            "max": {\n              "field": "@timestamp"\n            }\n          }\n        }\n      },\n      "cloud_region": {\n        "terms": {\n          "field": "cloud.region",\n          "size": 10,\n          "order": {\n            "timestamp": "desc"\n          }\n        },\n        "aggs": {\n          "timestamp": {\n            "max": {\n              "field": "@timestamp"\n            }\n          }\n        }\n      }\n    },\n    "query": {\n      "bool": {\n        "filter": [\n          {\n            "term": {\n              "host.name": "raspberrypi"\n            }\n          },\n          {\n            "range": {\n              "@timestamp": {\n                "format": "strict_date_optional_time",\n                "gte": "2000-01-01T00:00:00.000Z",\n                "lte": "3000-01-01T00:00:00.000Z"\n              }\n            }\n          }\n        ]\n      }\n    },\n    "size": 0,\n    "track_total_hits": false\n  }\n}',
-          ],
-        },
-        hostDetails: {
-          _id: 'raspberrypi',
-          host: {
-            architecture: ['armv7l'],
-            id: ['b19a781f683541a7a25ee345133aa399'],
-            ip: ['151.205.0.17'],
-            name: ['raspberrypi'],
-            os: {
-              family: [''],
-              name: ['Raspbian GNU/Linux'],
-              platform: ['raspbian'],
-              version: ['9 (stretch)'],
-            },
-          },
-        },
-      };
-
-      it('Make sure that we get HostDetails data', async () => {
-        const { hostDetails } = await bsearch.send<HostDetailsStrategyResponse>({
-          supertest,
-          options: {
-            factoryQueryType: HostsQueries.details,
-            timerange: {
-              interval: '12h',
-              to: TO,
-              from: FROM,
-            },
-            defaultIndex: ['filebeat-*'],
-            hostName: 'raspberrypi',
-            inspect: false,
-          },
-          strategy: 'securitySolutionSearchStrategy',
-        });
-        expect(hostDetails).to.eql(expectedResult.hostDetails);
-      });
-    });
-  });
-}
diff --git a/x-pack/test/api_integration/apis/security_solution/index.js b/x-pack/test/api_integration/apis/security_solution/index.js
deleted file mode 100644
index 501e2de697ec97..00000000000000
--- a/x-pack/test/api_integration/apis/security_solution/index.js
+++ /dev/null
@@ -1,30 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-export default function ({ loadTestFile }) {
-  describe('SecuritySolution Endpoints', () => {
-    loadTestFile(require.resolve('./authentications'));
-    loadTestFile(require.resolve('./events'));
-    loadTestFile(require.resolve('./hosts'));
-    loadTestFile(require.resolve('./host_details'));
-    loadTestFile(require.resolve('./network_details'));
-    loadTestFile(require.resolve('./network_dns'));
-    loadTestFile(require.resolve('./network_top_n_flow'));
-    loadTestFile(require.resolve('./overview_host'));
-    loadTestFile(require.resolve('./overview_network'));
-    loadTestFile(require.resolve('./saved_objects/notes'));
-    loadTestFile(require.resolve('./saved_objects/pinned_events'));
-    loadTestFile(require.resolve('./saved_objects/timeline'));
-    loadTestFile(require.resolve('./sources'));
-    loadTestFile(require.resolve('./timeline'));
-    loadTestFile(require.resolve('./timeline_migrations'));
-    loadTestFile(require.resolve('./timeline_details'));
-    loadTestFile(require.resolve('./uncommon_processes'));
-    loadTestFile(require.resolve('./users'));
-    loadTestFile(require.resolve('./tls'));
-  });
-}
diff --git a/x-pack/test/apm_api_integration/common/config.ts b/x-pack/test/apm_api_integration/common/config.ts
index c22fb0325288b3..37278fa510bc9f 100644
--- a/x-pack/test/apm_api_integration/common/config.ts
+++ b/x-pack/test/apm_api_integration/common/config.ts
@@ -11,6 +11,7 @@ import {
   ApmSynthtraceEsClient,
   ApmSynthtraceKibanaClient,
   LogsSynthtraceEsClient,
+  AssetsSynthtraceEsClient,
   createLogger,
   LogLevel,
 } from '@kbn/apm-synthtrace';
@@ -75,6 +76,10 @@ export interface CreateTest {
     logSynthtraceEsClient: (
       context: InheritedFtrProviderContext
     ) => Promise<LogsSynthtraceEsClient>;
+    synthtraceEsClient: (context: InheritedFtrProviderContext) => Promise<ApmSynthtraceEsClient>;
+    assetsSynthtraceEsClient: (
+      context: InheritedFtrProviderContext
+    ) => Promise<AssetsSynthtraceEsClient>;
     apmSynthtraceEsClient: (context: InheritedFtrProviderContext) => Promise<ApmSynthtraceEsClient>;
     synthtraceKibanaClient: (
       context: InheritedFtrProviderContext
@@ -121,6 +126,12 @@ export function createTestConfig(
             logger: createLogger(LogLevel.info),
             refreshAfterIndex: true,
           }),
+        assetsSynthtraceEsClient: (context: InheritedFtrProviderContext) =>
+          new AssetsSynthtraceEsClient({
+            client: context.getService('es'),
+            logger: createLogger(LogLevel.info),
+            refreshAfterIndex: true,
+          }),
         synthtraceKibanaClient: () => synthtraceKibanaClient,
         apmApiClient: async (context: InheritedFtrProviderContext) => {
           const { username, password } = servers.kibana;
diff --git a/x-pack/test/apm_api_integration/tests/asset_services/asset_services.spec.ts b/x-pack/test/apm_api_integration/tests/asset_services/asset_services.spec.ts
new file mode 100644
index 00000000000000..983c2c7ec7c2ff
--- /dev/null
+++ b/x-pack/test/apm_api_integration/tests/asset_services/asset_services.spec.ts
@@ -0,0 +1,261 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { Readable } from 'stream';
+import {
+  apm,
+  timerange,
+  log,
+  generateShortId,
+  Instance,
+  Serializable,
+} from '@kbn/apm-synthtrace-client';
+import { RecursivePartial } from '@kbn/apm-plugin/typings/common';
+import expect from '@kbn/expect';
+import moment from 'moment';
+import {
+  APIReturnType,
+  APIClientRequestParamsOf,
+} from '@kbn/apm-plugin/public/services/rest/create_call_apm_api';
+import { FtrProviderContext } from '../../common/ftr_provider_context';
+
+export default function ApiTest({ getService }: FtrProviderContext) {
+  const registry = getService('registry');
+  const apmApiClient = getService('apmApiClient');
+  const assetsSynthtraceClient = getService('assetsSynthtraceEsClient');
+
+  const start = new Date(moment().subtract(10, 'minutes').valueOf()).toISOString();
+  const end = new Date(moment().valueOf()).toISOString();
+  const range = timerange(start, end);
+
+  async function getServiceAssets(
+    overrides?: RecursivePartial<
+      APIClientRequestParamsOf<'GET /internal/apm/assets/services'>['params']
+    >
+  ) {
+    const response = await apmApiClient.readUser({
+      endpoint: 'GET /internal/apm/assets/services',
+      params: {
+        query: {
+          start,
+          end,
+          kuery: '',
+          ...overrides?.query,
+        },
+      },
+    });
+    return response;
+  }
+
+  let response: {
+    status: number;
+    body: APIReturnType<'GET /internal/apm/assets/services'>;
+  };
+
+  registry.when('Asset services when data is not loaded', { config: 'basic', archives: [] }, () => {
+    it('handles the empty state', async () => {
+      response = await getServiceAssets({ query: { start, end } });
+      expect(response.status).to.be(200);
+      expect(response.body.services.length).to.be(0);
+    });
+  });
+
+  registry.when('Asset services when data is loaded', { config: 'basic', archives: [] }, () => {
+    before(async () => {
+      const transactionName = '240rpm/75% 1000ms';
+
+      const successfulTimestamps = range.interval('1m').rate(1);
+      const failedTimestamps = range.interval('1m').rate(1);
+      const serviceNames = ['multisignal-service', 'apm-only-service'];
+
+      const instances = serviceNames.map((serviceName) =>
+        apm
+          .service({ name: serviceName, environment: 'testing', agentName: 'nodejs' })
+          .instance('instance')
+      );
+      const instanceSpans = (instance: Instance) => {
+        const successfulTraceEvents = successfulTimestamps.generator((timestamp) =>
+          instance
+            .transaction({ transactionName })
+            .timestamp(timestamp)
+            .duration(1000)
+            .success()
+            .children(
+              instance
+                .span({
+                  spanName: 'GET apm-*/_search',
+                  spanType: 'db',
+                  spanSubtype: 'elasticsearch',
+                })
+                .duration(1000)
+                .success()
+                .destination('elasticsearch')
+                .timestamp(timestamp),
+              instance
+                .span({ spanName: 'custom_operation', spanType: 'custom' })
+                .duration(100)
+                .success()
+                .timestamp(timestamp)
+            )
+        );
+
+        const failedTraceEvents = failedTimestamps.generator((timestamp) =>
+          instance
+            .transaction({ transactionName })
+            .timestamp(timestamp)
+            .duration(1000)
+            .failure()
+            .errors(
+              instance
+                .error({
+                  message: '[ResponseError] index_not_found_exception',
+                  type: 'ResponseError',
+                })
+                .timestamp(timestamp + 50)
+            )
+        );
+
+        const metricsets = range
+          .interval('30s')
+          .rate(1)
+          .generator((timestamp) =>
+            instance
+              .appMetrics({
+                'system.memory.actual.free': 800,
+                'system.memory.total': 1000,
+                'system.cpu.total.norm.pct': 0.6,
+                'system.process.cpu.total.norm.pct': 0.7,
+              })
+              .timestamp(timestamp)
+          );
+
+        return [...successfulTraceEvents, ...failedTraceEvents, ...metricsets];
+      };
+
+      const logEvents = range
+        .interval('1m')
+        .rate(1)
+        .generator((timestamp) => {
+          return [
+            log
+              .create()
+              .message('this is a log message')
+              .service('logs-only-service')
+              .logLevel('error')
+              .defaults({
+                'trace.id': generateShortId(),
+                'agent.name': 'synth-agent',
+              })
+              .timestamp(timestamp),
+            log
+              .create()
+              .message('this is a log message')
+              .service('multisignal-service')
+              .logLevel('error')
+              .defaults({
+                'trace.id': generateShortId(),
+                'agent.name': 'synth-agent',
+              })
+              .timestamp(timestamp),
+          ];
+        });
+
+      function* createGeneratorFromArray(arr: Array<Serializable<any>>) {
+        yield* arr;
+      }
+      const traces = instances.flatMap((instance) => instanceSpans(instance));
+      const tracesGenAssets = createGeneratorFromArray(traces);
+
+      //
+      return await assetsSynthtraceClient.index(
+        Readable.from(Array.from(logEvents).concat(Array.from(tracesGenAssets)))
+      );
+    });
+
+    after(async () => {
+      await assetsSynthtraceClient.clean();
+    });
+
+    describe('when no additional filters are applied', () => {
+      before(async () => {
+        response = await getServiceAssets({ query: { start, end } });
+      });
+
+      it('returns a successful response', async () => {
+        expect(response.status).to.be(200);
+        expect(response.body.services.length).to.be(3);
+      });
+
+      it('returns all services', () => {
+        const multisignal = response.body.services.find(
+          (item) => item.service.name === 'multisignal-service'
+        );
+
+        expect(multisignal?.asset.signalTypes).to.eql({
+          'asset.traces': true,
+          'asset.logs': true,
+        });
+        expect(multisignal?.service.environment).to.be('testing');
+
+        const apmOnly = response.body.services.find(
+          (item) => item.service.name === 'apm-only-service'
+        );
+
+        expect(apmOnly?.asset.signalTypes).to.eql({ 'asset.traces': true });
+        expect(apmOnly?.service.environment).to.be('testing');
+
+        const logsOnly = response.body.services.find(
+          (item) => item.service.name === 'logs-only-service'
+        );
+
+        expect(logsOnly?.asset.signalTypes).to.eql({ 'asset.logs': true });
+        expect(logsOnly?.service.environment).not.to.be('testing');
+      });
+    });
+
+    describe('when additional filters are applied', () => {
+      it('returns no services when the time range is outside the data range', async () => {
+        response = await getServiceAssets({
+          query: { start: '2022-10-01T00:00:00.000Z', end: '2022-10-01T01:00:00.000Z' },
+        });
+        expect(response.status).to.be(200);
+        expect(response.body.services.length).to.be(0);
+      });
+
+      it('returns services when the time range is within the data range', async () => {
+        response = await getServiceAssets({
+          query: {
+            start: new Date(moment().subtract(2, 'days').valueOf()).toISOString(),
+            end: new Date(moment().add(1, 'days').valueOf()).toISOString(),
+          },
+        });
+
+        expect(response.status).to.be(200);
+        expect(response.body.services.length).to.be(3);
+      });
+
+      it('returns services when filtering by service.name', async () => {
+        response = await getServiceAssets({
+          query: { start, end, kuery: 'service.name: "logs-only-*" ' },
+        });
+        expect(response.status).to.be(200);
+        const service = response.body.services[0];
+        expect(service.service.name).to.be('logs-only-service');
+        expect(service.asset.signalTypes['asset.logs']).to.be(true);
+      });
+
+      it('returns not services when filtering by a field that does not exist in assets', async () => {
+        response = await getServiceAssets({
+          query: { start, end, kuery: 'transaction.name: "240rpm/75% 1000ms" ' },
+        });
+
+        expect(response.status).to.be(200);
+        expect(response.body.services.length).to.be(0);
+      });
+    });
+  });
+}
diff --git a/x-pack/test/apm_api_integration/tests/time_range_metadata/many_apm_server_versions.spec.ts b/x-pack/test/apm_api_integration/tests/time_range_metadata/many_apm_server_versions.spec.ts
index 01b4b355308368..6031b7dd8de5bb 100644
--- a/x-pack/test/apm_api_integration/tests/time_range_metadata/many_apm_server_versions.spec.ts
+++ b/x-pack/test/apm_api_integration/tests/time_range_metadata/many_apm_server_versions.spec.ts
@@ -7,11 +7,7 @@
 import expect from '@kbn/expect';
 import { apm, timerange } from '@kbn/apm-synthtrace-client';
 import moment from 'moment';
-import {
-  addObserverVersionTransform,
-  ApmSynthtraceEsClient,
-  deleteSummaryFieldTransform,
-} from '@kbn/apm-synthtrace';
+import { ApmSynthtraceEsClient } from '@kbn/apm-synthtrace';
 import {
   TRANSACTION_DURATION_HISTOGRAM,
   TRANSACTION_DURATION_SUMMARY,
@@ -19,7 +15,7 @@ import {
 import { ApmDocumentType } from '@kbn/apm-plugin/common/document_type';
 import { RollupInterval } from '@kbn/apm-plugin/common/rollup';
 import { LatencyAggregationType } from '@kbn/apm-plugin/common/latency_aggregation_types';
-import { pipeline, Readable } from 'stream';
+import { Readable } from 'stream';
 import { FtrProviderContext } from '../../common/ftr_provider_context';
 import { ApmApiClient } from '../../common/config';
 
@@ -32,9 +28,9 @@ export default function ApiTest({ getService }: FtrProviderContext) {
   const baseTime = new Date('2023-10-01T00:00:00.000Z').getTime();
   const startLegacy = moment(baseTime).add(0, 'minutes');
   const start = moment(baseTime).add(5, 'minutes');
-  const end = moment(baseTime).add(10, 'minutes');
+  const endLegacy = moment(baseTime).add(10, 'minutes');
+  const end = moment(baseTime).add(15, 'minutes');
 
-  // FLAKY: https://github.com/elastic/kibana/issues/177534
   registry.when(
     'Time range metadata when there are multiple APM Server versions',
     { config: 'basic', archives: [] },
@@ -44,7 +40,7 @@ export default function ApiTest({ getService }: FtrProviderContext) {
           await generateTraceDataForService({
             serviceName: 'synth-java-legacy',
             start: startLegacy,
-            end,
+            end: endLegacy,
             isLegacy: true,
             synthtrace,
           });
@@ -78,7 +74,7 @@ export default function ApiTest({ getService }: FtrProviderContext) {
           });
 
           // @ts-expect-error
-          expect(res.hits.total.value).to.be(10);
+          expect(res.hits.total.value).to.be(20);
         });
 
         it('ingests transaction metrics without transaction.duration.summary', async () => {
@@ -95,7 +91,7 @@ export default function ApiTest({ getService }: FtrProviderContext) {
           });
 
           // @ts-expect-error
-          expect(res.hits.total.value).to.be(20);
+          expect(res.hits.total.value).to.be(10);
         });
 
         it('has transaction.duration.summary field for every document type', async () => {
@@ -103,7 +99,7 @@ export default function ApiTest({ getService }: FtrProviderContext) {
             endpoint: 'GET /internal/apm/time_range_metadata',
             params: {
               query: {
-                start: start.toISOString(),
+                start: endLegacy.toISOString(),
                 end: end.toISOString(),
                 enableContinuousRollups: true,
                 enableServiceTransactionMetrics: true,
@@ -116,8 +112,8 @@ export default function ApiTest({ getService }: FtrProviderContext) {
           const allHasSummaryField = response.body.sources
             .filter(
               (source) =>
-                source.documentType === ApmDocumentType.TransactionMetric &&
-                source.rollupInterval !== RollupInterval.OneMinute
+                source.documentType !== ApmDocumentType.TransactionEvent &&
+                source.rollupInterval !== RollupInterval.SixtyMinutes // there is not enough data for 60 minutes
             )
             .every((source) => {
               return source.hasDurationSummaryField;
@@ -132,7 +128,7 @@ export default function ApiTest({ getService }: FtrProviderContext) {
             params: {
               query: {
                 start: startLegacy.toISOString(),
-                end: end.toISOString(),
+                end: endLegacy.toISOString(),
                 enableContinuousRollups: true,
                 enableServiceTransactionMetrics: true,
                 useSpanName: false,
@@ -148,11 +144,35 @@ export default function ApiTest({ getService }: FtrProviderContext) {
           expect(allHasSummaryField).to.eql(false);
         });
 
+        it('does not support transaction.duration.summary for transactionMetric 1m when not all documents within the range support it ', async () => {
+          const response = await apmApiClient.readUser({
+            endpoint: 'GET /internal/apm/time_range_metadata',
+            params: {
+              query: {
+                start: startLegacy.toISOString(),
+                end: end.toISOString(),
+                enableContinuousRollups: true,
+                enableServiceTransactionMetrics: true,
+                useSpanName: false,
+                kuery: '',
+              },
+            },
+          });
+
+          const hasDurationSummaryField = response.body.sources.find(
+            (source) =>
+              source.documentType === ApmDocumentType.TransactionMetric &&
+              source.rollupInterval === RollupInterval.OneMinute // there is not enough data for 60 minutes in the timerange defined for the tests
+          )?.hasDurationSummaryField;
+
+          expect(hasDurationSummaryField).to.eql(false);
+        });
+
         it('does not have latency data for synth-java-legacy', async () => {
           const res = await getLatencyChartForService({
             serviceName: 'synth-java-legacy',
             start,
-            end,
+            end: endLegacy,
             apmApiClient,
             useDurationSummary: true,
           });
@@ -171,18 +191,13 @@ export default function ApiTest({ getService }: FtrProviderContext) {
           const res = await getLatencyChartForService({
             serviceName: 'synth-java',
             start,
-            end,
+            end: endLegacy,
             apmApiClient,
             useDurationSummary: true,
           });
 
           expect(res.body.currentPeriod.latencyTimeseries.map(({ y }) => y)).to.eql([
-            1000000,
-            1000000,
-            1000000,
-            1000000,
-            1000000,
-            null,
+            1000000, 1000000, 1000000, 1000000, 1000000, 1000000,
           ]);
         });
       });
@@ -256,21 +271,7 @@ function generateTraceDataForService({
     );
 
   const apmPipeline = (base: Readable) => {
-    const defaultPipeline = synthtrace.getDefaultPipeline()(
-      base
-    ) as unknown as NodeJS.ReadableStream;
-
-    return pipeline(
-      defaultPipeline,
-      addObserverVersionTransform('8.5.0'),
-      deleteSummaryFieldTransform(),
-      (err) => {
-        if (err) {
-          // eslint-disable-next-line no-console
-          console.error(err);
-        }
-      }
-    );
+    return synthtrace.getDefaultPipeline({ versionOverride: '8.5.0' })(base);
   };
 
   return synthtrace.index(events, isLegacy ? apmPipeline : undefined);
diff --git a/x-pack/test/apm_api_integration/tests/time_range_metadata/time_range_metadata.spec.ts b/x-pack/test/apm_api_integration/tests/time_range_metadata/time_range_metadata.spec.ts
index 43aee07583c180..6e73372f261ae0 100644
--- a/x-pack/test/apm_api_integration/tests/time_range_metadata/time_range_metadata.spec.ts
+++ b/x-pack/test/apm_api_integration/tests/time_range_metadata/time_range_metadata.spec.ts
@@ -11,12 +11,8 @@ import { omit, sortBy } from 'lodash';
 import moment, { Moment } from 'moment';
 import { ApmDocumentType } from '@kbn/apm-plugin/common/document_type';
 import { RollupInterval } from '@kbn/apm-plugin/common/rollup';
-import {
-  addObserverVersionTransform,
-  ApmSynthtraceEsClient,
-  deleteSummaryFieldTransform,
-} from '@kbn/apm-synthtrace';
-import { Readable, pipeline } from 'stream';
+import { ApmSynthtraceEsClient } from '@kbn/apm-synthtrace';
+import { Readable } from 'stream';
 import { ToolingLog } from '@kbn/tooling-log';
 import { FtrProviderContext } from '../../common/ftr_provider_context';
 
@@ -78,9 +74,8 @@ export default function ApiTest({ getService }: FtrProviderContext) {
     });
   });
 
-  // FLAKY: https://github.com/elastic/kibana/issues/177541
   registry.when(
-    'Time range metadata when generating summary data',
+    'Time range metadata when generating data with multiple APM server versions',
     { config: 'basic', archives: [] },
     () => {
       describe('data loaded with and without summary field', () => {
@@ -88,7 +83,7 @@ export default function ApiTest({ getService }: FtrProviderContext) {
         const withoutSummaryFieldEnd = moment(withoutSummaryFieldStart).add(2, 'hours');
 
         const withSummaryFieldStart = moment(withoutSummaryFieldEnd);
-        const withSummaryFieldEnd = moment(withoutSummaryFieldEnd).add(2, 'hours');
+        const withSummaryFieldEnd = moment(withSummaryFieldStart).add(2, 'hours');
 
         before(async () => {
           await getTransactionEvents({
@@ -112,42 +107,161 @@ export default function ApiTest({ getService }: FtrProviderContext) {
           return apmSynthtraceEsClient.clean();
         });
 
-        describe('Values for hasDurationSummaryField for transaction metrics', () => {
-          it('returns true when summary field is available both inside and outside the range', async () => {
+        describe('aggregators and summary field support', () => {
+          it('returns support only for legacy transactionMetrics 1m without duration summary field', async () => {
             const response = await getTimeRangeMedata({
-              start: moment(withSummaryFieldStart).add(1, 'hour'),
-              end: moment(withSummaryFieldEnd),
+              start: withoutSummaryFieldStart,
+              end: withoutSummaryFieldEnd,
             });
 
             expect(
               response.sources.filter(
-                (source) =>
-                  source.documentType === ApmDocumentType.TransactionMetric &&
-                  source.hasDurationSummaryField
-              ).length
-            ).to.eql(3);
+                (source) => source.documentType !== ApmDocumentType.TransactionEvent
+              )
+            ).to.eql([
+              {
+                documentType: ApmDocumentType.ServiceTransactionMetric,
+                rollupInterval: RollupInterval.TenMinutes,
+                hasDocs: false,
+                hasDurationSummaryField: false,
+              },
+              {
+                documentType: ApmDocumentType.ServiceTransactionMetric,
+                rollupInterval: RollupInterval.OneMinute,
+                hasDocs: false,
+                hasDurationSummaryField: false,
+              },
+              {
+                documentType: ApmDocumentType.ServiceTransactionMetric,
+                rollupInterval: RollupInterval.SixtyMinutes,
+                hasDocs: false,
+                hasDurationSummaryField: false,
+              },
+              {
+                documentType: ApmDocumentType.TransactionMetric,
+                rollupInterval: RollupInterval.TenMinutes,
+                hasDocs: false,
+                hasDurationSummaryField: false,
+              },
+              {
+                documentType: ApmDocumentType.TransactionMetric,
+                rollupInterval: RollupInterval.OneMinute,
+                hasDocs: true,
+                hasDurationSummaryField: false,
+              },
+              {
+                documentType: ApmDocumentType.TransactionMetric,
+                rollupInterval: RollupInterval.SixtyMinutes,
+                hasDocs: false,
+                hasDurationSummaryField: false,
+              },
+            ]);
+          });
+
+          it('returns support for all document types with duration summary field', async () => {
+            const response = await getTimeRangeMedata({
+              start: withSummaryFieldStart,
+              end: withSummaryFieldEnd,
+            });
+
+            expect(
+              response.sources.filter(
+                (source) => source.documentType !== ApmDocumentType.TransactionEvent
+              )
+            ).to.eql([
+              {
+                documentType: ApmDocumentType.ServiceTransactionMetric,
+                rollupInterval: RollupInterval.TenMinutes,
+                hasDocs: true,
+                hasDurationSummaryField: true,
+              },
+              {
+                documentType: ApmDocumentType.ServiceTransactionMetric,
+                rollupInterval: RollupInterval.OneMinute,
+                hasDocs: true,
+                hasDurationSummaryField: true,
+              },
+              {
+                documentType: ApmDocumentType.ServiceTransactionMetric,
+                rollupInterval: RollupInterval.SixtyMinutes,
+                hasDocs: true,
+                hasDurationSummaryField: true,
+              },
+              {
+                documentType: ApmDocumentType.TransactionMetric,
+                rollupInterval: RollupInterval.TenMinutes,
+                hasDocs: true,
+                hasDurationSummaryField: true,
+              },
+              {
+                documentType: ApmDocumentType.TransactionMetric,
+                rollupInterval: RollupInterval.OneMinute,
+                hasDocs: true,
+                hasDurationSummaryField: true,
+              },
+              {
+                documentType: ApmDocumentType.TransactionMetric,
+                rollupInterval: RollupInterval.SixtyMinutes,
+                hasDocs: true,
+                hasDurationSummaryField: true,
+              },
+            ]);
           });
 
-          it('returns false when summary field is available inside but not outside the range', async () => {
+          it('returns support only for transaction 1m when timerange includes both new and legacy documents', async () => {
             const response = await getTimeRangeMedata({
-              start: moment(withSummaryFieldStart).subtract(30, 'minutes'),
-              end: moment(withSummaryFieldEnd),
+              start: withoutSummaryFieldStart,
+              end: withSummaryFieldEnd,
             });
 
             expect(
               response.sources.filter(
-                (source) =>
-                  source.documentType === ApmDocumentType.TransactionMetric &&
-                  !source.hasDurationSummaryField
-              ).length
-            ).to.eql(2);
+                (source) => source.documentType !== ApmDocumentType.TransactionEvent
+              )
+            ).to.eql([
+              {
+                documentType: ApmDocumentType.ServiceTransactionMetric,
+                rollupInterval: RollupInterval.TenMinutes,
+                hasDocs: false,
+                hasDurationSummaryField: false,
+              },
+              {
+                documentType: ApmDocumentType.ServiceTransactionMetric,
+                rollupInterval: RollupInterval.OneMinute,
+                hasDocs: false,
+                hasDurationSummaryField: false,
+              },
+              {
+                documentType: ApmDocumentType.ServiceTransactionMetric,
+                rollupInterval: RollupInterval.SixtyMinutes,
+                hasDocs: false,
+                hasDurationSummaryField: false,
+              },
+              {
+                documentType: ApmDocumentType.TransactionMetric,
+                rollupInterval: RollupInterval.TenMinutes,
+                hasDocs: false,
+                hasDurationSummaryField: false,
+              },
+              {
+                documentType: ApmDocumentType.TransactionMetric,
+                rollupInterval: RollupInterval.OneMinute,
+                hasDocs: true,
+                hasDurationSummaryField: false,
+              },
+              {
+                documentType: ApmDocumentType.TransactionMetric,
+                rollupInterval: RollupInterval.SixtyMinutes,
+                hasDocs: false,
+                hasDurationSummaryField: false,
+              },
+            ]);
           });
         });
       });
     }
   );
 
-  // FLAKY: https://github.com/elastic/kibana/issues/177601
   registry.when(
     'Time range metadata when generating data',
     { config: 'basic', archives: [] },
@@ -400,8 +514,8 @@ export default function ApiTest({ getService }: FtrProviderContext) {
       });
 
       describe('when service metrics are only available in the current time range', () => {
-        before(async () => {
-          await es.deleteByQuery({
+        before(async () =>
+          es.deleteByQuery({
             index: 'metrics-apm*',
             query: {
               bool: {
@@ -414,7 +528,7 @@ export default function ApiTest({ getService }: FtrProviderContext) {
                   {
                     range: {
                       '@timestamp': {
-                        lte: start.toISOString(),
+                        gte: start.toISOString(),
                       },
                     },
                   },
@@ -423,8 +537,8 @@ export default function ApiTest({ getService }: FtrProviderContext) {
             },
             refresh: true,
             expand_wildcards: ['open', 'hidden'],
-          });
-        });
+          })
+        );
 
         it('marks service transaction metrics as unavailable', async () => {
           const response = await getTimeRangeMedata({
@@ -495,7 +609,7 @@ export default function ApiTest({ getService }: FtrProviderContext) {
               documentType: ApmDocumentType.TransactionMetric,
               rollupInterval: RollupInterval.OneMinute,
               hasDocs: false,
-              hasDurationSummaryField: true,
+              hasDurationSummaryField: false,
             },
             {
               documentType: ApmDocumentType.TransactionMetric,
@@ -561,20 +675,7 @@ function getTransactionEvents({
   ];
 
   const apmPipeline = (base: Readable) => {
-    const defaultPipeline = synthtrace.getDefaultPipeline()(
-      base
-    ) as unknown as NodeJS.ReadableStream;
-
-    return pipeline(
-      defaultPipeline,
-      addObserverVersionTransform('8.5.0'),
-      deleteSummaryFieldTransform(),
-      (err) => {
-        if (err) {
-          logger.error(err);
-        }
-      }
-    );
+    return synthtrace.getDefaultPipeline({ versionOverride: '8.5.0' })(base);
   };
 
   return synthtrace.index(events, isLegacy ? apmPipeline : undefined);
diff --git a/x-pack/test/cloud_security_posture_api/routes/vulnerabilities_dashboard.ts b/x-pack/test/cloud_security_posture_api/routes/vulnerabilities_dashboard.ts
index db77ce1c325c35..aa2887a04da212 100644
--- a/x-pack/test/cloud_security_posture_api/routes/vulnerabilities_dashboard.ts
+++ b/x-pack/test/cloud_security_posture_api/routes/vulnerabilities_dashboard.ts
@@ -155,7 +155,7 @@ export default function ({ getService }: FtrProviderContext) {
       const indexExists = await es.indices.exists({ index: VULNERABILITIES_LATEST_INDEX });
 
       if (indexExists) {
-        es.deleteByQuery({
+        await es.deleteByQuery({
           index: VULNERABILITIES_LATEST_INDEX,
           query: { match_all: {} },
           refresh: true,
@@ -167,7 +167,7 @@ export default function ({ getService }: FtrProviderContext) {
       const indexExists = await es.indices.exists({ index: BENCHMARK_SCORES_INDEX });
 
       if (indexExists) {
-        es.deleteByQuery({
+        await es.deleteByQuery({
           index: BENCHMARK_SCORES_INDEX,
           query: { match_all: {} },
           refresh: true,
diff --git a/x-pack/test/fleet_api_integration/apis/agent_policy/__snapshots__/agent_policy.snap b/x-pack/test/fleet_api_integration/apis/agent_policy/__snapshots__/agent_policy.snap
new file mode 100644
index 00000000000000..a31d1d0f176e65
--- /dev/null
+++ b/x-pack/test/fleet_api_integration/apis/agent_policy/__snapshots__/agent_policy.snap
@@ -0,0 +1,48 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`Agent policies fleet_agent_policies GET /api/fleet/agent_policies should get a list of agent policies by kuery 1`] = `
+Object {
+  "agents": 0,
+  "inactivity_timeout": 1209600,
+  "is_managed": false,
+  "is_protected": false,
+  "name": "TEST",
+  "namespace": "default",
+  "revision": 1,
+  "schema_version": "1.1.1",
+  "status": "active",
+  "unprivileged_agents": 0,
+  "updated_by": "elastic",
+}
+`;
+
+exports[`Agent policies fleet_agent_policies POST /api/fleet/agent_policies/_bulk_get should populate package_policies if called with ?full=true 1`] = `
+Object {
+  "agents": 0,
+  "inactivity_timeout": 1209600,
+  "is_managed": false,
+  "is_protected": false,
+  "name": "Bulk GET test policy",
+  "namespace": "default",
+  "package_policies": Array [
+    Object {
+      "created_by": "elastic",
+      "enabled": true,
+      "name": "system-1",
+      "namespace": "default",
+      "package": Object {
+        "name": "system",
+        "title": "System",
+        "version": "1.56.0",
+      },
+      "revision": 1,
+      "updated_by": "elastic",
+    },
+  ],
+  "revision": 1,
+  "schema_version": "1.1.1",
+  "status": "active",
+  "unprivileged_agents": 0,
+  "updated_by": "elastic",
+}
+`;
diff --git a/x-pack/test/fleet_api_integration/apis/agent_policy/agent_policy.ts b/x-pack/test/fleet_api_integration/apis/agent_policy/agent_policy.ts
index 69ff7a03822b2f..5c64bec5623c7b 100644
--- a/x-pack/test/fleet_api_integration/apis/agent_policy/agent_policy.ts
+++ b/x-pack/test/fleet_api_integration/apis/agent_policy/agent_policy.ts
@@ -58,11 +58,13 @@ export default function (providerContext: FtrProviderContext) {
             namespace: 'default',
           })
           .expect(200);
-        const { body: responseBody } = await supertest
+        const { body } = await supertest
           .get(`/api/fleet/agent_policies?kuery=ingest-agent-policies.name:TEST`)
           .set('kbn-xsrf', 'xxxx')
           .expect(200);
-        expect(responseBody.items.length).to.eql(1);
+        expect(body.items.length).to.eql(1);
+        const { id, updated_at: updatedAt, ...rest } = body.items[0];
+        expectSnapshot(rest).toMatch();
       });
 
       it('should return 200 even if the passed kuery does not have prefix ingest-agent-policies', async () => {
@@ -1343,6 +1345,21 @@ export default function (providerContext: FtrProviderContext) {
         expect(items[0].package_policies.length).equal(1);
         expect(items[0].package_policies[0]).to.have.property('package');
         expect(items[0].package_policies[0].package.name).equal('system');
+        const { package_policies: packagePolicies, id, updated_at: updatedAt, ...rest } = items[0];
+        expectSnapshot({
+          ...rest,
+          package_policies: packagePolicies.map(
+            ({
+              inputs,
+              id: ppId,
+              policy_id: ppPolicyId,
+              created_at: ppcreatedAt,
+              updated_at: ppupdatedAt,
+              version,
+              ...ppRest
+            }: any) => ppRest
+          ),
+        }).toMatch();
       });
 
       it('should return a 404 with invalid ids', async () => {
diff --git a/x-pack/test/fleet_api_integration/apis/package_policy/index.js b/x-pack/test/fleet_api_integration/apis/package_policy/index.js
index f4f3069922c1d9..8cb9cbd66a1866 100644
--- a/x-pack/test/fleet_api_integration/apis/package_policy/index.js
+++ b/x-pack/test/fleet_api_integration/apis/package_policy/index.js
@@ -19,5 +19,6 @@ export default function loadTests({ loadTestFile, getService }) {
     loadTestFile(require.resolve('./delete'));
     loadTestFile(require.resolve('./upgrade'));
     loadTestFile(require.resolve('./input_package_create_upgrade'));
+    loadTestFile(require.resolve('./input_package_rollback'));
   });
 }
diff --git a/x-pack/test/fleet_api_integration/apis/package_policy/input_package_rollback.ts b/x-pack/test/fleet_api_integration/apis/package_policy/input_package_rollback.ts
new file mode 100644
index 00000000000000..50c325dac22fbc
--- /dev/null
+++ b/x-pack/test/fleet_api_integration/apis/package_policy/input_package_rollback.ts
@@ -0,0 +1,136 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import expect from '@kbn/expect';
+import { sortBy } from 'lodash';
+import { FtrProviderContext } from '../../../api_integration/ftr_provider_context';
+import { skipIfNoDockerRegistry } from '../../helpers';
+import { setupFleetAndAgents } from '../agents/services';
+const PACKAGE_NAME = 'input_package_upgrade';
+const START_VERSION = '1.0.0';
+
+const expectIdArraysEqual = (arr1: any[], arr2: any[]) => {
+  expect(sortBy(arr1, 'id')).to.eql(sortBy(arr2, 'id'));
+};
+export default function (providerContext: FtrProviderContext) {
+  const { getService } = providerContext;
+  const supertest = getService('supertest');
+  const uninstallPackage = async (name: string, version: string) => {
+    await supertest.delete(`/api/fleet/epm/packages/${name}/${version}`).set('kbn-xsrf', 'xxxx');
+  };
+
+  const installPackage = async (name: string, version: string) => {
+    return await supertest
+      .post(`/api/fleet/epm/packages/${name}/${version}`)
+      .set('kbn-xsrf', 'xxxx')
+      .send({ force: true })
+      .expect(200);
+  };
+
+  const getInstallationSavedObject = async (name: string, version: string) => {
+    const res = await supertest.get(`/api/fleet/epm/packages/${name}/${version}`).expect(200);
+    return res.body.item.savedObject.attributes;
+  };
+
+  const getPackage = async (name: string, version: string) => {
+    const res = await supertest.get(`/api/fleet/epm/packages/${name}/${version}`).expect(200);
+    return res.body.item;
+  };
+
+  const createPackagePolicyWithDataset = async (
+    agentPolicyId: string,
+    dataset: string,
+    expectStatusCode = 200,
+    force = false
+  ) => {
+    const policy = {
+      force,
+      policy_id: agentPolicyId,
+      package: {
+        name: PACKAGE_NAME,
+        version: START_VERSION,
+      },
+      name: 'test-policy-' + dataset,
+      description: '',
+      namespace: 'default',
+      inputs: {
+        'logs-logfile': {
+          enabled: true,
+          streams: {
+            'input_package_upgrade.logs': {
+              enabled: true,
+              vars: {
+                paths: ['/tmp/test/log'],
+                tags: ['tag1'],
+                ignore_older: '72h',
+                'data_stream.dataset': dataset,
+              },
+            },
+          },
+        },
+      },
+    };
+    const res = await supertest
+      .post(`/api/fleet/package_policies`)
+      .set('kbn-xsrf', 'xxxx')
+      .send(policy)
+      .expect(expectStatusCode);
+
+    return res.body.item;
+  };
+
+  const createAgentPolicy = async (name = 'Input Package Test 3') => {
+    const res = await supertest
+      .post(`/api/fleet/agent_policies`)
+      .set('kbn-xsrf', 'xxxx')
+      .send({
+        name,
+        namespace: 'default',
+      })
+      .expect(200);
+    return res.body.item;
+  };
+
+  const deleteAgentPolicy = async (agentPolicyId: string) => {
+    if (!agentPolicyId) return;
+    return supertest
+      .post(`/api/fleet/agent_policies/delete`)
+      .set('kbn-xsrf', 'xxxx')
+      .send({ agentPolicyId });
+  };
+
+  describe('input package policy rollback', async function () {
+    skipIfNoDockerRegistry(providerContext);
+
+    let agentPolicyId: string;
+    before(async () => {
+      const agentPolicy = await createAgentPolicy();
+      agentPolicyId = agentPolicy.id;
+    });
+
+    after(async () => {
+      await deleteAgentPolicy(agentPolicyId);
+    });
+    setupFleetAndAgents(providerContext);
+
+    it('should rollback package install on package policy create failure', async () => {
+      await createPackagePolicyWithDataset(agentPolicyId, 'test*', 400);
+
+      const pkg = await getPackage(PACKAGE_NAME, START_VERSION);
+      expect(pkg?.status).to.eql('not_installed');
+    });
+
+    it('should not add es references on package policy create failure when package is already installed', async () => {
+      await installPackage(PACKAGE_NAME, START_VERSION);
+      await createPackagePolicyWithDataset(agentPolicyId, 'test*', 400);
+
+      const installation = await getInstallationSavedObject(PACKAGE_NAME, START_VERSION);
+      expectIdArraysEqual(installation.installed_es, []);
+
+      await uninstallPackage(PACKAGE_NAME, START_VERSION);
+    });
+  });
+}
diff --git a/x-pack/test/functional/apps/aiops/log_pattern_analysis_in_discover.ts b/x-pack/test/functional/apps/aiops/log_pattern_analysis_in_discover.ts
index acdff3e3b8cf3e..197b5b5338a178 100644
--- a/x-pack/test/functional/apps/aiops/log_pattern_analysis_in_discover.ts
+++ b/x-pack/test/functional/apps/aiops/log_pattern_analysis_in_discover.ts
@@ -23,8 +23,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
     });
   }
 
-  // FLAKY: https://github.com/elastic/kibana/issues/172770
-  describe.skip('log pattern analysis', async function () {
+  describe('log pattern analysis', async function () {
     let tabsCount = 1;
 
     afterEach(async () => {
diff --git a/x-pack/test/functional/apps/dashboard/group2/_async_dashboard.ts b/x-pack/test/functional/apps/dashboard/group2/_async_dashboard.ts
index 66b31842df00ae..3bb127283a7621 100644
--- a/x-pack/test/functional/apps/dashboard/group2/_async_dashboard.ts
+++ b/x-pack/test/functional/apps/dashboard/group2/_async_dashboard.ts
@@ -29,7 +29,8 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
     'timePicker',
   ]);
 
-  describe('sample data dashboard', function describeIndexTests() {
+  // FLAKY: https://github.com/elastic/kibana/issues/183064
+  describe.skip('sample data dashboard', function describeIndexTests() {
     before(async () => {
       await esArchiver.emptyKibanaIndex();
       await PageObjects.common.sleep(5000);
diff --git a/x-pack/test/functional/apps/ml/data_visualizer/esql_data_visualizer.ts b/x-pack/test/functional/apps/ml/data_visualizer/esql_data_visualizer.ts
index 047b24f8be2337..471c0c89f6b9c0 100644
--- a/x-pack/test/functional/apps/ml/data_visualizer/esql_data_visualizer.ts
+++ b/x-pack/test/functional/apps/ml/data_visualizer/esql_data_visualizer.ts
@@ -310,7 +310,8 @@ export default function ({ getPageObject, getService }: FtrProviderContext) {
       await ml.securityUI.loginAsMlPowerUser();
     });
 
-    describe('with farequote', function () {
+    // FAILING ES PROMOTION: https://github.com/elastic/kibana/issues/183046
+    describe.skip('with farequote', function () {
       runTests(esqlFarequoteData);
     });
 
diff --git a/x-pack/test/functional/apps/security/index.ts b/x-pack/test/functional/apps/security/index.ts
index 3260e61e67cbf0..009c270d3c2a36 100644
--- a/x-pack/test/functional/apps/security/index.ts
+++ b/x-pack/test/functional/apps/security/index.ts
@@ -17,5 +17,6 @@ export default function ({ loadTestFile }: FtrProviderContext) {
     loadTestFile(require.resolve('./field_level_security'));
     loadTestFile(require.resolve('./user_email'));
     loadTestFile(require.resolve('./role_mappings'));
+    loadTestFile(require.resolve('./remote_cluster_security_roles'));
   });
 }
diff --git a/x-pack/test/functional/apps/security/remote_cluster_security_roles.ts b/x-pack/test/functional/apps/security/remote_cluster_security_roles.ts
new file mode 100644
index 00000000000000..1525406b2fa02e
--- /dev/null
+++ b/x-pack/test/functional/apps/security/remote_cluster_security_roles.ts
@@ -0,0 +1,90 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import expect from '@kbn/expect';
+import { keyBy } from 'lodash';
+import { FtrProviderContext } from '../../ftr_provider_context';
+
+const EDIT_ROLES_PATH = 'security/roles/edit';
+
+export default function ({ getService, getPageObjects }: FtrProviderContext) {
+  const esArchiver = getService('esArchiver');
+  const browser = getService('browser');
+  const log = getService('log');
+  const security = getService('security');
+  const PageObjects = getPageObjects(['security', 'common', 'header', 'discover', 'settings']);
+  const kibanaServer = getService('kibanaServer');
+
+  describe('Remote Cluster Privileges', function () {
+    const customRole = 'rc-custom-role';
+
+    before('initialize tests', async () => {
+      await kibanaServer.savedObjects.cleanStandardList();
+      await esArchiver.loadIfNeeded('x-pack/test/functional/es_archives/security/dlstest');
+      await browser.setWindowSize(1600, 1000);
+
+      await PageObjects.common.navigateToApp('settings');
+      await PageObjects.settings.createIndexPattern('dlstest', null);
+
+      await security.testUser.setRoles(['cluster_security_manager', 'kibana_admin']);
+      await PageObjects.settings.navigateTo();
+      await PageObjects.security.clickElasticsearchRoles();
+    });
+
+    it(`should add new role ${customRole} with remote cluster privileges`, async function () {
+      await PageObjects.security.addRole(customRole, {
+        elasticsearch: {
+          indices: [
+            {
+              names: ['dlstest'],
+              privileges: ['read', 'view_index_metadata'],
+            },
+          ],
+          remote_cluster: [
+            {
+              clusters: ['cluster1', 'cluster2'],
+              privileges: ['monitor_enrich'],
+            },
+          ],
+        },
+      });
+      const roles = keyBy(await PageObjects.security.getElasticsearchRoles(), 'rolename');
+      log.debug('actualRoles = %j', roles);
+      expect(roles).to.have.key(customRole);
+      expect(roles[customRole].reserved).to.be(false);
+    });
+
+    it(`should update role ${customRole} with remote cluster privileges`, async function () {
+      await PageObjects.settings.clickLinkText(customRole);
+      const currentUrl = await browser.getCurrentUrl();
+
+      expect(currentUrl).to.contain(EDIT_ROLES_PATH);
+
+      const { clusters: currentClusters, privileges: currentPrivileges } =
+        await PageObjects.security.getRemoteClusterPrivilege(0);
+
+      expect(currentClusters).to.eql(['cluster1', 'cluster2']);
+      expect(currentPrivileges).to.eql(['monitor_enrich']);
+
+      await PageObjects.security.deleteRemoteClusterPrivilege(0);
+
+      await PageObjects.security.addRemoteClusterPrivilege({
+        clusters: ['cluster3', 'cluster4'],
+        privileges: ['monitor_enrich'],
+      });
+
+      await PageObjects.security.saveRole();
+    });
+
+    after('logout', async () => {
+      // NOTE: Logout needs to happen before anything else to avoid flaky behavior
+      await PageObjects.security.forceLogout();
+      await security.role.delete(customRole);
+      await security.testUser.restoreDefaults();
+    });
+  });
+}
diff --git a/x-pack/test/api_integration/apis/security_solution/config.ts b/x-pack/test/functional/apps/slo/embeddables/config.ts
similarity index 68%
rename from x-pack/test/api_integration/apis/security_solution/config.ts
rename to x-pack/test/functional/apps/slo/embeddables/config.ts
index 5f335f116fefeb..f7fe54a56831d0 100644
--- a/x-pack/test/api_integration/apis/security_solution/config.ts
+++ b/x-pack/test/functional/apps/slo/embeddables/config.ts
@@ -8,10 +8,10 @@
 import { FtrConfigProviderContext } from '@kbn/test';
 
 export default async function ({ readConfigFile }: FtrConfigProviderContext) {
-  const baseIntegrationTestsConfig = await readConfigFile(require.resolve('../../config.ts'));
+  const functionalConfig = await readConfigFile(require.resolve('../../../config.base.js'));
 
   return {
-    ...baseIntegrationTestsConfig.getAll(),
-    testFiles: [require.resolve('.')],
+    ...functionalConfig.getAll(),
+    testFiles: [require.resolve('./overview_embeddable')],
   };
 }
diff --git a/x-pack/test/functional/apps/slo/embeddables/overview_embeddable.ts b/x-pack/test/functional/apps/slo/embeddables/overview_embeddable.ts
new file mode 100644
index 00000000000000..a9671b6e350d63
--- /dev/null
+++ b/x-pack/test/functional/apps/slo/embeddables/overview_embeddable.ts
@@ -0,0 +1,95 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { cleanup } from '@kbn/infra-forge';
+import { loadTestData } from '../../../../api_integration/apis/slos/helper/load_test_data';
+import { SloEsClient } from '../../../../api_integration/apis/slos/helper/es';
+import { sloData } from '../../../../api_integration/apis/slos/fixtures/create_slo';
+import { FtrProviderContext } from '../../../ftr_provider_context';
+
+export default function ({ getService, getPageObjects }: FtrProviderContext) {
+  const PageObjects = getPageObjects(['common', 'dashboard']);
+  const esClient = getService('es');
+  const sloEsClient = new SloEsClient(esClient);
+  const logger = getService('log');
+  const slo = getService('slo');
+  const sloUi = getService('sloUi');
+  const dashboardAddPanel = getService('dashboardAddPanel');
+
+  describe('overview embeddable', function () {
+    before(async () => {
+      await loadTestData(getService);
+      await slo.deleteAllSLOs();
+      await slo.create(sloData);
+      await PageObjects.dashboard.navigateToApp();
+      await PageObjects.dashboard.clickNewDashboard();
+      await PageObjects.dashboard.switchToEditMode();
+    });
+
+    after(async () => {
+      await slo.deleteAllSLOs();
+      await cleanup({ esClient, logger });
+      await sloEsClient.deleteTestSourceData();
+    });
+
+    describe('Single SLO', function () {
+      it('should open SLO configuration flyout', async () => {
+        await dashboardAddPanel.clickEditorMenuButton();
+        await dashboardAddPanel.clickEmbeddableFactoryGroupButton('slos');
+        await dashboardAddPanel.clickAddNewPanelFromUIActionLink('SLO Overview');
+        await sloUi.common.assertSloOverviewConfigurationExists();
+      });
+
+      it('should have an overview mode selector', async () => {
+        await sloUi.common.assertOverviewModeSelectorExists();
+      });
+
+      it('can select an SLO', async () => {
+        await sloUi.common.assertOverviewSloSelectorExists();
+        await sloUi.common.setComboBoxSloSelection();
+        await sloUi.common.clickOverviewCofigurationSaveButton();
+      });
+
+      it('creates an overview panel', async () => {
+        await sloUi.common.assertSingleOverviewPanelExists();
+        await sloUi.common.dismissAllToasts();
+      });
+
+      it('renders SLO card item chart', async () => {
+        await sloUi.common.assertSingleOverviewPanelContentExists();
+      });
+    });
+
+    describe('Group of SLOs', function () {
+      it('can select Group Overview mode in the Flyout configuration', async () => {
+        await dashboardAddPanel.clickEditorMenuButton();
+        await dashboardAddPanel.clickEmbeddableFactoryGroupButton('slos');
+        await dashboardAddPanel.clickAddNewPanelFromUIActionLink('SLO Overview');
+        await sloUi.common.clickOverviewMode();
+        await sloUi.common.assertSloConfigurationGroupOverviewModeIsSelected();
+      });
+
+      it('can select a group by', async () => {
+        await sloUi.common.assertGroupOverviewConfigurationGroupByExists();
+      });
+
+      it('can optionally select a group', async () => {
+        await sloUi.common.assertGroupOverviewConfigurationGroupExists();
+      });
+
+      it('can optionally search for custom query', async () => {
+        await sloUi.common.assertGroupOverviewConfigurationKqlBarExists();
+      });
+
+      it('creates a group overview panel', async () => {
+        await sloUi.common.clickOverviewCofigurationSaveButton();
+        await sloUi.common.assertGroupOverviewPanelExists();
+        await sloUi.common.dismissAllToasts();
+      });
+    });
+  });
+}
diff --git a/x-pack/test/functional/es_archives/auditbeat/default/data.json b/x-pack/test/functional/es_archives/auditbeat/default/data.json
deleted file mode 100644
index b10f3cc73ec6ab..00000000000000
--- a/x-pack/test/functional/es_archives/auditbeat/default/data.json
+++ /dev/null
@@ -1,110231 +0,0 @@
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Rs93UmcBTFzn_XoLWT6M",
-    "source": {
-      "@timestamp": "2018-11-27T00:00:11.544Z",
-      "process": {
-        "pid": "31964",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "128.199.87.213"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "hostname": "128.199.87.213",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "128.199.87.213",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 192383,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "R893UmcBTFzn_XoLWT6M",
-    "source": {
-      "@timestamp": "2018-11-27T00:00:12.110Z",
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "31966",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "89.40.116.98"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "89.40.116.98",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192384,
-        "result": "fail"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "SM93UmcBTFzn_XoLWT6M",
-    "source": {
-      "@timestamp": "2018-11-27T00:00:12.111Z",
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "31966",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "89.40.116.98"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "89.40.116.98",
-            "type": "user-session"
-          }
-        },
-        "sequence": 192385,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Sc93UmcBTFzn_XoLWT6M",
-    "source": {
-      "@timestamp": "2018-11-27T00:00:12.224Z",
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "31966"
-      },
-      "source": {
-        "ip": "89.40.116.98"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "auditd": {
-        "sequence": 192386,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "89.40.116.98",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "89.40.116.98"
-          }
-        }
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "A89-UmcBTFzn_XoLj91w",
-    "source": {
-      "@timestamp": "2018-11-27T00:08:04.229Z",
-      "auditd": {
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "187.188.146.35",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142249,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-haproxy-01"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "19190",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "187.188.146.35"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "BM9-UmcBTFzn_XoLj91w",
-    "source": {
-      "@timestamp": "2018-11-27T00:08:04.231Z",
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "19190",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "187.188.146.35"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 142250,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "187.188.146.35"
-          }
-        }
-      },
-      "beat": {
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-haproxy-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Bc9-UmcBTFzn_XoLj91w",
-    "source": {
-      "@timestamp": "2018-11-27T00:08:04.295Z",
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "187.188.146.35",
-            "type": "user-session"
-          }
-        },
-        "sequence": 142251,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "187.188.146.35"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "19190",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "187.188.146.35"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "3M99UmcBTFzn_XoL9c8q",
-    "source": {
-      "@timestamp": "2018-11-27T00:07:24.736Z",
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "31771"
-      },
-      "source": {
-        "ip": "185.66.213.116"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "185.66.213.116",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186194
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "3c99UmcBTFzn_XoL9c8q",
-    "source": {
-      "@timestamp": "2018-11-27T00:07:24.738Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186195,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "185.66.213.116",
-            "type": "user-session",
-            "primary": "sshd"
-          }
-        }
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "31771",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "185.66.213.116"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "3s99UmcBTFzn_XoL9c8q",
-    "source": {
-      "@timestamp": "2018-11-27T00:07:24.872Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "31771",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "185.66.213.116"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "185.66.213.116",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          }
-        },
-        "sequence": 186196,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "185.66.213.116"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "cNCAUmcBTFzn_XoLVQS1",
-    "source": {
-      "@timestamp": "2018-11-27T00:10:00.521Z",
-      "source": {
-        "ip": "202.138.233.92"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 142255,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "202.138.233.92",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "19202",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "cdCAUmcBTFzn_XoLVQS1",
-    "source": {
-      "@timestamp": "2018-11-27T00:10:00.523Z",
-      "process": {
-        "pid": "19202",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "202.138.233.92"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 142256,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "202.138.233.92",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ctCAUmcBTFzn_XoLVQS1",
-    "source": {
-      "@timestamp": "2018-11-27T00:10:00.758Z",
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "19202",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "202.138.233.92"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "hostname": "202.138.233.92",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "202.138.233.92",
-            "type": "user-session"
-          }
-        },
-        "sequence": 142257,
-        "result": "fail"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Lc9_UmcBTFzn_XoL2_og",
-    "source": {
-      "@timestamp": "2018-11-27T00:09:29.142Z",
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "source": {
-        "ip": "183.6.176.182"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "183.6.176.182"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142252,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "19199",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Ls9_UmcBTFzn_XoL2_og",
-    "source": {
-      "@timestamp": "2018-11-27T00:09:29.143Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 142253,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "183.6.176.182"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "19199",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "183.6.176.182"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "L89_UmcBTFzn_XoL2_og",
-    "source": {
-      "@timestamp": "2018-11-27T00:09:29.337Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "183.6.176.182",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "183.6.176.182",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 142254
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "19199",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "183.6.176.182"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "0c9_UmcBTFzn_XoL8Ptt",
-    "source": {
-      "@timestamp": "2018-11-27T00:09:34.595Z",
-      "source": {
-        "ip": "82.165.64.156"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "82.165.64.156",
-            "type": "user-session"
-          }
-        },
-        "sequence": 186200,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "31787"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "0s9_UmcBTFzn_XoL8Ptt",
-    "source": {
-      "@timestamp": "2018-11-27T00:09:34.596Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "82.165.64.156"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186201
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "31787",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "82.165.64.156"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "089_UmcBTFzn_XoL8Ptt",
-    "source": {
-      "@timestamp": "2018-11-27T00:09:34.710Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "31787",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "82.165.64.156"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "82.165.64.156",
-            "type": "user-session"
-          }
-        },
-        "sequence": 186202,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "82.165.64.156",
-          "terminal": "ssh"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ns9_UmcBTFzn_XoLYe_m",
-    "source": {
-      "@timestamp": "2018-11-27T00:08:58.109Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "31779",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "46.148.18.163"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186197,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "46.148.18.163"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "n89_UmcBTFzn_XoLYe_m",
-    "source": {
-      "@timestamp": "2018-11-27T00:08:58.110Z",
-      "auditd": {
-        "sequence": 186198,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "46.148.18.163",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "31779",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "46.148.18.163"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "oM9_UmcBTFzn_XoLYe_m",
-    "source": {
-      "@timestamp": "2018-11-27T00:08:58.253Z",
-      "source": {
-        "ip": "46.148.18.163"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "46.148.18.163",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "46.148.18.163"
-          }
-        },
-        "sequence": 186199,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "31779",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "hM-AUmcBTFzn_XoLEf64",
-    "source": {
-      "@timestamp": "2018-11-27T00:09:43.118Z",
-      "source": {
-        "ip": "74.208.43.208"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "sequence": 186203,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "74.208.43.208",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        }
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "31789",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "hc-AUmcBTFzn_XoLEf64",
-    "source": {
-      "@timestamp": "2018-11-27T00:09:43.119Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "74.208.43.208",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186204,
-        "result": "fail"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "31789",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "74.208.43.208"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "hs-AUmcBTFzn_XoLEf64",
-    "source": {
-      "@timestamp": "2018-11-27T00:09:43.146Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186205,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "74.208.43.208",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "74.208.43.208",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "31789",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "74.208.43.208"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "m89-UmcBTFzn_XoL1OLk",
-    "source": {
-      "@timestamp": "2018-11-27T00:08:22.009Z",
-      "source": {
-        "ip": "201.75.60.100"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "201.75.60.100"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184237,
-        "result": "fail"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "24759",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "nM9-UmcBTFzn_XoL1OLk",
-    "source": {
-      "@timestamp": "2018-11-27T00:08:22.011Z",
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "process": {
-        "pid": "24759",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "201.75.60.100"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 184238,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "201.75.60.100",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "nc9-UmcBTFzn_XoL1OLk",
-    "source": {
-      "@timestamp": "2018-11-27T00:08:22.241Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "24759"
-      },
-      "source": {
-        "ip": "201.75.60.100"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 184239,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "201.75.60.100"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "201.75.60.100",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Vc9_UmcBTFzn_XoLb_AH",
-    "source": {
-      "@timestamp": "2018-11-27T00:09:01.469Z",
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "PAM:accounting",
-          "terminal": "cron",
-          "acct": "root"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "cron"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 184240,
-        "result": "success"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_acct",
-        "action": "was-authorized"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "process": {
-        "pid": "24768",
-        "exe": "/usr/sbin/cron"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Vs9_UmcBTFzn_XoLb_AH",
-    "source": {
-      "@timestamp": "2018-11-27T00:09:01.469Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "process": {
-        "pid": "24768",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "sequence": 184241,
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "acct": "root",
-          "op": "PAM:setcred",
-          "terminal": "cron"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "cred_acq",
-        "action": "acquired-credentials",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "V89_UmcBTFzn_XoLb_AH",
-    "source": {
-      "@timestamp": "2018-11-27T00:09:01.471Z",
-      "user": {
-        "auid": "0",
-        "uid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "24768",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "result": "success",
-        "session": "9854",
-        "data": {
-          "terminal": "cron",
-          "op": "PAM:session_open",
-          "acct": "root"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 184243
-      },
-      "event": {
-        "action": "started-session",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_start"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "WM9_UmcBTFzn_XoLb_AH",
-    "source": {
-      "@timestamp": "2018-11-27T00:09:01.574Z",
-      "auditd": {
-        "result": "success",
-        "session": "9854",
-        "data": {
-          "terminal": "cron",
-          "acct": "root",
-          "op": "PAM:setcred"
-        },
-        "summary": {
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "cron"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 184244
-      },
-      "event": {
-        "category": "user-login",
-        "type": "cred_disp",
-        "action": "disposed-credentials",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root",
-          "auid": "root"
-        },
-        "auid": "0",
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/cron",
-        "pid": "24768"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Wc9_UmcBTFzn_XoLb_AH",
-    "source": {
-      "@timestamp": "2018-11-27T00:09:01.575Z",
-      "auditd": {
-        "session": "9854",
-        "data": {
-          "acct": "root",
-          "op": "PAM:session_close",
-          "terminal": "cron"
-        },
-        "summary": {
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "cron"
-          }
-        },
-        "sequence": 184245,
-        "result": "success"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_end",
-        "action": "ended-session",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "0"
-      },
-      "process": {
-        "pid": "24768",
-        "exe": "/usr/sbin/cron"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "W89_UmcBTFzn_XoLb_DG",
-    "source": {
-      "@timestamp": "2018-11-27T00:09:01.660Z",
-      "auditd": {
-        "sequence": 192396,
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "terminal": "cron",
-          "op": "PAM:accounting",
-          "acct": "root"
-        },
-        "summary": {
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          }
-        }
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_acct",
-        "action": "was-authorized",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/cron",
-        "pid": "32020"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "XM9_UmcBTFzn_XoLb_DG",
-    "source": {
-      "@timestamp": "2018-11-27T00:09:01.660Z",
-      "auditd": {
-        "sequence": 192397,
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "acct": "root",
-          "op": "PAM:setcred",
-          "terminal": "cron"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "cron"
-          },
-          "how": "/usr/sbin/cron"
-        }
-      },
-      "event": {
-        "type": "cred_acq",
-        "action": "acquired-credentials",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/cron",
-        "pid": "32020"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Xc9_UmcBTFzn_XoLb_DG",
-    "source": {
-      "@timestamp": "2018-11-27T00:09:01.661Z",
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_start",
-        "action": "started-session",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "0"
-      },
-      "process": {
-        "pid": "32020",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "result": "success",
-        "session": "9858",
-        "data": {
-          "terminal": "cron",
-          "op": "PAM:session_open",
-          "acct": "root"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "cron"
-          },
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "secondary": "root",
-            "primary": "root"
-          }
-        },
-        "sequence": 192399
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Xs9_UmcBTFzn_XoLb_DG",
-    "source": {
-      "@timestamp": "2018-11-27T00:09:01.756Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "auid": "0"
-      },
-      "process": {
-        "pid": "32020",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "data": {
-          "op": "PAM:setcred",
-          "terminal": "cron",
-          "acct": "root"
-        },
-        "summary": {
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          }
-        },
-        "sequence": 192400,
-        "result": "success",
-        "session": "9858"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "cred_disp",
-        "action": "disposed-credentials",
-        "module": "auditd"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "X89_UmcBTFzn_XoLb_DG",
-    "source": {
-      "@timestamp": "2018-11-27T00:09:01.757Z",
-      "auditd": {
-        "sequence": 192401,
-        "result": "success",
-        "session": "9858",
-        "data": {
-          "terminal": "cron",
-          "op": "PAM:session_close",
-          "acct": "root"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_end",
-        "action": "ended-session"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "auid": "0"
-      },
-      "process": {
-        "pid": "32020",
-        "exe": "/usr/sbin/cron"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "tNCGUmcBTFzn_XoLwJHN",
-    "source": {
-      "@timestamp": "2018-11-27T00:17:01.150Z",
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "process": {
-        "pid": "28080",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "data": {
-          "op": "PAM:setcred",
-          "acct": "root",
-          "terminal": "cron"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 44083,
-        "result": "success",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "cred_acq",
-        "action": "acquired-credentials",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "tdCGUmcBTFzn_XoLwJHN",
-    "source": {
-      "@timestamp": "2018-11-27T00:17:01.150Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "28080",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "acct": "root",
-          "terminal": "cron",
-          "op": "PAM:accounting"
-        },
-        "summary": {
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          }
-        },
-        "sequence": 44082
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_acct",
-        "action": "was-authorized",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ttCGUmcBTFzn_XoLwJHN",
-    "source": {
-      "@timestamp": "2018-11-27T00:17:01.150Z",
-      "process": {
-        "pid": "28080",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          }
-        },
-        "sequence": 44085,
-        "result": "success",
-        "session": "1442",
-        "data": {
-          "terminal": "cron",
-          "op": "PAM:session_open",
-          "acct": "root"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_start",
-        "action": "started-session",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "auid": "0",
-        "uid": "0"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "t9CGUmcBTFzn_XoLwJHN",
-    "source": {
-      "@timestamp": "2018-11-27T00:17:01.154Z",
-      "event": {
-        "action": "disposed-credentials",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "cred_disp"
-      },
-      "user": {
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "auid": "0",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "28080",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "sequence": 44086,
-        "result": "success",
-        "session": "1442",
-        "data": {
-          "op": "PAM:setcred",
-          "terminal": "cron",
-          "acct": "root"
-        },
-        "summary": {
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "uNCGUmcBTFzn_XoLwJHN",
-    "source": {
-      "@timestamp": "2018-11-27T00:17:01.154Z",
-      "auditd": {
-        "session": "1442",
-        "data": {
-          "op": "PAM:session_close",
-          "terminal": "cron",
-          "acct": "root"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 44087,
-        "result": "success"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "action": "ended-session",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_end"
-      },
-      "user": {
-        "auid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "28080",
-        "exe": "/usr/sbin/cron"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "udCGUmcBTFzn_XoLwJHb",
-    "source": {
-      "@timestamp": "2018-11-27T00:17:01.168Z",
-      "auditd": {
-        "sequence": 142264,
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "op": "PAM:accounting",
-          "terminal": "cron",
-          "acct": "root"
-        },
-        "summary": {
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          }
-        }
-      },
-      "beat": {
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-haproxy-01"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "type": "user_acct",
-        "action": "was-authorized",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "19244",
-        "exe": "/usr/sbin/cron"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "utCGUmcBTFzn_XoLwJHb",
-    "source": {
-      "@timestamp": "2018-11-27T00:17:01.169Z",
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "cred_acq",
-        "action": "acquired-credentials"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "19244",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "PAM:setcred",
-          "terminal": "cron",
-          "acct": "root"
-        },
-        "summary": {
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 142265,
-        "result": "success"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "u9CGUmcBTFzn_XoLwJHb",
-    "source": {
-      "@timestamp": "2018-11-27T00:17:01.171Z",
-      "event": {
-        "type": "user_start",
-        "action": "started-session",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "auid": "0"
-      },
-      "process": {
-        "pid": "19244",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "cron",
-          "op": "PAM:session_open",
-          "acct": "root"
-        },
-        "summary": {
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 142267,
-        "result": "success",
-        "session": "3502"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "vNCGUmcBTFzn_XoLwJHb",
-    "source": {
-      "@timestamp": "2018-11-27T00:17:01.174Z",
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "action": "disposed-credentials",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "cred_disp"
-      },
-      "user": {
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "0"
-      },
-      "process": {
-        "pid": "19244",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "session": "3502",
-        "data": {
-          "op": "PAM:setcred",
-          "acct": "root",
-          "terminal": "cron"
-        },
-        "summary": {
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          }
-        },
-        "sequence": 142268,
-        "result": "success"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "vdCGUmcBTFzn_XoLwJHb",
-    "source": {
-      "@timestamp": "2018-11-27T00:17:01.175Z",
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_end",
-        "action": "ended-session"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root",
-          "auid": "root"
-        },
-        "auid": "0"
-      },
-      "process": {
-        "pid": "19244",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "summary": {
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "secondary": "root",
-            "primary": "root"
-          }
-        },
-        "sequence": 142269,
-        "result": "success",
-        "session": "3502",
-        "data": {
-          "acct": "root",
-          "op": "PAM:session_close",
-          "terminal": "cron"
-        }
-      },
-      "beat": {
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-haproxy-01"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "vtCGUmcBTFzn_XoLwJH4",
-    "source": {
-      "@timestamp": "2018-11-27T00:17:01.195Z",
-      "event": {
-        "type": "user_acct",
-        "action": "was-authorized",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "12297",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "root",
-          "terminal": "cron",
-          "op": "PAM:accounting"
-        },
-        "summary": {
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 43110,
-        "result": "success"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "v9CGUmcBTFzn_XoLwJH4",
-    "source": {
-      "@timestamp": "2018-11-27T00:17:01.195Z",
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "12297",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "cron",
-          "op": "PAM:setcred",
-          "acct": "root"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 43111,
-        "result": "success"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "cred_acq",
-        "action": "acquired-credentials",
-        "module": "auditd"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "wNCGUmcBTFzn_XoLwJH4",
-    "source": {
-      "@timestamp": "2018-11-27T00:17:01.195Z",
-      "event": {
-        "action": "started-session",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_start"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "auid": "0"
-      },
-      "process": {
-        "pid": "12297",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 43113,
-        "result": "success",
-        "session": "1251",
-        "data": {
-          "terminal": "cron",
-          "op": "PAM:session_open",
-          "acct": "root"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "wdCGUmcBTFzn_XoLwJH4",
-    "source": {
-      "@timestamp": "2018-11-27T00:17:01.195Z",
-      "auditd": {
-        "session": "1251",
-        "data": {
-          "op": "PAM:setcred",
-          "terminal": "cron",
-          "acct": "root"
-        },
-        "summary": {
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          }
-        },
-        "sequence": 43114,
-        "result": "success"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "cred_disp",
-        "action": "disposed-credentials"
-      },
-      "user": {
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "auid": "0",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "12297",
-        "exe": "/usr/sbin/cron"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "wtCGUmcBTFzn_XoLwJH4",
-    "source": {
-      "@timestamp": "2018-11-27T00:17:01.199Z",
-      "process": {
-        "pid": "12297",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "session": "1251",
-        "data": {
-          "acct": "root",
-          "terminal": "cron",
-          "op": "PAM:session_close"
-        },
-        "summary": {
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 43115,
-        "result": "success"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_end",
-        "action": "ended-session"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "2dCGUmcBTFzn_XoLwpF3",
-    "source": {
-      "@timestamp": "2018-11-27T00:17:01.580Z",
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "action": "was-authorized",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_acct"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "24860",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "acct": "root",
-          "op": "PAM:accounting",
-          "terminal": "cron"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 184252
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "2tCGUmcBTFzn_XoLwpF3",
-    "source": {
-      "@timestamp": "2018-11-27T00:17:01.581Z",
-      "process": {
-        "pid": "24860",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "sequence": 184253,
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "op": "PAM:setcred",
-          "terminal": "cron",
-          "acct": "root"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "cred_acq",
-        "action": "acquired-credentials",
-        "module": "auditd"
-      },
-      "beat": {
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "29CGUmcBTFzn_XoLwpF3",
-    "source": {
-      "@timestamp": "2018-11-27T00:17:01.582Z",
-      "auditd": {
-        "sequence": 184255,
-        "result": "success",
-        "session": "9855",
-        "data": {
-          "terminal": "cron",
-          "op": "PAM:session_open",
-          "acct": "root"
-        },
-        "summary": {
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "cron"
-          }
-        }
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "type": "user_start",
-        "action": "started-session",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "auid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/cron",
-        "pid": "24860"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "3NCGUmcBTFzn_XoLwpF3",
-    "source": {
-      "@timestamp": "2018-11-27T00:17:01.585Z",
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "cred_disp",
-        "action": "disposed-credentials"
-      },
-      "user": {
-        "auid": "0",
-        "name_map": {
-          "uid": "root",
-          "auid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "24860",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "session": "9855",
-        "data": {
-          "terminal": "cron",
-          "op": "PAM:setcred",
-          "acct": "root"
-        },
-        "summary": {
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "secondary": "root",
-            "primary": "root"
-          }
-        },
-        "sequence": 184256,
-        "result": "success"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "3dCGUmcBTFzn_XoLwpF3",
-    "source": {
-      "@timestamp": "2018-11-27T00:17:01.586Z",
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_end",
-        "action": "ended-session",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "auid": "0"
-      },
-      "process": {
-        "pid": "24860",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "result": "success",
-        "session": "9855",
-        "data": {
-          "terminal": "cron",
-          "op": "PAM:session_close",
-          "acct": "root"
-        },
-        "summary": {
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          }
-        },
-        "sequence": 184257
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "7dCGUmcBTFzn_XoLw5Er",
-    "source": {
-      "@timestamp": "2018-11-27T00:17:01.761Z",
-      "process": {
-        "pid": "32105",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "sequence": 192405,
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "op": "PAM:accounting",
-          "acct": "root",
-          "terminal": "cron"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        }
-      },
-      "event": {
-        "action": "was-authorized",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_acct"
-      },
-      "beat": {
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "7tCGUmcBTFzn_XoLw5Er",
-    "source": {
-      "@timestamp": "2018-11-27T00:17:01.762Z",
-      "auditd": {
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "acct": "root",
-          "op": "PAM:setcred",
-          "terminal": "cron"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 192406
-      },
-      "beat": {
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "cred_acq",
-        "action": "acquired-credentials",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32105",
-        "exe": "/usr/sbin/cron"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "79CGUmcBTFzn_XoLw5Er",
-    "source": {
-      "@timestamp": "2018-11-27T00:17:01.763Z",
-      "event": {
-        "type": "user_start",
-        "action": "started-session",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32105",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 192408,
-        "result": "success",
-        "session": "9859",
-        "data": {
-          "acct": "root",
-          "terminal": "cron",
-          "op": "PAM:session_open"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "8NCGUmcBTFzn_XoLw5Er",
-    "source": {
-      "@timestamp": "2018-11-27T00:17:01.766Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "auid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/cron",
-        "pid": "32105"
-      },
-      "auditd": {
-        "sequence": 192409,
-        "result": "success",
-        "session": "9859",
-        "data": {
-          "op": "PAM:setcred",
-          "terminal": "cron",
-          "acct": "root"
-        },
-        "summary": {
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "cron"
-          }
-        }
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "cred_disp",
-        "action": "disposed-credentials"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "8dCGUmcBTFzn_XoLw5Er",
-    "source": {
-      "@timestamp": "2018-11-27T00:17:01.767Z",
-      "event": {
-        "action": "ended-session",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_end"
-      },
-      "user": {
-        "auid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32105",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "session": "9859",
-        "data": {
-          "op": "PAM:session_close",
-          "terminal": "cron",
-          "acct": "root"
-        },
-        "summary": {
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 192410,
-        "result": "success"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "-tCGUmcBTFzn_XoLw5GT",
-    "source": {
-      "@timestamp": "2018-11-27T00:17:01.863Z",
-      "event": {
-        "type": "user_acct",
-        "action": "was-authorized",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "process": {
-        "pid": "31840",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "data": {
-          "op": "PAM:accounting",
-          "terminal": "cron",
-          "acct": "root"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 186230,
-        "result": "success",
-        "session": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "-9CGUmcBTFzn_XoLw5GT",
-    "source": {
-      "@timestamp": "2018-11-27T00:17:01.864Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "action": "acquired-credentials",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "cred_acq"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "31840",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "data": {
-          "acct": "root",
-          "op": "PAM:setcred",
-          "terminal": "cron"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "cron"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 186231,
-        "result": "success",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "_NCGUmcBTFzn_XoLw5GT",
-    "source": {
-      "@timestamp": "2018-11-27T00:17:01.866Z",
-      "process": {
-        "pid": "31840",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "sequence": 186233,
-        "result": "success",
-        "session": "3510",
-        "data": {
-          "op": "PAM:session_open",
-          "terminal": "cron",
-          "acct": "root"
-        },
-        "summary": {
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          }
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "action": "started-session",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_start"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "auid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "_dCGUmcBTFzn_XoLw5GT",
-    "source": {
-      "@timestamp": "2018-11-27T00:17:01.868Z",
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "cred_disp",
-        "action": "disposed-credentials"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "auid": "0"
-      },
-      "process": {
-        "pid": "31840",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "data": {
-          "acct": "root",
-          "terminal": "cron",
-          "op": "PAM:setcred"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 186234,
-        "result": "success",
-        "session": "3510"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "_tCGUmcBTFzn_XoLw5GT",
-    "source": {
-      "@timestamp": "2018-11-27T00:17:01.869Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_end",
-        "action": "ended-session",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/cron",
-        "pid": "31840"
-      },
-      "auditd": {
-        "sequence": 186235,
-        "result": "success",
-        "session": "3510",
-        "data": {
-          "terminal": "cron",
-          "op": "PAM:session_close",
-          "acct": "root"
-        },
-        "summary": {
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          }
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "rdCFUmcBTFzn_XoLNW-m",
-    "source": {
-      "@timestamp": "2018-11-27T00:15:19.990Z",
-      "source": {
-        "ip": "181.58.119.34"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 43101,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "181.58.119.34",
-            "type": "user-session"
-          }
-        }
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "12279",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "rtCFUmcBTFzn_XoLNW-m",
-    "source": {
-      "@timestamp": "2018-11-27T00:15:19.990Z",
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "181.58.119.34",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 43102
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "12279",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "181.58.119.34"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "r9CFUmcBTFzn_XoLNW-m",
-    "source": {
-      "@timestamp": "2018-11-27T00:15:20.098Z",
-      "source": {
-        "ip": "181.58.119.34"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "181.58.119.34",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "181.58.119.34",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43103,
-        "result": "fail"
-      },
-      "beat": {
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "12279"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "9dCFUmcBTFzn_XoLPm_6",
-    "source": {
-      "@timestamp": "2018-11-27T00:15:22.384Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "24844"
-      },
-      "source": {
-        "ip": "78.217.134.141"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 184246,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "78.217.134.141"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "9tCFUmcBTFzn_XoLPm_6",
-    "source": {
-      "@timestamp": "2018-11-27T00:15:22.385Z",
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "24844"
-      },
-      "source": {
-        "ip": "78.217.134.141"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 184247,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "78.217.134.141",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "99CFUmcBTFzn_XoLPm_6",
-    "source": {
-      "@timestamp": "2018-11-27T00:15:22.546Z",
-      "process": {
-        "pid": "24844",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "78.217.134.141"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "78.217.134.141",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "78.217.134.141",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184248,
-        "result": "fail"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ZdCGUmcBTFzn_XoLhYxL",
-    "source": {
-      "@timestamp": "2018-11-27T00:16:45.917Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "212.144.234.165"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 43104
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "12288",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "212.144.234.165"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ZtCGUmcBTFzn_XoLhYxL",
-    "source": {
-      "@timestamp": "2018-11-27T00:16:45.917Z",
-      "source": {
-        "ip": "212.144.234.165"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "212.144.234.165",
-            "type": "user-session"
-          }
-        },
-        "sequence": 43105,
-        "result": "fail"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "12288",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Z9CGUmcBTFzn_XoLhYxL",
-    "source": {
-      "@timestamp": "2018-11-27T00:16:46.029Z",
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "12288",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "212.144.234.165"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "auditd": {
-        "sequence": 43106,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "212.144.234.165",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "212.144.234.165"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "CtCGUmcBTFzn_XoLj44z",
-    "source": {
-      "@timestamp": "2018-11-27T00:16:48.454Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "process": {
-        "pid": "12290",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "82.165.64.156"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "82.165.64.156",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43107,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "C9CGUmcBTFzn_XoLj44z",
-    "source": {
-      "@timestamp": "2018-11-27T00:16:48.458Z",
-      "process": {
-        "pid": "12290",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "82.165.64.156"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "82.165.64.156"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43108,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "DNCGUmcBTFzn_XoLj44z",
-    "source": {
-      "@timestamp": "2018-11-27T00:16:48.574Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "82.165.64.156",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43109,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "82.165.64.156"
-        }
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "12290"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "source": {
-        "ip": "82.165.64.156"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "XdCGUmcBTFzn_XoLspGv",
-    "source": {
-      "@timestamp": "2018-11-27T00:16:57.541Z",
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "process": {
-        "pid": "24857",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "90.63.218.214"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "90.63.218.214",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184249,
-        "result": "fail"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "XtCGUmcBTFzn_XoLspGv",
-    "source": {
-      "@timestamp": "2018-11-27T00:16:57.542Z",
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "90.63.218.214"
-          }
-        },
-        "sequence": 184250,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "24857",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "90.63.218.214"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "X9CGUmcBTFzn_XoLspGv",
-    "source": {
-      "@timestamp": "2018-11-27T00:16:57.654Z",
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "24857",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "90.63.218.214"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 184251,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "90.63.218.214",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "90.63.218.214",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "gNCDUmcBTFzn_XoLe0qz",
-    "source": {
-      "@timestamp": "2018-11-27T00:13:26.761Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "31815",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "178.128.221.237"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186221,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "178.128.221.237"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "gdCDUmcBTFzn_XoLe0qz",
-    "source": {
-      "@timestamp": "2018-11-27T00:13:26.762Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "178.128.221.237",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186222,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        }
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "process": {
-        "pid": "31815",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "178.128.221.237"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "gtCDUmcBTFzn_XoLe0qz",
-    "source": {
-      "@timestamp": "2018-11-27T00:13:26.955Z",
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "31815",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "178.128.221.237"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186223,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "178.128.221.237",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "178.128.221.237",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "oNCFUmcBTFzn_XoLinbC",
-    "source": {
-      "@timestamp": "2018-11-27T00:15:41.783Z",
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "31832"
-      },
-      "source": {
-        "ip": "46.148.18.163"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "46.148.18.163",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186227,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "odCFUmcBTFzn_XoLinbC",
-    "source": {
-      "@timestamp": "2018-11-27T00:15:41.784Z",
-      "source": {
-        "ip": "46.148.18.163"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "46.148.18.163",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186228
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "31832",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "otCFUmcBTFzn_XoLinbC",
-    "source": {
-      "@timestamp": "2018-11-27T00:15:41.927Z",
-      "source": {
-        "ip": "46.148.18.163"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "hostname": "46.148.18.163",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "46.148.18.163"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186229,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "process": {
-        "pid": "31832",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "5tCEUmcBTFzn_XoLU1tS",
-    "source": {
-      "@timestamp": "2018-11-27T00:14:22.056Z",
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "31823"
-      },
-      "source": {
-        "ip": "185.241.4.160"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "185.241.4.160",
-            "type": "user-session",
-            "primary": "sshd"
-          }
-        },
-        "sequence": 186224,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        }
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "59CEUmcBTFzn_XoLU1tS",
-    "source": {
-      "@timestamp": "2018-11-27T00:14:22.061Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "31823",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "185.241.4.160"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186225,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "secondary": "185.241.4.160",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "6NCEUmcBTFzn_XoLU1tS",
-    "source": {
-      "@timestamp": "2018-11-27T00:14:22.221Z",
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "31823"
-      },
-      "source": {
-        "ip": "185.241.4.160"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "hostname": "185.241.4.160",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "185.241.4.160",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186226,
-        "result": "fail"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "D9CFUmcBTFzn_XoL031l",
-    "source": {
-      "@timestamp": "2018-11-27T00:16:00.377Z",
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "117.102.68.188",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44076,
-        "result": "fail"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "beat": {
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "28053"
-      },
-      "source": {
-        "ip": "117.102.68.188"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ENCFUmcBTFzn_XoL031l",
-    "source": {
-      "@timestamp": "2018-11-27T00:16:00.377Z",
-      "source": {
-        "ip": "117.102.68.188"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44077,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "117.102.68.188"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "28053",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "EdCFUmcBTFzn_XoL031l",
-    "source": {
-      "@timestamp": "2018-11-27T00:16:00.581Z",
-      "auditd": {
-        "sequence": 44078,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "117.102.68.188",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "117.102.68.188",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "process": {
-        "pid": "28053",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "117.102.68.188"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "19CGUmcBTFzn_XoLC4FO",
-    "source": {
-      "@timestamp": "2018-11-27T00:16:14.690Z",
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "91.183.42.58",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 44079,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "28062",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "91.183.42.58"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "2NCGUmcBTFzn_XoLC4FO",
-    "source": {
-      "@timestamp": "2018-11-27T00:16:14.690Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "28062",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "91.183.42.58"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44080,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "91.183.42.58",
-            "type": "user-session"
-          }
-        }
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "beat": {
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "2dCGUmcBTFzn_XoLC4FO",
-    "source": {
-      "@timestamp": "2018-11-27T00:16:14.802Z",
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "28062",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "91.183.42.58"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "auditd": {
-        "sequence": 44081,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "91.183.42.58",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "91.183.42.58"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "dtCJUmcBTFzn_XoL_tm6",
-    "source": {
-      "@timestamp": "2018-11-27T00:20:33.614Z",
-      "auditd": {
-        "sequence": 44091,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "209.59.65.109"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "28150",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "209.59.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "d9CJUmcBTFzn_XoL_tm6",
-    "source": {
-      "@timestamp": "2018-11-27T00:20:33.614Z",
-      "auditd": {
-        "sequence": 44092,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "209.59.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "28150",
-        "exe": "/usr/sbin/sshd"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "source": {
-        "ip": "209.59.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "eNCJUmcBTFzn_XoL_tm6",
-    "source": {
-      "@timestamp": "2018-11-27T00:20:33.698Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "28150"
-      },
-      "source": {
-        "ip": "209.59.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44093,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "209.59.65.109",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "209.59.65.109",
-            "type": "user-session"
-          }
-        }
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ptCKUmcBTFzn_XoLDtsd",
-    "source": {
-      "@timestamp": "2018-11-27T00:20:37.550Z",
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "106.51.72.37",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44094,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "28153",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "106.51.72.37"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "p9CKUmcBTFzn_XoLDtsd",
-    "source": {
-      "@timestamp": "2018-11-27T00:20:37.550Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "28153"
-      },
-      "source": {
-        "ip": "106.51.72.37"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44095,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "106.51.72.37",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "qNCKUmcBTFzn_XoLDtsd",
-    "source": {
-      "@timestamp": "2018-11-27T00:20:37.782Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "28153",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "106.51.72.37"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44096,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "106.51.72.37"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "106.51.72.37",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "5tGMUmcBTFzn_XoLPwqH",
-    "source": {
-      "@timestamp": "2018-11-27T00:23:01.275Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "31880",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "46.105.123.11"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186254,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "46.105.123.11",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          }
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "59GMUmcBTFzn_XoLPwqH",
-    "source": {
-      "@timestamp": "2018-11-27T00:23:01.276Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "46.105.123.11"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186255
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "31880",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "46.105.123.11"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "6NGMUmcBTFzn_XoLPwqH",
-    "source": {
-      "@timestamp": "2018-11-27T00:23:01.383Z",
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "31880",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "46.105.123.11"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "sequence": 186256,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "46.105.123.11"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "46.105.123.11"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "FtCKUmcBTFzn_XoL0uxn",
-    "source": {
-      "@timestamp": "2018-11-27T00:21:27.805Z",
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "213.143.97.179",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 142270,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "19271",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "213.143.97.179"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "F9CKUmcBTFzn_XoL0uxn",
-    "source": {
-      "@timestamp": "2018-11-27T00:21:27.807Z",
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "auditd": {
-        "sequence": 142271,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "213.143.97.179"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "19271",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "213.143.97.179"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "GNCKUmcBTFzn_XoL0uxn",
-    "source": {
-      "@timestamp": "2018-11-27T00:21:27.937Z",
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "auditd": {
-        "sequence": 142272,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "213.143.97.179"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "213.143.97.179",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "19271",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "213.143.97.179"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ZtCLUmcBTFzn_XoLLPOM",
-    "source": {
-      "@timestamp": "2018-11-27T00:21:50.882Z",
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "beat": {
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "24899",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "192.99.252.97"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "192.99.252.97",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184273,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Z9CLUmcBTFzn_XoLLPOM",
-    "source": {
-      "@timestamp": "2018-11-27T00:21:50.883Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "24899"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "source": {
-        "ip": "192.99.252.97"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 184274,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "192.99.252.97"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "aNCLUmcBTFzn_XoLLPOM",
-    "source": {
-      "@timestamp": "2018-11-27T00:21:50.926Z",
-      "process": {
-        "pid": "24899",
-        "exe": "/usr/sbin/sshd"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01"
-      },
-      "source": {
-        "ip": "192.99.252.97"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "192.99.252.97",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 184275,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "192.99.252.97"
-        }
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "A9CKUmcBTFzn_XoLrulM",
-    "source": {
-      "@timestamp": "2018-11-27T00:21:18.562Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186251,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "163.172.35.93"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "31872"
-      },
-      "source": {
-        "ip": "163.172.35.93"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "BNCKUmcBTFzn_XoLrulM",
-    "source": {
-      "@timestamp": "2018-11-27T00:21:18.563Z",
-      "source": {
-        "ip": "163.172.35.93"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "163.172.35.93",
-            "type": "user-session"
-          }
-        },
-        "sequence": 186252
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "process": {
-        "pid": "31872",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "BdCKUmcBTFzn_XoLrulM",
-    "source": {
-      "@timestamp": "2018-11-27T00:21:18.669Z",
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "31872",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "163.172.35.93"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186253,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "163.172.35.93"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "163.172.35.93",
-            "type": "user-session"
-          }
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "VtCKUmcBTFzn_XoLLt0C",
-    "source": {
-      "@timestamp": "2018-11-27T00:20:45.720Z",
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "24889",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "122.175.55.196"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "122.175.55.196",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184270,
-        "result": "fail",
-        "session": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "V9CKUmcBTFzn_XoLLt0C",
-    "source": {
-      "@timestamp": "2018-11-27T00:20:45.721Z",
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "24889",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "122.175.55.196"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 184271,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "122.175.55.196",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "WNCKUmcBTFzn_XoLLt0C",
-    "source": {
-      "@timestamp": "2018-11-27T00:20:45.977Z",
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "source": {
-        "ip": "122.175.55.196"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "122.175.55.196",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "122.175.55.196",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184272
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "24889",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "FNGNUmcBTFzn_XoLiyd2",
-    "source": {
-      "@timestamp": "2018-11-27T00:24:26.252Z",
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "source": {
-        "ip": "145.239.137.89"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "145.239.137.89",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192426,
-        "result": "fail"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32155",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "FdGNUmcBTFzn_XoLiyd2",
-    "source": {
-      "@timestamp": "2018-11-27T00:24:26.253Z",
-      "source": {
-        "ip": "145.239.137.89"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192427,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "145.239.137.89",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        }
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32155"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "FtGNUmcBTFzn_XoLiyd2",
-    "source": {
-      "@timestamp": "2018-11-27T00:24:26.370Z",
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32155"
-      },
-      "source": {
-        "ip": "145.239.137.89"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "145.239.137.89",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 192428,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "145.239.137.89",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "QNGLUmcBTFzn_XoL7gTu",
-    "source": {
-      "@timestamp": "2018-11-27T00:22:40.643Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32146",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "source": {
-        "ip": "52.189.217.7"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "52.189.217.7",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192423
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "QdGLUmcBTFzn_XoL7gTu",
-    "source": {
-      "@timestamp": "2018-11-27T00:22:40.644Z",
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32146",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "52.189.217.7"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "52.189.217.7",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192424,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "QtGLUmcBTFzn_XoL7gTu",
-    "source": {
-      "@timestamp": "2018-11-27T00:22:40.849Z",
-      "process": {
-        "pid": "32146",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "source": {
-        "ip": "52.189.217.7"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "52.189.217.7"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "52.189.217.7",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192425,
-        "result": "fail"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "_9GMUmcBTFzn_XoL1xdJ",
-    "source": {
-      "@timestamp": "2018-11-27T00:23:40.121Z",
-      "process": {
-        "pid": "28213",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "139.59.133.18"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44097,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "139.59.133.18",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ANGMUmcBTFzn_XoL1xhJ",
-    "source": {
-      "@timestamp": "2018-11-27T00:23:40.125Z",
-      "process": {
-        "pid": "28213",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "139.59.133.18"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "auditd": {
-        "sequence": 44098,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "139.59.133.18",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "AdGMUmcBTFzn_XoL1xhJ",
-    "source": {
-      "@timestamp": "2018-11-27T00:23:40.237Z",
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "139.59.133.18",
-            "type": "user-session"
-          }
-        },
-        "sequence": 44099,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "139.59.133.18"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "28213",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "139.59.133.18"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ydGRUmcBTFzn_XoL6IZr",
-    "source": {
-      "@timestamp": "2018-11-27T00:29:12.188Z",
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "source": {
-        "ip": "54.37.154.254"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "54.37.154.254",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43119,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "12362",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ytGRUmcBTFzn_XoL6IZr",
-    "source": {
-      "@timestamp": "2018-11-27T00:29:12.188Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "12362",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "54.37.154.254"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "54.37.154.254",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43120,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "y9GRUmcBTFzn_XoL6IZr",
-    "source": {
-      "@timestamp": "2018-11-27T00:29:12.300Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 43121,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "54.37.154.254"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "54.37.154.254",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "12362",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "source": {
-        "ip": "54.37.154.254"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "UtGRUmcBTFzn_XoL7YcV",
-    "source": {
-      "@timestamp": "2018-11-27T00:29:13.387Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "24953",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "86.104.220.26"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "86.104.220.26",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184288
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "U9GRUmcBTFzn_XoL7YcV",
-    "source": {
-      "@timestamp": "2018-11-27T00:29:13.388Z",
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "beat": {
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "24953"
-      },
-      "source": {
-        "ip": "86.104.220.26"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "86.104.220.26",
-            "type": "user-session",
-            "primary": "sshd"
-          }
-        },
-        "sequence": 184289,
-        "result": "fail",
-        "session": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "VNGRUmcBTFzn_XoL7YcV",
-    "source": {
-      "@timestamp": "2018-11-27T00:29:13.531Z",
-      "process": {
-        "pid": "24953",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "86.104.220.26"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 184290,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "86.104.220.26",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "86.104.220.26"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "QdGPUmcBTFzn_XoLtVea",
-    "source": {
-      "@timestamp": "2018-11-27T00:26:48.111Z",
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "process": {
-        "pid": "19304",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "121.162.29.165"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "121.162.29.165",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142276,
-        "result": "fail"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "QtGPUmcBTFzn_XoLtVea",
-    "source": {
-      "@timestamp": "2018-11-27T00:26:48.112Z",
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "19304"
-      },
-      "source": {
-        "ip": "121.162.29.165"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "121.162.29.165",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142277,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Q9GPUmcBTFzn_XoLtVea",
-    "source": {
-      "@timestamp": "2018-11-27T00:26:48.273Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "19304",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "121.162.29.165"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "121.162.29.165",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "121.162.29.165",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 142278,
-        "result": "fail"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "1tGPUmcBTFzn_XoL8FvF",
-    "source": {
-      "@timestamp": "2018-11-27T00:27:03.259Z",
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "auditd": {
-        "sequence": 142279,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "103.56.207.96",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "19306",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "103.56.207.96"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "19GPUmcBTFzn_XoL8FvF",
-    "source": {
-      "@timestamp": "2018-11-27T00:27:03.260Z",
-      "process": {
-        "pid": "19306",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "103.56.207.96"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "103.56.207.96"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          }
-        },
-        "sequence": 142280
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "2NGPUmcBTFzn_XoL8FvF",
-    "source": {
-      "@timestamp": "2018-11-27T00:27:03.463Z",
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "19306",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "103.56.207.96"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "hostname": "103.56.207.96",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "103.56.207.96"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142281,
-        "result": "fail"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "l9GQUmcBTFzn_XoL0m8i",
-    "source": {
-      "@timestamp": "2018-11-27T00:28:00.952Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "31904"
-      },
-      "source": {
-        "ip": "122.152.225.120"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186260,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "122.152.225.120",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "mNGQUmcBTFzn_XoL0m8i",
-    "source": {
-      "@timestamp": "2018-11-27T00:28:00.954Z",
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "31904"
-      },
-      "source": {
-        "ip": "122.152.225.120"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186261,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "122.152.225.120",
-            "type": "user-session"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "mdGQUmcBTFzn_XoL0m8i",
-    "source": {
-      "@timestamp": "2018-11-27T00:28:01.157Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "122.152.225.120"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "122.152.225.120"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 186262,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "31904"
-      },
-      "source": {
-        "ip": "122.152.225.120"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "nNGTUmcBTFzn_XoLCp-5",
-    "source": {
-      "@timestamp": "2018-11-27T00:30:26.511Z",
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32530"
-      },
-      "source": {
-        "ip": "173.167.200.227"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "173.167.200.227"
-          }
-        },
-        "sequence": 192434
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ndGTUmcBTFzn_XoLCp-5",
-    "source": {
-      "@timestamp": "2018-11-27T00:30:26.512Z",
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32530",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "source": {
-        "ip": "173.167.200.227"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "173.167.200.227",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192435,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ntGTUmcBTFzn_XoLCp-5",
-    "source": {
-      "@timestamp": "2018-11-27T00:30:26.557Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32530",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "173.167.200.227"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "173.167.200.227",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192436,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "173.167.200.227",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "zdGQUmcBTFzn_XoLtmz7",
-    "source": {
-      "@timestamp": "2018-11-27T00:27:54.000Z",
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "31902",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "184.170.7.230"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186257,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "184.170.7.230",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ztGQUmcBTFzn_XoLtmz7",
-    "source": {
-      "@timestamp": "2018-11-27T00:27:54.002Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "process": {
-        "pid": "31902",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "184.170.7.230"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "184.170.7.230",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186258,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "z9GQUmcBTFzn_XoLtmz7",
-    "source": {
-      "@timestamp": "2018-11-27T00:27:54.541Z",
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "31902",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "184.170.7.230"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "184.170.7.230"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "184.170.7.230",
-            "type": "user-session"
-          }
-        },
-        "sequence": 186259,
-        "result": "fail"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "QdGSUmcBTFzn_XoLx5oM",
-    "source": {
-      "@timestamp": "2018-11-27T00:30:09.185Z",
-      "beat": {
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "12372"
-      },
-      "source": {
-        "ip": "86.229.8.199"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "86.229.8.199",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43125,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "QtGSUmcBTFzn_XoLx5oM",
-    "source": {
-      "@timestamp": "2018-11-27T00:30:09.185Z",
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "86.229.8.199"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43126,
-        "result": "fail"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "12372",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "86.229.8.199"
-      },
-      "beat": {
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Q9GSUmcBTFzn_XoLx5oM",
-    "source": {
-      "@timestamp": "2018-11-27T00:30:09.329Z",
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "12372"
-      },
-      "source": {
-        "ip": "86.229.8.199"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "86.229.8.199",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43127,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "86.229.8.199",
-          "op": "PAM:bad_ident"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "6tGSUmcBTFzn_XoLe5Pk",
-    "source": {
-      "@timestamp": "2018-11-27T00:29:49.943Z",
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "12370",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "138.197.44.25"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 43122,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "138.197.44.25",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "beat": {
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "69GSUmcBTFzn_XoLe5Pk",
-    "source": {
-      "@timestamp": "2018-11-27T00:29:49.943Z",
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "12370",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "138.197.44.25"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "138.197.44.25",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 43123,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        }
-      },
-      "beat": {
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "7NGSUmcBTFzn_XoLe5Pk",
-    "source": {
-      "@timestamp": "2018-11-27T00:29:49.975Z",
-      "auditd": {
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "138.197.44.25",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "138.197.44.25",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43124,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "12370",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "138.197.44.25"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "59GRUmcBTFzn_XoLFXXo",
-    "source": {
-      "@timestamp": "2018-11-27T00:28:18.298Z",
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "beat": {
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "28318"
-      },
-      "source": {
-        "ip": "200.35.110.58"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "200.35.110.58"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 44112
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "6NGRUmcBTFzn_XoLFXXo",
-    "source": {
-      "@timestamp": "2018-11-27T00:28:18.298Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "28318"
-      },
-      "source": {
-        "ip": "200.35.110.58"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44113,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "200.35.110.58",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "6dGRUmcBTFzn_XoLFXXo",
-    "source": {
-      "@timestamp": "2018-11-27T00:28:18.414Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "200.35.110.58",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "200.35.110.58",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44114
-      },
-      "beat": {
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "28318",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "200.35.110.58"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "r9KXUmcBTFzn_XoLtQab",
-    "source": {
-      "@timestamp": "2018-11-27T00:35:32.401Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "31943",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "164.132.43.198"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "164.132.43.198"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 186269,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "sNKXUmcBTFzn_XoLtQab",
-    "source": {
-      "@timestamp": "2018-11-27T00:35:32.402Z",
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "sequence": 186270,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "164.132.43.198",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "31943"
-      },
-      "source": {
-        "ip": "164.132.43.198"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "sdKXUmcBTFzn_XoLtQab",
-    "source": {
-      "@timestamp": "2018-11-27T00:35:32.510Z",
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "31943",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "164.132.43.198"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186271,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "164.132.43.198",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "164.132.43.198",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "CNKXUmcBTFzn_XoLxggy",
-    "source": {
-      "@timestamp": "2018-11-27T00:35:36.648Z",
-      "process": {
-        "pid": "19353",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "46.55.214.3"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "46.55.214.3",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142285
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "CdKXUmcBTFzn_XoLxggy",
-    "source": {
-      "@timestamp": "2018-11-27T00:35:36.650Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "auditd": {
-        "sequence": 142286,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "46.55.214.3"
-          }
-        }
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "19353",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "46.55.214.3"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "CtKXUmcBTFzn_XoLxggy",
-    "source": {
-      "@timestamp": "2018-11-27T00:35:36.800Z",
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "46.55.214.3"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          }
-        },
-        "sequence": 142287,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "46.55.214.3"
-        }
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "19353",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "46.55.214.3"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "S9KYUmcBTFzn_XoL9yJk",
-    "source": {
-      "@timestamp": "2018-11-27T00:36:54.778Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "125.63.92.170",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142288
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "19361"
-      },
-      "source": {
-        "ip": "125.63.92.170"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "TNKYUmcBTFzn_XoL9yJk",
-    "source": {
-      "@timestamp": "2018-11-27T00:36:54.779Z",
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "125.63.92.170",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142289,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "19361",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "125.63.92.170"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "TdKYUmcBTFzn_XoL9yJk",
-    "source": {
-      "@timestamp": "2018-11-27T00:36:55.043Z",
-      "beat": {
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-haproxy-01"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "19361",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "125.63.92.170"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "125.63.92.170",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142290,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "125.63.92.170"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "8tKZUmcBTFzn_XoLZyud",
-    "source": {
-      "@timestamp": "2018-11-27T00:37:23.507Z",
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "180.151.228.58",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186272
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "31951"
-      },
-      "source": {
-        "ip": "180.151.228.58"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "89KZUmcBTFzn_XoLZyud",
-    "source": {
-      "@timestamp": "2018-11-27T00:37:23.508Z",
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "180.151.228.58",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186273,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "31951",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "180.151.228.58"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "9NKZUmcBTFzn_XoLZyud",
-    "source": {
-      "@timestamp": "2018-11-27T00:37:23.776Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "31951",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "180.151.228.58"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "180.151.228.58",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186274,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "180.151.228.58"
-        }
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "BtGWUmcBTFzn_XoLwfK7",
-    "source": {
-      "@timestamp": "2018-11-27T00:34:29.968Z",
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32558",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "211.24.100.205"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "211.24.100.205",
-            "type": "user-session"
-          }
-        },
-        "sequence": 192440,
-        "result": "fail",
-        "session": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "B9GWUmcBTFzn_XoLwfK7",
-    "source": {
-      "@timestamp": "2018-11-27T00:34:29.969Z",
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "process": {
-        "pid": "32558",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "211.24.100.205"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "211.24.100.205",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192441,
-        "result": "fail",
-        "session": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "CNGWUmcBTFzn_XoLwfK7",
-    "source": {
-      "@timestamp": "2018-11-27T00:34:30.179Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32558"
-      },
-      "source": {
-        "ip": "211.24.100.205"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "211.24.100.205"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "211.24.100.205",
-            "type": "user-session"
-          }
-        },
-        "sequence": 192442
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "pdKaUmcBTFzn_XoL802l",
-    "source": {
-      "@timestamp": "2018-11-27T00:39:04.878Z",
-      "process": {
-        "pid": "31959",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "46.251.239.72"
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "46.251.239.72"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186275,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ptKaUmcBTFzn_XoL802l",
-    "source": {
-      "@timestamp": "2018-11-27T00:39:04.879Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "31959",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "46.251.239.72"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186276,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "46.251.239.72",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "p9KaUmcBTFzn_XoL802l",
-    "source": {
-      "@timestamp": "2018-11-27T00:39:04.990Z",
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "31959",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "46.251.239.72"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "46.251.239.72",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186277,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "46.251.239.72"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "r9KXUmcBTFzn_XoLowUZ",
-    "source": {
-      "@timestamp": "2018-11-27T00:35:27.663Z",
-      "source": {
-        "ip": "185.254.97.113"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "185.254.97.113",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186266,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "31941",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "sNKXUmcBTFzn_XoLowUZ",
-    "source": {
-      "@timestamp": "2018-11-27T00:35:27.664Z",
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "185.254.97.113"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "185.254.97.113"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186267,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "31941",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "sdKXUmcBTFzn_XoLowUZ",
-    "source": {
-      "@timestamp": "2018-11-27T00:35:27.773Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "31941",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "185.254.97.113"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "185.254.97.113",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186268,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "185.254.97.113"
-        }
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "h9GWUmcBTFzn_XoL7_UK",
-    "source": {
-      "@timestamp": "2018-11-27T00:34:41.567Z",
-      "process": {
-        "pid": "19345",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "202.84.76.146"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "202.84.76.146",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142282
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "iNGWUmcBTFzn_XoL7_UK",
-    "source": {
-      "@timestamp": "2018-11-27T00:34:41.568Z",
-      "process": {
-        "pid": "19345",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "202.84.76.146"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "202.84.76.146",
-            "type": "user-session",
-            "primary": "sshd"
-          }
-        },
-        "sequence": 142283
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "idGWUmcBTFzn_XoL7_UK",
-    "source": {
-      "@timestamp": "2018-11-27T00:34:41.795Z",
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "process": {
-        "pid": "19345",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "202.84.76.146"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "202.84.76.146"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "202.84.76.146",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142284,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "StKaUmcBTFzn_XoL5kzE",
-    "source": {
-      "@timestamp": "2018-11-27T00:39:01.594Z",
-      "auditd": {
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "acct": "root",
-          "terminal": "cron",
-          "op": "PAM:accounting"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "cron"
-          },
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          }
-        },
-        "sequence": 184300
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_acct",
-        "action": "was-authorized",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/cron",
-        "pid": "25011"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "S9KaUmcBTFzn_XoL5kzE",
-    "source": {
-      "@timestamp": "2018-11-27T00:39:01.594Z",
-      "process": {
-        "pid": "25011",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "sequence": 184301,
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "terminal": "cron",
-          "op": "PAM:setcred",
-          "acct": "root"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "cred_acq",
-        "action": "acquired-credentials"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "TNKaUmcBTFzn_XoL5kzE",
-    "source": {
-      "@timestamp": "2018-11-27T00:39:01.596Z",
-      "event": {
-        "type": "user_start",
-        "action": "started-session",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "process": {
-        "pid": "25011",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "result": "success",
-        "session": "9856",
-        "data": {
-          "acct": "root",
-          "op": "PAM:session_open",
-          "terminal": "cron"
-        },
-        "summary": {
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 184303
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "TdKaUmcBTFzn_XoL5kzE",
-    "source": {
-      "@timestamp": "2018-11-27T00:39:01.697Z",
-      "auditd": {
-        "session": "9856",
-        "data": {
-          "acct": "root",
-          "terminal": "cron",
-          "op": "PAM:setcred"
-        },
-        "summary": {
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "cron"
-          }
-        },
-        "sequence": 184304,
-        "result": "success"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "cred_disp",
-        "action": "disposed-credentials",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "25011",
-        "exe": "/usr/sbin/cron"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "TtKaUmcBTFzn_XoL5kzE",
-    "source": {
-      "@timestamp": "2018-11-27T00:39:01.698Z",
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_end",
-        "action": "ended-session",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "25011",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "cron",
-          "op": "PAM:session_close",
-          "acct": "root"
-        },
-        "summary": {
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          }
-        },
-        "sequence": 184305,
-        "result": "success",
-        "session": "9856"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "V9KaUmcBTFzn_XoL50x5",
-    "source": {
-      "@timestamp": "2018-11-27T00:39:01.774Z",
-      "auditd": {
-        "data": {
-          "acct": "root",
-          "terminal": "cron",
-          "op": "PAM:accounting"
-        },
-        "summary": {
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 192443,
-        "result": "success",
-        "session": "unset"
-      },
-      "event": {
-        "type": "user_acct",
-        "action": "was-authorized",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32579",
-        "exe": "/usr/sbin/cron"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "WNKaUmcBTFzn_XoL50x5",
-    "source": {
-      "@timestamp": "2018-11-27T00:39:01.774Z",
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "cred_acq",
-        "action": "acquired-credentials"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/cron",
-        "pid": "32579"
-      },
-      "auditd": {
-        "sequence": 192444,
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "op": "PAM:setcred",
-          "acct": "root",
-          "terminal": "cron"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "WdKaUmcBTFzn_XoL50x5",
-    "source": {
-      "@timestamp": "2018-11-27T00:39:01.776Z",
-      "process": {
-        "pid": "32579",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "session": "9860",
-        "data": {
-          "terminal": "cron",
-          "acct": "root",
-          "op": "PAM:session_open"
-        },
-        "summary": {
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "cron"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 192446,
-        "result": "success"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_start",
-        "action": "started-session",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "auid": "0",
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "WtKaUmcBTFzn_XoL50x5",
-    "source": {
-      "@timestamp": "2018-11-27T00:39:01.873Z",
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          }
-        },
-        "sequence": 192447,
-        "result": "success",
-        "session": "9860",
-        "data": {
-          "op": "PAM:setcred",
-          "acct": "root",
-          "terminal": "cron"
-        }
-      },
-      "event": {
-        "action": "disposed-credentials",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "cred_disp"
-      },
-      "user": {
-        "auid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32579",
-        "exe": "/usr/sbin/cron"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "W9KaUmcBTFzn_XoL50x5",
-    "source": {
-      "@timestamp": "2018-11-27T00:39:01.874Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "auid": "0"
-      },
-      "process": {
-        "pid": "32579",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "cron",
-          "op": "PAM:session_close",
-          "acct": "root"
-        },
-        "summary": {
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "cron"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 192448,
-        "result": "success",
-        "session": "9860"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_end",
-        "action": "ended-session",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "W9KbUmcBTFzn_XoLP1QB",
-    "source": {
-      "@timestamp": "2018-11-27T00:39:24.137Z",
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "138.68.111.27",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44121,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "28526",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "138.68.111.27"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "XNKbUmcBTFzn_XoLP1QB",
-    "source": {
-      "@timestamp": "2018-11-27T00:39:24.137Z",
-      "source": {
-        "ip": "138.68.111.27"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "138.68.111.27",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44122,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "28526",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "XdKbUmcBTFzn_XoLP1QB",
-    "source": {
-      "@timestamp": "2018-11-27T00:39:24.241Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "28526",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "138.68.111.27"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "138.68.111.27"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "138.68.111.27",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44123
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "CNKiUmcBTFzn_XoLvfm3",
-    "source": {
-      "@timestamp": "2018-11-27T00:47:35.372Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "19424",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "137.74.114.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "auditd": {
-        "sequence": 142300,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "137.74.114.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "CdKiUmcBTFzn_XoLvfm3",
-    "source": {
-      "@timestamp": "2018-11-27T00:47:35.374Z",
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "19424"
-      },
-      "source": {
-        "ip": "137.74.114.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "object": {
-            "secondary": "137.74.114.109",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 142301,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "CtKiUmcBTFzn_XoLvfm3",
-    "source": {
-      "@timestamp": "2018-11-27T00:47:35.480Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "19424"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "source": {
-        "ip": "137.74.114.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "137.74.114.109"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142302,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "137.74.114.109",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "qdOkUmcBTFzn_XoLDBVT",
-    "source": {
-      "@timestamp": "2018-11-27T00:49:01.033Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "25113",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "121.67.246.139"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "121.67.246.139",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184309,
-        "result": "fail"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "qtOkUmcBTFzn_XoLDBVT",
-    "source": {
-      "@timestamp": "2018-11-27T00:49:01.034Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 184310,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "121.67.246.139",
-            "type": "user-session"
-          }
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "25113",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "source": {
-        "ip": "121.67.246.139"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "q9OkUmcBTFzn_XoLDBVT",
-    "source": {
-      "@timestamp": "2018-11-27T00:49:01.224Z",
-      "auditd": {
-        "data": {
-          "hostname": "121.67.246.139",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "121.67.246.139",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184311,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "25113",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "121.67.246.139"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "qNOkUmcBTFzn_XoLgx_7",
-    "source": {
-      "@timestamp": "2018-11-27T00:49:31.664Z",
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "25115",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "179.228.242.120"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "179.228.242.120",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184312,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "qdOkUmcBTFzn_XoLgx_7",
-    "source": {
-      "@timestamp": "2018-11-27T00:49:31.665Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "25115",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "179.228.242.120"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "179.228.242.120",
-            "type": "user-session"
-          }
-        },
-        "sequence": 184313,
-        "result": "fail",
-        "session": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "qtOkUmcBTFzn_XoLgx_7",
-    "source": {
-      "@timestamp": "2018-11-27T00:49:31.831Z",
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "25115",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "179.228.242.120"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "179.228.242.120",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184314,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "179.228.242.120"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "BtKiUmcBTFzn_XoL-P7X",
-    "source": {
-      "@timestamp": "2018-11-27T00:47:50.509Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "19431",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "39.110.219.91"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-haproxy-01"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "39.110.219.91",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142303,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "B9KiUmcBTFzn_XoL-P7X",
-    "source": {
-      "@timestamp": "2018-11-27T00:47:50.511Z",
-      "source": {
-        "ip": "39.110.219.91"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 142304,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "39.110.219.91",
-            "type": "user-session"
-          }
-        }
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "19431",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "CNKiUmcBTFzn_XoL-P7X",
-    "source": {
-      "@timestamp": "2018-11-27T00:47:50.642Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "19431",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "39.110.219.91"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "39.110.219.91",
-            "type": "user-session"
-          }
-        },
-        "sequence": 142305,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "39.110.219.91"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "X9OkUmcBTFzn_XoLABX7",
-    "source": {
-      "@timestamp": "2018-11-27T00:48:58.129Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "19439",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "41.89.47.14"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 142306,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "41.89.47.14",
-            "type": "user-session"
-          }
-        }
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "YNOkUmcBTFzn_XoLABX7",
-    "source": {
-      "@timestamp": "2018-11-27T00:48:58.130Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "41.89.47.14",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142307,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-haproxy-01"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "19439",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "41.89.47.14"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "YdOkUmcBTFzn_XoLABX7",
-    "source": {
-      "@timestamp": "2018-11-27T00:48:58.365Z",
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "41.89.47.14",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "object": {
-            "secondary": "41.89.47.14",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 142308
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "19439",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "41.89.47.14"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "gNOkUmcBTFzn_XoL8ilB",
-    "source": {
-      "@timestamp": "2018-11-27T00:49:59.894Z",
-      "process": {
-        "pid": "32019",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "105.16.153.210"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "105.16.153.210",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186284
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "gdOkUmcBTFzn_XoL8ilB",
-    "source": {
-      "@timestamp": "2018-11-27T00:49:59.895Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "process": {
-        "pid": "32019",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "105.16.153.210"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "105.16.153.210",
-            "type": "user-session"
-          }
-        },
-        "sequence": 186285,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "gtOkUmcBTFzn_XoL8ilB",
-    "source": {
-      "@timestamp": "2018-11-27T00:50:00.158Z",
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32019",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "105.16.153.210"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186286,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "105.16.153.210",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "105.16.153.210"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "FdOlUmcBTFzn_XoLkjc2",
-    "source": {
-      "@timestamp": "2018-11-27T00:50:40.838Z",
-      "source": {
-        "ip": "188.166.243.150"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44130,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "188.166.243.150",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "28746",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "FtOlUmcBTFzn_XoLkjc2",
-    "source": {
-      "@timestamp": "2018-11-27T00:50:40.842Z",
-      "source": {
-        "ip": "188.166.243.150"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "188.166.243.150",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 44131
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "28746"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "F9OlUmcBTFzn_XoLkjc2",
-    "source": {
-      "@timestamp": "2018-11-27T00:50:41.034Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "188.166.243.150",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "188.166.243.150"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 44132,
-        "result": "fail"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "28746",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "188.166.243.150"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "JdOmUmcBTFzn_XoLCEHk",
-    "source": {
-      "@timestamp": "2018-11-27T00:51:11.223Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 43140,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "194.35.114.10"
-          }
-        }
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "12495",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "194.35.114.10"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "JtOmUmcBTFzn_XoLCEHk",
-    "source": {
-      "@timestamp": "2018-11-27T00:51:11.223Z",
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "12495"
-      },
-      "source": {
-        "ip": "194.35.114.10"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "194.35.114.10"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43141,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "J9OmUmcBTFzn_XoLCEHk",
-    "source": {
-      "@timestamp": "2018-11-27T00:51:11.503Z",
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "12495"
-      },
-      "source": {
-        "ip": "194.35.114.10"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "194.35.114.10",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "194.35.114.10",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43142
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "0dOlUmcBTFzn_XoLvzre",
-    "source": {
-      "@timestamp": "2018-11-27T00:50:52.531Z",
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "104.131.178.223",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44133,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "28750",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "104.131.178.223"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "0tOlUmcBTFzn_XoLvzre",
-    "source": {
-      "@timestamp": "2018-11-27T00:50:52.531Z",
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "104.131.178.223",
-            "type": "user-session",
-            "primary": "sshd"
-          }
-        },
-        "sequence": 44134,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "28750"
-      },
-      "source": {
-        "ip": "104.131.178.223"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "09OlUmcBTFzn_XoLvzre",
-    "source": {
-      "@timestamp": "2018-11-27T00:50:52.559Z",
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "28750",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "104.131.178.223"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "104.131.178.223"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "104.131.178.223",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44135
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "7NSvUmcBTFzn_XoL9Rog",
-    "source": {
-      "@timestamp": "2018-11-27T01:02:01.525Z",
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "25194",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "211.219.52.136"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "211.219.52.136"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184321,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "7dSvUmcBTFzn_XoL9Rog",
-    "source": {
-      "@timestamp": "2018-11-27T01:02:01.526Z",
-      "auditd": {
-        "sequence": 184322,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "211.219.52.136",
-            "type": "user-session"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "25194",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "source": {
-        "ip": "211.219.52.136"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "7tSvUmcBTFzn_XoL9Rog",
-    "source": {
-      "@timestamp": "2018-11-27T01:02:01.686Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "25194",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "211.219.52.136"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "211.219.52.136",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184323,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "211.219.52.136"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "btOsUmcBTFzn_XoLdc7t",
-    "source": {
-      "@timestamp": "2018-11-27T00:58:12.354Z",
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "19491",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "91.234.241.55"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "91.234.241.55",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142312,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "b9OsUmcBTFzn_XoLdc7t",
-    "source": {
-      "@timestamp": "2018-11-27T00:58:12.355Z",
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "19491"
-      },
-      "source": {
-        "ip": "91.234.241.55"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "91.234.241.55",
-            "type": "user-session",
-            "primary": "sshd"
-          }
-        },
-        "sequence": 142313,
-        "result": "fail",
-        "session": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "cNOsUmcBTFzn_XoLdc7t",
-    "source": {
-      "@timestamp": "2018-11-27T00:58:12.497Z",
-      "source": {
-        "ip": "91.234.241.55"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "91.234.241.55",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          }
-        },
-        "sequence": 142314,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "91.234.241.55"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "19491"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "VtOsUmcBTFzn_XoLGcfx",
-    "source": {
-      "@timestamp": "2018-11-27T00:57:48.807Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "19483",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "128.0.121.168"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 142309,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "128.0.121.168",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "V9OsUmcBTFzn_XoLGcfx",
-    "source": {
-      "@timestamp": "2018-11-27T00:57:48.808Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "19483",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "128.0.121.168"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "128.0.121.168",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 142310
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "WNOsUmcBTFzn_XoLGcfx",
-    "source": {
-      "@timestamp": "2018-11-27T00:57:48.917Z",
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "19483",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "128.0.121.168"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 142311,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "128.0.121.168",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "128.0.121.168",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "p9SvUmcBTFzn_XoLTQyw",
-    "source": {
-      "@timestamp": "2018-11-27T01:01:18.662Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "220.135.55.172",
-            "type": "user-session"
-          }
-        },
-        "sequence": 192458,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32763",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "220.135.55.172"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "qNSvUmcBTFzn_XoLTQyw",
-    "source": {
-      "@timestamp": "2018-11-27T01:01:18.663Z",
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "220.135.55.172",
-            "type": "user-session"
-          }
-        },
-        "sequence": 192459,
-        "result": "fail"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32763",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "source": {
-        "ip": "220.135.55.172"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "qdSvUmcBTFzn_XoLTQyw",
-    "source": {
-      "@timestamp": "2018-11-27T01:01:18.839Z",
-      "auditd": {
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "220.135.55.172"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "220.135.55.172"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192460,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32763",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "source": {
-        "ip": "220.135.55.172"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ztOuUmcBTFzn_XoLCvAK",
-    "source": {
-      "@timestamp": "2018-11-27T00:59:55.808Z",
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "19499",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "13.77.75.153"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "13.77.75.153",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142315
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "z9OuUmcBTFzn_XoLCvAK",
-    "source": {
-      "@timestamp": "2018-11-27T00:59:55.809Z",
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "19499"
-      },
-      "source": {
-        "ip": "13.77.75.153"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "13.77.75.153",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142316,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "0NOuUmcBTFzn_XoLCvAK",
-    "source": {
-      "@timestamp": "2018-11-27T00:59:55.852Z",
-      "process": {
-        "pid": "19499",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "13.77.75.153"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "13.77.75.153",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142317,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "13.77.75.153",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "59SwUmcBTFzn_XoLmSiw",
-    "source": {
-      "@timestamp": "2018-11-27T01:02:43.654Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 186290,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32075",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "6NSwUmcBTFzn_XoLmSiw",
-    "source": {
-      "@timestamp": "2018-11-27T01:02:43.655Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32075",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186291,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        }
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "6dSwUmcBTFzn_XoLmSiw",
-    "source": {
-      "@timestamp": "2018-11-27T01:02:43.688Z",
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32075",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "107.170.65.109",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "107.170.65.109",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186292,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ANSwUmcBTFzn_XoL0C7C",
-    "source": {
-      "@timestamp": "2018-11-27T01:02:57.752Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32082",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 186293,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "AdSwUmcBTFzn_XoL0C7C",
-    "source": {
-      "@timestamp": "2018-11-27T01:02:57.754Z",
-      "process": {
-        "pid": "32082",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "107.170.65.109",
-            "type": "user-session",
-            "primary": "sshd"
-          }
-        },
-        "sequence": 186294,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "AtSwUmcBTFzn_XoL0C7C",
-    "source": {
-      "@timestamp": "2018-11-27T01:02:57.784Z",
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32082"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "107.170.65.109",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "107.170.65.109",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186295
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "t9OuUmcBTFzn_XoLHfKW",
-    "source": {
-      "@timestamp": "2018-11-27T01:00:00.805Z",
-      "source": {
-        "ip": "178.128.127.228"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "178.128.127.228",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 44145,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "28933",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "uNOuUmcBTFzn_XoLHfKW",
-    "source": {
-      "@timestamp": "2018-11-27T01:00:00.809Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "28933",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "178.128.127.228"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44146,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "178.128.127.228",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "udOuUmcBTFzn_XoLHfKW",
-    "source": {
-      "@timestamp": "2018-11-27T01:00:01.001Z",
-      "auditd": {
-        "sequence": 44147,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "178.128.127.228"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "178.128.127.228",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "process": {
-        "pid": "28933",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "178.128.127.228"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "bNOtUmcBTFzn_XoL8u_M",
-    "source": {
-      "@timestamp": "2018-11-27T00:59:49.852Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "164.132.197.108",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44142,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "28930"
-      },
-      "source": {
-        "ip": "164.132.197.108"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "bdOtUmcBTFzn_XoL8u_M",
-    "source": {
-      "@timestamp": "2018-11-27T00:59:49.852Z",
-      "auditd": {
-        "sequence": 44143,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "164.132.197.108",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "28930",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "164.132.197.108"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "btOtUmcBTFzn_XoL8u_M",
-    "source": {
-      "@timestamp": "2018-11-27T00:59:49.964Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "28930",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "164.132.197.108"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44144,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "164.132.197.108",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "164.132.197.108"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ptS1UmcBTFzn_XoL0JuA",
-    "source": {
-      "@timestamp": "2018-11-27T01:08:25.366Z",
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "345"
-      },
-      "source": {
-        "ip": "5.186.77.221"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "5.186.77.221",
-            "type": "user-session"
-          }
-        },
-        "sequence": 192473
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "p9S1UmcBTFzn_XoL0JuA",
-    "source": {
-      "@timestamp": "2018-11-27T01:08:25.367Z",
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "beat": {
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192474,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "5.186.77.221"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "345"
-      },
-      "source": {
-        "ip": "5.186.77.221"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "qNS1UmcBTFzn_XoL0JuA",
-    "source": {
-      "@timestamp": "2018-11-27T01:08:25.506Z",
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "345"
-      },
-      "source": {
-        "ip": "5.186.77.221"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192475,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "5.186.77.221",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "object": {
-            "secondary": "5.186.77.221",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          }
-        }
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "-NS1UmcBTFzn_XoL2Jxv",
-    "source": {
-      "@timestamp": "2018-11-27T01:08:27.396Z",
-      "source": {
-        "ip": "24.37.251.196"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186326,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "24.37.251.196",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32127",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "-dS1UmcBTFzn_XoL2Jxv",
-    "source": {
-      "@timestamp": "2018-11-27T01:08:27.397Z",
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32127"
-      },
-      "source": {
-        "ip": "24.37.251.196"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "24.37.251.196",
-            "type": "user-session"
-          }
-        },
-        "sequence": 186327
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "-tS1UmcBTFzn_XoL2Jxv",
-    "source": {
-      "@timestamp": "2018-11-27T01:08:27.453Z",
-      "source": {
-        "ip": "24.37.251.196"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "24.37.251.196"
-        },
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "24.37.251.196",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 186328
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32127",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ydSzUmcBTFzn_XoLp2tF",
-    "source": {
-      "@timestamp": "2018-11-27T01:06:03.738Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "object": {
-            "secondary": "178.128.124.241",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          }
-        },
-        "sequence": 186311,
-        "result": "fail"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32108"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "178.128.124.241"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ytSzUmcBTFzn_XoLp2tF",
-    "source": {
-      "@timestamp": "2018-11-27T01:06:03.739Z",
-      "process": {
-        "pid": "32108",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "178.128.124.241"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "178.128.124.241",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186312,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "y9SzUmcBTFzn_XoLp2tF",
-    "source": {
-      "@timestamp": "2018-11-27T01:06:03.933Z",
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32108",
-        "exe": "/usr/sbin/sshd"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "178.128.124.241"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186313,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "178.128.124.241",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "object": {
-            "secondary": "178.128.124.241",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "UtSzUmcBTFzn_XoLrWwF",
-    "source": {
-      "@timestamp": "2018-11-27T01:06:05.210Z",
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32110"
-      },
-      "source": {
-        "ip": "191.92.71.194"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186314,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "191.92.71.194",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "U9SzUmcBTFzn_XoLrWwF",
-    "source": {
-      "@timestamp": "2018-11-27T01:06:05.211Z",
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32110"
-      },
-      "source": {
-        "ip": "191.92.71.194"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "191.92.71.194",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186315
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "VNSzUmcBTFzn_XoLrWwF",
-    "source": {
-      "@timestamp": "2018-11-27T01:06:05.347Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "191.92.71.194"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186316,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "191.92.71.194",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "191.92.71.194",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32110",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ztS0UmcBTFzn_XoLK3fA",
-    "source": {
-      "@timestamp": "2018-11-27T01:06:37.654Z",
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "327",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "source": {
-        "ip": "106.241.53.82"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192467,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "106.241.53.82"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "z9S0UmcBTFzn_XoLK3fA",
-    "source": {
-      "@timestamp": "2018-11-27T01:06:37.655Z",
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "beat": {
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "106.241.53.82",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192468,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "327",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "106.241.53.82"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "0NS0UmcBTFzn_XoLK3fA",
-    "source": {
-      "@timestamp": "2018-11-27T01:06:37.861Z",
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "327",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "106.241.53.82"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "106.241.53.82",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "106.241.53.82"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192469
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "k9S0UmcBTFzn_XoLPHgu",
-    "source": {
-      "@timestamp": "2018-11-27T01:06:41.860Z",
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "330"
-      },
-      "source": {
-        "ip": "170.210.88.50"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "170.210.88.50",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192470,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "lNS0UmcBTFzn_XoLPHgu",
-    "source": {
-      "@timestamp": "2018-11-27T01:06:41.861Z",
-      "auditd": {
-        "sequence": 192471,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "170.210.88.50",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "330",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "170.210.88.50"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ldS0UmcBTFzn_XoLPHgu",
-    "source": {
-      "@timestamp": "2018-11-27T01:06:42.073Z",
-      "beat": {
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "170.210.88.50",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "170.210.88.50",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192472,
-        "result": "fail"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "330",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "170.210.88.50"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "bdS1UmcBTFzn_XoLo5cq",
-    "source": {
-      "@timestamp": "2018-11-27T01:08:13.760Z",
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186323,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32125",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "btS1UmcBTFzn_XoLo5cq",
-    "source": {
-      "@timestamp": "2018-11-27T01:08:13.761Z",
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32125"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 186324
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "b9S1UmcBTFzn_XoLo5cq",
-    "source": {
-      "@timestamp": "2018-11-27T01:08:13.791Z",
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32125"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186325,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "107.170.65.109",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "c9S0UmcBTFzn_XoLsoI4",
-    "source": {
-      "@timestamp": "2018-11-27T01:07:12.077Z",
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 186320,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32117",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "dNS0UmcBTFzn_XoLsoI4",
-    "source": {
-      "@timestamp": "2018-11-27T01:07:12.079Z",
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "107.170.65.109",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186321,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "process": {
-        "pid": "32117",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ddS0UmcBTFzn_XoLsoI4",
-    "source": {
-      "@timestamp": "2018-11-27T01:07:12.110Z",
-      "auditd": {
-        "sequence": 186322,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "107.170.65.109",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        }
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32117",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "U9SzUmcBTFzn_XoLw27K",
-    "source": {
-      "@timestamp": "2018-11-27T01:06:11.040Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "sequence": 186317,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        }
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32112",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "VNSzUmcBTFzn_XoLw27K",
-    "source": {
-      "@timestamp": "2018-11-27T01:06:11.041Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186318,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32112",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "VdSzUmcBTFzn_XoLw27K",
-    "source": {
-      "@timestamp": "2018-11-27T01:06:11.071Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32112",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "107.170.65.109",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186319,
-        "result": "fail",
-        "session": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "o9S0UmcBTFzn_XoL1YXV",
-    "source": {
-      "@timestamp": "2018-11-27T01:07:21.191Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "104.234.223.14",
-            "type": "user-session"
-          }
-        },
-        "sequence": 44148,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "29074",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "source": {
-        "ip": "104.234.223.14"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "pNS0UmcBTFzn_XoL1YXV",
-    "source": {
-      "@timestamp": "2018-11-27T01:07:21.195Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "104.234.223.14",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 44149,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "29074",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "104.234.223.14"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "pdS0UmcBTFzn_XoL1YXV",
-    "source": {
-      "@timestamp": "2018-11-27T01:07:21.243Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "104.234.223.14",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "104.234.223.14"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44150
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "29074"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "source": {
-        "ip": "104.234.223.14"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "dtS2UmcBTFzn_XoLXqd2",
-    "source": {
-      "@timestamp": "2018-11-27T01:09:01.707Z",
-      "auditd": {
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "op": "PAM:accounting",
-          "acct": "root",
-          "terminal": "cron"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "cron"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 184324
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_acct",
-        "action": "was-authorized",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "25243",
-        "exe": "/usr/sbin/cron"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "d9S2UmcBTFzn_XoLXqd2",
-    "source": {
-      "@timestamp": "2018-11-27T01:09:01.708Z",
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "beat": {
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "action": "acquired-credentials",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "cred_acq"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "25243",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "cron",
-          "acct": "root",
-          "op": "PAM:setcred"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 184325,
-        "result": "success"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "eNS2UmcBTFzn_XoLXqd2",
-    "source": {
-      "@timestamp": "2018-11-27T01:09:01.710Z",
-      "process": {
-        "pid": "25243",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "sequence": 184327,
-        "result": "success",
-        "session": "9857",
-        "data": {
-          "terminal": "cron",
-          "op": "PAM:session_open",
-          "acct": "root"
-        },
-        "summary": {
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        }
-      },
-      "event": {
-        "action": "started-session",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_start"
-      },
-      "user": {
-        "auid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "edS2UmcBTFzn_XoLXqd2",
-    "source": {
-      "@timestamp": "2018-11-27T01:09:01.806Z",
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "cred_disp",
-        "action": "disposed-credentials"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "auid": "0"
-      },
-      "process": {
-        "pid": "25243",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "cron"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 184328,
-        "result": "success",
-        "session": "9857",
-        "data": {
-          "terminal": "cron",
-          "op": "PAM:setcred",
-          "acct": "root"
-        }
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "etS2UmcBTFzn_XoLXqd2",
-    "source": {
-      "@timestamp": "2018-11-27T01:09:01.808Z",
-      "beat": {
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_end",
-        "action": "ended-session",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "0",
-        "name_map": {
-          "uid": "root",
-          "auid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "25243",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "sequence": 184329,
-        "result": "success",
-        "session": "9857",
-        "data": {
-          "terminal": "cron",
-          "acct": "root",
-          "op": "PAM:session_close"
-        },
-        "summary": {
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "secondary": "root",
-            "primary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          }
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "t9S2UmcBTFzn_XoLX6cl",
-    "source": {
-      "@timestamp": "2018-11-27T01:09:01.883Z",
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "type": "user_acct",
-        "action": "was-authorized",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "348",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "sequence": 192476,
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "op": "PAM:accounting",
-          "acct": "root",
-          "terminal": "cron"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "uNS2UmcBTFzn_XoLX6cl",
-    "source": {
-      "@timestamp": "2018-11-27T01:09:01.884Z",
-      "event": {
-        "type": "cred_acq",
-        "action": "acquired-credentials",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "348",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "sequence": 192477,
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "op": "PAM:setcred",
-          "acct": "root",
-          "terminal": "cron"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "cron"
-          },
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          }
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "udS2UmcBTFzn_XoLX6cl",
-    "source": {
-      "@timestamp": "2018-11-27T01:09:01.885Z",
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "cron"
-          }
-        },
-        "sequence": 192479,
-        "result": "success",
-        "session": "9861",
-        "data": {
-          "terminal": "cron",
-          "op": "PAM:session_open",
-          "acct": "root"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_start",
-        "action": "started-session",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "348",
-        "exe": "/usr/sbin/cron"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "utS2UmcBTFzn_XoLX6cl",
-    "source": {
-      "@timestamp": "2018-11-27T01:09:01.981Z",
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 192480,
-        "result": "success",
-        "session": "9861",
-        "data": {
-          "op": "PAM:setcred",
-          "terminal": "cron",
-          "acct": "root"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "cred_disp",
-        "action": "disposed-credentials",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "348",
-        "exe": "/usr/sbin/cron"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "u9S2UmcBTFzn_XoLX6cl",
-    "source": {
-      "@timestamp": "2018-11-27T01:09:01.982Z",
-      "event": {
-        "type": "user_end",
-        "action": "ended-session",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "0",
-        "uid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "348",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "session": "9861",
-        "data": {
-          "terminal": "cron",
-          "op": "PAM:session_close",
-          "acct": "root"
-        },
-        "summary": {
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "secondary": "root",
-            "primary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "cron"
-          }
-        },
-        "sequence": 192481,
-        "result": "success"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ItS2UmcBTFzn_XoLBKBn",
-    "source": {
-      "@timestamp": "2018-11-27T01:08:38.649Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "178.33.228.67",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44151,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "29096",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "178.33.228.67"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "I9S2UmcBTFzn_XoLBKBn",
-    "source": {
-      "@timestamp": "2018-11-27T01:08:38.649Z",
-      "source": {
-        "ip": "178.33.228.67"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "178.33.228.67",
-            "type": "user-session"
-          }
-        },
-        "sequence": 44152
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "29096",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "JNS2UmcBTFzn_XoLBKBn",
-    "source": {
-      "@timestamp": "2018-11-27T01:08:38.757Z",
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "29096",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "178.33.228.67"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "ssh",
-          "hostname": "178.33.228.67",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "178.33.228.67",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44153,
-        "result": "fail",
-        "session": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "LNS4UmcBTFzn_XoLIM6c",
-    "source": {
-      "@timestamp": "2018-11-27T01:10:56.938Z",
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 184333,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "91.230.8.194"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "91.230.8.194"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "25299",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "91.230.8.194"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "2NS4UmcBTFzn_XoLMc9n",
-    "source": {
-      "@timestamp": "2018-11-27T01:11:01.244Z",
-      "process": {
-        "pid": "29148",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "85.234.34.92"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "85.234.34.92",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44158,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "2dS4UmcBTFzn_XoLMc9n",
-    "source": {
-      "@timestamp": "2018-11-27T01:11:01.244Z",
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "29148",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "source": {
-        "ip": "85.234.34.92"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "85.234.34.92"
-          }
-        },
-        "sequence": 44159,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "2tS4UmcBTFzn_XoLMc9n",
-    "source": {
-      "@timestamp": "2018-11-27T01:11:01.400Z",
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "29148"
-      },
-      "source": {
-        "ip": "85.234.34.92"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44160,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "85.234.34.92",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "85.234.34.92"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "beat": {
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ctS3UmcBTFzn_XoLgcD-",
-    "source": {
-      "@timestamp": "2018-11-27T01:10:16.337Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "79.137.64.132",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186333,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32141",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "79.137.64.132"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "c9S3UmcBTFzn_XoLgcD-",
-    "source": {
-      "@timestamp": "2018-11-27T01:10:16.339Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "79.137.64.132"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186334,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "79.137.64.132",
-            "type": "user-session"
-          }
-        }
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32141"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "dNS3UmcBTFzn_XoLgcD-",
-    "source": {
-      "@timestamp": "2018-11-27T01:10:16.445Z",
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "79.137.64.132"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186335,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "79.137.64.132",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "79.137.64.132",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32141",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "u9S3UmcBTFzn_XoLh8GC",
-    "source": {
-      "@timestamp": "2018-11-27T01:10:17.752Z",
-      "auditd": {
-        "data": {
-          "hostname": "107.170.65.109",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "107.170.65.109",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186336,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32148",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Z9S2UmcBTFzn_XoLtK-X",
-    "source": {
-      "@timestamp": "2018-11-27T01:09:23.757Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192482,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "109.202.18.235",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "process": {
-        "pid": "397",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "109.202.18.235"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "aNS2UmcBTFzn_XoLtK-X",
-    "source": {
-      "@timestamp": "2018-11-27T01:09:23.758Z",
-      "process": {
-        "pid": "397",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "109.202.18.235"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "109.202.18.235",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192483,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "adS2UmcBTFzn_XoLtK-X",
-    "source": {
-      "@timestamp": "2018-11-27T01:09:23.948Z",
-      "source": {
-        "ip": "109.202.18.235"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192484,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "109.202.18.235",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "109.202.18.235"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "397"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "BdS4UmcBTFzn_XoLFs5k",
-    "source": {
-      "@timestamp": "2018-11-27T01:10:54.329Z",
-      "auditd": {
-        "sequence": 184330,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "188.68.54.39",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "25297",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "188.68.54.39"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "BtS4UmcBTFzn_XoLFs5k",
-    "source": {
-      "@timestamp": "2018-11-27T01:10:54.330Z",
-      "auditd": {
-        "sequence": 184331,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "188.68.54.39",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        }
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "25297",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "188.68.54.39"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "B9S4UmcBTFzn_XoLFs5k",
-    "source": {
-      "@timestamp": "2018-11-27T01:10:54.443Z",
-      "source": {
-        "ip": "188.68.54.39"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 184332,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "188.68.54.39",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "188.68.54.39",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "25297",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "F9S2UmcBTFzn_XoLf6s6",
-    "source": {
-      "@timestamp": "2018-11-27T01:09:10.091Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "46.148.18.163",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186329
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32135",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "46.148.18.163"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "GNS2UmcBTFzn_XoLf6s6",
-    "source": {
-      "@timestamp": "2018-11-27T01:09:10.092Z",
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32135",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "46.148.18.163"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "46.148.18.163",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186330,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "GdS2UmcBTFzn_XoLf6s6",
-    "source": {
-      "@timestamp": "2018-11-27T01:09:10.235Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32135"
-      },
-      "source": {
-        "ip": "46.148.18.163"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "46.148.18.163"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "46.148.18.163",
-            "type": "user-session"
-          }
-        },
-        "sequence": 186331,
-        "result": "fail",
-        "session": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "l9S2UmcBTFzn_XoLxbHN",
-    "source": {
-      "@timestamp": "2018-11-27T01:09:28.162Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "399",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "103.68.38.86"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192485,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "103.68.38.86",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "mNS2UmcBTFzn_XoLxbHN",
-    "source": {
-      "@timestamp": "2018-11-27T01:09:28.163Z",
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "103.68.38.86"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192486
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "399"
-      },
-      "source": {
-        "ip": "103.68.38.86"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "mdS2UmcBTFzn_XoLxbHN",
-    "source": {
-      "@timestamp": "2018-11-27T01:09:28.435Z",
-      "auditd": {
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "103.68.38.86",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 192487,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "103.68.38.86",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "399",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "source": {
-        "ip": "103.68.38.86"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "KdS3UmcBTFzn_XoL-8sa",
-    "source": {
-      "@timestamp": "2018-11-27T01:10:47.311Z",
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "29142",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "51.38.37.69"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44155,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "51.38.37.69",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "KtS3UmcBTFzn_XoL-8sa",
-    "source": {
-      "@timestamp": "2018-11-27T01:10:47.315Z",
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "29142",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "51.38.37.69"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "51.38.37.69",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44156,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "K9S3UmcBTFzn_XoL-8sa",
-    "source": {
-      "@timestamp": "2018-11-27T01:10:47.419Z",
-      "auditd": {
-        "data": {
-          "terminal": "ssh",
-          "hostname": "51.38.37.69",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "51.38.37.69"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44157,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "29142"
-      },
-      "source": {
-        "ip": "51.38.37.69"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "itS2UmcBTFzn_XoLlayd",
-    "source": {
-      "@timestamp": "2018-11-27T01:09:15.827Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32137",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "107.170.65.109",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 186332
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "I9S3UmcBTFzn_XoLlcLB",
-    "source": {
-      "@timestamp": "2018-11-27T01:10:21.397Z",
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "process": {
-        "pid": "29135",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "142.93.31.198"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "142.93.31.198"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "142.93.31.198",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44154,
-        "result": "fail"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "PdW9UmcBTFzn_XoLr0tl",
-    "source": {
-      "@timestamp": "2018-11-27T01:17:01.176Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/cron",
-        "pid": "29271"
-      },
-      "auditd": {
-        "sequence": 44173,
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "op": "PAM:accounting",
-          "acct": "root",
-          "terminal": "cron"
-        },
-        "summary": {
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          }
-        }
-      },
-      "event": {
-        "type": "user_acct",
-        "action": "was-authorized",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "beat": {
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "PtW9UmcBTFzn_XoLr0tl",
-    "source": {
-      "@timestamp": "2018-11-27T01:17:01.176Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "29271",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "cron"
-          },
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 44174,
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "acct": "root",
-          "op": "PAM:setcred",
-          "terminal": "cron"
-        }
-      },
-      "event": {
-        "type": "cred_acq",
-        "action": "acquired-credentials",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "P9W9UmcBTFzn_XoLr0tl",
-    "source": {
-      "@timestamp": "2018-11-27T01:17:01.180Z",
-      "process": {
-        "pid": "29271",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "sequence": 44176,
-        "result": "success",
-        "session": "1444",
-        "data": {
-          "op": "PAM:session_open",
-          "terminal": "cron",
-          "acct": "root"
-        },
-        "summary": {
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        }
-      },
-      "event": {
-        "type": "user_start",
-        "action": "started-session",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "auid": "0"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "QNW9UmcBTFzn_XoLr0tl",
-    "source": {
-      "@timestamp": "2018-11-27T01:17:01.180Z",
-      "process": {
-        "pid": "29271",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "sequence": 44177,
-        "result": "success",
-        "session": "1444",
-        "data": {
-          "op": "PAM:setcred",
-          "acct": "root",
-          "terminal": "cron"
-        },
-        "summary": {
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "action": "disposed-credentials",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "cred_disp"
-      },
-      "user": {
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "QdW9UmcBTFzn_XoLr0tl",
-    "source": {
-      "@timestamp": "2018-11-27T01:17:01.180Z",
-      "user": {
-        "auid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "29271",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "sequence": 44178,
-        "result": "success",
-        "session": "1444",
-        "data": {
-          "op": "PAM:session_close",
-          "acct": "root",
-          "terminal": "cron"
-        },
-        "summary": {
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "secondary": "root",
-            "primary": "root"
-          }
-        }
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_end",
-        "action": "ended-session"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "QtW9UmcBTFzn_XoLr0ty",
-    "source": {
-      "@timestamp": "2018-11-27T01:17:01.191Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_acct",
-        "action": "was-authorized",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "19593",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "cron"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 142321,
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "acct": "root",
-          "op": "PAM:accounting",
-          "terminal": "cron"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Q9W9UmcBTFzn_XoLr0ty",
-    "source": {
-      "@timestamp": "2018-11-27T01:17:01.191Z",
-      "process": {
-        "pid": "19593",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "cron",
-          "op": "PAM:setcred",
-          "acct": "root"
-        },
-        "summary": {
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          }
-        },
-        "sequence": 142322,
-        "result": "success",
-        "session": "unset"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "action": "acquired-credentials",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "cred_acq"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "RNW9UmcBTFzn_XoLr0ty",
-    "source": {
-      "@timestamp": "2018-11-27T01:17:01.193Z",
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_start",
-        "action": "started-session"
-      },
-      "user": {
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "0"
-      },
-      "process": {
-        "pid": "19593",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "sequence": 142324,
-        "result": "success",
-        "session": "3503",
-        "data": {
-          "acct": "root",
-          "terminal": "cron",
-          "op": "PAM:session_open"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "RdW9UmcBTFzn_XoLr0ty",
-    "source": {
-      "@timestamp": "2018-11-27T01:17:01.196Z",
-      "user": {
-        "auid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "19593",
-        "exe": "/usr/sbin/cron"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 142325,
-        "result": "success",
-        "session": "3503",
-        "data": {
-          "acct": "root",
-          "terminal": "cron",
-          "op": "PAM:setcred"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "cred_disp",
-        "action": "disposed-credentials",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "RtW9UmcBTFzn_XoLr0ty",
-    "source": {
-      "@timestamp": "2018-11-27T01:17:01.196Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_end",
-        "action": "ended-session",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "19593",
-        "exe": "/usr/sbin/cron"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "auditd": {
-        "data": {
-          "op": "PAM:session_close",
-          "terminal": "cron",
-          "acct": "root"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "cron"
-          },
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          }
-        },
-        "sequence": 142326,
-        "result": "success",
-        "session": "3503"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "WdW9UmcBTFzn_XoLr0uP",
-    "source": {
-      "@timestamp": "2018-11-27T01:17:01.214Z",
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "process": {
-        "pid": "12641",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "cron",
-          "op": "PAM:accounting",
-          "acct": "root"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 43155,
-        "result": "success",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_acct",
-        "action": "was-authorized",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "WtW9UmcBTFzn_XoLr0uP",
-    "source": {
-      "@timestamp": "2018-11-27T01:17:01.214Z",
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "12641",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "op": "PAM:setcred",
-          "terminal": "cron",
-          "acct": "root"
-        },
-        "summary": {
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          }
-        },
-        "sequence": 43156
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "cred_acq",
-        "action": "acquired-credentials"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "W9W9UmcBTFzn_XoLr0uP",
-    "source": {
-      "@timestamp": "2018-11-27T01:17:01.218Z",
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_start",
-        "action": "started-session",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "0",
-        "uid": "0",
-        "name_map": {
-          "uid": "root",
-          "auid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/cron",
-        "pid": "12641"
-      },
-      "auditd": {
-        "data": {
-          "op": "PAM:session_open",
-          "terminal": "cron",
-          "acct": "root"
-        },
-        "summary": {
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 43158,
-        "result": "success",
-        "session": "1252"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "XNW9UmcBTFzn_XoLr0uP",
-    "source": {
-      "@timestamp": "2018-11-27T01:17:01.218Z",
-      "auditd": {
-        "sequence": 43159,
-        "result": "success",
-        "session": "1252",
-        "data": {
-          "terminal": "cron",
-          "acct": "root",
-          "op": "PAM:setcred"
-        },
-        "summary": {
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        }
-      },
-      "beat": {
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "cred_disp",
-        "action": "disposed-credentials"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "12641",
-        "exe": "/usr/sbin/cron"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "XdW9UmcBTFzn_XoLr0uP",
-    "source": {
-      "@timestamp": "2018-11-27T01:17:01.222Z",
-      "process": {
-        "pid": "12641",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "session": "1252",
-        "data": {
-          "terminal": "cron",
-          "op": "PAM:session_close",
-          "acct": "root"
-        },
-        "summary": {
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 43160,
-        "result": "success"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "action": "ended-session",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_end"
-      },
-      "user": {
-        "auid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "adW9UmcBTFzn_XoLsUvf",
-    "source": {
-      "@timestamp": "2018-11-27T01:17:01.812Z",
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_acct",
-        "action": "was-authorized"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "process": {
-        "pid": "25339",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "sequence": 184337,
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "op": "PAM:accounting",
-          "terminal": "cron",
-          "acct": "root"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "atW9UmcBTFzn_XoLsUvf",
-    "source": {
-      "@timestamp": "2018-11-27T01:17:01.813Z",
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "action": "acquired-credentials",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "cred_acq"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "25339",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 184338,
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "acct": "root",
-          "op": "PAM:setcred",
-          "terminal": "cron"
-        }
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "a9W9UmcBTFzn_XoLsUvf",
-    "source": {
-      "@timestamp": "2018-11-27T01:17:01.814Z",
-      "user": {
-        "auid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "25339",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "cron",
-          "op": "PAM:session_open",
-          "acct": "root"
-        },
-        "summary": {
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          }
-        },
-        "sequence": 184340,
-        "result": "success",
-        "session": "9858"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_start",
-        "action": "started-session"
-      },
-      "beat": {
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "bNW9UmcBTFzn_XoLsUvf",
-    "source": {
-      "@timestamp": "2018-11-27T01:17:01.817Z",
-      "process": {
-        "pid": "25339",
-        "exe": "/usr/sbin/cron"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "auditd": {
-        "result": "success",
-        "session": "9858",
-        "data": {
-          "acct": "root",
-          "terminal": "cron",
-          "op": "PAM:setcred"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 184341
-      },
-      "event": {
-        "type": "cred_disp",
-        "action": "disposed-credentials",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "auid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "bdW9UmcBTFzn_XoLsUvf",
-    "source": {
-      "@timestamp": "2018-11-27T01:17:01.818Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_end",
-        "action": "ended-session",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "auid": "0",
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/cron",
-        "pid": "25339"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 184342,
-        "result": "success",
-        "session": "9858",
-        "data": {
-          "acct": "root",
-          "op": "PAM:session_close",
-          "terminal": "cron"
-        }
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "beat": {
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "a9W-UmcBTFzn_XoL5GZq",
-    "source": {
-      "@timestamp": "2018-11-27T01:18:20.287Z",
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "19602",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "209.59.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "209.59.65.109"
-          }
-        },
-        "sequence": 142327,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "bNW-UmcBTFzn_XoL5GZq",
-    "source": {
-      "@timestamp": "2018-11-27T01:18:20.288Z",
-      "source": {
-        "ip": "209.59.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 142328,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "209.59.65.109"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "19602",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "bdW-UmcBTFzn_XoL5GZq",
-    "source": {
-      "@timestamp": "2018-11-27T01:18:20.382Z",
-      "auditd": {
-        "sequence": 142329,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "209.59.65.109",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "209.59.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "19602",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "209.59.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "h9W-UmcBTFzn_XoL6WZS",
-    "source": {
-      "@timestamp": "2018-11-27T01:18:21.543Z",
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "source": {
-        "ip": "95.156.31.74"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "95.156.31.74"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142330,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "19604",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "iNW-UmcBTFzn_XoL6WZS",
-    "source": {
-      "@timestamp": "2018-11-27T01:18:21.545Z",
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "19604",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "95.156.31.74"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 142331,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "95.156.31.74",
-            "type": "user-session",
-            "primary": "sshd"
-          }
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "idW-UmcBTFzn_XoL6WZS",
-    "source": {
-      "@timestamp": "2018-11-27T01:18:21.689Z",
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "19604",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "source": {
-        "ip": "95.156.31.74"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "95.156.31.74"
-        },
-        "summary": {
-          "object": {
-            "secondary": "95.156.31.74",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 142332
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "39W_UmcBTFzn_XoLD2nn",
-    "source": {
-      "@timestamp": "2018-11-27T01:18:31.420Z",
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32215",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 186386,
-        "result": "fail"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "4NW_UmcBTFzn_XoLD2nn",
-    "source": {
-      "@timestamp": "2018-11-27T01:18:31.421Z",
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32215",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186387,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "4dW_UmcBTFzn_XoLD2nn",
-    "source": {
-      "@timestamp": "2018-11-27T01:18:31.453Z",
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32215"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "107.170.65.109"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186388,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "adW_UmcBTFzn_XoLeXOw",
-    "source": {
-      "@timestamp": "2018-11-27T01:18:58.502Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32217",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "46.148.18.163"
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186389,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "46.148.18.163",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "atW_UmcBTFzn_XoLeXOw",
-    "source": {
-      "@timestamp": "2018-11-27T01:18:58.503Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "secondary": "46.148.18.163",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 186390,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32217",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "46.148.18.163"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "a9W_UmcBTFzn_XoLeXOw",
-    "source": {
-      "@timestamp": "2018-11-27T01:18:58.645Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32217",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "46.148.18.163"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "46.148.18.163"
-        },
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "46.148.18.163",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 186391,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ctW-UmcBTFzn_XoLJVU7",
-    "source": {
-      "@timestamp": "2018-11-27T01:17:31.345Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32207",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186383,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "c9W-UmcBTFzn_XoLJVU7",
-    "source": {
-      "@timestamp": "2018-11-27T01:17:31.346Z",
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32207",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186384,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "dNW-UmcBTFzn_XoLJVU7",
-    "source": {
-      "@timestamp": "2018-11-27T01:17:31.378Z",
-      "process": {
-        "pid": "32207",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186385,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "107.170.65.109",
-          "op": "PAM:bad_ident"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "rdW9UmcBTFzn_XoLfkeK",
-    "source": {
-      "@timestamp": "2018-11-27T01:16:48.669Z",
-      "source": {
-        "ip": "115.146.127.132"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "115.146.127.132",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43152,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "12639",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "rtW9UmcBTFzn_XoLfkeK",
-    "source": {
-      "@timestamp": "2018-11-27T01:16:48.669Z",
-      "auditd": {
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "115.146.127.132",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 43153,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "12639",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "115.146.127.132"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "r9W9UmcBTFzn_XoLfkeK",
-    "source": {
-      "@timestamp": "2018-11-27T01:16:48.873Z",
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "beat": {
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 43154,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "115.146.127.132",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "115.146.127.132"
-          }
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "12639",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "115.146.127.132"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "y9W9UmcBTFzn_XoLUUI6",
-    "source": {
-      "@timestamp": "2018-11-27T01:16:37.072Z",
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32202"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186374,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "zNW9UmcBTFzn_XoLUUI6",
-    "source": {
-      "@timestamp": "2018-11-27T01:16:37.073Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32202"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186375,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "zdW9UmcBTFzn_XoLUUI6",
-    "source": {
-      "@timestamp": "2018-11-27T01:16:37.104Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186376,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "107.170.65.109",
-          "op": "PAM:bad_ident"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32202"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "btW9UmcBTFzn_XoLskuL",
-    "source": {
-      "@timestamp": "2018-11-27T01:17:01.885Z",
-      "auditd": {
-        "data": {
-          "op": "PAM:accounting",
-          "terminal": "cron",
-          "acct": "root"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 186377,
-        "result": "success",
-        "session": "unset"
-      },
-      "event": {
-        "type": "user_acct",
-        "action": "was-authorized",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "process": {
-        "pid": "32204",
-        "exe": "/usr/sbin/cron"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "b9W9UmcBTFzn_XoLskuL",
-    "source": {
-      "@timestamp": "2018-11-27T01:17:01.886Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/cron",
-        "pid": "32204"
-      },
-      "auditd": {
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "op": "PAM:setcred",
-          "acct": "root",
-          "terminal": "cron"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 186378
-      },
-      "event": {
-        "category": "user-login",
-        "type": "cred_acq",
-        "action": "acquired-credentials",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "cNW9UmcBTFzn_XoLskuL",
-    "source": {
-      "@timestamp": "2018-11-27T01:17:01.887Z",
-      "auditd": {
-        "summary": {
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "secondary": "root",
-            "primary": "root"
-          }
-        },
-        "sequence": 186380,
-        "result": "success",
-        "session": "3511",
-        "data": {
-          "acct": "root",
-          "terminal": "cron",
-          "op": "PAM:session_open"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_start",
-        "action": "started-session",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "0"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "process": {
-        "pid": "32204",
-        "exe": "/usr/sbin/cron"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "cdW9UmcBTFzn_XoLskuL",
-    "source": {
-      "@timestamp": "2018-11-27T01:17:01.890Z",
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "type": "cred_disp",
-        "action": "disposed-credentials",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32204",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "sequence": 186381,
-        "result": "success",
-        "session": "3511",
-        "data": {
-          "op": "PAM:setcred",
-          "terminal": "cron",
-          "acct": "root"
-        },
-        "summary": {
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ctW9UmcBTFzn_XoLskuL",
-    "source": {
-      "@timestamp": "2018-11-27T01:17:01.891Z",
-      "process": {
-        "pid": "32204",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "data": {
-          "acct": "root",
-          "op": "PAM:session_close",
-          "terminal": "cron"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 186382,
-        "result": "success",
-        "session": "3511"
-      },
-      "event": {
-        "type": "user_end",
-        "action": "ended-session",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "auid": "0",
-        "uid": "0"
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "c9W9UmcBTFzn_XoLskuR",
-    "source": {
-      "@timestamp": "2018-11-27T01:17:01.987Z",
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/cron",
-        "pid": "458"
-      },
-      "auditd": {
-        "summary": {
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          }
-        },
-        "sequence": 192494,
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "op": "PAM:accounting",
-          "acct": "root",
-          "terminal": "cron"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_acct",
-        "action": "was-authorized"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "dNW9UmcBTFzn_XoLskuR",
-    "source": {
-      "@timestamp": "2018-11-27T01:17:01.988Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "458",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "sequence": 192495,
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "terminal": "cron",
-          "acct": "root",
-          "op": "PAM:setcred"
-        },
-        "summary": {
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "cron"
-          }
-        }
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "beat": {
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "type": "cred_acq",
-        "action": "acquired-credentials",
-        "module": "auditd",
-        "category": "user-login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ddW9UmcBTFzn_XoLskuR",
-    "source": {
-      "@timestamp": "2018-11-27T01:17:01.989Z",
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_start",
-        "action": "started-session",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "458",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "session": "9862",
-        "data": {
-          "terminal": "cron",
-          "acct": "root",
-          "op": "PAM:session_open"
-        },
-        "summary": {
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "secondary": "root",
-            "primary": "root"
-          }
-        },
-        "sequence": 192497,
-        "result": "success"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "dtW9UmcBTFzn_XoLskuR",
-    "source": {
-      "@timestamp": "2018-11-27T01:17:01.992Z",
-      "event": {
-        "category": "user-login",
-        "type": "cred_disp",
-        "action": "disposed-credentials",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "0"
-      },
-      "process": {
-        "pid": "458",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "session": "9862",
-        "data": {
-          "acct": "root",
-          "op": "PAM:setcred",
-          "terminal": "cron"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 192498,
-        "result": "success"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "d9W9UmcBTFzn_XoLskuR",
-    "source": {
-      "@timestamp": "2018-11-27T01:17:01.993Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_end",
-        "action": "ended-session",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "auid": "0",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "458",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "summary": {
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          }
-        },
-        "sequence": 192499,
-        "result": "success",
-        "session": "9862",
-        "data": {
-          "terminal": "cron",
-          "acct": "root",
-          "op": "PAM:session_close"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "p9W_UmcBTFzn_XoLs3cF",
-    "source": {
-      "@timestamp": "2018-11-27T01:19:13.179Z",
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "module": "file_integrity",
-        "action": [
-          "created"
-        ]
-      },
-      "file": {
-        "uid": 0,
-        "owner": "root",
-        "inode": "121",
-        "mtime": "2018-11-27T01:19:13.174Z",
-        "size": 20,
-        "type": "file",
-        "gid": 0,
-        "mode": "0000",
-        "path": "/etc/sed4Tvfpv",
-        "ctime": "2018-11-27T01:19:13.174Z",
-        "group": "root"
-      },
-      "hash": {
-        "sha1": "c7f9a550b77ece79052aa1a630098b911883abde"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "qNW_UmcBTFzn_XoLs3cF",
-    "source": {
-      "@timestamp": "2018-11-27T01:19:13.180Z",
-      "event": {
-        "module": "file_integrity",
-        "action": [
-          "updated"
-        ]
-      },
-      "file": {
-        "group": "root",
-        "inode": "121",
-        "gid": 0,
-        "type": "file",
-        "mtime": "2018-11-27T01:19:13.178Z",
-        "ctime": "2018-11-27T01:19:13.178Z",
-        "uid": 0,
-        "mode": "0000",
-        "owner": "root",
-        "path": "/etc/sed4Tvfpv",
-        "size": 51
-      },
-      "hash": {
-        "sha1": "4dac5cd40b12d209e8a87bf8089fadab9edfca00"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "qdW_UmcBTFzn_XoLs3cF",
-    "source": {
-      "@timestamp": "2018-11-27T01:19:13.187Z",
-      "file": {
-        "path": "/etc/sed4Tvfpv"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "module": "file_integrity",
-        "action": [
-          "attributes_modified"
-        ]
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "qtW_UmcBTFzn_XoLs3cF",
-    "source": {
-      "@timestamp": "2018-11-27T01:19:13.188Z",
-      "event": {
-        "action": [
-          "moved"
-        ],
-        "module": "file_integrity"
-      },
-      "file": {
-        "path": "/etc/sed4Tvfpv"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "q9W_UmcBTFzn_XoLs3cF",
-    "source": {
-      "@timestamp": "2018-11-27T01:19:13.195Z",
-      "event": {
-        "module": "file_integrity",
-        "action": [
-          "created"
-        ]
-      },
-      "file": {
-        "type": "file",
-        "owner": "root",
-        "mtime": "2018-11-27T01:19:13.178Z",
-        "ctime": "2018-11-27T01:19:13.178Z",
-        "group": "root",
-        "path": "/etc/hosts",
-        "gid": 0,
-        "uid": 0,
-        "inode": "121",
-        "mode": "0644",
-        "size": 209
-      },
-      "hash": {
-        "sha1": "ac0139feba2533b2670370c22551547341fde295"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "XNbJUmcBTFzn_XoL6leU",
-    "source": {
-      "@timestamp": "2018-11-27T01:30:22.705Z",
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "25784",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "152.245.204.82"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "152.245.204.82",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 184359
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "XdbJUmcBTFzn_XoL6leU",
-    "source": {
-      "@timestamp": "2018-11-27T01:30:22.707Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "25784",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "152.245.204.82"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "152.245.204.82",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184360,
-        "result": "fail"
-      },
-      "beat": {
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "XtbJUmcBTFzn_XoL6leU",
-    "source": {
-      "@timestamp": "2018-11-27T01:30:22.717Z",
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "25783"
-      },
-      "source": {
-        "ip": "152.245.204.82"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 184361,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "152.245.204.82",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "X9bJUmcBTFzn_XoL6leU",
-    "source": {
-      "@timestamp": "2018-11-27T01:30:22.719Z",
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "auditd": {
-        "sequence": 184362,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "152.245.204.82"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "25783",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "152.245.204.82"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "YNbJUmcBTFzn_XoL6leU",
-    "source": {
-      "@timestamp": "2018-11-27T01:30:22.897Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "25784",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "152.245.204.82"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "hostname": "152.245.204.82",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "152.245.204.82",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184363,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "YdbJUmcBTFzn_XoL6leU",
-    "source": {
-      "@timestamp": "2018-11-27T01:30:22.918Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "152.245.204.82"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "152.245.204.82"
-          }
-        },
-        "sequence": 184364
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "25783"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "source": {
-        "ip": "152.245.204.82"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "DNbKUmcBTFzn_XoLGlxF",
-    "source": {
-      "@timestamp": "2018-11-27T01:30:34.971Z",
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32299",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "107.170.65.109",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186434
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "DdbKUmcBTFzn_XoLGlxF",
-    "source": {
-      "@timestamp": "2018-11-27T01:30:34.972Z",
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32299"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186435,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "DtbKUmcBTFzn_XoLGlxF",
-    "source": {
-      "@timestamp": "2018-11-27T01:30:35.002Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32299",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186436,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "107.170.65.109",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "107.170.65.109"
-          }
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "r9bJUmcBTFzn_XoLAkOP",
-    "source": {
-      "@timestamp": "2018-11-27T01:29:23.365Z",
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32290",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186431,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "107.170.65.109",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "sNbJUmcBTFzn_XoLAkOP",
-    "source": {
-      "@timestamp": "2018-11-27T01:29:23.366Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32290"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186432
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "sdbJUmcBTFzn_XoLAkOP",
-    "source": {
-      "@timestamp": "2018-11-27T01:29:23.397Z",
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186433,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "107.170.65.109",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32290"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "KtbLUmcBTFzn_XoLIXLc",
-    "source": {
-      "@timestamp": "2018-11-27T01:31:42.449Z",
-      "auditd": {
-        "sequence": 186437,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32307",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "K9bLUmcBTFzn_XoLIXLc",
-    "source": {
-      "@timestamp": "2018-11-27T01:31:42.450Z",
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32307"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 186438,
-        "result": "fail",
-        "session": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "LNbLUmcBTFzn_XoLIXLc",
-    "source": {
-      "@timestamp": "2018-11-27T01:31:42.481Z",
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32307"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186439,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "107.170.65.109"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          }
-        }
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "udbLUmcBTFzn_XoLfHlZ",
-    "source": {
-      "@timestamp": "2018-11-27T01:32:05.615Z",
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "173.167.200.227",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192532,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "562"
-      },
-      "source": {
-        "ip": "173.167.200.227"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "utbLUmcBTFzn_XoLfHlZ",
-    "source": {
-      "@timestamp": "2018-11-27T01:32:05.616Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "562"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "source": {
-        "ip": "173.167.200.227"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192533,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "173.167.200.227"
-          }
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "u9bLUmcBTFzn_XoLfHlZ",
-    "source": {
-      "@timestamp": "2018-11-27T01:32:05.661Z",
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "562",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "173.167.200.227"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "hostname": "173.167.200.227",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "173.167.200.227",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192534,
-        "result": "fail"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "KtbJUmcBTFzn_XoLK0dG",
-    "source": {
-      "@timestamp": "2018-11-27T01:29:33.789Z",
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "548",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "138.68.50.250"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "138.68.50.250",
-            "type": "user-session"
-          }
-        },
-        "sequence": 192529,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        }
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "K9bJUmcBTFzn_XoLK0dG",
-    "source": {
-      "@timestamp": "2018-11-27T01:29:33.789Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "548"
-      },
-      "source": {
-        "ip": "138.68.50.250"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192530,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "138.68.50.250"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "LNbJUmcBTFzn_XoLK0dG",
-    "source": {
-      "@timestamp": "2018-11-27T01:29:33.830Z",
-      "auditd": {
-        "sequence": 192531,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "138.68.50.250",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "138.68.50.250",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "548",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "138.68.50.250"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ZtbKUmcBTFzn_XoLRF8K",
-    "source": {
-      "@timestamp": "2018-11-27T01:30:45.664Z",
-      "process": {
-        "pid": "29595",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "138.68.249.156"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44189,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "138.68.249.156",
-            "type": "user-session",
-            "primary": "sshd"
-          }
-        }
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Z9bKUmcBTFzn_XoLRF8K",
-    "source": {
-      "@timestamp": "2018-11-27T01:30:45.664Z",
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "29595"
-      },
-      "source": {
-        "ip": "138.68.249.156"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "138.68.249.156",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44190
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "aNbKUmcBTFzn_XoLRF8K",
-    "source": {
-      "@timestamp": "2018-11-27T01:30:45.708Z",
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "29595",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "138.68.249.156"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44191,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "138.68.249.156"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "138.68.249.156",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "gNbKUmcBTFzn_XoL3Gzp",
-    "source": {
-      "@timestamp": "2018-11-27T01:31:24.795Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "200.160.115.234",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 44192,
-        "result": "fail"
-      },
-      "beat": {
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "29609",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "200.160.115.234"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "gdbKUmcBTFzn_XoL3Gzp",
-    "source": {
-      "@timestamp": "2018-11-27T01:31:24.795Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "200.160.115.234",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 44193
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "29609",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "200.160.115.234"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "gtbKUmcBTFzn_XoL3Gzp",
-    "source": {
-      "@timestamp": "2018-11-27T01:31:24.971Z",
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "auditd": {
-        "sequence": 44194,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "200.160.115.234",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "200.160.115.234",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "29609",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "200.160.115.234"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "CNbKUmcBTFzn_XoLLl55",
-    "source": {
-      "@timestamp": "2018-11-27T01:30:40.139Z",
-      "process": {
-        "pid": "29592",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "164.132.197.108"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44188,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "164.132.197.108",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "164.132.197.108",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "YdbNUmcBTFzn_XoLn6nH",
-    "source": {
-      "@timestamp": "2018-11-27T01:34:25.758Z",
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "107.170.65.109",
-            "type": "user-session",
-            "primary": "sshd"
-          }
-        },
-        "sequence": 186449,
-        "result": "fail"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32327",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "YtbNUmcBTFzn_XoLn6nH",
-    "source": {
-      "@timestamp": "2018-11-27T01:34:25.759Z",
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32327",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186450
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Y9bNUmcBTFzn_XoLn6nH",
-    "source": {
-      "@timestamp": "2018-11-27T01:34:25.789Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32327",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "107.170.65.109"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          }
-        },
-        "sequence": 186451
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "adbNUmcBTFzn_XoLo6mE",
-    "source": {
-      "@timestamp": "2018-11-27T01:34:26.614Z",
-      "process": {
-        "pid": "12750",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "101.89.114.94"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 43176,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "101.89.114.94",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "atbNUmcBTFzn_XoLo6mE",
-    "source": {
-      "@timestamp": "2018-11-27T01:34:26.614Z",
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "12750",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "101.89.114.94"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 43177,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "101.89.114.94",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "a9bNUmcBTFzn_XoLo6mE",
-    "source": {
-      "@timestamp": "2018-11-27T01:34:26.814Z",
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "process": {
-        "pid": "12750",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "101.89.114.94"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "101.89.114.94",
-            "type": "user-session"
-          }
-        },
-        "sequence": 43178,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "101.89.114.94",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "2tbPUmcBTFzn_XoLbtDN",
-    "source": {
-      "@timestamp": "2018-11-27T01:36:24.291Z",
-      "process": {
-        "pid": "32340",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186458,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "107.170.65.109",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "29bPUmcBTFzn_XoLbtDN",
-    "source": {
-      "@timestamp": "2018-11-27T01:36:24.292Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186459,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        }
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32340",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "3NbPUmcBTFzn_XoLbtDN",
-    "source": {
-      "@timestamp": "2018-11-27T01:36:24.322Z",
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "process": {
-        "pid": "32340",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186460,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "107.170.65.109",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "107.170.65.109",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "EtbOUmcBTFzn_XoLf7xx",
-    "source": {
-      "@timestamp": "2018-11-27T01:35:22.989Z",
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186455,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32333"
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "E9bOUmcBTFzn_XoLf7xx",
-    "source": {
-      "@timestamp": "2018-11-27T01:35:22.990Z",
-      "process": {
-        "pid": "32333",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186456,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "107.170.65.109",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "FNbOUmcBTFzn_XoLf7xx",
-    "source": {
-      "@timestamp": "2018-11-27T01:35:23.020Z",
-      "process": {
-        "pid": "32333",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186457,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "107.170.65.109",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "6tbMUmcBTFzn_XoLzZY6",
-    "source": {
-      "@timestamp": "2018-11-27T01:33:31.856Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32317",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186443,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "69bMUmcBTFzn_XoLzZY6",
-    "source": {
-      "@timestamp": "2018-11-27T01:33:31.857Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32317",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          }
-        },
-        "sequence": 186444,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "7NbMUmcBTFzn_XoLzZY6",
-    "source": {
-      "@timestamp": "2018-11-27T01:33:31.887Z",
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32317",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "hostname": "107.170.65.109",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "107.170.65.109",
-            "type": "user-session",
-            "primary": "ssh"
-          }
-        },
-        "sequence": 186445,
-        "result": "fail"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "EdbMUmcBTFzn_XoLAYZs",
-    "source": {
-      "@timestamp": "2018-11-27T01:32:39.681Z",
-      "auditd": {
-        "sequence": 186440,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "process": {
-        "pid": "32315",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "EtbMUmcBTFzn_XoLAYZs",
-    "source": {
-      "@timestamp": "2018-11-27T01:32:39.682Z",
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32315",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186441,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "107.170.65.109",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "E9bMUmcBTFzn_XoLAYZs",
-    "source": {
-      "@timestamp": "2018-11-27T01:32:39.713Z",
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32315",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "107.170.65.109",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186442
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "6dbOUmcBTFzn_XoLD7I4",
-    "source": {
-      "@timestamp": "2018-11-27T01:34:54.285Z",
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32330",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "178.33.228.67"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "sequence": 186452,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "178.33.228.67"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "6tbOUmcBTFzn_XoLD7I4",
-    "source": {
-      "@timestamp": "2018-11-27T01:34:54.286Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32330",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "178.33.228.67"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "178.33.228.67",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186453,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "69bOUmcBTFzn_XoLD7I4",
-    "source": {
-      "@timestamp": "2018-11-27T01:34:54.394Z",
-      "process": {
-        "pid": "32330",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "178.33.228.67"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186454,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "178.33.228.67",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "178.33.228.67",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "-tbOUmcBTFzn_XoL_cbV",
-    "source": {
-      "@timestamp": "2018-11-27T01:35:55.371Z",
-      "source": {
-        "ip": "85.113.39.134"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "85.113.39.134",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192535,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "583"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "-9bOUmcBTFzn_XoL_cbV",
-    "source": {
-      "@timestamp": "2018-11-27T01:35:55.372Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "583"
-      },
-      "source": {
-        "ip": "85.113.39.134"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "auditd": {
-        "sequence": 192536,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "85.113.39.134"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "_NbOUmcBTFzn_XoL_cbV",
-    "source": {
-      "@timestamp": "2018-11-27T01:35:55.530Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192537,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "85.113.39.134",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "85.113.39.134"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "583",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "85.113.39.134"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "xdbMUmcBTFzn_XoLx5bh",
-    "source": {
-      "@timestamp": "2018-11-27T01:33:30.481Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "12742",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "131.72.141.34"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "131.72.141.34"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43173,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "xtbMUmcBTFzn_XoLx5bh",
-    "source": {
-      "@timestamp": "2018-11-27T01:33:30.485Z",
-      "process": {
-        "pid": "12742",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "131.72.141.34"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 43174,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "131.72.141.34",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "x9bMUmcBTFzn_XoLx5bh",
-    "source": {
-      "@timestamp": "2018-11-27T01:33:30.637Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "131.72.141.34",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "131.72.141.34",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43175,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "12742",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "131.72.141.34"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "WtbNUmcBTFzn_XoLcqUk",
-    "source": {
-      "@timestamp": "2018-11-27T01:34:14.073Z",
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32325",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "51.38.33.178"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "51.38.33.178",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 186446,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "W9bNUmcBTFzn_XoLcqUk",
-    "source": {
-      "@timestamp": "2018-11-27T01:34:14.075Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32325"
-      },
-      "source": {
-        "ip": "51.38.33.178"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "51.38.33.178",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          }
-        },
-        "sequence": 186447
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "XNbNUmcBTFzn_XoLcqUk",
-    "source": {
-      "@timestamp": "2018-11-27T01:34:14.182Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32325"
-      },
-      "source": {
-        "ip": "51.38.33.178"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "51.38.33.178",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186448,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "51.38.33.178"
-        }
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "W9bQUmcBTFzn_XoLRuMO",
-    "source": {
-      "@timestamp": "2018-11-27T01:37:19.393Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "12766",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "117.172.59.127"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "117.172.59.127"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 43182
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "XNbQUmcBTFzn_XoLRuMO",
-    "source": {
-      "@timestamp": "2018-11-27T01:37:19.393Z",
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "12766"
-      },
-      "source": {
-        "ip": "117.172.59.127"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "117.172.59.127",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43183,
-        "result": "fail"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "XdbQUmcBTFzn_XoLRuMO",
-    "source": {
-      "@timestamp": "2018-11-27T01:37:19.649Z",
-      "process": {
-        "pid": "12766",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "source": {
-        "ip": "117.172.59.127"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "117.172.59.127"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "117.172.59.127"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43184,
-        "result": "fail"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "otbQUmcBTFzn_XoLVOSA",
-    "source": {
-      "@timestamp": "2018-11-27T01:37:23.093Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "12773",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "193.70.85.206"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 43185,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "193.70.85.206"
-        },
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "193.70.85.206",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          }
-        }
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "BtbQUmcBTFzn_XoLaudn",
-    "source": {
-      "@timestamp": "2018-11-27T01:37:28.701Z",
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32348"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186461,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "B9bQUmcBTFzn_XoLaudn",
-    "source": {
-      "@timestamp": "2018-11-27T01:37:28.702Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "secondary": "107.170.65.109",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 186462,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32348"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "CNbQUmcBTFzn_XoLaudn",
-    "source": {
-      "@timestamp": "2018-11-27T01:37:28.734Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32348"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "107.170.65.109",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186463,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "E9bRUmcBTFzn_XoLKPdd",
-    "source": {
-      "@timestamp": "2018-11-27T01:38:17.330Z",
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "19716"
-      },
-      "source": {
-        "ip": "93.157.241.40"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-haproxy-01"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "93.157.241.40",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142343,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "FNbRUmcBTFzn_XoLKPdd",
-    "source": {
-      "@timestamp": "2018-11-27T01:38:17.331Z",
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "19716",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "93.157.241.40"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "93.157.241.40",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142344,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "FdbRUmcBTFzn_XoLKPdd",
-    "source": {
-      "@timestamp": "2018-11-27T01:38:17.539Z",
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "19716",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "93.157.241.40"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "hostname": "93.157.241.40",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "93.157.241.40",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142345,
-        "result": "fail",
-        "session": "unset"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "qNbPUmcBTFzn_XoL8dwD",
-    "source": {
-      "@timestamp": "2018-11-27T01:36:57.625Z",
-      "process": {
-        "pid": "25824",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "94.23.0.13"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "94.23.0.13",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184365,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "qdbPUmcBTFzn_XoL8dwD",
-    "source": {
-      "@timestamp": "2018-11-27T01:36:57.626Z",
-      "source": {
-        "ip": "94.23.0.13"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "94.23.0.13"
-          }
-        },
-        "sequence": 184366,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "25824",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "qtbPUmcBTFzn_XoL8dwD",
-    "source": {
-      "@timestamp": "2018-11-27T01:36:57.733Z",
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "25824"
-      },
-      "source": {
-        "ip": "94.23.0.13"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 184367,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "94.23.0.13",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "94.23.0.13",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "T9bQUmcBTFzn_XoLQeNm",
-    "source": {
-      "@timestamp": "2018-11-27T01:37:18.204Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "159.203.185.59",
-            "type": "user-session"
-          }
-        },
-        "sequence": 192544
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "595",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "159.203.185.59"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "UNbQUmcBTFzn_XoLQeNm",
-    "source": {
-      "@timestamp": "2018-11-27T01:37:18.205Z",
-      "process": {
-        "pid": "595",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "159.203.185.59"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192545,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "159.203.185.59"
-          }
-        }
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "UdbQUmcBTFzn_XoLQeNm",
-    "source": {
-      "@timestamp": "2018-11-27T01:37:18.237Z",
-      "auditd": {
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "159.203.185.59",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192546,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "159.203.185.59"
-        }
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "595",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "159.203.185.59"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "RdbQUmcBTFzn_XoLGOA5",
-    "source": {
-      "@timestamp": "2018-11-27T01:37:07.663Z",
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "593",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "82.242.169.217"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "82.242.169.217",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192541,
-        "result": "fail"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "RtbQUmcBTFzn_XoLGOA5",
-    "source": {
-      "@timestamp": "2018-11-27T01:37:07.664Z",
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "82.242.169.217",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192542,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "593",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "82.242.169.217"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "R9bQUmcBTFzn_XoLGOA5",
-    "source": {
-      "@timestamp": "2018-11-27T01:37:08.073Z",
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "593",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "82.242.169.217"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192543,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "82.242.169.217",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "82.242.169.217",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "FtbPUmcBTFzn_XoL29qM",
-    "source": {
-      "@timestamp": "2018-11-27T01:36:52.130Z",
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "91.230.8.194",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          }
-        },
-        "sequence": 192538
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "591"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "source": {
-        "ip": "91.230.8.194"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "F9bPUmcBTFzn_XoL29qM",
-    "source": {
-      "@timestamp": "2018-11-27T01:36:52.131Z",
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "591",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "91.230.8.194"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "91.230.8.194",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192539
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "GNbPUmcBTFzn_XoL29qM",
-    "source": {
-      "@timestamp": "2018-11-27T01:36:52.258Z",
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "91.230.8.194",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "91.230.8.194",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192540
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "591",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "91.230.8.194"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "vtbQUmcBTFzn_XoLKeAA",
-    "source": {
-      "@timestamp": "2018-11-27T01:37:11.956Z",
-      "source": {
-        "ip": "51.254.201.64"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "51.254.201.64"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          }
-        },
-        "sequence": 43179,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "12764",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "v9bQUmcBTFzn_XoLKeAA",
-    "source": {
-      "@timestamp": "2018-11-27T01:37:11.956Z",
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "12764",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "51.254.201.64"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "51.254.201.64",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43180,
-        "result": "fail"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "wNbQUmcBTFzn_XoLKeAA",
-    "source": {
-      "@timestamp": "2018-11-27T01:37:12.064Z",
-      "process": {
-        "pid": "12764",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "51.254.201.64"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 43181,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "51.254.201.64",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "51.254.201.64"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ltbQUmcBTFzn_XoL3fAn",
-    "source": {
-      "@timestamp": "2018-11-27T01:37:58.076Z",
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "46.17.40.237",
-            "type": "user-session"
-          }
-        },
-        "sequence": 142342,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "46.17.40.237"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "process": {
-        "pid": "19713",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "46.17.40.237"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "VtfUUmcBTFzn_XoLxEaR",
-    "source": {
-      "@timestamp": "2018-11-27T01:42:13.909Z",
-      "source": {
-        "ip": "147.75.96.90"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "147.75.96.90",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44195,
-        "result": "fail"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "29821",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "V9fUUmcBTFzn_XoLxEaR",
-    "source": {
-      "@timestamp": "2018-11-27T01:42:13.913Z",
-      "source": {
-        "ip": "147.75.96.90"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44196,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "147.75.96.90",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "29821"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "WNfUUmcBTFzn_XoLxEaR",
-    "source": {
-      "@timestamp": "2018-11-27T01:42:13.945Z",
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "29821"
-      },
-      "source": {
-        "ip": "147.75.96.90"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44197,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "147.75.96.90",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "147.75.96.90"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "wtfUUmcBTFzn_XoLzEYU",
-    "source": {
-      "@timestamp": "2018-11-27T01:42:15.845Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "29824",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "144.217.4.14"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44198,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "144.217.4.14",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "w9fUUmcBTFzn_XoLzEYU",
-    "source": {
-      "@timestamp": "2018-11-27T01:42:15.845Z",
-      "process": {
-        "pid": "29824",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "144.217.4.14"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44199,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "144.217.4.14",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "xNfUUmcBTFzn_XoLzEYU",
-    "source": {
-      "@timestamp": "2018-11-27T01:42:15.889Z",
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "29824",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "144.217.4.14"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44200,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "144.217.4.14"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "144.217.4.14",
-            "type": "user-session"
-          }
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "0NfUUmcBTFzn_XoL0Ubg",
-    "source": {
-      "@timestamp": "2018-11-27T01:42:17.334Z",
-      "process": {
-        "pid": "19742",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "source": {
-        "ip": "192.252.209.190"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "object": {
-            "secondary": "192.252.209.190",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 142355
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "0dfUUmcBTFzn_XoL0Ubg",
-    "source": {
-      "@timestamp": "2018-11-27T01:42:17.335Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "192.252.209.190",
-            "type": "user-session"
-          }
-        },
-        "sequence": 142356,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "19742",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "192.252.209.190"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "0tfUUmcBTFzn_XoL0Ubg",
-    "source": {
-      "@timestamp": "2018-11-27T01:42:17.366Z",
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "19742",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "192.252.209.190"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 142357,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "192.252.209.190"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "192.252.209.190",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "tNfUUmcBTFzn_XoLIDfE",
-    "source": {
-      "@timestamp": "2018-11-27T01:41:31.994Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "19739",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "82.196.12.151"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "82.196.12.151",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142352,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        }
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "tdfUUmcBTFzn_XoLIDfE",
-    "source": {
-      "@timestamp": "2018-11-27T01:41:31.995Z",
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "82.196.12.151",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142353,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "19739",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "82.196.12.151"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ttfUUmcBTFzn_XoLIDfE",
-    "source": {
-      "@timestamp": "2018-11-27T01:41:32.100Z",
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "19739",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "82.196.12.151"
-      },
-      "beat": {
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-haproxy-01"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 142354,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "82.196.12.151"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "82.196.12.151",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "_dfVUmcBTFzn_XoLRFCU",
-    "source": {
-      "@timestamp": "2018-11-27T01:42:46.698Z",
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "secondary": "202.28.34.200",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 184380
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "process": {
-        "pid": "25911",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "202.28.34.200"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "_tfVUmcBTFzn_XoLRFCU",
-    "source": {
-      "@timestamp": "2018-11-27T01:42:46.700Z",
-      "auditd": {
-        "sequence": 184381,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "202.28.34.200",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "25911"
-      },
-      "source": {
-        "ip": "202.28.34.200"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "_9fVUmcBTFzn_XoLRFCU",
-    "source": {
-      "@timestamp": "2018-11-27T01:42:46.932Z",
-      "source": {
-        "ip": "202.28.34.200"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "202.28.34.200"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "202.28.34.200",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184382,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "25911",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ANfUUmcBTFzn_XoL5ElJ",
-    "source": {
-      "@timestamp": "2018-11-27T01:42:22.047Z",
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "25908"
-      },
-      "source": {
-        "ip": "104.234.223.14"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "104.234.223.14",
-            "type": "user-session"
-          }
-        },
-        "sequence": 184377,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "AdfUUmcBTFzn_XoL5ElJ",
-    "source": {
-      "@timestamp": "2018-11-27T01:42:22.048Z",
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "104.234.223.14",
-            "type": "user-session"
-          }
-        },
-        "sequence": 184378,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "25908",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "104.234.223.14"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "AtfUUmcBTFzn_XoL5ElJ",
-    "source": {
-      "@timestamp": "2018-11-27T01:42:22.097Z",
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "25908",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "104.234.223.14"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 184379,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "104.234.223.14",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "104.234.223.14",
-            "type": "user-session"
-          }
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "79fUUmcBTFzn_XoLuUSW",
-    "source": {
-      "@timestamp": "2018-11-27T01:42:11.115Z",
-      "auditd": {
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186479,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32381",
-        "exe": "/usr/sbin/sshd"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "8NfUUmcBTFzn_XoLuUSW",
-    "source": {
-      "@timestamp": "2018-11-27T01:42:11.116Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32381",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186480,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "8dfUUmcBTFzn_XoLuUSW",
-    "source": {
-      "@timestamp": "2018-11-27T01:42:11.146Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32381",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "107.170.65.109"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186481,
-        "result": "fail"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ntfUUmcBTFzn_XoLPzou",
-    "source": {
-      "@timestamp": "2018-11-27T01:41:39.780Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "25901",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "185.91.116.197"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "185.91.116.197",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184374,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "n9fUUmcBTFzn_XoLPzou",
-    "source": {
-      "@timestamp": "2018-11-27T01:41:39.781Z",
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "process": {
-        "pid": "25901",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "185.91.116.197"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "185.91.116.197",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184375,
-        "result": "fail"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "oNfUUmcBTFzn_XoLPzou",
-    "source": {
-      "@timestamp": "2018-11-27T01:41:39.902Z",
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "25901"
-      },
-      "source": {
-        "ip": "185.91.116.197"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "hostname": "185.91.116.197",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "185.91.116.197",
-            "type": "user-session",
-            "primary": "ssh"
-          }
-        },
-        "sequence": 184376,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "TdfUUmcBTFzn_XoLaj6n",
-    "source": {
-      "@timestamp": "2018-11-27T01:41:50.908Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32377"
-      },
-      "source": {
-        "ip": "37.187.113.229"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186476,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "37.187.113.229",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        }
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "TtfUUmcBTFzn_XoLaj6n",
-    "source": {
-      "@timestamp": "2018-11-27T01:41:50.909Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "sequence": 186477,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "37.187.113.229",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        }
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32377"
-      },
-      "source": {
-        "ip": "37.187.113.229"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "T9fUUmcBTFzn_XoLaj6n",
-    "source": {
-      "@timestamp": "2018-11-27T01:41:51.016Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32377",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "37.187.113.229"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "37.187.113.229"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "37.187.113.229"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186478,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "gdfVUmcBTFzn_XoLildy",
-    "source": {
-      "@timestamp": "2018-11-27T01:43:04.584Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "92.222.47.243",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184383,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "25918",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "92.222.47.243"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "gtfVUmcBTFzn_XoLildy",
-    "source": {
-      "@timestamp": "2018-11-27T01:43:04.585Z",
-      "source": {
-        "ip": "92.222.47.243"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "92.222.47.243",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 184384,
-        "result": "fail"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "25918",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "g9fVUmcBTFzn_XoLildy",
-    "source": {
-      "@timestamp": "2018-11-27T01:43:04.690Z",
-      "source": {
-        "ip": "92.222.47.243"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "hostname": "92.222.47.243",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "92.222.47.243",
-            "type": "user-session"
-          }
-        },
-        "sequence": 184385,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "25918"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "7tfUUmcBTFzn_XoL-0sw",
-    "source": {
-      "@timestamp": "2018-11-27T01:42:27.906Z",
-      "auditd": {
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "185.21.16.108",
-            "type": "user-session"
-          }
-        },
-        "sequence": 44201,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "29828",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "185.21.16.108"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "79fUUmcBTFzn_XoL-0sw",
-    "source": {
-      "@timestamp": "2018-11-27T01:42:27.906Z",
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "process": {
-        "pid": "29828",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "185.21.16.108"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "185.21.16.108",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44202,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "8NfUUmcBTFzn_XoL-0sw",
-    "source": {
-      "@timestamp": "2018-11-27T01:42:28.038Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "29828",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "185.21.16.108"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "hostname": "185.21.16.108",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "185.21.16.108"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44203,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "NNfcUmcBTFzn_XoLuPTT",
-    "source": {
-      "@timestamp": "2018-11-27T01:50:55.209Z",
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32438"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "107.170.65.109",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186506,
-        "result": "fail"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "NdfcUmcBTFzn_XoLuPTT",
-    "source": {
-      "@timestamp": "2018-11-27T01:50:55.210Z",
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186507,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32438"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "NtfcUmcBTFzn_XoLuPTT",
-    "source": {
-      "@timestamp": "2018-11-27T01:50:55.240Z",
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32438",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "hostname": "107.170.65.109",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          }
-        },
-        "sequence": 186508,
-        "result": "fail"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "OtfcUmcBTFzn_XoLu_Sp",
-    "source": {
-      "@timestamp": "2018-11-27T01:50:55.885Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "178.80.6.244",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142382,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "19808",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "178.80.6.244"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "O9fcUmcBTFzn_XoLu_Sp",
-    "source": {
-      "@timestamp": "2018-11-27T01:50:55.886Z",
-      "source": {
-        "ip": "178.80.6.244"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "178.80.6.244"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 142383,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "19808",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "PNfcUmcBTFzn_XoLu_Sp",
-    "source": {
-      "@timestamp": "2018-11-27T01:50:56.100Z",
-      "auditd": {
-        "data": {
-          "hostname": "178.80.6.244",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "178.80.6.244"
-          }
-        },
-        "sequence": 142384,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "19808",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "178.80.6.244"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ttfaUmcBTFzn_XoL780P",
-    "source": {
-      "@timestamp": "2018-11-27T01:48:58.021Z",
-      "source": {
-        "ip": "104.236.181.158"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "104.236.181.158"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142376,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        }
-      },
-      "beat": {
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-haproxy-01"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "19793",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "t9faUmcBTFzn_XoL780P",
-    "source": {
-      "@timestamp": "2018-11-27T01:48:58.022Z",
-      "source": {
-        "ip": "104.236.181.158"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "104.236.181.158",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 142377,
-        "result": "fail"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "process": {
-        "pid": "19793",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "uNfaUmcBTFzn_XoL780P",
-    "source": {
-      "@timestamp": "2018-11-27T01:48:58.064Z",
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "104.236.181.158"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "104.236.181.158"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142378,
-        "result": "fail"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "19793",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "104.236.181.158"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "tNfbUmcBTFzn_XoLTdQu",
-    "source": {
-      "@timestamp": "2018-11-27T01:49:22.116Z",
-      "process": {
-        "pid": "19795",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "153.142.75.192"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "secondary": "153.142.75.192",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 142379
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "tdfbUmcBTFzn_XoLTdQu",
-    "source": {
-      "@timestamp": "2018-11-27T01:49:22.117Z",
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "19795",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "153.142.75.192"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 142380,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "153.142.75.192",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        }
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ttfbUmcBTFzn_XoLTdQu",
-    "source": {
-      "@timestamp": "2018-11-27T01:49:22.274Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "19795",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "source": {
-        "ip": "153.142.75.192"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "153.142.75.192"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "153.142.75.192",
-            "type": "user-session"
-          }
-        },
-        "sequence": 142381,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "GtfaUmcBTFzn_XoLLr2X",
-    "source": {
-      "@timestamp": "2018-11-27T01:48:08.749Z",
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "19785",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "190.0.10.138"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "190.0.10.138"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 142373,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "G9faUmcBTFzn_XoLLr2X",
-    "source": {
-      "@timestamp": "2018-11-27T01:48:08.750Z",
-      "source": {
-        "ip": "190.0.10.138"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "190.0.10.138",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 142374
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01"
-      },
-      "process": {
-        "pid": "19785",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "HNfaUmcBTFzn_XoLLr2X",
-    "source": {
-      "@timestamp": "2018-11-27T01:48:08.857Z",
-      "source": {
-        "ip": "190.0.10.138"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 142375,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "190.0.10.138",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "190.0.10.138"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "19785",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "J9faUmcBTFzn_XoLbcKr",
-    "source": {
-      "@timestamp": "2018-11-27T01:48:24.897Z",
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32420"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186500,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "KNfaUmcBTFzn_XoLbcKr",
-    "source": {
-      "@timestamp": "2018-11-27T01:48:24.899Z",
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186501,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32420"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "KdfaUmcBTFzn_XoLbcKr",
-    "source": {
-      "@timestamp": "2018-11-27T01:48:24.929Z",
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "hostname": "107.170.65.109",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 186502,
-        "result": "fail"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32420",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ItfZUmcBTFzn_XoLRqn8",
-    "source": {
-      "@timestamp": "2018-11-27T01:47:09.456Z",
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32412"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186497,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "I9fZUmcBTFzn_XoLRqn8",
-    "source": {
-      "@timestamp": "2018-11-27T01:47:09.457Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32412",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186498,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "JNfZUmcBTFzn_XoLRqn8",
-    "source": {
-      "@timestamp": "2018-11-27T01:47:09.491Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32412",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "107.170.65.109"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186499,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "KtfbUmcBTFzn_XoLltt6",
-    "source": {
-      "@timestamp": "2018-11-27T01:49:40.879Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186503,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32428",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "K9fbUmcBTFzn_XoLltt6",
-    "source": {
-      "@timestamp": "2018-11-27T01:49:40.881Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32428"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186504
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "LNfbUmcBTFzn_XoLltt6",
-    "source": {
-      "@timestamp": "2018-11-27T01:49:40.911Z",
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186505,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "107.170.65.109"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32428"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "zNfZUmcBTFzn_XoL6LbT",
-    "source": {
-      "@timestamp": "2018-11-27T01:47:50.888Z",
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "19783",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "176.31.75.53"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 142370,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "176.31.75.53"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "zdfZUmcBTFzn_XoL6LbT",
-    "source": {
-      "@timestamp": "2018-11-27T01:47:50.889Z",
-      "source": {
-        "ip": "176.31.75.53"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 142371,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "176.31.75.53",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "19783",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ztfZUmcBTFzn_XoL6LbT",
-    "source": {
-      "@timestamp": "2018-11-27T01:47:50.996Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "176.31.75.53"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "176.31.75.53",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142372,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "19783",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "176.31.75.53"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "6dfcUmcBTFzn_XoLVuuz",
-    "source": {
-      "@timestamp": "2018-11-27T01:50:30.087Z",
-      "source": {
-        "ip": "178.33.45.156"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44204,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "178.33.45.156",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "29987"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "6tfcUmcBTFzn_XoLVuuz",
-    "source": {
-      "@timestamp": "2018-11-27T01:50:30.087Z",
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "29987",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "178.33.45.156"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "178.33.45.156",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44205,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        }
-      },
-      "beat": {
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "69fcUmcBTFzn_XoLVuuz",
-    "source": {
-      "@timestamp": "2018-11-27T01:50:30.195Z",
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "29987",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "178.33.45.156"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44206,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "178.33.45.156"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "178.33.45.156",
-            "type": "user-session"
-          }
-        }
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "i9jhUmcBTFzn_XoLAlEZ",
-    "source": {
-      "@timestamp": "2018-11-27T01:55:36.110Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "26002"
-      },
-      "source": {
-        "ip": "178.48.181.9"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "secondary": "178.48.181.9",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 184395
-      },
-      "beat": {
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "jNjhUmcBTFzn_XoLAlEZ",
-    "source": {
-      "@timestamp": "2018-11-27T01:55:36.111Z",
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "beat": {
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "26002"
-      },
-      "source": {
-        "ip": "178.48.181.9"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 184396,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "178.48.181.9",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "jdjhUmcBTFzn_XoLAlEZ",
-    "source": {
-      "@timestamp": "2018-11-27T01:55:36.272Z",
-      "source": {
-        "ip": "178.48.181.9"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 184397,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "178.48.181.9",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "178.48.181.9"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "26002"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "HNjhUmcBTFzn_XoLBFLi",
-    "source": {
-      "@timestamp": "2018-11-27T01:55:36.824Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186518,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32466",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "HdjhUmcBTFzn_XoLBFLi",
-    "source": {
-      "@timestamp": "2018-11-27T01:55:36.825Z",
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      },
-      "process": {
-        "pid": "32466",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186519,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          }
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "HtjhUmcBTFzn_XoLBFLi",
-    "source": {
-      "@timestamp": "2018-11-27T01:55:36.858Z",
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186520,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "107.170.65.109",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "process": {
-        "pid": "32466",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "X9jhUmcBTFzn_XoLml-F",
-    "source": {
-      "@timestamp": "2018-11-27T01:56:15.131Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "83.99.24.14",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186524,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32470",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "83.99.24.14"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "YNjhUmcBTFzn_XoLml-F",
-    "source": {
-      "@timestamp": "2018-11-27T01:56:15.132Z",
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32470"
-      },
-      "source": {
-        "ip": "83.99.24.14"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "83.99.24.14",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186525,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "YdjhUmcBTFzn_XoLml-F",
-    "source": {
-      "@timestamp": "2018-11-27T01:56:15.245Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32470",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "83.99.24.14"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "83.99.24.14",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186526,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "83.99.24.14"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "YtjhUmcBTFzn_XoLml-F",
-    "source": {
-      "@timestamp": "2018-11-27T01:56:15.822Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "51.38.68.237"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186527,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32472",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "51.38.68.237"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Y9jhUmcBTFzn_XoLml-F",
-    "source": {
-      "@timestamp": "2018-11-27T01:56:15.823Z",
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32472",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "51.38.68.237"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186528,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "51.38.68.237"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          }
-        }
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ZNjhUmcBTFzn_XoLml-F",
-    "source": {
-      "@timestamp": "2018-11-27T01:56:15.930Z",
-      "auditd": {
-        "sequence": 186529,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "51.38.68.237"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "51.38.68.237"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        }
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32472"
-      },
-      "source": {
-        "ip": "51.38.68.237"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "jNjgUmcBTFzn_XoL304M",
-    "source": {
-      "@timestamp": "2018-11-27T01:55:27.134Z",
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "30088",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "91.121.142.225"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "91.121.142.225",
-            "type": "user-session"
-          }
-        },
-        "sequence": 44210,
-        "result": "fail"
-      },
-      "beat": {
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "jdjgUmcBTFzn_XoL304M",
-    "source": {
-      "@timestamp": "2018-11-27T01:55:27.134Z",
-      "process": {
-        "pid": "30088",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "source": {
-        "ip": "91.121.142.225"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "91.121.142.225"
-          }
-        },
-        "sequence": 44211
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "jtjgUmcBTFzn_XoL304M",
-    "source": {
-      "@timestamp": "2018-11-27T01:55:27.238Z",
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "beat": {
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "process": {
-        "pid": "30088",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "91.121.142.225"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "91.121.142.225"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "91.121.142.225"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44212,
-        "result": "fail"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "j9jgUmcBTFzn_XoL304M",
-    "source": {
-      "@timestamp": "2018-11-27T01:55:27.846Z",
-      "source": {
-        "ip": "104.234.223.14"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44213,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "104.234.223.14",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "30090",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "kNjgUmcBTFzn_XoL304M",
-    "source": {
-      "@timestamp": "2018-11-27T01:55:27.850Z",
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "104.234.223.14",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44214
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "30090"
-      },
-      "source": {
-        "ip": "104.234.223.14"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "kdjgUmcBTFzn_XoL304M",
-    "source": {
-      "@timestamp": "2018-11-27T01:55:27.898Z",
-      "process": {
-        "pid": "30090",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "104.234.223.14"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44215,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "104.234.223.14",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "104.234.223.14",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "vNjfUmcBTFzn_XoL8jpi",
-    "source": {
-      "@timestamp": "2018-11-27T01:54:26.552Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32457",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 186515,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "vdjfUmcBTFzn_XoL8jpi",
-    "source": {
-      "@timestamp": "2018-11-27T01:54:26.553Z",
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32457"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          }
-        },
-        "sequence": 186516,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        }
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "vtjfUmcBTFzn_XoL8jpi",
-    "source": {
-      "@timestamp": "2018-11-27T01:54:26.584Z",
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "107.170.65.109",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "107.170.65.109",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186517,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32457",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "59jgUmcBTFzn_XoLk0ht",
-    "source": {
-      "@timestamp": "2018-11-27T01:55:07.779Z",
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "65.127.203.242",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142395,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "19840",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "65.127.203.242"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "6NjgUmcBTFzn_XoLk0ht",
-    "source": {
-      "@timestamp": "2018-11-27T01:55:07.780Z",
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "19840",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "65.127.203.242"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "65.127.203.242",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 142396,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "6djgUmcBTFzn_XoLk0ht",
-    "source": {
-      "@timestamp": "2018-11-27T01:55:07.840Z",
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "19840",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "65.127.203.242"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "object": {
-            "secondary": "65.127.203.242",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 142397,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "65.127.203.242",
-          "terminal": "ssh"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "P9jhUmcBTFzn_XoLbFvp",
-    "source": {
-      "@timestamp": "2018-11-27T01:56:03.454Z",
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "164.132.197.108",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186521
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32468",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "164.132.197.108"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "QNjhUmcBTFzn_XoLbFvp",
-    "source": {
-      "@timestamp": "2018-11-27T01:56:03.455Z",
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32468",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "164.132.197.108"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "164.132.197.108"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186522,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "QdjhUmcBTFzn_XoLbFvp",
-    "source": {
-      "@timestamp": "2018-11-27T01:56:03.574Z",
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "data": {
-          "hostname": "164.132.197.108",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "164.132.197.108",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186523,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32468",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "164.132.197.108"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "kNjgUmcBTFzn_XoLv0zp",
-    "source": {
-      "@timestamp": "2018-11-27T01:55:19.167Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "752",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "36.84.80.31"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "36.84.80.31",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192556,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "kdjgUmcBTFzn_XoLv0zp",
-    "source": {
-      "@timestamp": "2018-11-27T01:55:19.168Z",
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192557,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "36.84.80.31",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "752",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "36.84.80.31"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ktjgUmcBTFzn_XoLv0zp",
-    "source": {
-      "@timestamp": "2018-11-27T01:55:19.429Z",
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "36.84.80.31"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "36.84.80.31",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192558
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "752",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "36.84.80.31"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "_NjhUmcBTFzn_XoLd1s3",
-    "source": {
-      "@timestamp": "2018-11-27T01:56:06.089Z",
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "197.149.137.86",
-            "type": "user-session"
-          }
-        },
-        "sequence": 44216,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "30106",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "197.149.137.86"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "_djhUmcBTFzn_XoLd1s3",
-    "source": {
-      "@timestamp": "2018-11-27T01:56:06.089Z",
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "30106",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "197.149.137.86"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "197.149.137.86",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44217,
-        "result": "fail",
-        "session": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "_tjhUmcBTFzn_XoLd1s3",
-    "source": {
-      "@timestamp": "2018-11-27T01:56:06.317Z",
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "30106",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "197.149.137.86"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "197.149.137.86",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44218,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "197.149.137.86",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "JtjhUmcBTFzn_XoL7GYK",
-    "source": {
-      "@timestamp": "2018-11-27T01:56:36.000Z",
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "process": {
-        "pid": "26010",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "54.37.191.209"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 184398,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "54.37.191.209"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "54.37.191.209",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "NtjlUmcBTFzn_XoLuLrU",
-    "source": {
-      "@timestamp": "2018-11-27T02:00:45.031Z",
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "26032",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "128.199.145.205"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "128.199.145.205",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184399,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "N9jlUmcBTFzn_XoLuLrU",
-    "source": {
-      "@timestamp": "2018-11-27T02:00:45.032Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "26032",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "128.199.145.205"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "128.199.145.205",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184400
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ONjlUmcBTFzn_XoLuLrU",
-    "source": {
-      "@timestamp": "2018-11-27T02:00:45.255Z",
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "128.199.145.205",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "128.199.145.205",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184401
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "26032",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "source": {
-        "ip": "128.199.145.205"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "OdjlUmcBTFzn_XoLubrj",
-    "source": {
-      "@timestamp": "2018-11-27T02:00:45.301Z",
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32510"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "object": {
-            "secondary": "107.170.65.109",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 186545,
-        "result": "fail"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "OtjlUmcBTFzn_XoLubrj",
-    "source": {
-      "@timestamp": "2018-11-27T02:00:45.302Z",
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186546
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32510"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "O9jlUmcBTFzn_XoLubrj",
-    "source": {
-      "@timestamp": "2018-11-27T02:00:45.333Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186547,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "107.170.65.109",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "107.170.65.109"
-          }
-        }
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32510",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "R9jlUmcBTFzn_XoLvrqH",
-    "source": {
-      "@timestamp": "2018-11-27T02:00:46.487Z",
-      "source": {
-        "ip": "51.254.140.108"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 43217,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "51.254.140.108"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        }
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "12917",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "SNjlUmcBTFzn_XoLvrqH",
-    "source": {
-      "@timestamp": "2018-11-27T02:00:46.487Z",
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "12917",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "source": {
-        "ip": "51.254.140.108"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 43218,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "51.254.140.108"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "SdjlUmcBTFzn_XoLvrqH",
-    "source": {
-      "@timestamp": "2018-11-27T02:00:46.595Z",
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "process": {
-        "pid": "12917",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "51.254.140.108"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 43219,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "51.254.140.108",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "51.254.140.108",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        }
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "StjlUmcBTFzn_XoLvrqH",
-    "source": {
-      "@timestamp": "2018-11-27T02:00:47.131Z",
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "process": {
-        "pid": "12919",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "79.133.56.139"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "79.133.56.139",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43220,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "S9jlUmcBTFzn_XoLvrqH",
-    "source": {
-      "@timestamp": "2018-11-27T02:00:47.135Z",
-      "process": {
-        "pid": "12919",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "79.133.56.139"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "79.133.56.139",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          }
-        },
-        "sequence": 43221
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "TNjlUmcBTFzn_XoLvrqH",
-    "source": {
-      "@timestamp": "2018-11-27T02:00:47.243Z",
-      "source": {
-        "ip": "79.133.56.139"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "79.133.56.139"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "79.133.56.139"
-          }
-        },
-        "sequence": 43222
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "12919"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "wdjmUmcBTFzn_XoL8NQE",
-    "source": {
-      "@timestamp": "2018-11-27T02:02:04.698Z",
-      "process": {
-        "pid": "19884",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "50.71.229.131"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "50.71.229.131",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142407
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "wtjmUmcBTFzn_XoL8NQE",
-    "source": {
-      "@timestamp": "2018-11-27T02:02:04.699Z",
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "19884",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "50.71.229.131"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 142408,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "50.71.229.131",
-            "type": "user-session",
-            "primary": "sshd"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "w9jmUmcBTFzn_XoL8NQE",
-    "source": {
-      "@timestamp": "2018-11-27T02:02:04.762Z",
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "source": {
-        "ip": "50.71.229.131"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 142409,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "50.71.229.131",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "50.71.229.131",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "19884",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "xdjmUmcBTFzn_XoL8tSP",
-    "source": {
-      "@timestamp": "2018-11-27T02:02:05.349Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32513"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          }
-        },
-        "sequence": 186548,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "xtjmUmcBTFzn_XoL8tSP",
-    "source": {
-      "@timestamp": "2018-11-27T02:02:05.350Z",
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32513"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          }
-        },
-        "sequence": 186549,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "x9jmUmcBTFzn_XoL8tSP",
-    "source": {
-      "@timestamp": "2018-11-27T02:02:05.381Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32513",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186550,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "107.170.65.109"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "V9jlUmcBTFzn_XoLPq9B",
-    "source": {
-      "@timestamp": "2018-11-27T02:00:13.654Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 142398,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "217.182.55.191",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-haproxy-01"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "19871",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "217.182.55.191"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "WNjlUmcBTFzn_XoLPq9B",
-    "source": {
-      "@timestamp": "2018-11-27T02:00:13.656Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "217.182.55.191",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 142399,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "19871",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "217.182.55.191"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "WdjlUmcBTFzn_XoLPq9B",
-    "source": {
-      "@timestamp": "2018-11-27T02:00:13.762Z",
-      "beat": {
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-haproxy-01"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "19871",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "217.182.55.191"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 142400,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "217.182.55.191",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "217.182.55.191",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "4djmUmcBTFzn_XoLT8Yc",
-    "source": {
-      "@timestamp": "2018-11-27T02:01:23.506Z",
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "91.121.110.50",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142401,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "19879"
-      },
-      "source": {
-        "ip": "91.121.110.50"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "4tjmUmcBTFzn_XoLT8Yc",
-    "source": {
-      "@timestamp": "2018-11-27T02:01:23.507Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 142402,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "91.121.110.50",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "19879",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "source": {
-        "ip": "91.121.110.50"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "49jmUmcBTFzn_XoLT8Yc",
-    "source": {
-      "@timestamp": "2018-11-27T02:01:23.614Z",
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "hostname": "91.121.110.50",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "91.121.110.50",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142403,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "19879",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "91.121.110.50"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ktjnUmcBTFzn_XoLvuUr",
-    "source": {
-      "@timestamp": "2018-11-27T02:02:57.473Z",
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32520"
-      },
-      "source": {
-        "ip": "213.191.147.66"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "213.191.147.66"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 186551,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        }
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "k9jnUmcBTFzn_XoLvuUr",
-    "source": {
-      "@timestamp": "2018-11-27T02:02:57.474Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186552,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "213.191.147.66",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32520",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "213.191.147.66"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "lNjnUmcBTFzn_XoLvuUr",
-    "source": {
-      "@timestamp": "2018-11-27T02:02:57.617Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32520",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "213.191.147.66"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186553,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "213.191.147.66"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "213.191.147.66",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "7tjmUmcBTFzn_XoLlMzO",
-    "source": {
-      "@timestamp": "2018-11-27T02:01:41.348Z",
-      "source": {
-        "ip": "211.219.52.136"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "211.219.52.136",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142404,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "19881",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "79jmUmcBTFzn_XoLlMzO",
-    "source": {
-      "@timestamp": "2018-11-27T02:01:41.349Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "19881",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "211.219.52.136"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "211.219.52.136",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142405
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "8NjmUmcBTFzn_XoLlMzO",
-    "source": {
-      "@timestamp": "2018-11-27T02:01:41.509Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "19881",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "211.219.52.136"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "211.219.52.136",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142406,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "211.219.52.136",
-          "terminal": "ssh"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "h9joUmcBTFzn_XoLK-92",
-    "source": {
-      "@timestamp": "2018-11-27T02:03:25.452Z",
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32523"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186554,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "107.170.65.109",
-            "type": "user-session",
-            "primary": "sshd"
-          }
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "iNjoUmcBTFzn_XoLK-92",
-    "source": {
-      "@timestamp": "2018-11-27T02:03:25.453Z",
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32523"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186555
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "idjoUmcBTFzn_XoLK-92",
-    "source": {
-      "@timestamp": "2018-11-27T02:03:25.484Z",
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32523",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "107.170.65.109"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186556
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "KtjoUmcBTFzn_XoLAuyv",
-    "source": {
-      "@timestamp": "2018-11-27T02:03:15.008Z",
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "191.255.74.211",
-            "type": "user-session"
-          }
-        },
-        "sequence": 43223
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "12938",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "191.255.74.211"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "K9joUmcBTFzn_XoLAuyv",
-    "source": {
-      "@timestamp": "2018-11-27T02:03:15.008Z",
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "191.255.74.211"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43224
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "12938",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "source": {
-        "ip": "191.255.74.211"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "LNjoUmcBTFzn_XoLAuyv",
-    "source": {
-      "@timestamp": "2018-11-27T02:03:15.172Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "auditd": {
-        "data": {
-          "hostname": "191.255.74.211",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "191.255.74.211",
-            "type": "user-session"
-          }
-        },
-        "sequence": 43225,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "12938",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "191.255.74.211"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "F9jlUmcBTFzn_XoLX7Lz",
-    "source": {
-      "@timestamp": "2018-11-27T02:00:22.277Z",
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "source": {
-        "ip": "152.115.61.52"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44222,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "152.115.61.52",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "30191",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "GNjlUmcBTFzn_XoLX7Lz",
-    "source": {
-      "@timestamp": "2018-11-27T02:00:22.277Z",
-      "auditd": {
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "152.115.61.52"
-          }
-        },
-        "sequence": 44223,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "30191",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "152.115.61.52"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "GdjlUmcBTFzn_XoLX7Lz",
-    "source": {
-      "@timestamp": "2018-11-27T02:00:22.397Z",
-      "process": {
-        "pid": "30191",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "152.115.61.52"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "152.115.61.52",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "152.115.61.52"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44224
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "BtnuUmcBTFzn_XoLAnDn",
-    "source": {
-      "@timestamp": "2018-11-27T02:09:48.280Z",
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "30394"
-      },
-      "source": {
-        "ip": "185.227.110.251"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "185.227.110.251"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44237,
-        "result": "fail"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "B9nuUmcBTFzn_XoLAnDn",
-    "source": {
-      "@timestamp": "2018-11-27T02:09:48.280Z",
-      "source": {
-        "ip": "185.227.110.251"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44238,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "185.227.110.251",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "30394"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "CNnuUmcBTFzn_XoLAnDn",
-    "source": {
-      "@timestamp": "2018-11-27T02:09:48.468Z",
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "30394",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "185.227.110.251"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "185.227.110.251"
-        },
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "185.227.110.251",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 44239,
-        "result": "fail",
-        "session": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "X9nuUmcBTFzn_XoLDHBr",
-    "source": {
-      "@timestamp": "2018-11-27T02:09:50.721Z",
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "source": {
-        "ip": "218.149.228.158"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "218.149.228.158",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184418,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "26142",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "YNnuUmcBTFzn_XoLDHBr",
-    "source": {
-      "@timestamp": "2018-11-27T02:09:50.722Z",
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "process": {
-        "pid": "26142",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "218.149.228.158"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "218.149.228.158",
-            "type": "user-session"
-          }
-        },
-        "sequence": 184419,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "YdnuUmcBTFzn_XoLDHBr",
-    "source": {
-      "@timestamp": "2018-11-27T02:09:51.346Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 184420,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "218.149.228.158",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "218.149.228.158"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "26142",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "218.149.228.158"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "79ntUmcBTFzn_XoLGltv",
-    "source": {
-      "@timestamp": "2018-11-27T02:08:48.772Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186566,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32556",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "8NntUmcBTFzn_XoLGltv",
-    "source": {
-      "@timestamp": "2018-11-27T02:08:48.774Z",
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186567,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32556",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "8dntUmcBTFzn_XoLGltv",
-    "source": {
-      "@timestamp": "2018-11-27T02:08:48.804Z",
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          }
-        },
-        "sequence": 186568,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "107.170.65.109",
-          "op": "PAM:bad_ident"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32556",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "99ntUmcBTFzn_XoLHFsj",
-    "source": {
-      "@timestamp": "2018-11-27T02:08:49.207Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "auditd": {
-        "sequence": 184409,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "145.239.82.62",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "26086",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "145.239.82.62"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "-NntUmcBTFzn_XoLHFsj",
-    "source": {
-      "@timestamp": "2018-11-27T02:08:49.208Z",
-      "auditd": {
-        "sequence": 184410,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "145.239.82.62",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "26086",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "145.239.82.62"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "-dntUmcBTFzn_XoLHFsj",
-    "source": {
-      "@timestamp": "2018-11-27T02:08:49.341Z",
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "26086"
-      },
-      "source": {
-        "ip": "145.239.82.62"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "145.239.82.62",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184411,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "145.239.82.62"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "CNntUmcBTFzn_XoLc2Oa",
-    "source": {
-      "@timestamp": "2018-11-27T02:09:11.600Z",
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "19924",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "109.115.54.245"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "auditd": {
-        "sequence": 142413,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "109.115.54.245",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "CdntUmcBTFzn_XoLc2Oa",
-    "source": {
-      "@timestamp": "2018-11-27T02:09:11.601Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "109.115.54.245",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142414,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        }
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "19924"
-      },
-      "source": {
-        "ip": "109.115.54.245"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "CtntUmcBTFzn_XoLc2Oa",
-    "source": {
-      "@timestamp": "2018-11-27T02:09:11.721Z",
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "19924",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "109.115.54.245"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "109.115.54.245",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "109.115.54.245",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142415
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "RNnuUmcBTFzn_XoLWnfO",
-    "source": {
-      "@timestamp": "2018-11-27T02:10:10.787Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32565"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          }
-        },
-        "sequence": 186569,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "RdnuUmcBTFzn_XoLWnfO",
-    "source": {
-      "@timestamp": "2018-11-27T02:10:10.788Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186570,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32565",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "RtnuUmcBTFzn_XoLWnfO",
-    "source": {
-      "@timestamp": "2018-11-27T02:10:10.819Z",
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32565",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186571,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "107.170.65.109",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          }
-        }
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "AdntUmcBTFzn_XoLiGV_",
-    "source": {
-      "@timestamp": "2018-11-27T02:09:16.902Z",
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "19926",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "71.90.181.64"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 142416,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "71.90.181.64",
-            "type": "user-session"
-          }
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "AtntUmcBTFzn_XoLiGV_",
-    "source": {
-      "@timestamp": "2018-11-27T02:09:16.903Z",
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "19926",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "source": {
-        "ip": "71.90.181.64"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "71.90.181.64",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 142417
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "A9ntUmcBTFzn_XoLiGV_",
-    "source": {
-      "@timestamp": "2018-11-27T02:09:16.974Z",
-      "auditd": {
-        "sequence": 142418,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "71.90.181.64"
-        },
-        "summary": {
-          "object": {
-            "secondary": "71.90.181.64",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "19926",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "71.90.181.64"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "2tntUmcBTFzn_XoLSl-h",
-    "source": {
-      "@timestamp": "2018-11-27T02:09:01.110Z",
-      "event": {
-        "type": "user_acct",
-        "action": "was-authorized",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "830",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 192568,
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "terminal": "cron",
-          "op": "PAM:accounting",
-          "acct": "root"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "29ntUmcBTFzn_XoLSl-h",
-    "source": {
-      "@timestamp": "2018-11-27T02:09:01.110Z",
-      "auditd": {
-        "sequence": 192569,
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "terminal": "cron",
-          "acct": "root",
-          "op": "PAM:setcred"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "action": "acquired-credentials",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "cred_acq"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "830",
-        "exe": "/usr/sbin/cron"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "3NntUmcBTFzn_XoLSl-h",
-    "source": {
-      "@timestamp": "2018-11-27T02:09:01.112Z",
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "user": {
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "auid": "0",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "830",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "data": {
-          "op": "PAM:session_open",
-          "acct": "root",
-          "terminal": "cron"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "cron"
-          },
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          }
-        },
-        "sequence": 192571,
-        "result": "success",
-        "session": "9864"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_start",
-        "action": "started-session"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "3dntUmcBTFzn_XoLSl-h",
-    "source": {
-      "@timestamp": "2018-11-27T02:09:01.215Z",
-      "user": {
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "auid": "0",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "830",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "sequence": 192572,
-        "result": "success",
-        "session": "9864",
-        "data": {
-          "op": "PAM:setcred",
-          "acct": "root",
-          "terminal": "cron"
-        },
-        "summary": {
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          }
-        }
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "cred_disp",
-        "action": "disposed-credentials",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "3tntUmcBTFzn_XoLSl-h",
-    "source": {
-      "@timestamp": "2018-11-27T02:09:01.216Z",
-      "user": {
-        "auid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "830",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "data": {
-          "op": "PAM:session_close",
-          "acct": "root",
-          "terminal": "cron"
-        },
-        "summary": {
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 192573,
-        "result": "success",
-        "session": "9864"
-      },
-      "beat": {
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "action": "ended-session",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_end"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "_dntUmcBTFzn_XoLTV_Y",
-    "source": {
-      "@timestamp": "2018-11-27T02:09:01.933Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_acct",
-        "action": "was-authorized",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "process": {
-        "pid": "26094",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "sequence": 184412,
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "terminal": "cron",
-          "op": "PAM:accounting",
-          "acct": "root"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "_tntUmcBTFzn_XoLTV_Y",
-    "source": {
-      "@timestamp": "2018-11-27T02:09:01.933Z",
-      "event": {
-        "category": "user-login",
-        "type": "cred_acq",
-        "action": "acquired-credentials",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "26094",
-        "exe": "/usr/sbin/cron"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 184413,
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "terminal": "cron",
-          "op": "PAM:setcred",
-          "acct": "root"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "_9ntUmcBTFzn_XoLTV_Y",
-    "source": {
-      "@timestamp": "2018-11-27T02:09:01.935Z",
-      "auditd": {
-        "result": "success",
-        "session": "9860",
-        "data": {
-          "terminal": "cron",
-          "acct": "root",
-          "op": "PAM:session_open"
-        },
-        "summary": {
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 184415
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "action": "started-session",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_start"
-      },
-      "user": {
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "auid": "0",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "26094",
-        "exe": "/usr/sbin/cron"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ANntUmcBTFzn_XoLTWDY",
-    "source": {
-      "@timestamp": "2018-11-27T02:09:02.034Z",
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "auditd": {
-        "session": "9860",
-        "data": {
-          "acct": "root",
-          "terminal": "cron",
-          "op": "PAM:setcred"
-        },
-        "summary": {
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          }
-        },
-        "sequence": 184416,
-        "result": "success"
-      },
-      "event": {
-        "action": "disposed-credentials",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "cred_disp"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "26094",
-        "exe": "/usr/sbin/cron"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "AdntUmcBTFzn_XoLTWDY",
-    "source": {
-      "@timestamp": "2018-11-27T02:09:02.035Z",
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_end",
-        "action": "ended-session"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root",
-          "auid": "root"
-        },
-        "auid": "0",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "26094",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "cron",
-          "acct": "root",
-          "op": "PAM:session_close"
-        },
-        "summary": {
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "secondary": "root",
-            "primary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "cron"
-          }
-        },
-        "sequence": 184417,
-        "result": "success",
-        "session": "9860"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "odnuUmcBTFzn_XoLa3iq",
-    "source": {
-      "@timestamp": "2018-11-27T02:10:15.075Z",
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "185.244.25.108"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          }
-        },
-        "sequence": 44240,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "30401"
-      },
-      "source": {
-        "ip": "185.244.25.108"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "otnuUmcBTFzn_XoLa3iq",
-    "source": {
-      "@timestamp": "2018-11-27T02:10:15.075Z",
-      "process": {
-        "pid": "30401",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "source": {
-        "ip": "185.244.25.108"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "185.244.25.108",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44241,
-        "result": "fail"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "o9nuUmcBTFzn_XoLa3iq",
-    "source": {
-      "@timestamp": "2018-11-27T02:10:15.175Z",
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "auditd": {
-        "data": {
-          "hostname": "185.244.25.108",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "185.244.25.108",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44242,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "30401",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "185.244.25.108"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "z9nuUmcBTFzn_XoLh3rt",
-    "source": {
-      "@timestamp": "2018-11-27T02:10:22.335Z",
-      "auditd": {
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "146.196.59.36",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          }
-        },
-        "sequence": 44243,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "30405",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "146.196.59.36"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "0NnuUmcBTFzn_XoLh3rt",
-    "source": {
-      "@timestamp": "2018-11-27T02:10:22.335Z",
-      "source": {
-        "ip": "146.196.59.36"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "146.196.59.36"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44244
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "30405",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "0dnuUmcBTFzn_XoLh3rt",
-    "source": {
-      "@timestamp": "2018-11-27T02:10:22.583Z",
-      "process": {
-        "pid": "30405",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "146.196.59.36"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44245,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "146.196.59.36",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "146.196.59.36"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "9tnuUmcBTFzn_XoLM3ME",
-    "source": {
-      "@timestamp": "2018-11-27T02:10:00.602Z",
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "module": "file_integrity",
-        "action": [
-          "created"
-        ]
-      },
-      "file": {
-        "size": 0,
-        "type": "file",
-        "uid": 0,
-        "owner": "root",
-        "group": "root",
-        "mode": "0000",
-        "mtime": "2018-11-27T02:10:00.596Z",
-        "gid": 0,
-        "inode": "185",
-        "path": "/etc/sed6b0EHM",
-        "ctime": "2018-11-27T02:10:00.596Z"
-      },
-      "hash": {
-        "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "99nuUmcBTFzn_XoLM3ME",
-    "source": {
-      "@timestamp": "2018-11-27T02:10:00.603Z",
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01"
-      },
-      "event": {
-        "module": "file_integrity",
-        "action": [
-          "updated"
-        ]
-      },
-      "file": {
-        "inode": "185",
-        "size": 50,
-        "type": "file",
-        "uid": 0,
-        "owner": "root",
-        "mode": "0000",
-        "path": "/etc/sed6b0EHM",
-        "group": "root",
-        "mtime": "2018-11-27T02:10:00.600Z",
-        "ctime": "2018-11-27T02:10:00.600Z",
-        "gid": 0
-      },
-      "hash": {
-        "sha1": "58a8b2bb04893785eb5a48598a16a3fa8ad2fa36"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "-NnuUmcBTFzn_XoLM3ME",
-    "source": {
-      "@timestamp": "2018-11-27T02:10:00.605Z",
-      "file": {
-        "path": "/etc/sed6b0EHM"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "module": "file_integrity",
-        "action": [
-          "attributes_modified"
-        ]
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "-dnuUmcBTFzn_XoLM3ME",
-    "source": {
-      "@timestamp": "2018-11-27T02:10:00.606Z",
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "module": "file_integrity",
-        "action": [
-          "moved"
-        ]
-      },
-      "file": {
-        "path": "/etc/sed6b0EHM"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "-tnuUmcBTFzn_XoLM3ME",
-    "source": {
-      "@timestamp": "2018-11-27T02:10:00.607Z",
-      "event": {
-        "action": [
-          "created"
-        ],
-        "module": "file_integrity"
-      },
-      "file": {
-        "owner": "root",
-        "uid": 0,
-        "mode": "0644",
-        "inode": "185",
-        "mtime": "2018-11-27T02:10:00.600Z",
-        "gid": 0,
-        "group": "root",
-        "path": "/etc/hosts",
-        "ctime": "2018-11-27T02:10:00.600Z",
-        "type": "file",
-        "size": 205
-      },
-      "hash": {
-        "sha1": "5a4ccf92aa02bc100c5b20faeed3691286e039e5"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "VdnzUmcBTFzn_XoLR-PG",
-    "source": {
-      "@timestamp": "2018-11-27T02:15:33.590Z",
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "51.75.23.199",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43238
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "13014",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "51.75.23.199"
-      },
-      "beat": {
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "VtnzUmcBTFzn_XoLR-PG",
-    "source": {
-      "@timestamp": "2018-11-27T02:15:33.590Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "13014"
-      },
-      "source": {
-        "ip": "51.75.23.199"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 43239,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "51.75.23.199",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "V9nzUmcBTFzn_XoLR-PG",
-    "source": {
-      "@timestamp": "2018-11-27T02:15:33.702Z",
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "13014",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "51.75.23.199"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "51.75.23.199",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43240,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "51.75.23.199"
-        }
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "beat": {
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "3tnzUmcBTFzn_XoLUOOL",
-    "source": {
-      "@timestamp": "2018-11-27T02:15:35.841Z",
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "939"
-      },
-      "source": {
-        "ip": "181.28.191.54"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "181.28.191.54",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192586,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "39nzUmcBTFzn_XoLUOOL",
-    "source": {
-      "@timestamp": "2018-11-27T02:15:35.843Z",
-      "auditd": {
-        "sequence": 192587,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "181.28.191.54",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "939"
-      },
-      "source": {
-        "ip": "181.28.191.54"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "4NnzUmcBTFzn_XoLUOOL",
-    "source": {
-      "@timestamp": "2018-11-27T02:15:36.030Z",
-      "auditd": {
-        "sequence": 192588,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "181.28.191.54",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "181.28.191.54"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        }
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "939",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "181.28.191.54"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "-NnxUmcBTFzn_XoLYbnr",
-    "source": {
-      "@timestamp": "2018-11-27T02:13:29.217Z",
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "180.76.239.66"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 184427,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "26172"
-      },
-      "source": {
-        "ip": "180.76.239.66"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "-dnxUmcBTFzn_XoLYbnr",
-    "source": {
-      "@timestamp": "2018-11-27T02:13:29.218Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "26172",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "source": {
-        "ip": "180.76.239.66"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "180.76.239.66"
-          }
-        },
-        "sequence": 184428,
-        "result": "fail",
-        "session": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "-tnxUmcBTFzn_XoLYbnr",
-    "source": {
-      "@timestamp": "2018-11-27T02:13:29.430Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 184429,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "180.76.239.66",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "180.76.239.66",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "process": {
-        "pid": "26172",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "180.76.239.66"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "H9nxUmcBTFzn_XoLY7rL",
-    "source": {
-      "@timestamp": "2018-11-27T02:13:29.694Z",
-      "process": {
-        "pid": "30475",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "164.132.43.198"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44252,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "164.132.43.198",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "INnxUmcBTFzn_XoLY7rL",
-    "source": {
-      "@timestamp": "2018-11-27T02:13:29.694Z",
-      "source": {
-        "ip": "164.132.43.198"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "164.132.43.198",
-            "type": "user-session"
-          }
-        },
-        "sequence": 44253,
-        "result": "fail"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "process": {
-        "pid": "30475",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "IdnxUmcBTFzn_XoLY7rL",
-    "source": {
-      "@timestamp": "2018-11-27T02:13:29.798Z",
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "30475",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "164.132.43.198"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "164.132.43.198",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "164.132.43.198",
-            "type": "user-session"
-          }
-        },
-        "sequence": 44254
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "LtnwUmcBTFzn_XoL5q-R",
-    "source": {
-      "@timestamp": "2018-11-27T02:12:57.636Z",
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32583"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186578,
-        "result": "fail",
-        "session": "unset"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "L9nwUmcBTFzn_XoL5q-R",
-    "source": {
-      "@timestamp": "2018-11-27T02:12:57.638Z",
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186579
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32583",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "MNnwUmcBTFzn_XoL5q-R",
-    "source": {
-      "@timestamp": "2018-11-27T02:12:57.669Z",
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "107.170.65.109",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186580
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32583",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ctnyUmcBTFzn_XoLDsgI",
-    "source": {
-      "@timestamp": "2018-11-27T02:14:13.278Z",
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32591"
-      },
-      "source": {
-        "ip": "182.61.32.147"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186581,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "182.61.32.147"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "c9nyUmcBTFzn_XoLDsgI",
-    "source": {
-      "@timestamp": "2018-11-27T02:14:13.279Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "182.61.32.147",
-            "type": "user-session"
-          }
-        },
-        "sequence": 186582,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32591"
-      },
-      "source": {
-        "ip": "182.61.32.147"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "dNnyUmcBTFzn_XoLDsgI",
-    "source": {
-      "@timestamp": "2018-11-27T02:14:13.485Z",
-      "source": {
-        "ip": "182.61.32.147"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "sequence": 186583,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "182.61.32.147"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "182.61.32.147",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32591"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "M9nyUmcBTFzn_XoLLcvi",
-    "source": {
-      "@timestamp": "2018-11-27T02:14:21.431Z",
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186584,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "object": {
-            "secondary": "107.170.65.109",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        }
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32593"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "NNnyUmcBTFzn_XoLLcvi",
-    "source": {
-      "@timestamp": "2018-11-27T02:14:21.432Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "107.170.65.109"
-          }
-        },
-        "sequence": 186585,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        }
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32593",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "NdnyUmcBTFzn_XoLLcvi",
-    "source": {
-      "@timestamp": "2018-11-27T02:14:21.462Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186586,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "107.170.65.109",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32593",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "NdnxUmcBTFzn_XoL1sT3",
-    "source": {
-      "@timestamp": "2018-11-27T02:13:59.181Z",
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "924",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "source": {
-        "ip": "201.155.38.30"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "201.155.38.30"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 192580,
-        "result": "fail"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "NtnxUmcBTFzn_XoL1sT3",
-    "source": {
-      "@timestamp": "2018-11-27T02:13:59.183Z",
-      "source": {
-        "ip": "201.155.38.30"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "201.155.38.30",
-            "type": "user-session",
-            "primary": "sshd"
-          }
-        },
-        "sequence": 192581,
-        "result": "fail"
-      },
-      "beat": {
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "924",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "N9nxUmcBTFzn_XoL1sT3",
-    "source": {
-      "@timestamp": "2018-11-27T02:13:59.755Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "924",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "201.155.38.30"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "201.155.38.30"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "201.155.38.30"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192582,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "I9nxUmcBTFzn_XoL58U9",
-    "source": {
-      "@timestamp": "2018-11-27T02:14:03.342Z",
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "13001"
-      },
-      "source": {
-        "ip": "137.74.199.177"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 43235,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "137.74.199.177"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "beat": {
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "JNnxUmcBTFzn_XoL58U9",
-    "source": {
-      "@timestamp": "2018-11-27T02:14:03.342Z",
-      "beat": {
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "13001",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "137.74.199.177"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 43236,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "137.74.199.177",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "JdnxUmcBTFzn_XoL58U9",
-    "source": {
-      "@timestamp": "2018-11-27T02:14:03.458Z",
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "137.74.199.177",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "137.74.199.177",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43237,
-        "result": "fail"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "13001"
-      },
-      "source": {
-        "ip": "137.74.199.177"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "jNnzUmcBTFzn_XoLLeBy",
-    "source": {
-      "@timestamp": "2018-11-27T02:15:26.857Z",
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "process": {
-        "pid": "937",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "190.0.10.138"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "190.0.10.138",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192583,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        }
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "jdnzUmcBTFzn_XoLLeBy",
-    "source": {
-      "@timestamp": "2018-11-27T02:15:26.858Z",
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "937",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "190.0.10.138"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "190.0.10.138"
-          }
-        },
-        "sequence": 192584,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "jtnzUmcBTFzn_XoLLeBy",
-    "source": {
-      "@timestamp": "2018-11-27T02:15:26.950Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "process": {
-        "pid": "937",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "190.0.10.138"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "190.0.10.138"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "190.0.10.138",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192585
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "n9nzUmcBTFzn_XoLXeXh",
-    "source": {
-      "@timestamp": "2018-11-27T02:15:39.252Z",
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "142.93.18.15"
-          }
-        },
-        "sequence": 44255,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "30517",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "142.93.18.15"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "oNnzUmcBTFzn_XoLXeXh",
-    "source": {
-      "@timestamp": "2018-11-27T02:15:39.252Z",
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "30517",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "142.93.18.15"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "142.93.18.15",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 44256
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "odnzUmcBTFzn_XoLXeXh",
-    "source": {
-      "@timestamp": "2018-11-27T02:15:39.292Z",
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "30517",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "142.93.18.15"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "142.93.18.15",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 44257,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "142.93.18.15",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Utr3UmcBTFzn_XoLVD0D",
-    "source": {
-      "@timestamp": "2018-11-27T02:19:58.873Z",
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "secondary": "164.132.197.108",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          }
-        },
-        "sequence": 184439,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "26214",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "164.132.197.108"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "U9r3UmcBTFzn_XoLVD0D",
-    "source": {
-      "@timestamp": "2018-11-27T02:19:58.874Z",
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "26214",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "164.132.197.108"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "164.132.197.108",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184440
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "VNr3UmcBTFzn_XoLVD0D",
-    "source": {
-      "@timestamp": "2018-11-27T02:19:58.986Z",
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "164.132.197.108"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "164.132.197.108",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184441,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "26214",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "164.132.197.108"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ltr3UmcBTFzn_XoLWD2x",
-    "source": {
-      "@timestamp": "2018-11-27T02:20:00.071Z",
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32625",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186602,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "l9r3UmcBTFzn_XoLWD2x",
-    "source": {
-      "@timestamp": "2018-11-27T02:20:00.072Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186603,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "107.170.65.109",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32625",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "mNr3UmcBTFzn_XoLWD2x",
-    "source": {
-      "@timestamp": "2018-11-27T02:20:00.103Z",
-      "process": {
-        "pid": "32625",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          }
-        },
-        "sequence": 186604,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "107.170.65.109",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        }
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "htr4UmcBTFzn_XoLpVlZ",
-    "source": {
-      "@timestamp": "2018-11-27T02:21:25.223Z",
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "37.195.105.57"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43262,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "13059",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "37.195.105.57"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "h9r4UmcBTFzn_XoLpVlZ",
-    "source": {
-      "@timestamp": "2018-11-27T02:21:25.227Z",
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "13059",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "37.195.105.57"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "37.195.105.57",
-            "type": "user-session"
-          }
-        },
-        "sequence": 43263,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "iNr4UmcBTFzn_XoLpVlZ",
-    "source": {
-      "@timestamp": "2018-11-27T02:21:25.431Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "13059",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "37.195.105.57"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "auditd": {
-        "sequence": 43264,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "37.195.105.57",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "37.195.105.57",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "idr4UmcBTFzn_XoLpVnm",
-    "source": {
-      "@timestamp": "2018-11-27T02:21:25.372Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32633"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186605,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "itr4UmcBTFzn_XoLpVnm",
-    "source": {
-      "@timestamp": "2018-11-27T02:21:25.373Z",
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          }
-        },
-        "sequence": 186606,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "process": {
-        "pid": "32633",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "i9r4UmcBTFzn_XoLpVnm",
-    "source": {
-      "@timestamp": "2018-11-27T02:21:25.404Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32633",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "hostname": "107.170.65.109",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          }
-        },
-        "sequence": 186607,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "6Nr4UmcBTFzn_XoL4l6d",
-    "source": {
-      "@timestamp": "2018-11-27T02:21:40.914Z",
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "20001",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "82.62.233.163"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 142431,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "82.62.233.163",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "6dr4UmcBTFzn_XoL4l6d",
-    "source": {
-      "@timestamp": "2018-11-27T02:21:40.915Z",
-      "process": {
-        "pid": "20001",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "source": {
-        "ip": "82.62.233.163"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "82.62.233.163",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142432,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "6tr4UmcBTFzn_XoL4l6d",
-    "source": {
-      "@timestamp": "2018-11-27T02:21:41.064Z",
-      "source": {
-        "ip": "82.62.233.163"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "82.62.233.163"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "82.62.233.163",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142433,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "20001",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Xtr5UmcBTFzn_XoL9Ha7",
-    "source": {
-      "@timestamp": "2018-11-27T02:22:51.088Z",
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32641"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186608,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "X9r5UmcBTFzn_XoL9Ha7",
-    "source": {
-      "@timestamp": "2018-11-27T02:22:51.090Z",
-      "auditd": {
-        "sequence": 186609,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          }
-        }
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32641",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "YNr5UmcBTFzn_XoL9Ha7",
-    "source": {
-      "@timestamp": "2018-11-27T02:22:51.120Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32641",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186610,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "107.170.65.109"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          }
-        }
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ZNr5UmcBTFzn_XoL03NO",
-    "source": {
-      "@timestamp": "2018-11-27T02:22:42.532Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "104.248.11.46",
-            "type": "user-session",
-            "primary": "sshd"
-          }
-        },
-        "sequence": 192601
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "986",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "104.248.11.46"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Zdr5UmcBTFzn_XoL03NO",
-    "source": {
-      "@timestamp": "2018-11-27T02:22:42.533Z",
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "986"
-      },
-      "source": {
-        "ip": "104.248.11.46"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "104.248.11.46",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192602
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Ztr5UmcBTFzn_XoL03NO",
-    "source": {
-      "@timestamp": "2018-11-27T02:22:42.564Z",
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "986"
-      },
-      "source": {
-        "ip": "104.248.11.46"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "hostname": "104.248.11.46",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "104.248.11.46",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192603,
-        "result": "fail"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Xdr5UmcBTFzn_XoL23R3",
-    "source": {
-      "@timestamp": "2018-11-27T02:22:44.622Z",
-      "source": {
-        "ip": "91.67.54.251"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "91.67.54.251"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192604,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        }
-      },
-      "beat": {
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "988",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Xtr5UmcBTFzn_XoL23R3",
-    "source": {
-      "@timestamp": "2018-11-27T02:22:44.623Z",
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "988",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "91.67.54.251"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "auditd": {
-        "sequence": 192605,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "91.67.54.251",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "X9r5UmcBTFzn_XoL23R3",
-    "source": {
-      "@timestamp": "2018-11-27T02:22:44.754Z",
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "988",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "91.67.54.251"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "91.67.54.251"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "91.67.54.251",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192606,
-        "result": "fail"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "INr4UmcBTFzn_XoLPlHT",
-    "source": {
-      "@timestamp": "2018-11-27T02:20:58.980Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "30623"
-      },
-      "source": {
-        "ip": "35.189.59.154"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "35.189.59.154",
-            "type": "user-session",
-            "primary": "sshd"
-          }
-        },
-        "sequence": 44267,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        }
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Idr4UmcBTFzn_XoLPlHT",
-    "source": {
-      "@timestamp": "2018-11-27T02:20:58.980Z",
-      "source": {
-        "ip": "35.189.59.154"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "35.189.59.154"
-          }
-        },
-        "sequence": 44268,
-        "result": "fail"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "30623",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Itr4UmcBTFzn_XoLPlHT",
-    "source": {
-      "@timestamp": "2018-11-27T02:20:59.156Z",
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "35.189.59.154",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "35.189.59.154",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 44269
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "30623",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "35.189.59.154"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "7Nr3UmcBTFzn_XoLyEYO",
-    "source": {
-      "@timestamp": "2018-11-27T02:20:28.574Z",
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "30616"
-      },
-      "source": {
-        "ip": "91.196.149.76"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44264,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "91.196.149.76",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "beat": {
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "7dr3UmcBTFzn_XoLyEYO",
-    "source": {
-      "@timestamp": "2018-11-27T02:20:28.574Z",
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "91.196.149.76",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44265,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "30616"
-      },
-      "source": {
-        "ip": "91.196.149.76"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "7tr3UmcBTFzn_XoLyEYO",
-    "source": {
-      "@timestamp": "2018-11-27T02:20:28.710Z",
-      "process": {
-        "pid": "30616",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "91.196.149.76"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "91.196.149.76"
-        },
-        "summary": {
-          "object": {
-            "secondary": "91.196.149.76",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          }
-        },
-        "sequence": 44266,
-        "result": "fail",
-        "session": "unset"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "str3UmcBTFzn_XoLOzru",
-    "source": {
-      "@timestamp": "2018-11-27T02:19:52.704Z",
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "13051",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "193.70.38.229"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 43259,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "193.70.38.229",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "s9r3UmcBTFzn_XoLOzru",
-    "source": {
-      "@timestamp": "2018-11-27T02:19:52.704Z",
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "process": {
-        "pid": "13051",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "193.70.38.229"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "193.70.38.229",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43260,
-        "result": "fail",
-        "session": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "tNr3UmcBTFzn_XoLOzru",
-    "source": {
-      "@timestamp": "2018-11-27T02:19:52.820Z",
-      "process": {
-        "pid": "13051",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "193.70.38.229"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "193.70.38.229"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "193.70.38.229",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43261,
-        "result": "fail"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "O9r9UmcBTFzn_XoL4syL",
-    "source": {
-      "@timestamp": "2018-11-27T02:27:08.552Z",
-      "source": {
-        "ip": "150.95.110.147"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "150.95.110.147",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43265,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "process": {
-        "pid": "13101",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "PNr9UmcBTFzn_XoL4syL",
-    "source": {
-      "@timestamp": "2018-11-27T02:27:08.552Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "13101",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "150.95.110.147"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "150.95.110.147",
-            "type": "user-session"
-          }
-        },
-        "sequence": 43266
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Pdr9UmcBTFzn_XoL4syL",
-    "source": {
-      "@timestamp": "2018-11-27T02:27:08.760Z",
-      "beat": {
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "150.95.110.147"
-        },
-        "summary": {
-          "object": {
-            "secondary": "150.95.110.147",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 43267,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "13101"
-      },
-      "source": {
-        "ip": "150.95.110.147"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "5tr9UmcBTFzn_XoL7Mz5",
-    "source": {
-      "@timestamp": "2018-11-27T02:27:11.246Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186617,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32666"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "59r9UmcBTFzn_XoL7Mz5",
-    "source": {
-      "@timestamp": "2018-11-27T02:27:11.247Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32666"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186618,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        }
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "6Nr9UmcBTFzn_XoL7Mz5",
-    "source": {
-      "@timestamp": "2018-11-27T02:27:11.279Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32666",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "107.170.65.109",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "107.170.65.109",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186619,
-        "result": "fail"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "qtr7UmcBTFzn_XoLqZv2",
-    "source": {
-      "@timestamp": "2018-11-27T02:24:43.020Z",
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "134.175.33.189"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142434
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "20021",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "134.175.33.189"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "q9r7UmcBTFzn_XoLqZv2",
-    "source": {
-      "@timestamp": "2018-11-27T02:24:43.021Z",
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "134.175.33.189",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142435,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "20021",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "134.175.33.189"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "beat": {
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-haproxy-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "rNr7UmcBTFzn_XoLqZv2",
-    "source": {
-      "@timestamp": "2018-11-27T02:24:43.229Z",
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "auditd": {
-        "sequence": 142436,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "134.175.33.189",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "134.175.33.189",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "20021"
-      },
-      "source": {
-        "ip": "134.175.33.189"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "V9r7UmcBTFzn_XoLRZIS",
-    "source": {
-      "@timestamp": "2018-11-27T02:24:17.192Z",
-      "process": {
-        "pid": "32649",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186611,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "WNr7UmcBTFzn_XoLRZIS",
-    "source": {
-      "@timestamp": "2018-11-27T02:24:17.193Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 186612,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32649",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Wdr7UmcBTFzn_XoLRZIS",
-    "source": {
-      "@timestamp": "2018-11-27T02:24:17.223Z",
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32649",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 186613,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "107.170.65.109",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        }
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "tdr8UmcBTFzn_XoLmK-a",
-    "source": {
-      "@timestamp": "2018-11-27T02:25:44.112Z",
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186614
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32658",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ttr8UmcBTFzn_XoLmK-a",
-    "source": {
-      "@timestamp": "2018-11-27T02:25:44.114Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186615,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32658"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "t9r8UmcBTFzn_XoLmK-a",
-    "source": {
-      "@timestamp": "2018-11-27T02:25:44.144Z",
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "107.170.65.109",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186616
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32658",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Kdr8UmcBTFzn_XoL8rcs",
-    "source": {
-      "@timestamp": "2018-11-27T02:26:07.005Z",
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "1003",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "144.217.12.168"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "144.217.12.168",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          }
-        },
-        "sequence": 192607,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Ktr8UmcBTFzn_XoL8rcs",
-    "source": {
-      "@timestamp": "2018-11-27T02:26:07.006Z",
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "1003",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "144.217.12.168"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "144.217.12.168",
-            "type": "user-session"
-          }
-        },
-        "sequence": 192608
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "K9r8UmcBTFzn_XoL8rcs",
-    "source": {
-      "@timestamp": "2018-11-27T02:26:07.048Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "1003",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "144.217.12.168"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "144.217.12.168",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "144.217.12.168",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 192609
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "6dr7UmcBTFzn_XoLa5XB",
-    "source": {
-      "@timestamp": "2018-11-27T02:24:27.095Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "26248",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "159.138.6.50"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "159.138.6.50",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184442,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        }
-      },
-      "beat": {
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "6tr7UmcBTFzn_XoLa5XB",
-    "source": {
-      "@timestamp": "2018-11-27T02:24:27.096Z",
-      "process": {
-        "pid": "26248",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "159.138.6.50"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 184443,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "159.138.6.50",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "69r7UmcBTFzn_XoLa5XB",
-    "source": {
-      "@timestamp": "2018-11-27T02:24:27.306Z",
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "26248",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "159.138.6.50"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "hostname": "159.138.6.50",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "159.138.6.50",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 184444,
-        "result": "fail",
-        "session": "unset"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "mdr9UmcBTFzn_XoLS7_z",
-    "source": {
-      "@timestamp": "2018-11-27T02:26:30.024Z",
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "178.33.228.67",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192610,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "1010",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "178.33.228.67"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "mtr9UmcBTFzn_XoLS7_z",
-    "source": {
-      "@timestamp": "2018-11-27T02:26:30.025Z",
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "1010",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "178.33.228.67"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "178.33.228.67",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192611,
-        "result": "fail"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "m9r9UmcBTFzn_XoLS7_z",
-    "source": {
-      "@timestamp": "2018-11-27T02:26:30.133Z",
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "178.33.228.67",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "178.33.228.67",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192612,
-        "result": "fail"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "1010"
-      },
-      "source": {
-        "ip": "178.33.228.67"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Gdr-UmcBTFzn_XoLHdFd",
-    "source": {
-      "@timestamp": "2018-11-27T02:27:23.630Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "213.34.172.74",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44273
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "30753"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "source": {
-        "ip": "213.34.172.74"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Gtr-UmcBTFzn_XoLHdFd",
-    "source": {
-      "@timestamp": "2018-11-27T02:27:23.634Z",
-      "source": {
-        "ip": "213.34.172.74"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "213.34.172.74",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44274
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "beat": {
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "30753"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "G9r-UmcBTFzn_XoLHdFd",
-    "source": {
-      "@timestamp": "2018-11-27T02:27:23.758Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "30753",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "source": {
-        "ip": "213.34.172.74"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44275,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "213.34.172.74",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "213.34.172.74",
-            "type": "user-session"
-          }
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "o9r7UmcBTFzn_XoLJpB1",
-    "source": {
-      "@timestamp": "2018-11-27T02:24:09.351Z",
-      "process": {
-        "pid": "30690",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "175.205.114.52"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "175.205.114.52",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44270
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "pNr7UmcBTFzn_XoLJpB1",
-    "source": {
-      "@timestamp": "2018-11-27T02:24:09.351Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "175.205.114.52",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44271,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "30690",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "175.205.114.52"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "pdr7UmcBTFzn_XoLJpB1",
-    "source": {
-      "@timestamp": "2018-11-27T02:24:09.523Z",
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "175.205.114.52"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "175.205.114.52",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44272
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "30690"
-      },
-      "source": {
-        "ip": "175.205.114.52"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "3NsDU2cBTFzn_XoLlEgC",
-    "source": {
-      "@timestamp": "2018-11-27T02:33:21.687Z",
-      "auditd": {
-        "sequence": 186632,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "92.86.47.26",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "92.86.47.26"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32702",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "92.86.47.26"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "a9sDU2cBTFzn_XoLmUlp",
-    "source": {
-      "@timestamp": "2018-11-27T02:33:23.071Z",
-      "auditd": {
-        "sequence": 192616,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "145.239.137.89"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "1048"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "source": {
-        "ip": "145.239.137.89"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "bNsDU2cBTFzn_XoLmUlp",
-    "source": {
-      "@timestamp": "2018-11-27T02:33:23.072Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "1048",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "145.239.137.89"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "145.239.137.89",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192617
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "bdsDU2cBTFzn_XoLmUlp",
-    "source": {
-      "@timestamp": "2018-11-27T02:33:23.187Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "145.239.137.89",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "145.239.137.89"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192618,
-        "result": "fail"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "1048",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "145.239.137.89"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "f9sDU2cBTFzn_XoLp0rb",
-    "source": {
-      "@timestamp": "2018-11-27T02:33:26.769Z",
-      "auditd": {
-        "sequence": 142437,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "115.113.54.122",
-            "type": "user-session"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "20065",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "115.113.54.122"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "gNsDU2cBTFzn_XoLp0rb",
-    "source": {
-      "@timestamp": "2018-11-27T02:33:26.771Z",
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "115.113.54.122",
-            "type": "user-session"
-          }
-        },
-        "sequence": 142438,
-        "result": "fail"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "process": {
-        "pid": "20065",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "115.113.54.122"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "gdsDU2cBTFzn_XoLp0rb",
-    "source": {
-      "@timestamp": "2018-11-27T02:33:27.053Z",
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "20065",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "115.113.54.122"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "115.113.54.122",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "115.113.54.122",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142439,
-        "result": "fail"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "J9sGU2cBTFzn_XoLiIku",
-    "source": {
-      "@timestamp": "2018-11-27T02:36:35.268Z",
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "beat": {
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01"
-      },
-      "process": {
-        "pid": "26335",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "37.59.9.162"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "37.59.9.162"
-          }
-        },
-        "sequence": 184445
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "KNsGU2cBTFzn_XoLiIku",
-    "source": {
-      "@timestamp": "2018-11-27T02:36:35.269Z",
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "26335"
-      },
-      "source": {
-        "ip": "37.59.9.162"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "37.59.9.162"
-          }
-        },
-        "sequence": 184446
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "KdsGU2cBTFzn_XoLiIku",
-    "source": {
-      "@timestamp": "2018-11-27T02:36:35.380Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "26335",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "37.59.9.162"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "37.59.9.162",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184447,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "37.59.9.162",
-          "terminal": "ssh"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "uNsFU2cBTFzn_XoLNGx8",
-    "source": {
-      "@timestamp": "2018-11-27T02:35:08.305Z",
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "source": {
-        "ip": "81.174.25.52"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "81.174.25.52"
-          }
-        },
-        "sequence": 192619
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "1062",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "udsFU2cBTFzn_XoLNGx8",
-    "source": {
-      "@timestamp": "2018-11-27T02:35:08.307Z",
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "1062",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "81.174.25.52"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192620,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "81.174.25.52"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          }
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "utsFU2cBTFzn_XoLNGx8",
-    "source": {
-      "@timestamp": "2018-11-27T02:35:08.440Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "81.174.25.52"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "81.174.25.52",
-            "type": "user-session"
-          }
-        },
-        "sequence": 192621
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "1062",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "81.174.25.52"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "yNsFU2cBTFzn_XoLA2fV",
-    "source": {
-      "@timestamp": "2018-11-27T02:34:55.845Z",
-      "source": {
-        "ip": "74.208.43.208"
-      },
-      "beat": {
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "74.208.43.208",
-            "type": "user-session",
-            "primary": "sshd"
-          }
-        },
-        "sequence": 44282,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        }
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "30899"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ydsFU2cBTFzn_XoLA2fV",
-    "source": {
-      "@timestamp": "2018-11-27T02:34:55.849Z",
-      "source": {
-        "ip": "74.208.43.208"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "74.208.43.208",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44283,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        }
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "30899",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ytsFU2cBTFzn_XoLA2fV",
-    "source": {
-      "@timestamp": "2018-11-27T02:34:55.873Z",
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "30899"
-      },
-      "source": {
-        "ip": "74.208.43.208"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "74.208.43.208",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "object": {
-            "secondary": "74.208.43.208",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 44284
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "vNsHU2cBTFzn_XoLOZig",
-    "source": {
-      "@timestamp": "2018-11-27T02:37:20.688Z",
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "30953",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "87.249.215.83"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44289,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "87.249.215.83"
-          }
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "vdsHU2cBTFzn_XoLOZig",
-    "source": {
-      "@timestamp": "2018-11-27T02:37:20.688Z",
-      "source": {
-        "ip": "87.249.215.83"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "87.249.215.83",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          }
-        },
-        "sequence": 44290,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "30953"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "vtsHU2cBTFzn_XoLOZig",
-    "source": {
-      "@timestamp": "2018-11-27T02:37:20.864Z",
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "30953",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "87.249.215.83"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "87.249.215.83"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "87.249.215.83"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44291,
-        "result": "fail"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "MtsEU2cBTFzn_XoLzWOC",
-    "source": {
-      "@timestamp": "2018-11-27T02:34:41.940Z",
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "30892",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "175.116.217.13"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "175.116.217.13",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44279,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "M9sEU2cBTFzn_XoLzWOC",
-    "source": {
-      "@timestamp": "2018-11-27T02:34:41.944Z",
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "30892",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "175.116.217.13"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "175.116.217.13",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 44280,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "NNsEU2cBTFzn_XoLzWOC",
-    "source": {
-      "@timestamp": "2018-11-27T02:34:42.116Z",
-      "auditd": {
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "175.116.217.13"
-        },
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "175.116.217.13",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 44281,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "30892",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "175.116.217.13"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "59sHU2cBTFzn_XoLBZOc",
-    "source": {
-      "@timestamp": "2018-11-27T02:37:07.375Z",
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "30947",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "45.55.190.46"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "45.55.190.46"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44286
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "6NsHU2cBTFzn_XoLBZOc",
-    "source": {
-      "@timestamp": "2018-11-27T02:37:07.375Z",
-      "auditd": {
-        "sequence": 44287,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "45.55.190.46",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "30947",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "45.55.190.46"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "6dsHU2cBTFzn_XoLBZOc",
-    "source": {
-      "@timestamp": "2018-11-27T02:37:07.407Z",
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "source": {
-        "ip": "45.55.190.46"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "45.55.190.46",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "45.55.190.46",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44288
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "30947",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Y9sGU2cBTFzn_XoL6ZGy",
-    "source": {
-      "@timestamp": "2018-11-27T02:37:00.227Z",
-      "source": {
-        "ip": "103.48.12.177"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44285,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "103.48.12.177",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "103.48.12.177"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        }
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "process": {
-        "pid": "30943",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "JNsJU2cBTFzn_XoLCcBJ",
-    "source": {
-      "@timestamp": "2018-11-27T02:39:19.382Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "secondary": "167.99.84.229",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 43278,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "13175",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "167.99.84.229"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "JdsJU2cBTFzn_XoLCcBJ",
-    "source": {
-      "@timestamp": "2018-11-27T02:39:19.386Z",
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "13175"
-      },
-      "source": {
-        "ip": "167.99.84.229"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 43279,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "167.99.84.229",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "JtsJU2cBTFzn_XoLCcBJ",
-    "source": {
-      "@timestamp": "2018-11-27T02:39:19.486Z",
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "13175"
-      },
-      "source": {
-        "ip": "167.99.84.229"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "hostname": "167.99.84.229",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "167.99.84.229",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          }
-        },
-        "sequence": 43280,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "J9sJU2cBTFzn_XoLCcCX",
-    "source": {
-      "@timestamp": "2018-11-27T02:39:19.468Z",
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "89.223.28.0",
-            "type": "user-session"
-          }
-        },
-        "sequence": 184454,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "26405",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "89.223.28.0"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "KNsJU2cBTFzn_XoLCcCX",
-    "source": {
-      "@timestamp": "2018-11-27T02:39:19.469Z",
-      "source": {
-        "ip": "89.223.28.0"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "89.223.28.0",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184455
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "26405",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "KdsJU2cBTFzn_XoLCcCX",
-    "source": {
-      "@timestamp": "2018-11-27T02:39:19.630Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "26405"
-      },
-      "source": {
-        "ip": "89.223.28.0"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "hostname": "89.223.28.0",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "89.223.28.0",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184456,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "7dsJU2cBTFzn_XoLVsZ3",
-    "source": {
-      "@timestamp": "2018-11-27T02:39:39.149Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "188.166.58.40",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192640,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "process": {
-        "pid": "1141",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "188.166.58.40"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "7tsJU2cBTFzn_XoLVsZ3",
-    "source": {
-      "@timestamp": "2018-11-27T02:39:39.150Z",
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "188.166.58.40",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192641,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "1141",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "188.166.58.40"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "79sJU2cBTFzn_XoLVsZ3",
-    "source": {
-      "@timestamp": "2018-11-27T02:39:39.256Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "1141"
-      },
-      "source": {
-        "ip": "188.166.58.40"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "188.166.58.40",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "188.166.58.40",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192642
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "KtsJU2cBTFzn_XoLWMfm",
-    "source": {
-      "@timestamp": "2018-11-27T02:39:39.771Z",
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "139.59.171.172",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44295
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "31024",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "139.59.171.172"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "K9sJU2cBTFzn_XoLWMfm",
-    "source": {
-      "@timestamp": "2018-11-27T02:39:39.771Z",
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "31024",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "139.59.171.172"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "139.59.171.172"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 44296,
-        "result": "fail",
-        "session": "unset"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "LNsJU2cBTFzn_XoLWMfm",
-    "source": {
-      "@timestamp": "2018-11-27T02:39:39.863Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "31024",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "139.59.171.172"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "hostname": "139.59.171.172",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "139.59.171.172"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 44297,
-        "result": "fail"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "HNsIU2cBTFzn_XoLc7MQ",
-    "source": {
-      "@timestamp": "2018-11-27T02:38:40.934Z",
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "1086"
-      },
-      "source": {
-        "ip": "139.99.168.192"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "139.99.168.192",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192628,
-        "result": "fail"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "HdsIU2cBTFzn_XoLc7MQ",
-    "source": {
-      "@timestamp": "2018-11-27T02:38:40.935Z",
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "process": {
-        "pid": "1086",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "139.99.168.192"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "139.99.168.192"
-          }
-        },
-        "sequence": 192629,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "HtsIU2cBTFzn_XoLc7MQ",
-    "source": {
-      "@timestamp": "2018-11-27T02:38:41.215Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "hostname": "139.99.168.192",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "139.99.168.192",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192630,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "1086",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "139.99.168.192"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "nNsJU2cBTFzn_XoLTcVS",
-    "source": {
-      "@timestamp": "2018-11-27T02:39:36.808Z",
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "1139",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "source": {
-        "ip": "52.60.179.151"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "52.60.179.151",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192637,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        }
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ndsJU2cBTFzn_XoLTcVS",
-    "source": {
-      "@timestamp": "2018-11-27T02:39:36.809Z",
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "52.60.179.151",
-            "type": "user-session"
-          }
-        },
-        "sequence": 192638,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "1139",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "52.60.179.151"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ntsJU2cBTFzn_XoLTcVS",
-    "source": {
-      "@timestamp": "2018-11-27T02:39:36.855Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "52.60.179.151"
-        },
-        "summary": {
-          "object": {
-            "secondary": "52.60.179.151",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 192639,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "1139",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "52.60.179.151"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "sNsHU2cBTFzn_XoLr6LF",
-    "source": {
-      "@timestamp": "2018-11-27T02:37:50.939Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "1076",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "37.187.114.136"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "37.187.114.136",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 192622
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "sdsHU2cBTFzn_XoLr6LF",
-    "source": {
-      "@timestamp": "2018-11-27T02:37:50.940Z",
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "37.187.114.136",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192623
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "1076",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "37.187.114.136"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "stsHU2cBTFzn_XoLr6LF",
-    "source": {
-      "@timestamp": "2018-11-27T02:37:51.046Z",
-      "auditd": {
-        "sequence": 192624,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "37.187.114.136",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "37.187.114.136"
-          }
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "1076",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "37.187.114.136"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "M9sIU2cBTFzn_XoLPq6w",
-    "source": {
-      "@timestamp": "2018-11-27T02:38:27.526Z",
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "1084",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "85.214.81.104"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "85.214.81.104",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192625,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "NNsIU2cBTFzn_XoLPq6w",
-    "source": {
-      "@timestamp": "2018-11-27T02:38:27.527Z",
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "85.214.81.104"
-          }
-        },
-        "sequence": 192626,
-        "result": "fail"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "1084",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "85.214.81.104"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "NdsIU2cBTFzn_XoLPq6w",
-    "source": {
-      "@timestamp": "2018-11-27T02:38:27.644Z",
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "1084"
-      },
-      "source": {
-        "ip": "85.214.81.104"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "hostname": "85.214.81.104",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "85.214.81.104",
-            "type": "user-session",
-            "primary": "ssh"
-          }
-        },
-        "sequence": 192627,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "N9sJU2cBTFzn_XoLm8zp",
-    "source": {
-      "@timestamp": "2018-11-27T02:39:56.927Z",
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "13.66.193.177",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186633,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "process": {
-        "pid": "32736",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "13.66.193.177"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ONsJU2cBTFzn_XoLm8zp",
-    "source": {
-      "@timestamp": "2018-11-27T02:39:56.928Z",
-      "auditd": {
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "13.66.193.177",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186634,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32736",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "13.66.193.177"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "OdsJU2cBTFzn_XoLm8zp",
-    "source": {
-      "@timestamp": "2018-11-27T02:39:56.989Z",
-      "source": {
-        "ip": "13.66.193.177"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186635,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "13.66.193.177"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "13.66.193.177"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "process": {
-        "pid": "32736",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "btsHU2cBTFzn_XoLaZwR",
-    "source": {
-      "@timestamp": "2018-11-27T02:37:32.833Z",
-      "source": {
-        "ip": "36.67.135.42"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "36.67.135.42",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44292
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "30958"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "b9sHU2cBTFzn_XoLaZwR",
-    "source": {
-      "@timestamp": "2018-11-27T02:37:32.837Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "30958"
-      },
-      "source": {
-        "ip": "36.67.135.42"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "36.67.135.42",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44293
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "cNsHU2cBTFzn_XoLaZwR",
-    "source": {
-      "@timestamp": "2018-11-27T02:37:33.045Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44294,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "36.67.135.42",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "36.67.135.42",
-            "type": "user-session"
-          }
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "30958",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "source": {
-        "ip": "36.67.135.42"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "XNsIU2cBTFzn_XoLwbmn",
-    "source": {
-      "@timestamp": "2018-11-27T02:39:01.052Z",
-      "auditd": {
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "op": "PAM:accounting",
-          "acct": "root",
-          "terminal": "cron"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "cron"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 184448
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_acct",
-        "action": "was-authorized",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "26360",
-        "exe": "/usr/sbin/cron"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "XdsIU2cBTFzn_XoLwbmn",
-    "source": {
-      "@timestamp": "2018-11-27T02:39:01.052Z",
-      "process": {
-        "pid": "26360",
-        "exe": "/usr/sbin/cron"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "cron",
-          "acct": "root",
-          "op": "PAM:setcred"
-        },
-        "summary": {
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          }
-        },
-        "sequence": 184449,
-        "result": "success"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "cred_acq",
-        "action": "acquired-credentials"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "XtsIU2cBTFzn_XoLwbmn",
-    "source": {
-      "@timestamp": "2018-11-27T02:39:01.054Z",
-      "process": {
-        "pid": "26360",
-        "exe": "/usr/sbin/cron"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "auditd": {
-        "data": {
-          "op": "PAM:session_open",
-          "terminal": "cron",
-          "acct": "root"
-        },
-        "summary": {
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          }
-        },
-        "sequence": 184451,
-        "result": "success",
-        "session": "9862"
-      },
-      "event": {
-        "type": "user_start",
-        "action": "started-session",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "auid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "X9sIU2cBTFzn_XoLwbmn",
-    "source": {
-      "@timestamp": "2018-11-27T02:39:01.154Z",
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "cred_disp",
-        "action": "disposed-credentials"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "auid": "0"
-      },
-      "process": {
-        "pid": "26360",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "session": "9862",
-        "data": {
-          "acct": "root",
-          "terminal": "cron",
-          "op": "PAM:setcred"
-        },
-        "summary": {
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 184452,
-        "result": "success"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "YNsIU2cBTFzn_XoLwbmn",
-    "source": {
-      "@timestamp": "2018-11-27T02:39:01.156Z",
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_end",
-        "action": "ended-session"
-      },
-      "user": {
-        "auid": "0",
-        "name_map": {
-          "uid": "root",
-          "auid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "26360",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "data": {
-          "acct": "root",
-          "op": "PAM:session_close",
-          "terminal": "cron"
-        },
-        "summary": {
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "cron"
-          }
-        },
-        "sequence": 184453,
-        "result": "success",
-        "session": "9862"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "c9sIU2cBTFzn_XoLwrlb",
-    "source": {
-      "@timestamp": "2018-11-27T02:39:01.233Z",
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_acct",
-        "action": "was-authorized"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "1088",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "sequence": 192631,
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "terminal": "cron",
-          "op": "PAM:accounting",
-          "acct": "root"
-        },
-        "summary": {
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          }
-        }
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "dNsIU2cBTFzn_XoLwrlb",
-    "source": {
-      "@timestamp": "2018-11-27T02:39:01.234Z",
-      "event": {
-        "type": "cred_acq",
-        "action": "acquired-credentials",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "process": {
-        "pid": "1088",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "sequence": 192632,
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "acct": "root",
-          "terminal": "cron",
-          "op": "PAM:setcred"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ddsIU2cBTFzn_XoLwrlb",
-    "source": {
-      "@timestamp": "2018-11-27T02:39:01.235Z",
-      "user": {
-        "auid": "0",
-        "uid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "process": {
-        "pid": "1088",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "session": "9866",
-        "data": {
-          "terminal": "cron",
-          "acct": "root",
-          "op": "PAM:session_open"
-        },
-        "summary": {
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 192634,
-        "result": "success"
-      },
-      "event": {
-        "action": "started-session",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_start"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "dtsIU2cBTFzn_XoLwrlb",
-    "source": {
-      "@timestamp": "2018-11-27T02:39:01.327Z",
-      "user": {
-        "auid": "0",
-        "uid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/cron",
-        "pid": "1088"
-      },
-      "auditd": {
-        "session": "9866",
-        "data": {
-          "op": "PAM:setcred",
-          "terminal": "cron",
-          "acct": "root"
-        },
-        "summary": {
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          }
-        },
-        "sequence": 192635,
-        "result": "success"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "cred_disp",
-        "action": "disposed-credentials",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "d9sIU2cBTFzn_XoLwrlb",
-    "source": {
-      "@timestamp": "2018-11-27T02:39:01.327Z",
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "auditd": {
-        "session": "9866",
-        "data": {
-          "acct": "root",
-          "terminal": "cron",
-          "op": "PAM:session_close"
-        },
-        "summary": {
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 192636,
-        "result": "success"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_end",
-        "action": "ended-session",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "1088",
-        "exe": "/usr/sbin/cron"
-      },
-      "beat": {
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ndwMU2cBTFzn_XoLNAWN",
-    "source": {
-      "@timestamp": "2018-11-27T02:42:47.067Z",
-      "source": {
-        "ip": "107.170.76.170"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "107.170.76.170",
-            "type": "user-session",
-            "primary": "sshd"
-          }
-        },
-        "sequence": 43284,
-        "result": "fail"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "13197",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ntwMU2cBTFzn_XoLNAWN",
-    "source": {
-      "@timestamp": "2018-11-27T02:42:47.071Z",
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "13197",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "source": {
-        "ip": "107.170.76.170"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.76.170",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43285,
-        "result": "fail"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "n9wMU2cBTFzn_XoLNAWN",
-    "source": {
-      "@timestamp": "2018-11-27T02:42:47.107Z",
-      "auditd": {
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "107.170.76.170",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "107.170.76.170",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43286,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "13197"
-      },
-      "source": {
-        "ip": "107.170.76.170"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "8NwMU2cBTFzn_XoLOwZZ",
-    "source": {
-      "@timestamp": "2018-11-27T02:42:48.812Z",
-      "event": {
-        "category": "configuration",
-        "type": "netfilter_cfg",
-        "action": "loaded-firewall-rule-to",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "user": {
-        "sgid": "0",
-        "name_map": {
-          "egid": "root",
-          "euid": "root",
-          "fsgid": "root",
-          "fsuid": "root",
-          "gid": "root",
-          "sgid": "root",
-          "suid": "root",
-          "uid": "root"
-        },
-        "gid": "0",
-        "suid": "0",
-        "fsuid": "0",
-        "egid": "0",
-        "uid": "0",
-        "auid": "unset",
-        "euid": "0",
-        "fsgid": "0"
-      },
-      "process": {
-        "exe": "/sbin/xtables-multi",
-        "pid": "13199",
-        "ppid": "1379",
-        "title": "/sbin/iptables -w -D sshguard -s 147.135.208.7 -j DROP",
-        "name": "iptables"
-      },
-      "auditd": {
-        "data": {
-          "table": "filter",
-          "tty": "(none)",
-          "family": "2",
-          "a1": "0",
-          "exit": "0",
-          "a3": "1666870",
-          "syscall": "setsockopt",
-          "a2": "40",
-          "arch": "x86_64",
-          "a0": "5",
-          "entries": "155"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "firewall",
-            "primary": "filter"
-          },
-          "how": "/sbin/xtables-multi"
-        },
-        "sequence": 43287,
-        "result": "success",
-        "session": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "WdwMU2cBTFzn_XoLRgdH",
-    "source": {
-      "@timestamp": "2018-11-27T02:42:51.613Z",
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "84.19.176.196",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184460
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "beat": {
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "26436",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "84.19.176.196"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "WtwMU2cBTFzn_XoLRgdH",
-    "source": {
-      "@timestamp": "2018-11-27T02:42:51.614Z",
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "26436",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "84.19.176.196"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 184461,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "84.19.176.196",
-            "type": "user-session"
-          }
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "W9wMU2cBTFzn_XoLRgdH",
-    "source": {
-      "@timestamp": "2018-11-27T02:42:51.728Z",
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "84.19.176.196"
-          }
-        },
-        "sequence": 184462,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "84.19.176.196"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "process": {
-        "pid": "26436",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "84.19.176.196"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "rdwMU2cBTFzn_XoLSQex",
-    "source": {
-      "@timestamp": "2018-11-27T02:42:52.477Z",
-      "process": {
-        "pid": "20119",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "58.97.13.206"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "58.97.13.206"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142443,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "rtwMU2cBTFzn_XoLSQex",
-    "source": {
-      "@timestamp": "2018-11-27T02:42:52.479Z",
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "20119",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "58.97.13.206"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "58.97.13.206",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142444,
-        "result": "fail",
-        "session": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "r9wMU2cBTFzn_XoLSQex",
-    "source": {
-      "@timestamp": "2018-11-27T02:42:52.702Z",
-      "auditd": {
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "58.97.13.206",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "58.97.13.206",
-            "type": "user-session"
-          }
-        },
-        "sequence": 142445,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "20119",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "58.97.13.206"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "qdwMU2cBTFzn_XoLVwgF",
-    "source": {
-      "@timestamp": "2018-11-27T02:42:55.899Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "45.55.239.241",
-            "type": "user-session",
-            "primary": "sshd"
-          }
-        },
-        "sequence": 142446
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "20121",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "45.55.239.241"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "qtwMU2cBTFzn_XoLVwgF",
-    "source": {
-      "@timestamp": "2018-11-27T02:42:55.899Z",
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "20121",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "45.55.239.241"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "45.55.239.241",
-            "type": "user-session",
-            "primary": "sshd"
-          }
-        },
-        "sequence": 142447
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "q9wMU2cBTFzn_XoLVwgF",
-    "source": {
-      "@timestamp": "2018-11-27T02:42:55.930Z",
-      "source": {
-        "ip": "45.55.239.241"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "45.55.239.241"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "45.55.239.241",
-            "type": "user-session"
-          }
-        },
-        "sequence": 142448,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "20121"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "JdsLU2cBTFzn_XoLffYn",
-    "source": {
-      "@timestamp": "2018-11-27T02:42:00.124Z",
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "104.131.124.166",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184457,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "26431",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "104.131.124.166"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "JtsLU2cBTFzn_XoLffYn",
-    "source": {
-      "@timestamp": "2018-11-27T02:42:00.125Z",
-      "process": {
-        "pid": "26431",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "104.131.124.166"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 184458,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "104.131.124.166",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "J9sLU2cBTFzn_XoLffYn",
-    "source": {
-      "@timestamp": "2018-11-27T02:42:00.158Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "26431"
-      },
-      "source": {
-        "ip": "104.131.124.166"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 184459,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "104.131.124.166",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "object": {
-            "secondary": "104.131.124.166",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        }
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "CNwMU2cBTFzn_XoLDAJ2",
-    "source": {
-      "@timestamp": "2018-11-27T02:42:36.811Z",
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "20117",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "202.28.34.200"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "202.28.34.200"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142440,
-        "result": "fail",
-        "session": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "CdwMU2cBTFzn_XoLDAJ2",
-    "source": {
-      "@timestamp": "2018-11-27T02:42:36.812Z",
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "20117",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "202.28.34.200"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "202.28.34.200",
-            "type": "user-session",
-            "primary": "sshd"
-          }
-        },
-        "sequence": 142441
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "CtwMU2cBTFzn_XoLDAJ2",
-    "source": {
-      "@timestamp": "2018-11-27T02:42:37.043Z",
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "20117",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "202.28.34.200"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "202.28.34.200",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142442,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "202.28.34.200",
-          "op": "PAM:bad_ident"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "QtwMU2cBTFzn_XoLKwWd",
-    "source": {
-      "@timestamp": "2018-11-27T02:42:44.787Z",
-      "source": {
-        "ip": "103.249.205.78"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186639,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "103.249.205.78"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32752"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Q9wMU2cBTFzn_XoLKwWd",
-    "source": {
-      "@timestamp": "2018-11-27T02:42:44.788Z",
-      "source": {
-        "ip": "103.249.205.78"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "103.249.205.78",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186640
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32752",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "RNwMU2cBTFzn_XoLKwWd",
-    "source": {
-      "@timestamp": "2018-11-27T02:42:45.017Z",
-      "auditd": {
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "103.249.205.78",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186641,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "103.249.205.78"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32752",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "103.249.205.78"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "btsKU2cBTFzn_XoL6ul0",
-    "source": {
-      "@timestamp": "2018-11-27T02:41:22.569Z",
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "1149"
-      },
-      "source": {
-        "ip": "149.56.15.98"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "149.56.15.98",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192643,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "b9sKU2cBTFzn_XoL6ul0",
-    "source": {
-      "@timestamp": "2018-11-27T02:41:22.571Z",
-      "source": {
-        "ip": "149.56.15.98"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192644,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "secondary": "149.56.15.98",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          }
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "process": {
-        "pid": "1149",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "cNsKU2cBTFzn_XoL6ul0",
-    "source": {
-      "@timestamp": "2018-11-27T02:41:22.613Z",
-      "source": {
-        "ip": "149.56.15.98"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192645,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "149.56.15.98"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "149.56.15.98",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "process": {
-        "pid": "1149",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "99sKU2cBTFzn_XoLJtjT",
-    "source": {
-      "@timestamp": "2018-11-27T02:40:32.489Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32738"
-      },
-      "source": {
-        "ip": "37.59.183.21"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "37.59.183.21",
-            "type": "user-session"
-          }
-        },
-        "sequence": 186636
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "-NsKU2cBTFzn_XoLJtjT",
-    "source": {
-      "@timestamp": "2018-11-27T02:40:32.490Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32738",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "37.59.183.21"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186637,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "37.59.183.21"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "-dsKU2cBTFzn_XoLJtjT",
-    "source": {
-      "@timestamp": "2018-11-27T02:40:32.600Z",
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "37.59.183.21",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186638,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "37.59.183.21"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32738",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "37.59.183.21"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "6dsKU2cBTFzn_XoLCtYx",
-    "source": {
-      "@timestamp": "2018-11-27T02:40:25.154Z",
-      "process": {
-        "pid": "31052",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "104.248.237.238"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "104.248.237.238"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44298,
-        "result": "fail"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "6tsKU2cBTFzn_XoLCtYx",
-    "source": {
-      "@timestamp": "2018-11-27T02:40:25.158Z",
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "31052",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "104.248.237.238"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "104.248.237.238",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44299,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "69sKU2cBTFzn_XoLCtYx",
-    "source": {
-      "@timestamp": "2018-11-27T02:40:25.190Z",
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "31052"
-      },
-      "source": {
-        "ip": "104.248.237.238"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "104.248.237.238"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44300,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "104.248.237.238",
-          "terminal": "ssh"
-        }
-      },
-      "beat": {
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "TtsKU2cBTFzn_XoLcN9z",
-    "source": {
-      "@timestamp": "2018-11-27T02:40:51.334Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "13183",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "191.255.248.91"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "191.255.248.91"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43281
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "T9sKU2cBTFzn_XoLcN9z",
-    "source": {
-      "@timestamp": "2018-11-27T02:40:51.334Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "secondary": "191.255.248.91",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 43282
-      },
-      "beat": {
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "13183"
-      },
-      "source": {
-        "ip": "191.255.248.91"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "UNsKU2cBTFzn_XoLcN9z",
-    "source": {
-      "@timestamp": "2018-11-27T02:40:51.490Z",
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "13183",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "191.255.248.91"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 43283,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "191.255.248.91"
-        },
-        "summary": {
-          "object": {
-            "secondary": "191.255.248.91",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        }
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "beat": {
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "O90YU2cBTFzn_XoLthfG",
-    "source": {
-      "@timestamp": "2018-11-27T02:56:26.843Z",
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "212.46.209.158",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192667
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "1253"
-      },
-      "source": {
-        "ip": "212.46.209.158"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "PN0YU2cBTFzn_XoLthfG",
-    "source": {
-      "@timestamp": "2018-11-27T02:56:26.844Z",
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "212.46.209.158",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192668,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "1253",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "212.46.209.158"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Pd0YU2cBTFzn_XoLthfG",
-    "source": {
-      "@timestamp": "2018-11-27T02:56:27.038Z",
-      "source": {
-        "ip": "212.46.209.158"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "212.46.209.158",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192669,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "212.46.209.158"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "1253"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Wd0YU2cBTFzn_XoLuRey",
-    "source": {
-      "@timestamp": "2018-11-27T02:56:27.592Z",
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "20207",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "212.89.171.146"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "212.89.171.146",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142463,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Wt0YU2cBTFzn_XoLuRey",
-    "source": {
-      "@timestamp": "2018-11-27T02:56:27.593Z",
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "212.89.171.146",
-            "type": "user-session"
-          }
-        },
-        "sequence": 142464
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "20207",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "212.89.171.146"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "W90YU2cBTFzn_XoLuRey",
-    "source": {
-      "@timestamp": "2018-11-27T02:56:27.731Z",
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "20207"
-      },
-      "source": {
-        "ip": "212.89.171.146"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 142465,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "212.89.171.146"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "212.89.171.146",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "UN0ZU2cBTFzn_XoLKSHH",
-    "source": {
-      "@timestamp": "2018-11-27T02:56:56.285Z",
-      "auditd": {
-        "sequence": 184490,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "193.70.85.206",
-            "type": "user-session"
-          }
-        }
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "26545",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "193.70.85.206"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Ud0ZU2cBTFzn_XoLKSHH",
-    "source": {
-      "@timestamp": "2018-11-27T02:56:56.286Z",
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "193.70.85.206"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184491,
-        "result": "fail"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "26545",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "193.70.85.206"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Ut0ZU2cBTFzn_XoLKSHH",
-    "source": {
-      "@timestamp": "2018-11-27T02:56:56.392Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "26545",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "193.70.85.206"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 184492,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "193.70.85.206",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "object": {
-            "secondary": "193.70.85.206",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        }
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "0t0ZU2cBTFzn_XoL6TKj",
-    "source": {
-      "@timestamp": "2018-11-27T02:57:45.401Z",
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "process": {
-        "pid": "26553",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "89.36.221.229"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "89.36.221.229",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184493,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "090ZU2cBTFzn_XoL6TKj",
-    "source": {
-      "@timestamp": "2018-11-27T02:57:45.402Z",
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "89.36.221.229",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          }
-        },
-        "sequence": 184494,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "26553",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "89.36.221.229"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "1N0ZU2cBTFzn_XoL6TKj",
-    "source": {
-      "@timestamp": "2018-11-27T02:57:45.502Z",
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "26553",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "89.36.221.229"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 184495,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "89.36.221.229"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "89.36.221.229",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "beat": {
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "f90YU2cBTFzn_XoL-B3u",
-    "source": {
-      "@timestamp": "2018-11-27T02:56:43.779Z",
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "26542",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "138.68.111.27"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "138.68.111.27",
-            "type": "user-session"
-          }
-        },
-        "sequence": 184487,
-        "result": "fail",
-        "session": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "gN0YU2cBTFzn_XoL-B3u",
-    "source": {
-      "@timestamp": "2018-11-27T02:56:43.781Z",
-      "auditd": {
-        "sequence": 184488,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "138.68.111.27",
-            "type": "user-session"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "26542",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "source": {
-        "ip": "138.68.111.27"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "gd0YU2cBTFzn_XoL-B3u",
-    "source": {
-      "@timestamp": "2018-11-27T02:56:43.889Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 184489,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "138.68.111.27",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "138.68.111.27",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "26542",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "138.68.111.27"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "YN0ZU2cBTFzn_XoLMCE9",
-    "source": {
-      "@timestamp": "2018-11-27T02:56:57.939Z",
-      "auditd": {
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "5.39.77.167",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192670,
-        "result": "fail",
-        "session": "unset"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "1261"
-      },
-      "source": {
-        "ip": "5.39.77.167"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Yd0ZU2cBTFzn_XoLMCE9",
-    "source": {
-      "@timestamp": "2018-11-27T02:56:57.940Z",
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "5.39.77.167",
-            "type": "user-session",
-            "primary": "sshd"
-          }
-        },
-        "sequence": 192671,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "1261"
-      },
-      "source": {
-        "ip": "5.39.77.167"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Yt0ZU2cBTFzn_XoLMCE9",
-    "source": {
-      "@timestamp": "2018-11-27T02:56:58.047Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192672,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "5.39.77.167",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "5.39.77.167",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "beat": {
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "1261",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "5.39.77.167"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "yN0YU2cBTFzn_XoLnBVF",
-    "source": {
-      "@timestamp": "2018-11-27T02:56:20.058Z",
-      "source": {
-        "ip": "189.16.195.18"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "189.16.195.18"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192664
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "process": {
-        "pid": "1251",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "yd0YU2cBTFzn_XoLnBVF",
-    "source": {
-      "@timestamp": "2018-11-27T02:56:20.060Z",
-      "process": {
-        "pid": "1251",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "189.16.195.18"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "189.16.195.18",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192665,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "yt0YU2cBTFzn_XoLnBVF",
-    "source": {
-      "@timestamp": "2018-11-27T02:56:20.223Z",
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "1251"
-      },
-      "source": {
-        "ip": "189.16.195.18"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192666,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "189.16.195.18",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "189.16.195.18",
-            "type": "user-session"
-          }
-        }
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ld0YU2cBTFzn_XoL6hym",
-    "source": {
-      "@timestamp": "2018-11-27T02:56:40.122Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "157.100.133.21",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43303,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "13281",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "157.100.133.21"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "lt0YU2cBTFzn_XoL6hym",
-    "source": {
-      "@timestamp": "2018-11-27T02:56:40.122Z",
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "13281",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "157.100.133.21"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "157.100.133.21",
-            "type": "user-session"
-          }
-        },
-        "sequence": 43304,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "l90YU2cBTFzn_XoL6hym",
-    "source": {
-      "@timestamp": "2018-11-27T02:56:40.242Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "157.100.133.21",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43305,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "157.100.133.21"
-        }
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "13281",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "source": {
-        "ip": "157.100.133.21"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "wt0ZU2cBTFzn_XoLqiw3",
-    "source": {
-      "@timestamp": "2018-11-27T02:57:29.161Z",
-      "source": {
-        "ip": "37.59.62.23"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "37.59.62.23",
-            "type": "user-session",
-            "primary": "sshd"
-          }
-        },
-        "sequence": 44318
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "beat": {
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "31535",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "w90ZU2cBTFzn_XoLqiw3",
-    "source": {
-      "@timestamp": "2018-11-27T02:57:29.161Z",
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "31535",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "37.59.62.23"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "37.59.62.23",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44319
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "xN0ZU2cBTFzn_XoLqiw3",
-    "source": {
-      "@timestamp": "2018-11-27T02:57:29.269Z",
-      "source": {
-        "ip": "37.59.62.23"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "37.59.62.23",
-            "type": "user-session",
-            "primary": "ssh"
-          }
-        },
-        "sequence": 44320,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "37.59.62.23",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "31535",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Ld0ZU2cBTFzn_XoLxC9z",
-    "source": {
-      "@timestamp": "2018-11-27T02:57:35.874Z",
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/lib/systemd/systemd",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "apt-daily",
-            "type": "service"
-          }
-        },
-        "sequence": 43306,
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "unit": "apt-daily"
-        }
-      },
-      "event": {
-        "category": "system-services",
-        "type": "service_start",
-        "action": "started-service",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "1",
-        "name": "systemd",
-        "exe": "/lib/systemd/systemd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Lt0ZU2cBTFzn_XoLxC9z",
-    "source": {
-      "@timestamp": "2018-11-27T02:57:35.874Z",
-      "event": {
-        "category": "system-services",
-        "type": "service_stop",
-        "action": "stopped-service",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "1",
-        "name": "systemd",
-        "exe": "/lib/systemd/systemd"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "apt-daily",
-            "type": "service"
-          },
-          "how": "/lib/systemd/systemd"
-        },
-        "sequence": 43307,
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "unit": "apt-daily"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "p893UmcBTFzn_XoLs0bb",
-    "source": {
-      "@timestamp": "2018-11-27T00:00:34.801Z",
-      "process": {
-        "pid": "19147",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "200.35.110.58"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "200.35.110.58",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142246,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "beat": {
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-haproxy-01"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "qM93UmcBTFzn_XoLs0bb",
-    "source": {
-      "@timestamp": "2018-11-27T00:00:34.802Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "200.35.110.58",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142247,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "19147",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "200.35.110.58"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "qc93UmcBTFzn_XoLs0bb",
-    "source": {
-      "@timestamp": "2018-11-27T00:00:34.906Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "200.35.110.58"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142248,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "200.35.110.58",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        }
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "19147",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "source": {
-        "ip": "200.35.110.58"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Lc97UmcBTFzn_XoLKpLT",
-    "source": {
-      "@timestamp": "2018-11-27T00:04:21.865Z",
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "31749"
-      },
-      "source": {
-        "ip": "164.132.112.233"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "164.132.112.233",
-            "type": "user-session"
-          }
-        },
-        "sequence": 186182,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Ls97UmcBTFzn_XoLKpLT",
-    "source": {
-      "@timestamp": "2018-11-27T00:04:21.866Z",
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "31749",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "164.132.112.233"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186183,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "164.132.112.233",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "L897UmcBTFzn_XoLKpLT",
-    "source": {
-      "@timestamp": "2018-11-27T00:04:21.973Z",
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "164.132.112.233"
-          }
-        },
-        "sequence": 186184,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "164.132.112.233",
-          "terminal": "ssh"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "31749"
-      },
-      "source": {
-        "ip": "164.132.112.233"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "o894UmcBTFzn_XoLA00h",
-    "source": {
-      "@timestamp": "2018-11-27T00:00:55.095Z",
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "139.198.120.32",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192390,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "31971",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "139.198.120.32"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "pM94UmcBTFzn_XoLA00h",
-    "source": {
-      "@timestamp": "2018-11-27T00:00:55.096Z",
-      "auditd": {
-        "sequence": 192391,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "139.198.120.32",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          }
-        }
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "31971"
-      },
-      "source": {
-        "ip": "139.198.120.32"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "pc94UmcBTFzn_XoLA00h",
-    "source": {
-      "@timestamp": "2018-11-27T00:00:55.269Z",
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "process": {
-        "pid": "31971",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "139.198.120.32"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "139.198.120.32"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "139.198.120.32",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192392
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "eM95UmcBTFzn_XoLP2hD",
-    "source": {
-      "@timestamp": "2018-11-27T00:02:15.998Z",
-      "source": {
-        "ip": "106.12.29.232"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192393,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "106.12.29.232",
-            "type": "user-session"
-          }
-        }
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "31979",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ec95UmcBTFzn_XoLP2hD",
-    "source": {
-      "@timestamp": "2018-11-27T00:02:15.999Z",
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "31979"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "source": {
-        "ip": "106.12.29.232"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "106.12.29.232",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192394
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "es95UmcBTFzn_XoLP2hD",
-    "source": {
-      "@timestamp": "2018-11-27T00:02:16.292Z",
-      "source": {
-        "ip": "106.12.29.232"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "106.12.29.232"
-        },
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "106.12.29.232",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 192395
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "31979",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "PM99UmcBTFzn_XoLjscA",
-    "source": {
-      "@timestamp": "2018-11-27T00:06:58.326Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "54.37.154.254",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186188,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "31766",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "54.37.154.254"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Pc99UmcBTFzn_XoLjscA",
-    "source": {
-      "@timestamp": "2018-11-27T00:06:58.327Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "31766",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "54.37.154.254"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "54.37.154.254",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186189
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Ps99UmcBTFzn_XoLjscA",
-    "source": {
-      "@timestamp": "2018-11-27T00:06:58.438Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "54.37.154.254"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "54.37.154.254"
-          }
-        },
-        "sequence": 186190
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "31766",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "54.37.154.254"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "cM95UmcBTFzn_XoLKGaD",
-    "source": {
-      "@timestamp": "2018-11-27T00:02:10.186Z",
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "31740",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "211.24.100.205"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186179,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "211.24.100.205",
-            "type": "user-session"
-          }
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "cc95UmcBTFzn_XoLKGaD",
-    "source": {
-      "@timestamp": "2018-11-27T00:02:10.188Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "31740",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "211.24.100.205"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "211.24.100.205",
-            "type": "user-session"
-          }
-        },
-        "sequence": 186180,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        }
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "cs95UmcBTFzn_XoLKGaD",
-    "source": {
-      "@timestamp": "2018-11-27T00:02:10.392Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "31740",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "211.24.100.205"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "211.24.100.205",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186181,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "211.24.100.205"
-        }
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "hs93UmcBTFzn_XoLcEF7",
-    "source": {
-      "@timestamp": "2018-11-27T00:00:17.552Z",
-      "source": {
-        "ip": "142.93.210.90"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "142.93.210.90"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192387,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "31968",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "h893UmcBTFzn_XoLcEF7",
-    "source": {
-      "@timestamp": "2018-11-27T00:00:17.552Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "31968"
-      },
-      "source": {
-        "ip": "142.93.210.90"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192388,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "142.93.210.90",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "iM93UmcBTFzn_XoLcEF7",
-    "source": {
-      "@timestamp": "2018-11-27T00:00:17.784Z",
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "31968"
-      },
-      "source": {
-        "ip": "142.93.210.90"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "142.93.210.90"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192389,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "142.93.210.90",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        }
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "k899UmcBTFzn_XoL6M7W",
-    "source": {
-      "@timestamp": "2018-11-27T00:07:21.573Z",
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "27895",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "174.50.26.154"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "174.50.26.154",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          }
-        },
-        "sequence": 44073,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "lM99UmcBTFzn_XoL6M7W",
-    "source": {
-      "@timestamp": "2018-11-27T00:07:21.577Z",
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "174.50.26.154",
-            "type": "user-session"
-          }
-        },
-        "sequence": 44074,
-        "result": "fail"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "27895",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "174.50.26.154"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "lc99UmcBTFzn_XoL6M7W",
-    "source": {
-      "@timestamp": "2018-11-27T00:07:21.673Z",
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "27895"
-      },
-      "source": {
-        "ip": "174.50.26.154"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44075,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "174.50.26.154",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "174.50.26.154",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "aM97UmcBTFzn_XoL4qJ8",
-    "source": {
-      "@timestamp": "2018-11-27T00:05:08.881Z",
-      "process": {
-        "pid": "31758",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "51.38.82.60"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "51.38.82.60",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186185
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ac97UmcBTFzn_XoL4qJ8",
-    "source": {
-      "@timestamp": "2018-11-27T00:05:08.882Z",
-      "source": {
-        "ip": "51.38.82.60"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186186,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "51.38.82.60",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "31758",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "as97UmcBTFzn_XoL4qJ8",
-    "source": {
-      "@timestamp": "2018-11-27T00:05:08.989Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "31758",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "51.38.82.60"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186187,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "51.38.82.60"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "51.38.82.60"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "4M99UmcBTFzn_XoLtco1",
-    "source": {
-      "@timestamp": "2018-11-27T00:07:08.363Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "31768",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "46.101.26.63"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "46.101.26.63",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186191
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "4c99UmcBTFzn_XoLtco1",
-    "source": {
-      "@timestamp": "2018-11-27T00:07:08.364Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "31768",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "46.101.26.63"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "46.101.26.63",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186192,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "4s99UmcBTFzn_XoLtco1",
-    "source": {
-      "@timestamp": "2018-11-27T00:07:08.463Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "31768",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "46.101.26.63"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186193,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "46.101.26.63"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "46.101.26.63"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "_NCBUmcBTFzn_XoLzSMR",
-    "source": {
-      "@timestamp": "2018-11-27T00:11:36.615Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "86.96.203.107",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186212
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "31802",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "86.96.203.107"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "_dCBUmcBTFzn_XoLzSMR",
-    "source": {
-      "@timestamp": "2018-11-27T00:11:36.616Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "31802",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "86.96.203.107"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "86.96.203.107",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186213,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "_tCBUmcBTFzn_XoLzSMR",
-    "source": {
-      "@timestamp": "2018-11-27T00:11:36.828Z",
-      "source": {
-        "ip": "86.96.203.107"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "86.96.203.107"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "86.96.203.107",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186214,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "31802"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "WdCBUmcBTFzn_XoLzyVY",
-    "source": {
-      "@timestamp": "2018-11-27T00:11:37.195Z",
-      "auditd": {
-        "sequence": 43095,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "104.248.236.32"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        }
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "12257",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "104.248.236.32"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "WtCBUmcBTFzn_XoLzyVY",
-    "source": {
-      "@timestamp": "2018-11-27T00:11:37.195Z",
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "process": {
-        "pid": "12257",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "104.248.236.32"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 43096,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "104.248.236.32",
-            "type": "user-session",
-            "primary": "sshd"
-          }
-        }
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "W9CBUmcBTFzn_XoLzyVY",
-    "source": {
-      "@timestamp": "2018-11-27T00:11:37.223Z",
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 43097,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "104.248.236.32",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "104.248.236.32",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "12257",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "104.248.236.32"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ZNCBUmcBTFzn_XoL0yWS",
-    "source": {
-      "@timestamp": "2018-11-27T00:11:38.280Z",
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "process": {
-        "pid": "32078",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "91.121.26.184"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "91.121.26.184",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192402
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ZdCBUmcBTFzn_XoL0yWS",
-    "source": {
-      "@timestamp": "2018-11-27T00:11:38.280Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "91.121.26.184",
-            "type": "user-session"
-          }
-        },
-        "sequence": 192403,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32078",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "91.121.26.184"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ZtCBUmcBTFzn_XoL0yWS",
-    "source": {
-      "@timestamp": "2018-11-27T00:11:38.388Z",
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32078",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "source": {
-        "ip": "91.121.26.184"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192404,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "91.121.26.184",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "91.121.26.184",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "HtCBUmcBTFzn_XoLJBa0",
-    "source": {
-      "@timestamp": "2018-11-27T00:10:53.514Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "process": {
-        "pid": "19210",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "206.189.183.75"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "206.189.183.75"
-          }
-        },
-        "sequence": 142258,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "H9CBUmcBTFzn_XoLJBa0",
-    "source": {
-      "@timestamp": "2018-11-27T00:10:53.515Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-haproxy-01"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "206.189.183.75"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142259,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "19210"
-      },
-      "source": {
-        "ip": "206.189.183.75"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "INCBUmcBTFzn_XoLJBa0",
-    "source": {
-      "@timestamp": "2018-11-27T00:10:53.546Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 142260,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "206.189.183.75"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "206.189.183.75"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "beat": {
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "19210",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "206.189.183.75"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Z9CCUmcBTFzn_XoL5z0B",
-    "source": {
-      "@timestamp": "2018-11-27T00:12:48.790Z",
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "19223"
-      },
-      "source": {
-        "ip": "188.166.213.254"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "188.166.213.254",
-            "type": "user-session"
-          }
-        },
-        "sequence": 142261,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "aNCCUmcBTFzn_XoL5z0B",
-    "source": {
-      "@timestamp": "2018-11-27T00:12:48.791Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "19223",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "188.166.213.254"
-      },
-      "beat": {
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-haproxy-01"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 142262,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "188.166.213.254",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "adCCUmcBTFzn_XoL5z0B",
-    "source": {
-      "@timestamp": "2018-11-27T00:12:48.985Z",
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "19223",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "188.166.213.254"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 142263,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "188.166.213.254"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "188.166.213.254",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "beat": {
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-haproxy-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ytCAUmcBTFzn_XoLfAfq",
-    "source": {
-      "@timestamp": "2018-11-27T00:10:10.560Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "31792",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "123.136.161.146"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "123.136.161.146"
-          }
-        },
-        "sequence": 186206,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "y9CAUmcBTFzn_XoLfAfq",
-    "source": {
-      "@timestamp": "2018-11-27T00:10:10.561Z",
-      "auditd": {
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "123.136.161.146",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186207,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "31792",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "123.136.161.146"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "zNCAUmcBTFzn_XoLfAfq",
-    "source": {
-      "@timestamp": "2018-11-27T00:10:10.789Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "31792",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "123.136.161.146"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "123.136.161.146"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "123.136.161.146"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186208,
-        "result": "fail",
-        "session": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "-NCBUmcBTFzn_XoLRxhI",
-    "source": {
-      "@timestamp": "2018-11-27T00:11:02.367Z",
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "31799",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "103.241.146.65"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186209,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "103.241.146.65",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "-dCBUmcBTFzn_XoLRxhI",
-    "source": {
-      "@timestamp": "2018-11-27T00:11:02.368Z",
-      "source": {
-        "ip": "103.241.146.65"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "103.241.146.65",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186210
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "31799",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "-tCBUmcBTFzn_XoLRxhI",
-    "source": {
-      "@timestamp": "2018-11-27T00:11:02.619Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "31799",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "103.241.146.65"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186211,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "103.241.146.65",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "103.241.146.65"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "kdCDUmcBTFzn_XoLZUd0",
-    "source": {
-      "@timestamp": "2018-11-27T00:13:21.161Z",
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "104.248.159.44",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186218,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "31813",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "104.248.159.44"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ktCDUmcBTFzn_XoLZUd0",
-    "source": {
-      "@timestamp": "2018-11-27T00:13:21.162Z",
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "104.248.159.44",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186219,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "31813"
-      },
-      "source": {
-        "ip": "104.248.159.44"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "k9CDUmcBTFzn_XoLZUd0",
-    "source": {
-      "@timestamp": "2018-11-27T00:13:21.355Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "hostname": "104.248.159.44",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "104.248.159.44",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186220,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "31813",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "104.248.159.44"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "zdCCUmcBTFzn_XoLfDPd",
-    "source": {
-      "@timestamp": "2018-11-27T00:12:21.596Z",
-      "source": {
-        "ip": "46.148.18.163"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "46.148.18.163",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186215,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "31805",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ztCCUmcBTFzn_XoLfDPd",
-    "source": {
-      "@timestamp": "2018-11-27T00:12:21.598Z",
-      "source": {
-        "ip": "46.148.18.163"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "46.148.18.163",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186216,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        }
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "31805"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "z9CCUmcBTFzn_XoLfDPd",
-    "source": {
-      "@timestamp": "2018-11-27T00:12:21.740Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186217,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "46.148.18.163",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "46.148.18.163",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "31805",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "46.148.18.163"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "J9CAUmcBTFzn_XoL2xDJ",
-    "source": {
-      "@timestamp": "2018-11-27T00:10:34.814Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "177.206.128.131",
-            "type": "user-session"
-          }
-        },
-        "sequence": 43092,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "12250",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "177.206.128.131"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "KNCAUmcBTFzn_XoL2xDJ",
-    "source": {
-      "@timestamp": "2018-11-27T00:10:34.814Z",
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "12250",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "177.206.128.131"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "177.206.128.131",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 43093,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "KdCAUmcBTFzn_XoL2xDJ",
-    "source": {
-      "@timestamp": "2018-11-27T00:10:35.006Z",
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "process": {
-        "pid": "12250",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "177.206.128.131"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 43094,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "177.206.128.131"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "177.206.128.131",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "cdCCUmcBTFzn_XoLBilE",
-    "source": {
-      "@timestamp": "2018-11-27T00:11:51.257Z",
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "source": {
-        "ip": "142.93.109.33"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "142.93.109.33",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43098,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        }
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "12259",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ctCCUmcBTFzn_XoLBilE",
-    "source": {
-      "@timestamp": "2018-11-27T00:11:51.257Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "12259",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "142.93.109.33"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "142.93.109.33",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43099,
-        "result": "fail"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "c9CCUmcBTFzn_XoLBilE",
-    "source": {
-      "@timestamp": "2018-11-27T00:11:51.365Z",
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "12259",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "142.93.109.33"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "142.93.109.33"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43100,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "142.93.109.33",
-          "terminal": "ssh"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "5NCHUmcBTFzn_XoLiqIH",
-    "source": {
-      "@timestamp": "2018-11-27T00:17:52.669Z",
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192414,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "161.132.195.76",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32116",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "161.132.195.76"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "5dCHUmcBTFzn_XoLiqIH",
-    "source": {
-      "@timestamp": "2018-11-27T00:17:52.670Z",
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32116",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "161.132.195.76"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "161.132.195.76"
-          }
-        },
-        "sequence": 192415,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "5tCHUmcBTFzn_XoLiqIH",
-    "source": {
-      "@timestamp": "2018-11-27T00:17:52.776Z",
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32116"
-      },
-      "source": {
-        "ip": "161.132.195.76"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "auditd": {
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "161.132.195.76",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 192416,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "161.132.195.76",
-          "terminal": "ssh"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "q9CHUmcBTFzn_XoLj6PQ",
-    "source": {
-      "@timestamp": "2018-11-27T00:17:54.150Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "31844"
-      },
-      "source": {
-        "ip": "202.175.83.165"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "202.175.83.165"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186236,
-        "result": "fail"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "rNCHUmcBTFzn_XoLj6PQ",
-    "source": {
-      "@timestamp": "2018-11-27T00:17:54.151Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "31844"
-      },
-      "source": {
-        "ip": "202.175.83.165"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186237,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "202.175.83.165",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "rdCHUmcBTFzn_XoLj6PQ",
-    "source": {
-      "@timestamp": "2018-11-27T00:17:54.333Z",
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "31844"
-      },
-      "source": {
-        "ip": "202.175.83.165"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186238,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "202.175.83.165",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "202.175.83.165",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "NNCHUmcBTFzn_XoLkqTG",
-    "source": {
-      "@timestamp": "2018-11-27T00:17:54.909Z",
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32118",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "source": {
-        "ip": "128.199.107.237"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "128.199.107.237",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192417,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "NdCHUmcBTFzn_XoLkqTG",
-    "source": {
-      "@timestamp": "2018-11-27T00:17:54.910Z",
-      "source": {
-        "ip": "128.199.107.237"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "128.199.107.237",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192418,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32118",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "NtCHUmcBTFzn_XoLkqTG",
-    "source": {
-      "@timestamp": "2018-11-27T00:17:55.100Z",
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "source": {
-        "ip": "128.199.107.237"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "128.199.107.237",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "128.199.107.237",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192419
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32118",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "P9CHUmcBTFzn_XoLmKRB",
-    "source": {
-      "@timestamp": "2018-11-27T00:17:56.311Z",
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "197.149.137.86",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192420,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32120",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "197.149.137.86"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "QNCHUmcBTFzn_XoLmKRB",
-    "source": {
-      "@timestamp": "2018-11-27T00:17:56.312Z",
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "197.149.137.86",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192421,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32120",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "197.149.137.86"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "QdCHUmcBTFzn_XoLmKRB",
-    "source": {
-      "@timestamp": "2018-11-27T00:17:56.547Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "197.149.137.86",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "197.149.137.86"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192422
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32120"
-      },
-      "source": {
-        "ip": "197.149.137.86"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "kNCIUmcBTFzn_XoL68Ge",
-    "source": {
-      "@timestamp": "2018-11-27T00:19:23.188Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "31854"
-      },
-      "source": {
-        "ip": "165.227.63.250"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "165.227.63.250",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186242,
-        "result": "fail",
-        "session": "unset"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "kdCIUmcBTFzn_XoL68Ge",
-    "source": {
-      "@timestamp": "2018-11-27T00:19:23.189Z",
-      "process": {
-        "pid": "31854",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "165.227.63.250"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "165.227.63.250",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186243
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ktCIUmcBTFzn_XoL68Ge",
-    "source": {
-      "@timestamp": "2018-11-27T00:19:23.230Z",
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "31854",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "165.227.63.250"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "165.227.63.250",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "165.227.63.250",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186244,
-        "result": "fail"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "7tCIUmcBTFzn_XoL_MPx",
-    "source": {
-      "@timestamp": "2018-11-27T00:19:27.623Z",
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "24879"
-      },
-      "source": {
-        "ip": "185.137.92.168"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "185.137.92.168"
-          }
-        },
-        "sequence": 184264
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "79CIUmcBTFzn_XoL_MPx",
-    "source": {
-      "@timestamp": "2018-11-27T00:19:27.624Z",
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "24879",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "185.137.92.168"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "185.137.92.168",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184265
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "8NCIUmcBTFzn_XoL_MPx",
-    "source": {
-      "@timestamp": "2018-11-27T00:19:27.733Z",
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "24879",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "185.137.92.168"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "185.137.92.168"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "185.137.92.168"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184266,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "sdCJUmcBTFzn_XoLMcci",
-    "source": {
-      "@timestamp": "2018-11-27T00:19:40.983Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "31857",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "185.58.119.156"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186245,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "185.58.119.156"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "stCJUmcBTFzn_XoLMcci",
-    "source": {
-      "@timestamp": "2018-11-27T00:19:40.984Z",
-      "source": {
-        "ip": "185.58.119.156"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "185.58.119.156"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186246,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        }
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "31857",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "s9CJUmcBTFzn_XoLMcci",
-    "source": {
-      "@timestamp": "2018-11-27T00:19:41.111Z",
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "31857",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "185.58.119.156"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186247,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "185.58.119.156",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "185.58.119.156",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "RdCJUmcBTFzn_XoLOcgJ",
-    "source": {
-      "@timestamp": "2018-11-27T00:19:43.008Z",
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "201.134.231.33"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186248,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "31859",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "201.134.231.33"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "RtCJUmcBTFzn_XoLOcgJ",
-    "source": {
-      "@timestamp": "2018-11-27T00:19:43.009Z",
-      "process": {
-        "pid": "31859",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "201.134.231.33"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "secondary": "201.134.231.33",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          }
-        },
-        "sequence": 186249,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "R9CJUmcBTFzn_XoLOcgJ",
-    "source": {
-      "@timestamp": "2018-11-27T00:19:43.074Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "201.134.231.33",
-            "type": "user-session",
-            "primary": "ssh"
-          }
-        },
-        "sequence": 186250,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "201.134.231.33",
-          "terminal": "ssh"
-        }
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "31859",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "201.134.231.33"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "rtCGUmcBTFzn_XoL3pS1",
-    "source": {
-      "@timestamp": "2018-11-27T00:17:08.809Z",
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32108"
-      },
-      "source": {
-        "ip": "220.116.47.116"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "220.116.47.116",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192411,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "r9CGUmcBTFzn_XoL3pS1",
-    "source": {
-      "@timestamp": "2018-11-27T00:17:08.810Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "220.116.47.116",
-            "type": "user-session"
-          }
-        },
-        "sequence": 192412,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32108"
-      },
-      "source": {
-        "ip": "220.116.47.116"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "sNCGUmcBTFzn_XoL3pS1",
-    "source": {
-      "@timestamp": "2018-11-27T00:17:08.983Z",
-      "source": {
-        "ip": "220.116.47.116"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "220.116.47.116",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "220.116.47.116",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192413,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32108",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "rNCIUmcBTFzn_XoLa7Yh",
-    "source": {
-      "@timestamp": "2018-11-27T00:18:50.295Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "24869"
-      },
-      "source": {
-        "ip": "222.117.50.66"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "222.117.50.66"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184258,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "rdCIUmcBTFzn_XoLa7Yh",
-    "source": {
-      "@timestamp": "2018-11-27T00:18:50.297Z",
-      "process": {
-        "pid": "24869",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "222.117.50.66"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "222.117.50.66",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184259
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "rtCIUmcBTFzn_XoLa7Yh",
-    "source": {
-      "@timestamp": "2018-11-27T00:18:50.462Z",
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "222.117.50.66",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "222.117.50.66",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          }
-        },
-        "sequence": 184260,
-        "result": "fail"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "24869",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "222.117.50.66"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "SNCIUmcBTFzn_XoLeri8",
-    "source": {
-      "@timestamp": "2018-11-27T00:18:54.288Z",
-      "source": {
-        "ip": "46.148.18.163"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186239,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "46.148.18.163",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "31851",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "SdCIUmcBTFzn_XoLeri8",
-    "source": {
-      "@timestamp": "2018-11-27T00:18:54.289Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "sequence": 186240,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "46.148.18.163",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "31851",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "46.148.18.163"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "StCIUmcBTFzn_XoLeri8",
-    "source": {
-      "@timestamp": "2018-11-27T00:18:54.436Z",
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "31851"
-      },
-      "source": {
-        "ip": "46.148.18.163"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "46.148.18.163",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "46.148.18.163",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 186241
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Z9CJUmcBTFzn_XoLDcR_",
-    "source": {
-      "@timestamp": "2018-11-27T00:19:31.861Z",
-      "source": {
-        "ip": "85.234.34.90"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "85.234.34.90",
-            "type": "user-session",
-            "primary": "sshd"
-          }
-        },
-        "sequence": 184267,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "24881",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "aNCJUmcBTFzn_XoLDcR_",
-    "source": {
-      "@timestamp": "2018-11-27T00:19:31.862Z",
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "85.234.34.90",
-            "type": "user-session"
-          }
-        },
-        "sequence": 184268,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        }
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "24881"
-      },
-      "source": {
-        "ip": "85.234.34.90"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "adCJUmcBTFzn_XoLDcR_",
-    "source": {
-      "@timestamp": "2018-11-27T00:19:32.020Z",
-      "source": {
-        "ip": "85.234.34.90"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "ssh",
-          "hostname": "85.234.34.90",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "85.234.34.90",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 184269,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "24881"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "OtCIUmcBTFzn_XoL08CH",
-    "source": {
-      "@timestamp": "2018-11-27T00:19:17.019Z",
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "24877",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "27.254.90.106"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "27.254.90.106",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184261
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "O9CIUmcBTFzn_XoL08CH",
-    "source": {
-      "@timestamp": "2018-11-27T00:19:17.020Z",
-      "source": {
-        "ip": "27.254.90.106"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 184262,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "27.254.90.106",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "24877",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "PNCIUmcBTFzn_XoL08CH",
-    "source": {
-      "@timestamp": "2018-11-27T00:19:17.244Z",
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "27.254.90.106",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "27.254.90.106",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 184263
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "24877",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "27.254.90.106"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "_dCJUmcBTFzn_XoLv9T4",
-    "source": {
-      "@timestamp": "2018-11-27T00:20:17.545Z",
-      "auditd": {
-        "sequence": 44088,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "87.191.133.16",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "process": {
-        "pid": "28146",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "87.191.133.16"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "_tCJUmcBTFzn_XoLv9T4",
-    "source": {
-      "@timestamp": "2018-11-27T00:20:17.545Z",
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "28146"
-      },
-      "source": {
-        "ip": "87.191.133.16"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "87.191.133.16",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44089,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "beat": {
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "_9CJUmcBTFzn_XoLv9T4",
-    "source": {
-      "@timestamp": "2018-11-27T00:20:17.665Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "hostname": "87.191.133.16",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "object": {
-            "secondary": "87.191.133.16",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 44090,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "28146",
-        "exe": "/usr/sbin/sshd"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "beat": {
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01"
-      },
-      "source": {
-        "ip": "87.191.133.16"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "xtGOUmcBTFzn_XoLCjLw",
-    "source": {
-      "@timestamp": "2018-11-27T00:24:58.886Z",
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "24919",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "178.128.55.52"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 184276,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "178.128.55.52",
-            "type": "user-session"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "x9GOUmcBTFzn_XoLCjLw",
-    "source": {
-      "@timestamp": "2018-11-27T00:24:58.888Z",
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "source": {
-        "ip": "178.128.55.52"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 184277,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "178.128.55.52",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "24919",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "yNGOUmcBTFzn_XoLCjLw",
-    "source": {
-      "@timestamp": "2018-11-27T00:24:59.080Z",
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "24919",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "178.128.55.52"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "178.128.55.52",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "178.128.55.52",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184278
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "FtGOUmcBTFzn_XoLEzP0",
-    "source": {
-      "@timestamp": "2018-11-27T00:25:01.159Z",
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "root",
-          "op": "PAM:accounting",
-          "terminal": "cron"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "cron"
-          },
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 44103,
-        "result": "success"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "action": "was-authorized",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_acct"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "28242",
-        "exe": "/usr/sbin/cron"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "F9GOUmcBTFzn_XoLEzP0",
-    "source": {
-      "@timestamp": "2018-11-27T00:25:01.159Z",
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "process": {
-        "pid": "28242",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "sequence": 44104,
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "terminal": "cron",
-          "acct": "root",
-          "op": "PAM:setcred"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "cron"
-          },
-          "how": "/usr/sbin/cron"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "cred_acq",
-        "action": "acquired-credentials",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "GNGOUmcBTFzn_XoLEzP0",
-    "source": {
-      "@timestamp": "2018-11-27T00:25:01.159Z",
-      "process": {
-        "pid": "28242",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "cron"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 44106,
-        "result": "success",
-        "session": "1443",
-        "data": {
-          "op": "PAM:session_open",
-          "terminal": "cron",
-          "acct": "root"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_start",
-        "action": "started-session"
-      },
-      "beat": {
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "user": {
-        "auid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "GdGOUmcBTFzn_XoLEzP0",
-    "source": {
-      "@timestamp": "2018-11-27T00:25:01.163Z",
-      "event": {
-        "type": "cred_disp",
-        "action": "disposed-credentials",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "0",
-        "uid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/cron",
-        "pid": "28242"
-      },
-      "auditd": {
-        "sequence": 44107,
-        "result": "success",
-        "session": "1443",
-        "data": {
-          "acct": "root",
-          "op": "PAM:setcred",
-          "terminal": "cron"
-        },
-        "summary": {
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "cron"
-          },
-          "how": "/usr/sbin/cron"
-        }
-      },
-      "beat": {
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "GtGOUmcBTFzn_XoLEzP0",
-    "source": {
-      "@timestamp": "2018-11-27T00:25:01.163Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "auid": "0"
-      },
-      "process": {
-        "pid": "28242",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "sequence": 44108,
-        "result": "success",
-        "session": "1443",
-        "data": {
-          "terminal": "cron",
-          "acct": "root",
-          "op": "PAM:session_close"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "cron"
-          },
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          }
-        }
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "type": "user_end",
-        "action": "ended-session",
-        "module": "auditd",
-        "category": "user-login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "y9GOUmcBTFzn_XoLLTXy",
-    "source": {
-      "@timestamp": "2018-11-27T00:25:07.848Z",
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "24921"
-      },
-      "source": {
-        "ip": "78.217.134.141"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "78.217.134.141",
-            "type": "user-session"
-          }
-        },
-        "sequence": 184279
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "zNGOUmcBTFzn_XoLLTXy",
-    "source": {
-      "@timestamp": "2018-11-27T00:25:07.849Z",
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "24921"
-      },
-      "source": {
-        "ip": "78.217.134.141"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "78.217.134.141"
-          }
-        },
-        "sequence": 184280
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "zdGOUmcBTFzn_XoLLTXy",
-    "source": {
-      "@timestamp": "2018-11-27T00:25:07.962Z",
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "24921",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "78.217.134.141"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "hostname": "78.217.134.141",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "78.217.134.141",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184281,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "0NGOUmcBTFzn_XoLLjX5",
-    "source": {
-      "@timestamp": "2018-11-27T00:25:08.111Z",
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "151.80.144.39",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142273
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "19291",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "151.80.144.39"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "0dGOUmcBTFzn_XoLLjX5",
-    "source": {
-      "@timestamp": "2018-11-27T00:25:08.112Z",
-      "process": {
-        "pid": "19291",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "151.80.144.39"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 142274,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "151.80.144.39",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "0tGOUmcBTFzn_XoLLjX5",
-    "source": {
-      "@timestamp": "2018-11-27T00:25:08.218Z",
-      "auditd": {
-        "sequence": 142275,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "151.80.144.39",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "151.80.144.39",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "19291"
-      },
-      "source": {
-        "ip": "151.80.144.39"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "xNGOUmcBTFzn_XoLYDl2",
-    "source": {
-      "@timestamp": "2018-11-27T00:25:20.780Z",
-      "process": {
-        "pid": "24924",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "104.208.143.92"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 184282,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "104.208.143.92",
-            "type": "user-session",
-            "primary": "sshd"
-          }
-        }
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "xdGOUmcBTFzn_XoLYDl2",
-    "source": {
-      "@timestamp": "2018-11-27T00:25:20.781Z",
-      "process": {
-        "pid": "24924",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "104.208.143.92"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 184283,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "104.208.143.92"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "xtGOUmcBTFzn_XoLYDl2",
-    "source": {
-      "@timestamp": "2018-11-27T00:25:20.819Z",
-      "process": {
-        "pid": "24924",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "104.208.143.92"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "hostname": "104.208.143.92",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "104.208.143.92",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 184284,
-        "result": "fail",
-        "session": "unset"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "nNGPUmcBTFzn_XoLF0mX",
-    "source": {
-      "@timestamp": "2018-11-27T00:26:07.661Z",
-      "source": {
-        "ip": "197.13.4.211"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "197.13.4.211",
-            "type": "user-session",
-            "primary": "sshd"
-          }
-        },
-        "sequence": 184285
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "process": {
-        "pid": "24931",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ndGPUmcBTFzn_XoLF0mX",
-    "source": {
-      "@timestamp": "2018-11-27T00:26:07.662Z",
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "197.13.4.211"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184286,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "24931",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "197.13.4.211"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ntGPUmcBTFzn_XoLF0mX",
-    "source": {
-      "@timestamp": "2018-11-27T00:26:07.796Z",
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "24931",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "source": {
-        "ip": "197.13.4.211"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "197.13.4.211"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "197.13.4.211",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184287
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "N9GPUmcBTFzn_XoLi1R8",
-    "source": {
-      "@timestamp": "2018-11-27T00:26:37.330Z",
-      "source": {
-        "ip": "128.199.216.13"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "128.199.216.13",
-            "type": "user-session"
-          }
-        },
-        "sequence": 192431,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32510",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ONGPUmcBTFzn_XoLi1R8",
-    "source": {
-      "@timestamp": "2018-11-27T00:26:37.331Z",
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32510",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "128.199.216.13"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "128.199.216.13",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192432
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "OdGPUmcBTFzn_XoLi1R8",
-    "source": {
-      "@timestamp": "2018-11-27T00:26:37.524Z",
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "process": {
-        "pid": "32510",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "128.199.216.13"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192433,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "128.199.216.13",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "128.199.216.13",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "iNGNUmcBTFzn_XoLxiyC",
-    "source": {
-      "@timestamp": "2018-11-27T00:24:41.365Z",
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "object": {
-            "secondary": "147.135.208.7",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 43116,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        }
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "12336"
-      },
-      "source": {
-        "ip": "147.135.208.7"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "idGNUmcBTFzn_XoLxiyC",
-    "source": {
-      "@timestamp": "2018-11-27T00:24:41.365Z",
-      "source": {
-        "ip": "147.135.208.7"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 43117,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "147.135.208.7",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "12336",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "itGNUmcBTFzn_XoLxiyC",
-    "source": {
-      "@timestamp": "2018-11-27T00:24:41.497Z",
-      "auditd": {
-        "sequence": 43118,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "147.135.208.7"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "147.135.208.7",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "12336"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "source": {
-        "ip": "147.135.208.7"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "3NGPUmcBTFzn_XoLV05i",
-    "source": {
-      "@timestamp": "2018-11-27T00:26:23.985Z",
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "51.38.38.221",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44109,
-        "result": "fail",
-        "session": "unset"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "28278",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "51.38.38.221"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "3dGPUmcBTFzn_XoLV05i",
-    "source": {
-      "@timestamp": "2018-11-27T00:26:23.989Z",
-      "process": {
-        "pid": "28278",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "51.38.38.221"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "51.38.38.221",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44110,
-        "result": "fail"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "3tGPUmcBTFzn_XoLV05i",
-    "source": {
-      "@timestamp": "2018-11-27T00:26:24.093Z",
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "51.38.38.221",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "51.38.38.221",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44111,
-        "result": "fail"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "28278",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "51.38.38.221"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "NdGNUmcBTFzn_XoLoilI",
-    "source": {
-      "@timestamp": "2018-11-27T00:24:32.089Z",
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "process": {
-        "pid": "28228",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "202.138.233.92"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "202.138.233.92",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44100
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "NtGNUmcBTFzn_XoLoilI",
-    "source": {
-      "@timestamp": "2018-11-27T00:24:32.089Z",
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "28228",
-        "exe": "/usr/sbin/sshd"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "source": {
-        "ip": "202.138.233.92"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "202.138.233.92"
-          }
-        },
-        "sequence": 44101
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "N9GNUmcBTFzn_XoLoilI",
-    "source": {
-      "@timestamp": "2018-11-27T00:24:32.345Z",
-      "process": {
-        "pid": "28228",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "source": {
-        "ip": "202.138.233.92"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44102,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "202.138.233.92",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "202.138.233.92",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "69GPUmcBTFzn_XoLM0ud",
-    "source": {
-      "@timestamp": "2018-11-27T00:26:14.833Z",
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "1",
-        "name": "systemd",
-        "exe": "/lib/systemd/systemd"
-      },
-      "auditd": {
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "unit": "apt-daily"
-        },
-        "summary": {
-          "object": {
-            "primary": "apt-daily",
-            "type": "service"
-          },
-          "how": "/lib/systemd/systemd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 192429
-      },
-      "beat": {
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "category": "system-services",
-        "type": "service_start",
-        "action": "started-service",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "7NGPUmcBTFzn_XoLM0ud",
-    "source": {
-      "@timestamp": "2018-11-27T00:26:14.834Z",
-      "beat": {
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "process": {
-        "pid": "1",
-        "name": "systemd",
-        "exe": "/lib/systemd/systemd"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "apt-daily",
-            "type": "service"
-          },
-          "how": "/lib/systemd/systemd"
-        },
-        "sequence": 192430,
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "unit": "apt-daily"
-        }
-      },
-      "event": {
-        "action": "stopped-service",
-        "module": "auditd",
-        "category": "system-services",
-        "type": "service_stop"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "-dGTUmcBTFzn_XoLE6A1",
-    "source": {
-      "@timestamp": "2018-11-27T00:30:28.676Z",
-      "process": {
-        "pid": "28355",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "source": {
-        "ip": "212.227.192.118"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44115,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "212.227.192.118",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "-tGTUmcBTFzn_XoLE6A1",
-    "source": {
-      "@timestamp": "2018-11-27T00:30:28.680Z",
-      "process": {
-        "pid": "28355",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "212.227.192.118"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "212.227.192.118",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44116,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        }
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "-9GTUmcBTFzn_XoLE6A1",
-    "source": {
-      "@timestamp": "2018-11-27T00:30:28.788Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "212.227.192.118"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "212.227.192.118",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44117,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "28355"
-      },
-      "source": {
-        "ip": "212.227.192.118"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "_NGTUmcBTFzn_XoLIaG8",
-    "source": {
-      "@timestamp": "2018-11-27T00:30:32.403Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32532",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "164.132.56.243"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "164.132.56.243",
-            "type": "user-session"
-          }
-        },
-        "sequence": 192437
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "_dGTUmcBTFzn_XoLIaG8",
-    "source": {
-      "@timestamp": "2018-11-27T00:30:32.404Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32532"
-      },
-      "source": {
-        "ip": "164.132.56.243"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "164.132.56.243",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192438,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "_tGTUmcBTFzn_XoLIaG8",
-    "source": {
-      "@timestamp": "2018-11-27T00:30:32.516Z",
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32532",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "164.132.56.243"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "object": {
-            "secondary": "164.132.56.243",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 192439,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "164.132.56.243"
-        }
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "n9GVUmcBTFzn_XoLvdvo",
-    "source": {
-      "@timestamp": "2018-11-27T00:33:23.454Z",
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "auditd": {
-        "sequence": 184297,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "222.252.30.117",
-            "type": "user-session"
-          }
-        }
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "24978",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "222.252.30.117"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "oNGVUmcBTFzn_XoLvdvo",
-    "source": {
-      "@timestamp": "2018-11-27T00:33:23.455Z",
-      "source": {
-        "ip": "222.252.30.117"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "auditd": {
-        "sequence": 184298,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "222.252.30.117",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "24978",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "odGVUmcBTFzn_XoLvdvo",
-    "source": {
-      "@timestamp": "2018-11-27T00:33:23.682Z",
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "process": {
-        "pid": "24978",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "222.252.30.117"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "222.252.30.117",
-            "type": "user-session",
-            "primary": "ssh"
-          }
-        },
-        "sequence": 184299,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "222.252.30.117",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "0dGUUmcBTFzn_XoLfr-C",
-    "source": {
-      "@timestamp": "2018-11-27T00:32:01.688Z",
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "194.35.114.10",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184294,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "24969",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "194.35.114.10"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "0tGUUmcBTFzn_XoLfr-C",
-    "source": {
-      "@timestamp": "2018-11-27T00:32:01.689Z",
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "source": {
-        "ip": "194.35.114.10"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "194.35.114.10",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184295,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "24969"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "09GUUmcBTFzn_XoLfr-C",
-    "source": {
-      "@timestamp": "2018-11-27T00:32:01.975Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "ssh",
-          "hostname": "194.35.114.10",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "194.35.114.10",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          }
-        },
-        "sequence": 184296,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "24969"
-      },
-      "source": {
-        "ip": "194.35.114.10"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "FdGUUmcBTFzn_XoLVrxv",
-    "source": {
-      "@timestamp": "2018-11-27T00:31:51.428Z",
-      "source": {
-        "ip": "54.222.243.60"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "54.222.243.60",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184291,
-        "result": "fail"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "24967"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "FtGUUmcBTFzn_XoLVrxv",
-    "source": {
-      "@timestamp": "2018-11-27T00:31:51.429Z",
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "24967"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "source": {
-        "ip": "54.222.243.60"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "54.222.243.60",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          }
-        },
-        "sequence": 184292
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "F9GUUmcBTFzn_XoLVrxv",
-    "source": {
-      "@timestamp": "2018-11-27T00:31:51.655Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "24967",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "54.222.243.60"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "hostname": "54.222.243.60",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "54.222.243.60",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184293,
-        "result": "fail"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "iNGWUmcBTFzn_XoLZOnx",
-    "source": {
-      "@timestamp": "2018-11-27T00:34:06.215Z",
-      "auditd": {
-        "sequence": 186263,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "187.188.146.35",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "31932"
-      },
-      "source": {
-        "ip": "187.188.146.35"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "idGWUmcBTFzn_XoLZOnx",
-    "source": {
-      "@timestamp": "2018-11-27T00:34:06.216Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "187.188.146.35",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186264,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "31932",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "187.188.146.35"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "itGWUmcBTFzn_XoLZOnx",
-    "source": {
-      "@timestamp": "2018-11-27T00:34:06.294Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "187.188.146.35"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "187.188.146.35",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186265,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "31932",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "187.188.146.35"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "5NGTUmcBTFzn_XoLoqzb",
-    "source": {
-      "@timestamp": "2018-11-27T00:31:05.454Z",
-      "source": {
-        "ip": "190.153.219.50"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 43128,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "190.153.219.50",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "beat": {
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "process": {
-        "pid": "12380",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "5dGTUmcBTFzn_XoLoqzb",
-    "source": {
-      "@timestamp": "2018-11-27T00:31:05.454Z",
-      "process": {
-        "pid": "12380",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "190.153.219.50"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "190.153.219.50",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43129,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "5tGTUmcBTFzn_XoLoqzb",
-    "source": {
-      "@timestamp": "2018-11-27T00:31:05.610Z",
-      "auditd": {
-        "sequence": 43130,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "190.153.219.50",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "190.153.219.50",
-            "type": "user-session"
-          }
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "12380",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "190.153.219.50"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "f9GUUmcBTFzn_XoLl8LQ",
-    "source": {
-      "@timestamp": "2018-11-27T00:32:08.159Z",
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "12388",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "51.75.29.64"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "51.75.29.64",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43131,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        }
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "gNGUUmcBTFzn_XoLl8LQ",
-    "source": {
-      "@timestamp": "2018-11-27T00:32:08.163Z",
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "51.75.29.64",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43132,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "12388",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "51.75.29.64"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "gdGUUmcBTFzn_XoLl8LQ",
-    "source": {
-      "@timestamp": "2018-11-27T00:32:08.283Z",
-      "source": {
-        "ip": "51.75.29.64"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "51.75.29.64"
-          }
-        },
-        "sequence": 43133,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "51.75.29.64",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        }
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "12388",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "K9GUUmcBTFzn_XoLpsMN",
-    "source": {
-      "@timestamp": "2018-11-27T00:32:11.807Z",
-      "source": {
-        "ip": "159.203.94.6"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "159.203.94.6"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 43134,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "12390",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "LNGUUmcBTFzn_XoLpsMN",
-    "source": {
-      "@timestamp": "2018-11-27T00:32:11.807Z",
-      "process": {
-        "pid": "12390",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "159.203.94.6"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "159.203.94.6",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43135
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "LdGUUmcBTFzn_XoLpsMN",
-    "source": {
-      "@timestamp": "2018-11-27T00:32:11.839Z",
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "12390",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "159.203.94.6"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "159.203.94.6",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "159.203.94.6",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43136
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "49GUUmcBTFzn_XoL7sk-",
-    "source": {
-      "@timestamp": "2018-11-27T00:32:30.290Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "process": {
-        "pid": "28397",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "51.255.35.58"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44118,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "51.255.35.58",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "5NGUUmcBTFzn_XoL7sk-",
-    "source": {
-      "@timestamp": "2018-11-27T00:32:30.290Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "28397",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "51.255.35.58"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44119,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "51.255.35.58",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "5dGUUmcBTFzn_XoL7sk-",
-    "source": {
-      "@timestamp": "2018-11-27T00:32:30.394Z",
-      "auditd": {
-        "sequence": 44120,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "51.255.35.58"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "51.255.35.58",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "process": {
-        "pid": "28397",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "51.255.35.58"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ZtKdUmcBTFzn_XoLzIys",
-    "source": {
-      "@timestamp": "2018-11-27T00:42:11.490Z",
-      "process": {
-        "pid": "28582",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "source": {
-        "ip": "51.75.23.199"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "51.75.23.199",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44127,
-        "result": "fail"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Z9KdUmcBTFzn_XoLzIys",
-    "source": {
-      "@timestamp": "2018-11-27T00:42:11.494Z",
-      "auditd": {
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "51.75.23.199",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44128,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        }
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "28582",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "51.75.23.199"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "aNKdUmcBTFzn_XoLzIys",
-    "source": {
-      "@timestamp": "2018-11-27T00:42:11.598Z",
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "28582"
-      },
-      "source": {
-        "ip": "51.75.23.199"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44129,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "51.75.23.199",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "51.75.23.199"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        }
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "atKdUmcBTFzn_XoLzYxc",
-    "source": {
-      "@timestamp": "2018-11-27T00:42:11.696Z",
-      "source": {
-        "ip": "180.76.100.10"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186281,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "180.76.100.10",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "31982"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "a9KdUmcBTFzn_XoLzYxc",
-    "source": {
-      "@timestamp": "2018-11-27T00:42:11.697Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "31982",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "180.76.100.10"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186282,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "180.76.100.10",
-            "type": "user-session",
-            "primary": "sshd"
-          }
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "bNKdUmcBTFzn_XoLzYxc",
-    "source": {
-      "@timestamp": "2018-11-27T00:42:11.935Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "31982",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "180.76.100.10"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "180.76.100.10",
-            "type": "user-session"
-          }
-        },
-        "sequence": 186283,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "180.76.100.10",
-          "terminal": "ssh"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "N9KfUmcBTFzn_XoLkLSD",
-    "source": {
-      "@timestamp": "2018-11-27T00:44:07.193Z",
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "115.146.127.134",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142297,
-        "result": "fail"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "process": {
-        "pid": "19404",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "115.146.127.134"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ONKfUmcBTFzn_XoLkLSD",
-    "source": {
-      "@timestamp": "2018-11-27T00:44:07.194Z",
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "115.146.127.134"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 142298,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "19404",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "115.146.127.134"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "OdKfUmcBTFzn_XoLkLSD",
-    "source": {
-      "@timestamp": "2018-11-27T00:44:07.394Z",
-      "process": {
-        "pid": "19404",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "115.146.127.134"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 142299,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "115.146.127.134",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "object": {
-            "secondary": "115.146.127.134",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        }
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ftKgUmcBTFzn_XoLxc3Y",
-    "source": {
-      "@timestamp": "2018-11-27T00:45:26.381Z",
-      "auditd": {
-        "sequence": 184306,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "201.245.191.102",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "25092"
-      },
-      "beat": {
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "source": {
-        "ip": "201.245.191.102"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "f9KgUmcBTFzn_XoLxc3Y",
-    "source": {
-      "@timestamp": "2018-11-27T00:45:26.382Z",
-      "source": {
-        "ip": "201.245.191.102"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "secondary": "201.245.191.102",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 184307,
-        "result": "fail"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "process": {
-        "pid": "25092",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "gNKgUmcBTFzn_XoLxc3Y",
-    "source": {
-      "@timestamp": "2018-11-27T00:45:26.503Z",
-      "process": {
-        "pid": "25092",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "201.245.191.102"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "201.245.191.102",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "201.245.191.102",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184308,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "59KeUmcBTFzn_XoLO5ZL",
-    "source": {
-      "@timestamp": "2018-11-27T00:42:39.841Z",
-      "process": {
-        "pid": "19396",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "209.97.173.192"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 142294,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "209.97.173.192",
-            "type": "user-session"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "6NKeUmcBTFzn_XoLO5ZL",
-    "source": {
-      "@timestamp": "2018-11-27T00:42:39.843Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "19396",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "209.97.173.192"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "secondary": "209.97.173.192",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 142295,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "6dKeUmcBTFzn_XoLO5ZL",
-    "source": {
-      "@timestamp": "2018-11-27T00:42:40.035Z",
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "19396",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "209.97.173.192"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 142296,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "209.97.173.192"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "209.97.173.192",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "xdKbUmcBTFzn_XoL6WOD",
-    "source": {
-      "@timestamp": "2018-11-27T00:40:07.833Z",
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32633"
-      },
-      "source": {
-        "ip": "134.175.28.156"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192449,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "134.175.28.156",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "xtKbUmcBTFzn_XoL6WOD",
-    "source": {
-      "@timestamp": "2018-11-27T00:40:07.834Z",
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32633",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "134.175.28.156"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "134.175.28.156",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192450,
-        "result": "fail"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "x9KbUmcBTFzn_XoL6WOD",
-    "source": {
-      "@timestamp": "2018-11-27T00:40:08.034Z",
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "134.175.28.156",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "134.175.28.156",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192451
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32633",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "134.175.28.156"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ntKbUmcBTFzn_XoL2WE6",
-    "source": {
-      "@timestamp": "2018-11-27T00:40:03.664Z",
-      "source": {
-        "ip": "79.134.4.138"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "79.134.4.138",
-            "type": "user-session",
-            "primary": "sshd"
-          }
-        },
-        "sequence": 186278
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "31968",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "n9KbUmcBTFzn_XoL2WE6",
-    "source": {
-      "@timestamp": "2018-11-27T00:40:03.665Z",
-      "process": {
-        "pid": "31968",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "79.134.4.138"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "79.134.4.138",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186279,
-        "result": "fail"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "oNKbUmcBTFzn_XoL2WE6",
-    "source": {
-      "@timestamp": "2018-11-27T00:40:03.838Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "auditd": {
-        "sequence": 186280,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "79.134.4.138",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "79.134.4.138",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "31968"
-      },
-      "source": {
-        "ip": "79.134.4.138"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "lNKdUmcBTFzn_XoLiIaH",
-    "source": {
-      "@timestamp": "2018-11-27T00:41:54.077Z",
-      "source": {
-        "ip": "203.66.168.81"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "203.66.168.81",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142291
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "19393"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ldKdUmcBTFzn_XoLiIaH",
-    "source": {
-      "@timestamp": "2018-11-27T00:41:54.078Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 142292,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "203.66.168.81",
-            "type": "user-session"
-          }
-        }
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "19393",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "203.66.168.81"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ltKdUmcBTFzn_XoLiIaH",
-    "source": {
-      "@timestamp": "2018-11-27T00:41:54.267Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "19393"
-      },
-      "source": {
-        "ip": "203.66.168.81"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "203.66.168.81"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "203.66.168.81",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142293
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "zNKeUmcBTFzn_XoLtKCT",
-    "source": {
-      "@timestamp": "2018-11-27T00:43:10.887Z",
-      "source": {
-        "ip": "116.93.119.13"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "116.93.119.13",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43137,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "process": {
-        "pid": "12451",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "zdKeUmcBTFzn_XoLtKCT",
-    "source": {
-      "@timestamp": "2018-11-27T00:43:10.887Z",
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "12451",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "116.93.119.13"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "116.93.119.13",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 43138
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ztKeUmcBTFzn_XoLtKCT",
-    "source": {
-      "@timestamp": "2018-11-27T00:43:11.127Z",
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "12451"
-      },
-      "source": {
-        "ip": "116.93.119.13"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "116.93.119.13",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "116.93.119.13"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43139
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "YdKbUmcBTFzn_XoLs16u",
-    "source": {
-      "@timestamp": "2018-11-27T00:39:54.048Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "28538",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "41.185.28.133"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "41.185.28.133",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44124,
-        "result": "fail"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "YtKbUmcBTFzn_XoLs16u",
-    "source": {
-      "@timestamp": "2018-11-27T00:39:54.052Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "41.185.28.133",
-            "type": "user-session"
-          }
-        },
-        "sequence": 44125,
-        "result": "fail"
-      },
-      "beat": {
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "28538",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "41.185.28.133"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Y9KbUmcBTFzn_XoLs16u",
-    "source": {
-      "@timestamp": "2018-11-27T00:39:54.292Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "28538",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "41.185.28.133"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "41.185.28.133",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "41.185.28.133"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44126,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "otOnUmcBTFzn_XoLmmNb",
-    "source": {
-      "@timestamp": "2018-11-27T00:52:54.001Z",
-      "process": {
-        "pid": "25143",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "190.0.10.138"
-      },
-      "beat": {
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 184318,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "190.0.10.138"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          }
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "o9OnUmcBTFzn_XoLmmNb",
-    "source": {
-      "@timestamp": "2018-11-27T00:52:54.002Z",
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "process": {
-        "pid": "25143",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "190.0.10.138"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "190.0.10.138",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184319,
-        "result": "fail",
-        "session": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "pNOnUmcBTFzn_XoLmmNb",
-    "source": {
-      "@timestamp": "2018-11-27T00:52:54.109Z",
-      "source": {
-        "ip": "190.0.10.138"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 184320,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "190.0.10.138",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "190.0.10.138",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "25143"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "59OrUmcBTFzn_XoL6cFF",
-    "source": {
-      "@timestamp": "2018-11-27T00:57:36.347Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192455,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "202.28.34.200",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32742",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "202.28.34.200"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "6NOrUmcBTFzn_XoL6cFF",
-    "source": {
-      "@timestamp": "2018-11-27T00:57:36.348Z",
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32742"
-      },
-      "source": {
-        "ip": "202.28.34.200"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192456,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "202.28.34.200",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "6dOrUmcBTFzn_XoL6cFF",
-    "source": {
-      "@timestamp": "2018-11-27T00:57:36.577Z",
-      "process": {
-        "pid": "32742",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "202.28.34.200"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "202.28.34.200",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "202.28.34.200"
-          }
-        },
-        "sequence": 192457
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "P9OsUmcBTFzn_XoLBsX4",
-    "source": {
-      "@timestamp": "2018-11-27T00:57:43.944Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "process": {
-        "pid": "12534",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "103.10.44.255"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "103.10.44.255",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43146,
-        "result": "fail",
-        "session": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "QNOsUmcBTFzn_XoLBsX4",
-    "source": {
-      "@timestamp": "2018-11-27T00:57:43.948Z",
-      "process": {
-        "pid": "12534",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "103.10.44.255"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 43147,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "103.10.44.255"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "QdOsUmcBTFzn_XoLBsX4",
-    "source": {
-      "@timestamp": "2018-11-27T00:57:44.144Z",
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "12534",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "103.10.44.255"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "hostname": "103.10.44.255",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "103.10.44.255",
-            "type": "user-session"
-          }
-        },
-        "sequence": 43148,
-        "result": "fail",
-        "session": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "FNOpUmcBTFzn_XoLlY-1",
-    "source": {
-      "@timestamp": "2018-11-27T00:55:03.881Z",
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "146.0.105.29",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 186287
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32040",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "146.0.105.29"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "FdOpUmcBTFzn_XoLlY-1",
-    "source": {
-      "@timestamp": "2018-11-27T00:55:03.882Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "secondary": "146.0.105.29",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 186288,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32040",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "146.0.105.29"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "FtOpUmcBTFzn_XoLlY-1",
-    "source": {
-      "@timestamp": "2018-11-27T00:55:04.004Z",
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "146.0.105.29",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186289,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "146.0.105.29"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32040",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "146.0.105.29"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "FtOpUmcBTFzn_XoL5pZA",
-    "source": {
-      "@timestamp": "2018-11-27T00:55:24.501Z",
-      "process": {
-        "pid": "12520",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "217.19.148.142"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "217.19.148.142",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43143,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        }
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "F9OpUmcBTFzn_XoL5pZA",
-    "source": {
-      "@timestamp": "2018-11-27T00:55:24.501Z",
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "12520"
-      },
-      "source": {
-        "ip": "217.19.148.142"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "217.19.148.142",
-            "type": "user-session"
-          }
-        },
-        "sequence": 43144,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "GNOpUmcBTFzn_XoL5pZA",
-    "source": {
-      "@timestamp": "2018-11-27T00:55:24.637Z",
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "12520",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "217.19.148.142"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "217.19.148.142"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "217.19.148.142",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43145,
-        "result": "fail",
-        "session": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "2NOmUmcBTFzn_XoLfUpL",
-    "source": {
-      "@timestamp": "2018-11-27T00:51:41.026Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "59.120.243.8",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184315,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "25134",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "59.120.243.8"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "2dOmUmcBTFzn_XoLfUpL",
-    "source": {
-      "@timestamp": "2018-11-27T00:51:41.027Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "59.120.243.8",
-            "type": "user-session"
-          }
-        },
-        "sequence": 184316,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "25134",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "source": {
-        "ip": "59.120.243.8"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "2tOmUmcBTFzn_XoLfUpL",
-    "source": {
-      "@timestamp": "2018-11-27T00:51:41.202Z",
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "25134"
-      },
-      "source": {
-        "ip": "59.120.243.8"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "hostname": "59.120.243.8",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "59.120.243.8",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 184317,
-        "result": "fail",
-        "session": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "h9OpUmcBTFzn_XoLWIru",
-    "source": {
-      "@timestamp": "2018-11-27T00:54:48.324Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "process": {
-        "pid": "32723",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "124.6.139.242"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "124.6.139.242",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 192452,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "iNOpUmcBTFzn_XoLWIru",
-    "source": {
-      "@timestamp": "2018-11-27T00:54:48.325Z",
-      "process": {
-        "pid": "32723",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "source": {
-        "ip": "124.6.139.242"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "124.6.139.242",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192453,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "idOpUmcBTFzn_XoLWIru",
-    "source": {
-      "@timestamp": "2018-11-27T00:54:48.556Z",
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32723",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "124.6.139.242"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "124.6.139.242"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "124.6.139.242",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192454,
-        "result": "fail",
-        "session": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "YtOqUmcBTFzn_XoLnqU0",
-    "source": {
-      "@timestamp": "2018-11-27T00:56:11.591Z",
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "28851",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "93.152.166.29"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44139,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "object": {
-            "secondary": "93.152.166.29",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          }
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Y9OqUmcBTFzn_XoLnqU0",
-    "source": {
-      "@timestamp": "2018-11-27T00:56:11.591Z",
-      "source": {
-        "ip": "93.152.166.29"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "93.152.166.29",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44140,
-        "result": "fail"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "28851"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ZNOqUmcBTFzn_XoLnqU0",
-    "source": {
-      "@timestamp": "2018-11-27T00:56:11.743Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "28851",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "93.152.166.29"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "93.152.166.29",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 44141,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "93.152.166.29",
-          "op": "PAM:bad_ident"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "q9OnUmcBTFzn_XoLxWfH",
-    "source": {
-      "@timestamp": "2018-11-27T00:53:05.113Z",
-      "process": {
-        "pid": "28796",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "222.117.50.66"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44136,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "222.117.50.66",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "rNOnUmcBTFzn_XoLxWfH",
-    "source": {
-      "@timestamp": "2018-11-27T00:53:05.113Z",
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "28796",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "222.117.50.66"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "222.117.50.66",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 44137
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "rdOnUmcBTFzn_XoLxWfH",
-    "source": {
-      "@timestamp": "2018-11-27T00:53:05.277Z",
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "process": {
-        "pid": "28796",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "222.117.50.66"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "222.117.50.66",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44138,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "222.117.50.66",
-          "op": "PAM:bad_ident"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "_tSyUmcBTFzn_XoLI0rV",
-    "source": {
-      "@timestamp": "2018-11-27T01:04:24.552Z",
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32096",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "115.146.127.133"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186305,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "115.146.127.133"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "_9SyUmcBTFzn_XoLI0rV",
-    "source": {
-      "@timestamp": "2018-11-27T01:04:24.554Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32096",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "115.146.127.133"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186306,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "115.146.127.133",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ANSyUmcBTFzn_XoLI0vV",
-    "source": {
-      "@timestamp": "2018-11-27T01:04:24.758Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32096"
-      },
-      "source": {
-        "ip": "115.146.127.133"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186307,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "115.146.127.133"
-        },
-        "summary": {
-          "object": {
-            "secondary": "115.146.127.133",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "oNSxUmcBTFzn_XoL-0d6",
-    "source": {
-      "@timestamp": "2018-11-27T01:04:14.224Z",
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32089",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186302,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "odSxUmcBTFzn_XoL-0d6",
-    "source": {
-      "@timestamp": "2018-11-27T01:04:14.225Z",
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32089"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "sequence": 186303,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "107.170.65.109"
-          }
-        }
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "otSxUmcBTFzn_XoL-0d6",
-    "source": {
-      "@timestamp": "2018-11-27T01:04:14.256Z",
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32089"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "hostname": "107.170.65.109",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "object": {
-            "secondary": "107.170.65.109",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 186304,
-        "result": "fail"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "JNSyUmcBTFzn_XoL2FqQ",
-    "source": {
-      "@timestamp": "2018-11-27T01:05:10.789Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186308
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32100",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "JdSyUmcBTFzn_XoL2FqQ",
-    "source": {
-      "@timestamp": "2018-11-27T01:05:10.790Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32100",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186309,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "JtSyUmcBTFzn_XoL2FqQ",
-    "source": {
-      "@timestamp": "2018-11-27T01:05:10.821Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186310,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "107.170.65.109",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32100",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "9tSxUmcBTFzn_XoLATF1",
-    "source": {
-      "@timestamp": "2018-11-27T01:03:10.216Z",
-      "auditd": {
-        "sequence": 142318,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "81.174.25.52"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "process": {
-        "pid": "19519",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "81.174.25.52"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "99SxUmcBTFzn_XoLATF1",
-    "source": {
-      "@timestamp": "2018-11-27T01:03:10.217Z",
-      "process": {
-        "pid": "19519",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "81.174.25.52"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "81.174.25.52",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142319
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "-NSxUmcBTFzn_XoLATF1",
-    "source": {
-      "@timestamp": "2018-11-27T01:03:10.360Z",
-      "auditd": {
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "81.174.25.52"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "81.174.25.52",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142320,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "19519",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "81.174.25.52"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "69SyUmcBTFzn_XoLSE3q",
-    "source": {
-      "@timestamp": "2018-11-27T01:04:34.043Z",
-      "source": {
-        "ip": "110.170.166.101"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "110.170.166.101",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43149,
-        "result": "fail"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "12572",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "7NSyUmcBTFzn_XoLSE3q",
-    "source": {
-      "@timestamp": "2018-11-27T01:04:34.043Z",
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "process": {
-        "pid": "12572",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "110.170.166.101"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 43150,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "110.170.166.101"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          }
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "7dSyUmcBTFzn_XoLSE3q",
-    "source": {
-      "@timestamp": "2018-11-27T01:04:34.263Z",
-      "auditd": {
-        "summary": {
-          "object": {
-            "secondary": "110.170.166.101",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 43151,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "110.170.166.101",
-          "op": "PAM:bad_ident"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "12572"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "source": {
-        "ip": "110.170.166.101"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "R9SzUmcBTFzn_XoLbGcD",
-    "source": {
-      "@timestamp": "2018-11-27T01:05:48.570Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192461,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "178.155.249.205",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "316",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "source": {
-        "ip": "178.155.249.205"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "SNSzUmcBTFzn_XoLbGcD",
-    "source": {
-      "@timestamp": "2018-11-27T01:05:48.571Z",
-      "process": {
-        "pid": "316",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "178.155.249.205"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192462,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "178.155.249.205",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "SdSzUmcBTFzn_XoLbGcD",
-    "source": {
-      "@timestamp": "2018-11-27T01:05:48.697Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "316",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "178.155.249.205"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "178.155.249.205"
-        },
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "178.155.249.205",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 192463
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "wtSxUmcBTFzn_XoLPTZz",
-    "source": {
-      "@timestamp": "2018-11-27T01:03:25.577Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32085",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 186296,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "w9SxUmcBTFzn_XoLPTZz",
-    "source": {
-      "@timestamp": "2018-11-27T01:03:25.578Z",
-      "process": {
-        "pid": "32085",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "sequence": 186297,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "xNSxUmcBTFzn_XoLPTZz",
-    "source": {
-      "@timestamp": "2018-11-27T01:03:25.609Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186298,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "107.170.65.109",
-          "op": "PAM:bad_ident"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32085",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "jdSxUmcBTFzn_XoLZToB",
-    "source": {
-      "@timestamp": "2018-11-27T01:03:35.702Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32087",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "104.131.37.34"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "104.131.37.34",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186299,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "jtSxUmcBTFzn_XoLZToB",
-    "source": {
-      "@timestamp": "2018-11-27T01:03:35.707Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "104.131.37.34"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186300
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32087",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "104.131.37.34"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "j9SxUmcBTFzn_XoLZToB",
-    "source": {
-      "@timestamp": "2018-11-27T01:03:35.739Z",
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "104.131.37.34"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "104.131.37.34",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "104.131.37.34",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186301,
-        "result": "fail"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32087",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ydSzUmcBTFzn_XoLemeL",
-    "source": {
-      "@timestamp": "2018-11-27T01:05:52.289Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192464,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "195.68.29.234"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "323",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "195.68.29.234"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ytSzUmcBTFzn_XoLemeL",
-    "source": {
-      "@timestamp": "2018-11-27T01:05:52.290Z",
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "195.68.29.234"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192465,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "323",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "195.68.29.234"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "y9SzUmcBTFzn_XoLemeL",
-    "source": {
-      "@timestamp": "2018-11-27T01:05:52.396Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "195.68.29.234"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "195.68.29.234"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192466,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "323"
-      },
-      "source": {
-        "ip": "195.68.29.234"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "sNS4UmcBTFzn_XoLe9YN",
-    "source": {
-      "@timestamp": "2018-11-27T01:11:20.098Z",
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32151",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186337,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "107.170.65.109"
-          }
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "sdS4UmcBTFzn_XoLe9YN",
-    "source": {
-      "@timestamp": "2018-11-27T01:11:20.099Z",
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32151",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          }
-        },
-        "sequence": 186338
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "stS4UmcBTFzn_XoLe9YN",
-    "source": {
-      "@timestamp": "2018-11-27T01:11:20.130Z",
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32151"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "hostname": "107.170.65.109",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "107.170.65.109",
-            "type": "user-session",
-            "primary": "ssh"
-          }
-        },
-        "sequence": 186339,
-        "result": "fail",
-        "session": "unset"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "MNS5UmcBTFzn_XoLKuU8",
-    "source": {
-      "@timestamp": "2018-11-27T01:12:04.946Z",
-      "auditd": {
-        "sequence": 192488,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "secondary": "192.208.184.216",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        }
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "428",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "source": {
-        "ip": "192.208.184.216"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "MdS5UmcBTFzn_XoLKuU8",
-    "source": {
-      "@timestamp": "2018-11-27T01:12:04.947Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192489,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "192.208.184.216",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "428",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "192.208.184.216"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "MtS5UmcBTFzn_XoLKuU8",
-    "source": {
-      "@timestamp": "2018-11-27T01:12:04.962Z",
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "428",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "192.208.184.216"
-      },
-      "beat": {
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192490,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "192.208.184.216"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "192.208.184.216",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "GtW7UmcBTFzn_XoLNhOL",
-    "source": {
-      "@timestamp": "2018-11-27T01:14:19.169Z",
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32173"
-      },
-      "source": {
-        "ip": "73.15.91.251"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "73.15.91.251",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186350
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "G9W7UmcBTFzn_XoLNhOL",
-    "source": {
-      "@timestamp": "2018-11-27T01:14:19.170Z",
-      "source": {
-        "ip": "73.15.91.251"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186351,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "73.15.91.251"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        }
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32173",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "HNW7UmcBTFzn_XoLNhOL",
-    "source": {
-      "@timestamp": "2018-11-27T01:14:19.234Z",
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32173",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "73.15.91.251"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186352,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "73.15.91.251",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "73.15.91.251",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "R9W6UmcBTFzn_XoL9Aya",
-    "source": {
-      "@timestamp": "2018-11-27T01:14:02.288Z",
-      "process": {
-        "pid": "32171",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "201.144.84.82"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "201.144.84.82",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186347
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "SNW6UmcBTFzn_XoL9Aya",
-    "source": {
-      "@timestamp": "2018-11-27T01:14:02.289Z",
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "201.144.84.82",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186348,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32171",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "201.144.84.82"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "SdW6UmcBTFzn_XoL9Aya",
-    "source": {
-      "@timestamp": "2018-11-27T01:14:02.352Z",
-      "source": {
-        "ip": "201.144.84.82"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "201.144.84.82",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186349,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "201.144.84.82",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32171",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "19W7UmcBTFzn_XoLRBML",
-    "source": {
-      "@timestamp": "2018-11-27T01:14:22.625Z",
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32175",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          }
-        },
-        "sequence": 186353
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "2NW7UmcBTFzn_XoLRBML",
-    "source": {
-      "@timestamp": "2018-11-27T01:14:22.627Z",
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186354,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32175",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "2dW7UmcBTFzn_XoLRBML",
-    "source": {
-      "@timestamp": "2018-11-27T01:14:22.658Z",
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32175"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186355,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "107.170.65.109"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ltW6UmcBTFzn_XoLawEv",
-    "source": {
-      "@timestamp": "2018-11-27T01:13:27.109Z",
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186344,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32168"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "l9W6UmcBTFzn_XoLawEv",
-    "source": {
-      "@timestamp": "2018-11-27T01:13:27.110Z",
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32168",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          }
-        },
-        "sequence": 186345,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "mNW6UmcBTFzn_XoLawEv",
-    "source": {
-      "@timestamp": "2018-11-27T01:13:27.142Z",
-      "process": {
-        "pid": "32168",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "107.170.65.109"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "107.170.65.109"
-          }
-        },
-        "sequence": 186346,
-        "result": "fail"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "gdS5UmcBTFzn_XoLl-71",
-    "source": {
-      "@timestamp": "2018-11-27T01:12:33.036Z",
-      "auditd": {
-        "sequence": 186341,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "46.148.18.163",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32161"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "46.148.18.163"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "gtS5UmcBTFzn_XoLl-71",
-    "source": {
-      "@timestamp": "2018-11-27T01:12:33.037Z",
-      "auditd": {
-        "sequence": 186342,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "46.148.18.163",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        }
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32161",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "46.148.18.163"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "g9S5UmcBTFzn_XoLl-71",
-    "source": {
-      "@timestamp": "2018-11-27T01:12:33.179Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "process": {
-        "pid": "32161",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "46.148.18.163"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "hostname": "46.148.18.163",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "46.148.18.163",
-            "type": "user-session",
-            "primary": "ssh"
-          }
-        },
-        "sequence": 186343,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "LdW7UmcBTFzn_XoLDA9a",
-    "source": {
-      "@timestamp": "2018-11-27T01:14:08.367Z",
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "438"
-      },
-      "source": {
-        "ip": "193.70.38.229"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "193.70.38.229"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192491
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "LtW7UmcBTFzn_XoLDA9a",
-    "source": {
-      "@timestamp": "2018-11-27T01:14:08.368Z",
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "438"
-      },
-      "source": {
-        "ip": "193.70.38.229"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192492,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "193.70.38.229",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "L9W7UmcBTFzn_XoLDA9a",
-    "source": {
-      "@timestamp": "2018-11-27T01:14:08.480Z",
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "193.70.38.229",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "193.70.38.229"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192493
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "438",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "193.70.38.229"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "M9S5UmcBTFzn_XoLcevO",
-    "source": {
-      "@timestamp": "2018-11-27T01:12:23.261Z",
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "107.170.65.109"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186340
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32158",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "SdW9UmcBTFzn_XoLHz_j",
-    "source": {
-      "@timestamp": "2018-11-27T01:16:24.437Z",
-      "auditd": {
-        "sequence": 44170,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "37.187.113.229",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        }
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "process": {
-        "pid": "29260",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "37.187.113.229"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "StW9UmcBTFzn_XoLHz_j",
-    "source": {
-      "@timestamp": "2018-11-27T01:16:24.437Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "29260",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "37.187.113.229"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44171,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "37.187.113.229",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "S9W9UmcBTFzn_XoLHz_j",
-    "source": {
-      "@timestamp": "2018-11-27T01:16:24.541Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "29260",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "37.187.113.229"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "auditd": {
-        "sequence": 44172,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "37.187.113.229",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "37.187.113.229"
-          }
-        }
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "q9W9UmcBTFzn_XoLJj-I",
-    "source": {
-      "@timestamp": "2018-11-27T01:16:26.142Z",
-      "process": {
-        "pid": "25331",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "103.249.205.78"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "103.249.205.78"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184334,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "rNW9UmcBTFzn_XoLJj-I",
-    "source": {
-      "@timestamp": "2018-11-27T01:16:26.143Z",
-      "process": {
-        "pid": "25331",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "103.249.205.78"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 184335,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "103.249.205.78",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "rdW9UmcBTFzn_XoLJj-I",
-    "source": {
-      "@timestamp": "2018-11-27T01:16:26.372Z",
-      "source": {
-        "ip": "103.249.205.78"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "ssh",
-          "hostname": "103.249.205.78",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "103.249.205.78",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184336,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "25331"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "b9W8UmcBTFzn_XoLiTGg",
-    "source": {
-      "@timestamp": "2018-11-27T01:15:45.974Z",
-      "auditd": {
-        "sequence": 186365,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "46.148.18.163",
-            "type": "user-session"
-          }
-        }
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32190",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "46.148.18.163"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "cNW8UmcBTFzn_XoLiTGg",
-    "source": {
-      "@timestamp": "2018-11-27T01:15:45.975Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186366,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "46.148.18.163",
-            "type": "user-session"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32190",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "46.148.18.163"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "cdW8UmcBTFzn_XoLiTGg",
-    "source": {
-      "@timestamp": "2018-11-27T01:15:46.119Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32190",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "46.148.18.163"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "46.148.18.163"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "46.148.18.163"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 186367,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "FtW8UmcBTFzn_XoLkzMm",
-    "source": {
-      "@timestamp": "2018-11-27T01:15:48.412Z",
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32192"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 186368,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "F9W8UmcBTFzn_XoLkzMm",
-    "source": {
-      "@timestamp": "2018-11-27T01:15:48.413Z",
-      "process": {
-        "pid": "32192",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186369,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "GNW8UmcBTFzn_XoLkzMm",
-    "source": {
-      "@timestamp": "2018-11-27T01:15:48.444Z",
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186370,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "107.170.65.109",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "process": {
-        "pid": "32192",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "g9W7UmcBTFzn_XoL5iPr",
-    "source": {
-      "@timestamp": "2018-11-27T01:15:04.321Z",
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32185"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "107.170.65.109",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186359,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "hNW7UmcBTFzn_XoL5iPr",
-    "source": {
-      "@timestamp": "2018-11-27T01:15:04.322Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186360,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        }
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "process": {
-        "pid": "32185",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "hdW7UmcBTFzn_XoL5iPr",
-    "source": {
-      "@timestamp": "2018-11-27T01:15:04.353Z",
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32185",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "107.170.65.109",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          }
-        },
-        "sequence": 186361,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ddW7UmcBTFzn_XoLfxpa",
-    "source": {
-      "@timestamp": "2018-11-27T01:14:37.808Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "128.199.91.82",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 186356,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32178",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "128.199.91.82"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "dtW7UmcBTFzn_XoLfxpa",
-    "source": {
-      "@timestamp": "2018-11-27T01:14:37.809Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32178"
-      },
-      "source": {
-        "ip": "128.199.91.82"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "128.199.91.82"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186357,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "d9W7UmcBTFzn_XoLfxpa",
-    "source": {
-      "@timestamp": "2018-11-27T01:14:38.002Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "128.199.91.82",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "128.199.91.82",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186358,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32178"
-      },
-      "source": {
-        "ip": "128.199.91.82"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "I9W8UmcBTFzn_XoLdzAT",
-    "source": {
-      "@timestamp": "2018-11-27T01:15:41.225Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186362,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "89.36.221.229",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32188",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "89.36.221.229"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "JNW8UmcBTFzn_XoLdzAT",
-    "source": {
-      "@timestamp": "2018-11-27T01:15:41.226Z",
-      "source": {
-        "ip": "89.36.221.229"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186363,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "89.36.221.229"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32188",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "JdW8UmcBTFzn_XoLdzAT",
-    "source": {
-      "@timestamp": "2018-11-27T01:15:41.329Z",
-      "source": {
-        "ip": "89.36.221.229"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "89.36.221.229",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "89.36.221.229",
-            "type": "user-session"
-          }
-        },
-        "sequence": 186364,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32188",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "5dW7UmcBTFzn_XoLcBda",
-    "source": {
-      "@timestamp": "2018-11-27T01:14:33.960Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "131.100.219.3",
-            "type": "user-session"
-          }
-        },
-        "sequence": 44161,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "29218",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "131.100.219.3"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "5tW7UmcBTFzn_XoLcBda",
-    "source": {
-      "@timestamp": "2018-11-27T01:14:33.964Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "29218",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "131.100.219.3"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "131.100.219.3"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44162,
-        "result": "fail"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "59W7UmcBTFzn_XoLcBda",
-    "source": {
-      "@timestamp": "2018-11-27T01:14:34.176Z",
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "29218",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "131.100.219.3"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "131.100.219.3"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "131.100.219.3",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44163,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "D9W8UmcBTFzn_XoL6Do7",
-    "source": {
-      "@timestamp": "2018-11-27T01:16:10.192Z",
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32194",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "81.66.86.4"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "81.66.86.4"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186371,
-        "result": "fail",
-        "session": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ENW8UmcBTFzn_XoL6Do7",
-    "source": {
-      "@timestamp": "2018-11-27T01:16:10.194Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "81.66.86.4"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186372,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32194"
-      },
-      "source": {
-        "ip": "81.66.86.4"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "EdW8UmcBTFzn_XoL6Do7",
-    "source": {
-      "@timestamp": "2018-11-27T01:16:10.308Z",
-      "source": {
-        "ip": "81.66.86.4"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "81.66.86.4",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186373,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "81.66.86.4"
-        }
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "process": {
-        "pid": "32194",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "cNW8UmcBTFzn_XoLvDaC",
-    "source": {
-      "@timestamp": "2018-11-27T01:15:58.995Z",
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "204.145.5.2",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44164,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "29245",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "204.145.5.2"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "cdW8UmcBTFzn_XoLvDaC",
-    "source": {
-      "@timestamp": "2018-11-27T01:15:58.999Z",
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "204.145.5.2",
-            "type": "user-session",
-            "primary": "sshd"
-          }
-        },
-        "sequence": 44165,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        }
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "29245",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "204.145.5.2"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ctW8UmcBTFzn_XoLvDaC",
-    "source": {
-      "@timestamp": "2018-11-27T01:15:59.199Z",
-      "process": {
-        "pid": "29245",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "204.145.5.2"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "hostname": "204.145.5.2",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "204.145.5.2",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44166,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "f9W8UmcBTFzn_XoL_Dt-",
-    "source": {
-      "@timestamp": "2018-11-27T01:16:15.376Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "51.15.40.125",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 44167
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "29255"
-      },
-      "source": {
-        "ip": "51.15.40.125"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "gNW8UmcBTFzn_XoL_Dt-",
-    "source": {
-      "@timestamp": "2018-11-27T01:16:15.376Z",
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "51.15.40.125",
-            "type": "user-session"
-          }
-        },
-        "sequence": 44168
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "29255"
-      },
-      "source": {
-        "ip": "51.15.40.125"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "gdW8UmcBTFzn_XoL_Dt-",
-    "source": {
-      "@timestamp": "2018-11-27T01:16:15.488Z",
-      "auditd": {
-        "sequence": 44169,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "51.15.40.125"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "51.15.40.125",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "29255"
-      },
-      "source": {
-        "ip": "51.15.40.125"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "INXAUmcBTFzn_XoLvI6Q",
-    "source": {
-      "@timestamp": "2018-11-27T01:20:21.158Z",
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "138.68.50.250",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          }
-        },
-        "sequence": 142333,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "19612",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "138.68.50.250"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "IdXAUmcBTFzn_XoLvI6Q",
-    "source": {
-      "@timestamp": "2018-11-27T01:20:21.159Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "19612",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "source": {
-        "ip": "138.68.50.250"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "138.68.50.250",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142334,
-        "result": "fail",
-        "session": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ItXAUmcBTFzn_XoLvI6Q",
-    "source": {
-      "@timestamp": "2018-11-27T01:20:21.200Z",
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "19612"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "source": {
-        "ip": "138.68.50.250"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 142335,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "138.68.50.250",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "138.68.50.250",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "BdXAUmcBTFzn_XoLyZBk",
-    "source": {
-      "@timestamp": "2018-11-27T01:20:24.441Z",
-      "event": {
-        "category": "system-services",
-        "type": "service_start",
-        "action": "started-service",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "name": "systemd",
-        "exe": "/lib/systemd/systemd",
-        "pid": "1"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "unit": "apt-daily"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "apt-daily",
-            "type": "service"
-          },
-          "how": "/lib/systemd/systemd"
-        },
-        "sequence": 184343,
-        "result": "success"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "BtXAUmcBTFzn_XoLyZBk",
-    "source": {
-      "@timestamp": "2018-11-27T01:20:24.441Z",
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "auditd": {
-        "sequence": 184344,
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "unit": "apt-daily"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "apt-daily",
-            "type": "service"
-          },
-          "how": "/lib/systemd/systemd"
-        }
-      },
-      "event": {
-        "type": "service_stop",
-        "action": "stopped-service",
-        "module": "auditd",
-        "category": "system-services"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "1",
-        "name": "systemd",
-        "exe": "/lib/systemd/systemd"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "yNW_UmcBTFzn_XoL_n0W",
-    "source": {
-      "@timestamp": "2018-11-27T01:19:32.396Z",
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186392,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32225",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ydW_UmcBTFzn_XoL_n0W",
-    "source": {
-      "@timestamp": "2018-11-27T01:19:32.398Z",
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "107.170.65.109",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186393,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        }
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32225",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ytW_UmcBTFzn_XoL_n0W",
-    "source": {
-      "@timestamp": "2018-11-27T01:19:32.428Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32225"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "107.170.65.109"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186394
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "PNXAUmcBTFzn_XoLAX59",
-    "source": {
-      "@timestamp": "2018-11-27T01:19:33.267Z",
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "83.222.240.60",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          }
-        },
-        "sequence": 192500
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "473",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "83.222.240.60"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "PdXAUmcBTFzn_XoLAX59",
-    "source": {
-      "@timestamp": "2018-11-27T01:19:33.268Z",
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "473",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "83.222.240.60"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "83.222.240.60",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192501,
-        "result": "fail",
-        "session": "unset"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "PtXAUmcBTFzn_XoLAX59",
-    "source": {
-      "@timestamp": "2018-11-27T01:19:33.371Z",
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "473"
-      },
-      "source": {
-        "ip": "83.222.240.60"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "83.222.240.60",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "83.222.240.60",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192502,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "L9XBUmcBTFzn_XoLuKRN",
-    "source": {
-      "@timestamp": "2018-11-27T01:21:25.603Z",
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186398,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "153.254.115.57",
-            "type": "user-session"
-          }
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32236",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "153.254.115.57"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "MNXBUmcBTFzn_XoLuKRN",
-    "source": {
-      "@timestamp": "2018-11-27T01:21:25.604Z",
-      "auditd": {
-        "sequence": 186399,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "153.254.115.57",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "process": {
-        "pid": "32236",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "153.254.115.57"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "MdXBUmcBTFzn_XoLuKRN",
-    "source": {
-      "@timestamp": "2018-11-27T01:21:25.817Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32236"
-      },
-      "source": {
-        "ip": "153.254.115.57"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "hostname": "153.254.115.57",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "153.254.115.57",
-            "type": "user-session"
-          }
-        },
-        "sequence": 186400,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "xtXCUmcBTFzn_XoLq7my",
-    "source": {
-      "@timestamp": "2018-11-27T01:22:27.912Z",
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "118.163.107.56",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186404,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32246",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "118.163.107.56"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "x9XCUmcBTFzn_XoLq7my",
-    "source": {
-      "@timestamp": "2018-11-27T01:22:27.914Z",
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "process": {
-        "pid": "32246",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "118.163.107.56"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "118.163.107.56",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186405,
-        "result": "fail"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "yNXCUmcBTFzn_XoLq7my",
-    "source": {
-      "@timestamp": "2018-11-27T01:22:28.078Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32246"
-      },
-      "source": {
-        "ip": "118.163.107.56"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "118.163.107.56",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "118.163.107.56",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186406
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "8dXBUmcBTFzn_XoL0KVY",
-    "source": {
-      "@timestamp": "2018-11-27T01:21:31.757Z",
-      "process": {
-        "pid": "32238",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186401,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "8tXBUmcBTFzn_XoL0KVY",
-    "source": {
-      "@timestamp": "2018-11-27T01:21:31.758Z",
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186402,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32238"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "89XBUmcBTFzn_XoL0KVY",
-    "source": {
-      "@timestamp": "2018-11-27T01:21:31.789Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "hostname": "107.170.65.109",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186403,
-        "result": "fail"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32238",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "_dXAUmcBTFzn_XoL55GP",
-    "source": {
-      "@timestamp": "2018-11-27T01:20:32.165Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "process": {
-        "pid": "32229",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "107.170.65.109",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186395,
-        "result": "fail",
-        "session": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "_tXAUmcBTFzn_XoL55GP",
-    "source": {
-      "@timestamp": "2018-11-27T01:20:32.166Z",
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32229",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186396,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "_9XAUmcBTFzn_XoL55GP",
-    "source": {
-      "@timestamp": "2018-11-27T01:20:32.197Z",
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32229",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186397,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "107.170.65.109",
-          "terminal": "ssh"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "xNXCUmcBTFzn_XoLQq83",
-    "source": {
-      "@timestamp": "2018-11-27T01:22:00.907Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "process": {
-        "pid": "12675",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "145.239.237.80"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "145.239.237.80"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43161
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "xdXCUmcBTFzn_XoLQq83",
-    "source": {
-      "@timestamp": "2018-11-27T01:22:00.907Z",
-      "source": {
-        "ip": "145.239.237.80"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "145.239.237.80",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43162,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "12675",
-        "exe": "/usr/sbin/sshd"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "xtXCUmcBTFzn_XoLQq83",
-    "source": {
-      "@timestamp": "2018-11-27T01:22:01.039Z",
-      "source": {
-        "ip": "145.239.237.80"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "hostname": "145.239.237.80",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "145.239.237.80",
-            "type": "user-session"
-          }
-        },
-        "sequence": 43163,
-        "result": "fail"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "12675",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "o9XAUmcBTFzn_XoLKIGO",
-    "source": {
-      "@timestamp": "2018-11-27T01:19:43.268Z",
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "141.89.111.68",
-            "type": "user-session"
-          }
-        },
-        "sequence": 192503,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "475",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "141.89.111.68"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "pNXAUmcBTFzn_XoLKIGO",
-    "source": {
-      "@timestamp": "2018-11-27T01:19:43.269Z",
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "475",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "141.89.111.68"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "141.89.111.68",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192504
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "pdXAUmcBTFzn_XoLKIGO",
-    "source": {
-      "@timestamp": "2018-11-27T01:19:43.395Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "141.89.111.68"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "141.89.111.68",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192505
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "475",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "141.89.111.68"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "O9XAUmcBTFzn_XoLzZAP",
-    "source": {
-      "@timestamp": "2018-11-27T01:20:25.380Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "195.84.49.20",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44179,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "29341",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "195.84.49.20"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "PNXAUmcBTFzn_XoLzZAP",
-    "source": {
-      "@timestamp": "2018-11-27T01:20:25.380Z",
-      "source": {
-        "ip": "195.84.49.20"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "195.84.49.20",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 44180,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "29341",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "PdXAUmcBTFzn_XoLzZAP",
-    "source": {
-      "@timestamp": "2018-11-27T01:20:25.516Z",
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "source": {
-        "ip": "195.84.49.20"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44181,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "195.84.49.20"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "195.84.49.20",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "29341"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "SNXCUmcBTFzn_XoLvLq2",
-    "source": {
-      "@timestamp": "2018-11-27T01:22:32.268Z",
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32248"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186407,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "SdXCUmcBTFzn_XoLvLq2",
-    "source": {
-      "@timestamp": "2018-11-27T01:22:32.269Z",
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          }
-        },
-        "sequence": 186408,
-        "result": "fail"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32248",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "StXCUmcBTFzn_XoLvLq2",
-    "source": {
-      "@timestamp": "2018-11-27T01:22:32.300Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186409,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "107.170.65.109"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "107.170.65.109",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32248",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "c9XCUmcBTFzn_XoL-sCa",
-    "source": {
-      "@timestamp": "2018-11-27T01:22:48.071Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "490",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "68.183.62.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "68.183.62.109",
-            "type": "user-session",
-            "primary": "sshd"
-          }
-        },
-        "sequence": 192506,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        }
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "dNXCUmcBTFzn_XoL-sCa",
-    "source": {
-      "@timestamp": "2018-11-27T01:22:48.073Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "68.183.62.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 192507,
-        "result": "fail"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "490",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "68.183.62.109"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ddXCUmcBTFzn_XoL-sCa",
-    "source": {
-      "@timestamp": "2018-11-27T01:22:48.104Z",
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "490"
-      },
-      "source": {
-        "ip": "68.183.62.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "hostname": "68.183.62.109",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "68.183.62.109"
-          }
-        },
-        "sequence": 192508,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "stXDUmcBTFzn_XoLwdCO",
-    "source": {
-      "@timestamp": "2018-11-27T01:23:39.044Z",
-      "process": {
-        "pid": "502",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "80.127.254.119"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "auditd": {
-        "sequence": 192511,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "80.127.254.119"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "s9XDUmcBTFzn_XoLwdCO",
-    "source": {
-      "@timestamp": "2018-11-27T01:23:39.045Z",
-      "process": {
-        "pid": "502",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "80.127.254.119"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "auditd": {
-        "sequence": 192512,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "80.127.254.119",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "tNXDUmcBTFzn_XoLwdCO",
-    "source": {
-      "@timestamp": "2018-11-27T01:23:39.260Z",
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "502",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "80.127.254.119"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "80.127.254.119"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "80.127.254.119",
-            "type": "user-session"
-          }
-        },
-        "sequence": 192513,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "TtXDUmcBTFzn_XoLkcxS",
-    "source": {
-      "@timestamp": "2018-11-27T01:23:26.696Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32251",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "93.104.213.19"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186410,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "93.104.213.19",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "T9XDUmcBTFzn_XoLkcxS",
-    "source": {
-      "@timestamp": "2018-11-27T01:23:26.697Z",
-      "source": {
-        "ip": "93.104.213.19"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "93.104.213.19",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186411,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32251",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "UNXDUmcBTFzn_XoLkcxS",
-    "source": {
-      "@timestamp": "2018-11-27T01:23:26.812Z",
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32251",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "93.104.213.19"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "sequence": 186412,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "93.104.213.19",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "93.104.213.19",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ctXCUmcBTFzn_XoL3b2F",
-    "source": {
-      "@timestamp": "2018-11-27T01:22:40.662Z",
-      "source": {
-        "ip": "185.238.72.255"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "auditd": {
-        "sequence": 43164,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "185.238.72.255",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "12678",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "c9XCUmcBTFzn_XoL3b2F",
-    "source": {
-      "@timestamp": "2018-11-27T01:22:40.662Z",
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "12678",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "185.238.72.255"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "185.238.72.255",
-            "type": "user-session"
-          }
-        },
-        "sequence": 43165,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "dNXCUmcBTFzn_XoL3b2F",
-    "source": {
-      "@timestamp": "2018-11-27T01:22:40.794Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "12678"
-      },
-      "source": {
-        "ip": "185.238.72.255"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "hostname": "185.238.72.255",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "185.238.72.255",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43166,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "SNXDUmcBTFzn_XoLtc-O",
-    "source": {
-      "@timestamp": "2018-11-27T01:23:35.972Z",
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32253",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186413,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "SdXDUmcBTFzn_XoLtc-O",
-    "source": {
-      "@timestamp": "2018-11-27T01:23:35.973Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32253",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 186414,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "StXDUmcBTFzn_XoLtc-O",
-    "source": {
-      "@timestamp": "2018-11-27T01:23:36.003Z",
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32253",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "107.170.65.109",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "object": {
-            "secondary": "107.170.65.109",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 186415,
-        "result": "fail",
-        "session": "unset"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "CNXDUmcBTFzn_XoLps53",
-    "source": {
-      "@timestamp": "2018-11-27T01:23:32.109Z",
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "source": {
-        "ip": "125.227.77.88"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "125.227.77.88"
-        },
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "125.227.77.88",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 184346
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "25735",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "HNXDUmcBTFzn_XoLp84D",
-    "source": {
-      "@timestamp": "2018-11-27T01:23:32.249Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "500",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "142.93.109.33"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "142.93.109.33",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "142.93.109.33",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192510,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "rdXDUmcBTFzn_XoLZcgh",
-    "source": {
-      "@timestamp": "2018-11-27T01:23:15.383Z",
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "process": {
-        "pid": "25733",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "125.227.77.88"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "125.227.77.88",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "125.227.77.88",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 184345,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "v9XDUmcBTFzn_XoLIMO9",
-    "source": {
-      "@timestamp": "2018-11-27T01:22:57.875Z",
-      "process": {
-        "pid": "497",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "94.16.115.155"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "94.16.115.155"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "94.16.115.155",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192509,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ndXDUmcBTFzn_XoL69Tr",
-    "source": {
-      "@timestamp": "2018-11-27T01:23:49.884Z",
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "source": {
-        "ip": "147.229.176.122"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "147.229.176.122",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43167,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "12686"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ntXDUmcBTFzn_XoL69Tr",
-    "source": {
-      "@timestamp": "2018-11-27T01:23:49.884Z",
-      "source": {
-        "ip": "147.229.176.122"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "147.229.176.122",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 43168
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "12686"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "n9XDUmcBTFzn_XoL69Tr",
-    "source": {
-      "@timestamp": "2018-11-27T01:23:50.008Z",
-      "process": {
-        "pid": "12686",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "147.229.176.122"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "147.229.176.122",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 43169,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "147.229.176.122",
-          "terminal": "ssh"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "CNXDUmcBTFzn_XoL99V8",
-    "source": {
-      "@timestamp": "2018-11-27T01:23:52.849Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "25737"
-      },
-      "source": {
-        "ip": "125.227.77.88"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "125.227.77.88"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184347,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "CdXDUmcBTFzn_XoL99V8",
-    "source": {
-      "@timestamp": "2018-11-27T01:23:52.850Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "25737"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "source": {
-        "ip": "125.227.77.88"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "125.227.77.88",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 184348
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "CtXDUmcBTFzn_XoL99V8",
-    "source": {
-      "@timestamp": "2018-11-27T01:23:53.128Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "125.227.77.88",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "object": {
-            "secondary": "125.227.77.88",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 184349
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "25737",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "125.227.77.88"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "9dXFUmcBTFzn_XoLyvxi",
-    "source": {
-      "@timestamp": "2018-11-27T01:25:52.376Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32272"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186422,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "9tXFUmcBTFzn_XoLyvxi",
-    "source": {
-      "@timestamp": "2018-11-27T01:25:52.377Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          }
-        },
-        "sequence": 186423,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        }
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32272",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "99XFUmcBTFzn_XoLyvxi",
-    "source": {
-      "@timestamp": "2018-11-27T01:25:52.407Z",
-      "process": {
-        "pid": "32272",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          }
-        },
-        "sequence": 186424,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "107.170.65.109",
-          "terminal": "ssh"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "aNXFUmcBTFzn_XoLzv1N",
-    "source": {
-      "@timestamp": "2018-11-27T01:25:53.380Z",
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "524",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "104.236.181.158"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "104.236.181.158",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192520,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "adXFUmcBTFzn_XoLzv1N",
-    "source": {
-      "@timestamp": "2018-11-27T01:25:53.381Z",
-      "process": {
-        "pid": "524",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "104.236.181.158"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192521,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "104.236.181.158",
-            "type": "user-session",
-            "primary": "sshd"
-          }
-        }
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "beat": {
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "atXFUmcBTFzn_XoLzv1N",
-    "source": {
-      "@timestamp": "2018-11-27T01:25:53.425Z",
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "104.236.181.158"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "104.236.181.158"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192522,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "524",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "104.236.181.158"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "q9XDUmcBTFzn_XoL2tJr",
-    "source": {
-      "@timestamp": "2018-11-27T01:23:45.409Z",
-      "process": {
-        "pid": "19632",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "source": {
-        "ip": "46.101.192.45"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "46.101.192.45",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 142336,
-        "result": "fail"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "rNXDUmcBTFzn_XoL2tJr",
-    "source": {
-      "@timestamp": "2018-11-27T01:23:45.410Z",
-      "source": {
-        "ip": "46.101.192.45"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "46.101.192.45"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142337,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "process": {
-        "pid": "19632",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "rdXDUmcBTFzn_XoL2tJr",
-    "source": {
-      "@timestamp": "2018-11-27T01:23:45.519Z",
-      "auditd": {
-        "sequence": 142338,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "46.101.192.45",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "46.101.192.45",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "19632"
-      },
-      "source": {
-        "ip": "46.101.192.45"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "kNbGUmcBTFzn_XoLcgv7",
-    "source": {
-      "@timestamp": "2018-11-27T01:26:35.537Z",
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "25757",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "167.114.153.36"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 184350,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "167.114.153.36",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "kdbGUmcBTFzn_XoLcgv7",
-    "source": {
-      "@timestamp": "2018-11-27T01:26:35.538Z",
-      "source": {
-        "ip": "167.114.153.36"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "167.114.153.36",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184351,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        }
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "25757"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ktbGUmcBTFzn_XoLcgv7",
-    "source": {
-      "@timestamp": "2018-11-27T01:26:35.581Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "167.114.153.36"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "167.114.153.36",
-            "type": "user-session"
-          }
-        },
-        "sequence": 184352
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "25757"
-      },
-      "source": {
-        "ip": "167.114.153.36"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "YNXEUmcBTFzn_XoLu-bL",
-    "source": {
-      "@timestamp": "2018-11-27T01:24:43.105Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32262",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186416,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "YdXEUmcBTFzn_XoLu-bL",
-    "source": {
-      "@timestamp": "2018-11-27T01:24:43.106Z",
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186417,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32262"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "YtXEUmcBTFzn_XoLu-bL",
-    "source": {
-      "@timestamp": "2018-11-27T01:24:43.136Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32262"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "107.170.65.109",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186418,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "6dXFUmcBTFzn_XoLNvCh",
-    "source": {
-      "@timestamp": "2018-11-27T01:25:14.551Z",
-      "auditd": {
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "34.197.73.243",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186419,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32269",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "34.197.73.243"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "6tXFUmcBTFzn_XoLNvCh",
-    "source": {
-      "@timestamp": "2018-11-27T01:25:14.552Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32269",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "34.197.73.243"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "34.197.73.243"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186420,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "69XFUmcBTFzn_XoLNvCh",
-    "source": {
-      "@timestamp": "2018-11-27T01:25:14.587Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32269",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "34.197.73.243"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "hostname": "34.197.73.243",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "34.197.73.243",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 186421,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "WtXEUmcBTFzn_XoLA9aC",
-    "source": {
-      "@timestamp": "2018-11-27T01:23:55.928Z",
-      "auditd": {
-        "sequence": 192514,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "211.21.65.57",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "504",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "211.21.65.57"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "W9XEUmcBTFzn_XoLA9aC",
-    "source": {
-      "@timestamp": "2018-11-27T01:23:55.929Z",
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "504"
-      },
-      "source": {
-        "ip": "211.21.65.57"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192515,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "211.21.65.57",
-            "type": "user-session"
-          }
-        }
-      },
-      "beat": {
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "XNXEUmcBTFzn_XoLA9aC",
-    "source": {
-      "@timestamp": "2018-11-27T01:23:56.099Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "211.21.65.57"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192516,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "211.21.65.57"
-        }
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "504",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "211.21.65.57"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "sNXEUmcBTFzn_XoLbd__",
-    "source": {
-      "@timestamp": "2018-11-27T01:24:23.144Z",
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "515",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "54.254.52.72"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "beat": {
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "54.254.52.72",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192517,
-        "result": "fail",
-        "session": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "sdXEUmcBTFzn_XoLbd__",
-    "source": {
-      "@timestamp": "2018-11-27T01:24:23.145Z",
-      "auditd": {
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "54.254.52.72",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192518,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "515",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "54.254.52.72"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "stXEUmcBTFzn_XoLbd__",
-    "source": {
-      "@timestamp": "2018-11-27T01:24:23.339Z",
-      "auditd": {
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "54.254.52.72"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "54.254.52.72"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192519,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "515",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "54.254.52.72"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "PtXFUmcBTFzn_XoLg_d5",
-    "source": {
-      "@timestamp": "2018-11-27T01:25:34.159Z",
-      "source": {
-        "ip": "192.240.119.252"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "ssh",
-          "hostname": "192.240.119.252",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "192.240.119.252"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 44182,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "process": {
-        "pid": "29443",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "2NbIUmcBTFzn_XoLSjPA",
-    "source": {
-      "@timestamp": "2018-11-27T01:28:36.309Z",
-      "file": {
-        "size": 0,
-        "group": "root",
-        "path": "/etc/sed8B6Ati",
-        "ctime": "2018-11-27T01:28:36.306Z",
-        "uid": 0,
-        "gid": 0,
-        "inode": "332",
-        "mode": "0000",
-        "owner": "root",
-        "mtime": "2018-11-27T01:28:36.306Z",
-        "type": "file"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "hash": {
-        "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709"
-      },
-      "event": {
-        "module": "file_integrity",
-        "action": [
-          "created"
-        ]
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "2dbIUmcBTFzn_XoLSjPA",
-    "source": {
-      "@timestamp": "2018-11-27T01:28:36.311Z",
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "action": [
-          "updated"
-        ],
-        "module": "file_integrity"
-      },
-      "file": {
-        "ctime": "2018-11-27T01:28:36.306Z",
-        "mtime": "2018-11-27T01:28:36.306Z",
-        "owner": "root",
-        "path": "/etc/sed8B6Ati",
-        "size": 21,
-        "type": "file",
-        "uid": 0,
-        "gid": 0,
-        "inode": "332",
-        "mode": "0000",
-        "group": "root"
-      },
-      "hash": {
-        "sha1": "302493715263b503309437954b46d73fee714260"
-      },
-      "beat": {
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "2tbIUmcBTFzn_XoLSjPA",
-    "source": {
-      "@timestamp": "2018-11-27T01:28:36.312Z",
-      "event": {
-        "module": "file_integrity",
-        "action": [
-          "updated"
-        ]
-      },
-      "file": {
-        "path": "/etc/sed8B6Ati"
-      },
-      "beat": {
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "29bIUmcBTFzn_XoLSjPA",
-    "source": {
-      "@timestamp": "2018-11-27T01:28:36.314Z",
-      "event": {
-        "module": "file_integrity",
-        "action": [
-          "moved"
-        ]
-      },
-      "file": {
-        "path": "/etc/sed8B6Ati"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "3NbIUmcBTFzn_XoLSjPA",
-    "source": {
-      "@timestamp": "2018-11-27T01:28:36.315Z",
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "action": [
-          "created"
-        ],
-        "module": "file_integrity"
-      },
-      "file": {
-        "size": 420,
-        "type": "file",
-        "uid": 0,
-        "inode": "332",
-        "ctime": "2018-11-27T01:28:36.306Z",
-        "mode": "0644",
-        "path": "/etc/hosts",
-        "mtime": "2018-11-27T01:28:36.306Z",
-        "owner": "root",
-        "gid": 0,
-        "group": "root"
-      },
-      "hash": {
-        "sha1": "3ecab8f840eff15248fdb68f4cc7c3d0d9971476"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "3dbIUmcBTFzn_XoLSjPA",
-    "source": {
-      "@timestamp": "2018-11-27T01:28:36.410Z",
-      "event": {
-        "category": "system-services",
-        "type": "service_stop",
-        "action": "stopped-service",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "1",
-        "name": "systemd",
-        "exe": "/lib/systemd/systemd"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "unit": "rsyslog"
-        },
-        "summary": {
-          "object": {
-            "type": "service",
-            "primary": "rsyslog"
-          },
-          "how": "/lib/systemd/systemd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 44186,
-        "result": "success"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "3tbIUmcBTFzn_XoLSjPA",
-    "source": {
-      "@timestamp": "2018-11-27T01:28:36.470Z",
-      "process": {
-        "exe": "/lib/systemd/systemd",
-        "pid": "1",
-        "name": "systemd"
-      },
-      "auditd": {
-        "data": {
-          "unit": "rsyslog"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "service",
-            "primary": "rsyslog"
-          },
-          "how": "/lib/systemd/systemd"
-        },
-        "sequence": 44187,
-        "result": "success",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "type": "service_start",
-        "action": "started-service",
-        "module": "auditd",
-        "category": "system-services"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "MNbHUmcBTFzn_XoLFxpi",
-    "source": {
-      "@timestamp": "2018-11-27T01:27:17.624Z",
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "25765",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "source": {
-        "ip": "59.124.152.146"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "59.124.152.146",
-            "type": "user-session"
-          }
-        },
-        "sequence": 184353,
-        "result": "fail",
-        "session": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "MdbHUmcBTFzn_XoLFxpi",
-    "source": {
-      "@timestamp": "2018-11-27T01:27:17.625Z",
-      "beat": {
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "25765",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "59.124.152.146"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 184354,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "59.124.152.146"
-          }
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "MtbHUmcBTFzn_XoLFxpi",
-    "source": {
-      "@timestamp": "2018-11-27T01:27:17.794Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 184355,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "59.124.152.146",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "59.124.152.146",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "25765"
-      },
-      "source": {
-        "ip": "59.124.152.146"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "M9bHUmcBTFzn_XoLFxqn",
-    "source": {
-      "@timestamp": "2018-11-27T01:27:17.693Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "167.99.171.14",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192523
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "532",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "167.99.171.14"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "NNbHUmcBTFzn_XoLFxqn",
-    "source": {
-      "@timestamp": "2018-11-27T01:27:17.695Z",
-      "source": {
-        "ip": "167.99.171.14"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "167.99.171.14",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 192524,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "532"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "NdbHUmcBTFzn_XoLFxqn",
-    "source": {
-      "@timestamp": "2018-11-27T01:27:17.735Z",
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "532"
-      },
-      "source": {
-        "ip": "167.99.171.14"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192525,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "167.99.171.14",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "167.99.171.14",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "3dbHUmcBTFzn_XoLPR0X",
-    "source": {
-      "@timestamp": "2018-11-27T01:27:27.266Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "19657",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "139.59.130.2"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "139.59.130.2",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142339
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "3tbHUmcBTFzn_XoLPR0X",
-    "source": {
-      "@timestamp": "2018-11-27T01:27:27.267Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "19657",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-haproxy-01"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "source": {
-        "ip": "139.59.130.2"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "139.59.130.2",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 142340,
-        "result": "fail",
-        "session": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "39bHUmcBTFzn_XoLPR0X",
-    "source": {
-      "@timestamp": "2018-11-27T01:27:27.376Z",
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "139.59.130.2",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "139.59.130.2",
-            "type": "user-session"
-          }
-        },
-        "sequence": 142341
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "19657",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "139.59.130.2"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "mNbIUmcBTFzn_XoLFi9i",
-    "source": {
-      "@timestamp": "2018-11-27T01:28:22.881Z",
-      "beat": {
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "25773",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "37.139.20.56"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "37.139.20.56"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 184356,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "mdbIUmcBTFzn_XoLFi9i",
-    "source": {
-      "@timestamp": "2018-11-27T01:28:22.883Z",
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "37.139.20.56",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184357
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "25773",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "source": {
-        "ip": "37.139.20.56"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "mtbIUmcBTFzn_XoLFi9i",
-    "source": {
-      "@timestamp": "2018-11-27T01:28:22.989Z",
-      "source": {
-        "ip": "37.139.20.56"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "hostname": "37.139.20.56",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "37.139.20.56"
-          }
-        },
-        "sequence": 184358,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "25773",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "0NbHUmcBTFzn_XoL7Stw",
-    "source": {
-      "@timestamp": "2018-11-27T01:28:12.420Z",
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32287",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 186428,
-        "result": "fail"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "0dbHUmcBTFzn_XoL7Stw",
-    "source": {
-      "@timestamp": "2018-11-27T01:28:12.422Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32287",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186429,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "0tbHUmcBTFzn_XoL7Stw",
-    "source": {
-      "@timestamp": "2018-11-27T01:28:12.453Z",
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "107.170.65.109"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "107.170.65.109",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186430,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32287"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ItbIUmcBTFzn_XoLqjzc",
-    "source": {
-      "@timestamp": "2018-11-27T01:29:00.914Z",
-      "process": {
-        "pid": "545",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "209.97.173.192"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "209.97.173.192",
-            "type": "user-session",
-            "primary": "sshd"
-          }
-        },
-        "sequence": 192526
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "I9bIUmcBTFzn_XoLqjzc",
-    "source": {
-      "@timestamp": "2018-11-27T01:29:00.915Z",
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "545"
-      },
-      "source": {
-        "ip": "209.97.173.192"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "209.97.173.192"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 192527,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "JNbIUmcBTFzn_XoLqjzc",
-    "source": {
-      "@timestamp": "2018-11-27T01:29:01.108Z",
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "545",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "209.97.173.192"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192528,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "209.97.173.192"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "209.97.173.192",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ONbGUmcBTFzn_XoL2xQn",
-    "source": {
-      "@timestamp": "2018-11-27T01:27:02.205Z",
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32279",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186425,
-        "result": "fail"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "OdbGUmcBTFzn_XoL2xQn",
-    "source": {
-      "@timestamp": "2018-11-27T01:27:02.206Z",
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186426,
-        "result": "fail"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32279",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "OtbGUmcBTFzn_XoL2xQn",
-    "source": {
-      "@timestamp": "2018-11-27T01:27:02.238Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32279",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "107.170.65.109",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "107.170.65.109",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186427
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ltbHUmcBTFzn_XoLWR9W",
-    "source": {
-      "@timestamp": "2018-11-27T01:27:34.501Z",
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "29478"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "source": {
-        "ip": "46.105.89.195"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "46.105.89.195"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 44183,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "l9bHUmcBTFzn_XoLWR9W",
-    "source": {
-      "@timestamp": "2018-11-27T01:27:34.501Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "46.105.89.195",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44184
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "29478",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "46.105.89.195"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "mNbHUmcBTFzn_XoLWR9W",
-    "source": {
-      "@timestamp": "2018-11-27T01:27:34.613Z",
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "hostname": "46.105.89.195",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "46.105.89.195",
-            "type": "user-session"
-          }
-        },
-        "sequence": 44185,
-        "result": "fail"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "29478"
-      },
-      "source": {
-        "ip": "46.105.89.195"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "QtbIUmcBTFzn_XoLVjVA",
-    "source": {
-      "@timestamp": "2018-11-27T01:28:39.253Z",
-      "beat": {
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "auditd": {
-        "sequence": 43170,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "51.255.34.233",
-            "type": "user-session"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "12716"
-      },
-      "source": {
-        "ip": "51.255.34.233"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Q9bIUmcBTFzn_XoLVjVA",
-    "source": {
-      "@timestamp": "2018-11-27T01:28:39.253Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "12716"
-      },
-      "source": {
-        "ip": "51.255.34.233"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "51.255.34.233",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 43171
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "RNbIUmcBTFzn_XoLVjVA",
-    "source": {
-      "@timestamp": "2018-11-27T01:28:39.361Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "12716",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "51.255.34.233"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "51.255.34.233",
-            "type": "user-session"
-          }
-        },
-        "sequence": 43172,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "51.255.34.233",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "8tfRUmcBTFzn_XoL1ASG",
-    "source": {
-      "@timestamp": "2018-11-27T01:39:01.401Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "12782"
-      },
-      "source": {
-        "ip": "138.68.150.115"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "hostname": "138.68.150.115",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "138.68.150.115",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 43186,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "S9fRUmcBTFzn_XoL1gUs",
-    "source": {
-      "@timestamp": "2018-11-27T01:39:01.825Z",
-      "process": {
-        "pid": "25839",
-        "exe": "/usr/sbin/cron"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "auditd": {
-        "sequence": 184368,
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "op": "PAM:accounting",
-          "acct": "root",
-          "terminal": "cron"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        }
-      },
-      "event": {
-        "type": "user_acct",
-        "action": "was-authorized",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "TNfRUmcBTFzn_XoL1gUs",
-    "source": {
-      "@timestamp": "2018-11-27T01:39:01.826Z",
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "cron",
-          "acct": "root",
-          "op": "PAM:setcred"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 184369,
-        "result": "success"
-      },
-      "event": {
-        "type": "cred_acq",
-        "action": "acquired-credentials",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/cron",
-        "pid": "25839"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "TdfRUmcBTFzn_XoL1gUs",
-    "source": {
-      "@timestamp": "2018-11-27T01:39:01.828Z",
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_start",
-        "action": "started-session"
-      },
-      "user": {
-        "auid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "25839",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "sequence": 184371,
-        "result": "success",
-        "session": "9859",
-        "data": {
-          "acct": "root",
-          "terminal": "cron",
-          "op": "PAM:session_open"
-        },
-        "summary": {
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "TtfRUmcBTFzn_XoL1gUs",
-    "source": {
-      "@timestamp": "2018-11-27T01:39:01.923Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "auid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/cron",
-        "pid": "25839"
-      },
-      "auditd": {
-        "sequence": 184372,
-        "result": "success",
-        "session": "9859",
-        "data": {
-          "acct": "root",
-          "terminal": "cron",
-          "op": "PAM:setcred"
-        },
-        "summary": {
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "cred_disp",
-        "action": "disposed-credentials"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "T9fRUmcBTFzn_XoL1gUs",
-    "source": {
-      "@timestamp": "2018-11-27T01:39:01.924Z",
-      "process": {
-        "pid": "25839",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "sequence": 184373,
-        "result": "success",
-        "session": "9859",
-        "data": {
-          "acct": "root",
-          "op": "PAM:session_close",
-          "terminal": "cron"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_end",
-        "action": "ended-session",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "UdfRUmcBTFzn_XoL1gXc",
-    "source": {
-      "@timestamp": "2018-11-27T01:39:02.001Z",
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_acct",
-        "action": "was-authorized"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/cron",
-        "pid": "608"
-      },
-      "auditd": {
-        "sequence": 192547,
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "acct": "root",
-          "op": "PAM:accounting",
-          "terminal": "cron"
-        },
-        "summary": {
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          }
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "UtfRUmcBTFzn_XoL1gXc",
-    "source": {
-      "@timestamp": "2018-11-27T01:39:02.001Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/cron",
-        "pid": "608"
-      },
-      "auditd": {
-        "sequence": 192548,
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "op": "PAM:setcred",
-          "terminal": "cron",
-          "acct": "root"
-        },
-        "summary": {
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        }
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "action": "acquired-credentials",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "cred_acq"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "U9fRUmcBTFzn_XoL1gXc",
-    "source": {
-      "@timestamp": "2018-11-27T01:39:02.003Z",
-      "auditd": {
-        "result": "success",
-        "session": "9863",
-        "data": {
-          "terminal": "cron",
-          "op": "PAM:session_open",
-          "acct": "root"
-        },
-        "summary": {
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          }
-        },
-        "sequence": 192550
-      },
-      "event": {
-        "action": "started-session",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_start"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "auid": "0"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/cron",
-        "pid": "608"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "VNfRUmcBTFzn_XoL1gXc",
-    "source": {
-      "@timestamp": "2018-11-27T01:39:02.100Z",
-      "process": {
-        "pid": "608",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "result": "success",
-        "session": "9863",
-        "data": {
-          "op": "PAM:setcred",
-          "acct": "root",
-          "terminal": "cron"
-        },
-        "summary": {
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 192551
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "action": "disposed-credentials",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "cred_disp"
-      },
-      "user": {
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "auid": "0",
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "VdfRUmcBTFzn_XoL1gXc",
-    "source": {
-      "@timestamp": "2018-11-27T01:39:02.101Z",
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "user": {
-        "auid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "608",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "sequence": 192552,
-        "result": "success",
-        "session": "9863",
-        "data": {
-          "op": "PAM:session_close",
-          "terminal": "cron",
-          "acct": "root"
-        },
-        "summary": {
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_end",
-        "action": "ended-session",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "KdbRUmcBTFzn_XoLPPiy",
-    "source": {
-      "@timestamp": "2018-11-27T01:38:22.535Z",
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "19718"
-      },
-      "source": {
-        "ip": "207.154.201.218"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-haproxy-01"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "auditd": {
-        "sequence": 142346,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "207.154.201.218"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "KtbRUmcBTFzn_XoLPPiy",
-    "source": {
-      "@timestamp": "2018-11-27T01:38:22.537Z",
-      "process": {
-        "pid": "19718",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "207.154.201.218"
-      },
-      "beat": {
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-haproxy-01"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 142347,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "207.154.201.218",
-            "type": "user-session"
-          }
-        }
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "K9bRUmcBTFzn_XoLPPiy",
-    "source": {
-      "@timestamp": "2018-11-27T01:38:22.645Z",
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "19718"
-      },
-      "source": {
-        "ip": "207.154.201.218"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 142348,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "207.154.201.218"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "207.154.201.218",
-            "type": "user-session"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "GdfTUmcBTFzn_XoLdSoA",
-    "source": {
-      "@timestamp": "2018-11-27T01:40:48.022Z",
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "19732",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "188.226.187.115"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "188.226.187.115",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142349,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "GtfTUmcBTFzn_XoLdSoA",
-    "source": {
-      "@timestamp": "2018-11-27T01:40:48.024Z",
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "auditd": {
-        "sequence": 142350,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "188.226.187.115",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "19732",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "188.226.187.115"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "G9fTUmcBTFzn_XoLdSoA",
-    "source": {
-      "@timestamp": "2018-11-27T01:40:48.126Z",
-      "source": {
-        "ip": "188.226.187.115"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "188.226.187.115"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "188.226.187.115",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142351,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "19732",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "jdfTUmcBTFzn_XoLsi5i",
-    "source": {
-      "@timestamp": "2018-11-27T01:41:03.736Z",
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32370"
-      },
-      "source": {
-        "ip": "82.200.205.71"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "82.200.205.71",
-            "type": "user-session",
-            "primary": "sshd"
-          }
-        },
-        "sequence": 186473,
-        "result": "fail"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "jtfTUmcBTFzn_XoLsi5i",
-    "source": {
-      "@timestamp": "2018-11-27T01:41:03.737Z",
-      "source": {
-        "ip": "82.200.205.71"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "82.200.205.71"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186474,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32370",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "j9fTUmcBTFzn_XoLsi5i",
-    "source": {
-      "@timestamp": "2018-11-27T01:41:03.993Z",
-      "auditd": {
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "82.200.205.71"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "82.200.205.71"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186475,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32370",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "82.200.205.71"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "a9bRUmcBTFzn_XoLcPxx",
-    "source": {
-      "@timestamp": "2018-11-27T01:38:35.782Z",
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "secondary": "107.170.65.109",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 186464
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32356",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "bNbRUmcBTFzn_XoLcPxx",
-    "source": {
-      "@timestamp": "2018-11-27T01:38:35.783Z",
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32356"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 186465
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "bdbRUmcBTFzn_XoLcPxx",
-    "source": {
-      "@timestamp": "2018-11-27T01:38:35.814Z",
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32356",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "107.170.65.109"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          }
-        },
-        "sequence": 186466,
-        "result": "fail",
-        "session": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "2dfSUmcBTFzn_XoLXhCA",
-    "source": {
-      "@timestamp": "2018-11-27T01:39:36.720Z",
-      "auditd": {
-        "sequence": 43187,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "89.221.217.8",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "12790",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "89.221.217.8"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "2tfSUmcBTFzn_XoLXhCA",
-    "source": {
-      "@timestamp": "2018-11-27T01:39:36.724Z",
-      "source": {
-        "ip": "89.221.217.8"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 43188,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "89.221.217.8",
-            "type": "user-session",
-            "primary": "sshd"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "12790",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "29fSUmcBTFzn_XoLXhCA",
-    "source": {
-      "@timestamp": "2018-11-27T01:39:36.852Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "hostname": "89.221.217.8",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "89.221.217.8",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43189,
-        "result": "fail"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "12790",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "source": {
-        "ip": "89.221.217.8"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "adfSUmcBTFzn_XoLgRS2",
-    "source": {
-      "@timestamp": "2018-11-27T01:39:45.740Z",
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32360",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "auditd": {
-        "sequence": 186467,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "atfSUmcBTFzn_XoLgRS2",
-    "source": {
-      "@timestamp": "2018-11-27T01:39:45.741Z",
-      "process": {
-        "pid": "32360",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186468,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "a9fSUmcBTFzn_XoLgRS2",
-    "source": {
-      "@timestamp": "2018-11-27T01:39:45.771Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "107.170.65.109",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186469,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32360",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "FdfTUmcBTFzn_XoLmy0i",
-    "source": {
-      "@timestamp": "2018-11-27T01:40:57.784Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32368",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186470,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "FtfTUmcBTFzn_XoLmy0i",
-    "source": {
-      "@timestamp": "2018-11-27T01:40:57.785Z",
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186471
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32368",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "F9fTUmcBTFzn_XoLmy0i",
-    "source": {
-      "@timestamp": "2018-11-27T01:40:57.815Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "107.170.65.109"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186472,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32368"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "rNfUUmcBTFzn_XoLBTW-",
-    "source": {
-      "@timestamp": "2018-11-27T01:41:25.073Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "12798",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "104.131.37.34"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 43190,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "104.131.37.34",
-            "type": "user-session"
-          }
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "rdfUUmcBTFzn_XoLBTW-",
-    "source": {
-      "@timestamp": "2018-11-27T01:41:25.073Z",
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "12798",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "104.131.37.34"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "auditd": {
-        "sequence": 43191,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "104.131.37.34",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "rtfUUmcBTFzn_XoLBTW-",
-    "source": {
-      "@timestamp": "2018-11-27T01:41:25.105Z",
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "12798"
-      },
-      "source": {
-        "ip": "104.131.37.34"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 43192,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "104.131.37.34"
-        },
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "104.131.37.34",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        }
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "TNfWUmcBTFzn_XoLkW2H",
-    "source": {
-      "@timestamp": "2018-11-27T01:44:11.932Z",
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "128.199.106.169"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "128.199.106.169",
-            "type": "user-session"
-          }
-        },
-        "sequence": 186485,
-        "result": "fail"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32391",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "TdfWUmcBTFzn_XoLkW2H",
-    "source": {
-      "@timestamp": "2018-11-27T01:44:11.934Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32391",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "128.199.106.169"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "128.199.106.169",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186486
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "TtfWUmcBTFzn_XoLkW2H",
-    "source": {
-      "@timestamp": "2018-11-27T01:44:12.126Z",
-      "process": {
-        "pid": "32391",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "128.199.106.169"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "ssh",
-          "hostname": "128.199.106.169",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "128.199.106.169",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186487,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "CtfWUmcBTFzn_XoLl27w",
-    "source": {
-      "@timestamp": "2018-11-27T01:44:13.574Z",
-      "source": {
-        "ip": "45.122.222.253"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "45.122.222.253",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 142361
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "19759",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-haproxy-01"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "C9fWUmcBTFzn_XoLl27w",
-    "source": {
-      "@timestamp": "2018-11-27T01:44:13.575Z",
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "19759",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "45.122.222.253"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 142362,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "45.122.222.253"
-          }
-        }
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "DNfWUmcBTFzn_XoLl27w",
-    "source": {
-      "@timestamp": "2018-11-27T01:44:13.839Z",
-      "source": {
-        "ip": "45.122.222.253"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "ssh",
-          "hostname": "45.122.222.253",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "45.122.222.253"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          }
-        },
-        "sequence": 142363,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "19759",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "utfYUmcBTFzn_XoLQpK3",
-    "source": {
-      "@timestamp": "2018-11-27T01:46:02.828Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "19772"
-      },
-      "beat": {
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-haproxy-01"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "source": {
-        "ip": "151.203.70.218"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "151.203.70.218",
-            "type": "user-session"
-          }
-        },
-        "sequence": 142364,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "u9fYUmcBTFzn_XoLQpK3",
-    "source": {
-      "@timestamp": "2018-11-27T01:46:02.829Z",
-      "source": {
-        "ip": "151.203.70.218"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 142365,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "151.203.70.218"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "19772"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "vNfYUmcBTFzn_XoLQpK3",
-    "source": {
-      "@timestamp": "2018-11-27T01:46:02.868Z",
-      "source": {
-        "ip": "151.203.70.218"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "151.203.70.218"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142366,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "151.203.70.218",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "19772",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "SdfYUmcBTFzn_XoLRpPT",
-    "source": {
-      "@timestamp": "2018-11-27T01:46:03.873Z",
-      "process": {
-        "pid": "12823",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "152.115.61.52"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 43193,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "152.115.61.52",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "StfYUmcBTFzn_XoLRpPT",
-    "source": {
-      "@timestamp": "2018-11-27T01:46:03.873Z",
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "152.115.61.52",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 43194,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "12823",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "source": {
-        "ip": "152.115.61.52"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "S9fYUmcBTFzn_XoLRpPT",
-    "source": {
-      "@timestamp": "2018-11-27T01:46:04.009Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "12823",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "152.115.61.52"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "152.115.61.52",
-            "type": "user-session",
-            "primary": "ssh"
-          }
-        },
-        "sequence": 43195,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "152.115.61.52",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "adfYUmcBTFzn_XoLXJVb",
-    "source": {
-      "@timestamp": "2018-11-27T01:46:09.392Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32410"
-      },
-      "source": {
-        "ip": "106.51.66.214"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186494,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "106.51.66.214",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "atfYUmcBTFzn_XoLXJVb",
-    "source": {
-      "@timestamp": "2018-11-27T01:46:09.394Z",
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "106.51.66.214",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 186495,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32410",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "106.51.66.214"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "a9fYUmcBTFzn_XoLXJVb",
-    "source": {
-      "@timestamp": "2018-11-27T01:46:09.624Z",
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32410"
-      },
-      "source": {
-        "ip": "106.51.66.214"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186496,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "106.51.66.214",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "106.51.66.214",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "y9fYUmcBTFzn_XoLZZX6",
-    "source": {
-      "@timestamp": "2018-11-27T01:46:11.847Z",
-      "source": {
-        "ip": "92.86.47.26"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "92.86.47.26"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192553,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "700",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "zNfYUmcBTFzn_XoLZZX6",
-    "source": {
-      "@timestamp": "2018-11-27T01:46:11.848Z",
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "92.86.47.26",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192554
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "700",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "92.86.47.26"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "zdfYUmcBTFzn_XoLZZX6",
-    "source": {
-      "@timestamp": "2018-11-27T01:46:11.996Z",
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "700",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "92.86.47.26"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192555,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "92.86.47.26",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "92.86.47.26",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "JNfWUmcBTFzn_XoLc2tJ",
-    "source": {
-      "@timestamp": "2018-11-27T01:44:04.191Z",
-      "process": {
-        "pid": "19756",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "177.137.205.150"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "177.137.205.150",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142358
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "JdfWUmcBTFzn_XoLc2tJ",
-    "source": {
-      "@timestamp": "2018-11-27T01:44:04.192Z",
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "177.137.205.150",
-            "type": "user-session"
-          }
-        },
-        "sequence": 142359,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "19756"
-      },
-      "source": {
-        "ip": "177.137.205.150"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "JtfWUmcBTFzn_XoLc2tJ",
-    "source": {
-      "@timestamp": "2018-11-27T01:44:04.375Z",
-      "process": {
-        "pid": "19756",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "source": {
-        "ip": "177.137.205.150"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "177.137.205.150",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "177.137.205.150"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142360,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "atfYUmcBTFzn_XoLgpgd",
-    "source": {
-      "@timestamp": "2018-11-27T01:46:19.059Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "19774",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "140.143.190.243"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "auditd": {
-        "sequence": 142367,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "140.143.190.243",
-            "type": "user-session",
-            "primary": "sshd"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "a9fYUmcBTFzn_XoLgpgd",
-    "source": {
-      "@timestamp": "2018-11-27T01:46:19.060Z",
-      "process": {
-        "pid": "19774",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "140.143.190.243"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 142368,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "140.143.190.243",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "bNfYUmcBTFzn_XoLgpgd",
-    "source": {
-      "@timestamp": "2018-11-27T01:46:19.278Z",
-      "auditd": {
-        "sequence": 142369,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "140.143.190.243"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "140.143.190.243",
-            "type": "user-session"
-          }
-        }
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "19774",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "source": {
-        "ip": "140.143.190.243"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "AtfXUmcBTFzn_XoLaoE9",
-    "source": {
-      "@timestamp": "2018-11-27T01:45:07.411Z",
-      "auditd": {
-        "sequence": 184386,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "217.19.148.142",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "25932",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "217.19.148.142"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "A9fXUmcBTFzn_XoLaoE9",
-    "source": {
-      "@timestamp": "2018-11-27T01:45:07.412Z",
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "25932",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "217.19.148.142"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "217.19.148.142",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184387
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "BNfXUmcBTFzn_XoLaoE9",
-    "source": {
-      "@timestamp": "2018-11-27T01:45:07.545Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "process": {
-        "pid": "25932",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "217.19.148.142"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "217.19.148.142"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "217.19.148.142",
-            "type": "user-session"
-          }
-        },
-        "sequence": 184388,
-        "result": "fail",
-        "session": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "49fWUmcBTFzn_XoL_XYj",
-    "source": {
-      "@timestamp": "2018-11-27T01:44:39.480Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186488
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32399",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "5NfWUmcBTFzn_XoL_XYj",
-    "source": {
-      "@timestamp": "2018-11-27T01:44:39.481Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32399",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186489,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "5dfWUmcBTFzn_XoL_XYj",
-    "source": {
-      "@timestamp": "2018-11-27T01:44:39.512Z",
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "107.170.65.109",
-            "type": "user-session",
-            "primary": "ssh"
-          }
-        },
-        "sequence": 186490,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "107.170.65.109"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32399",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "GtfVUmcBTFzn_XoL2l5j",
-    "source": {
-      "@timestamp": "2018-11-27T01:43:25.049Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32389",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186482
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "G9fVUmcBTFzn_XoL2l5j",
-    "source": {
-      "@timestamp": "2018-11-27T01:43:25.050Z",
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32389"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186483,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "107.170.65.109"
-          }
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "HNfVUmcBTFzn_XoL2l5j",
-    "source": {
-      "@timestamp": "2018-11-27T01:43:25.081Z",
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32389",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "107.170.65.109",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186484,
-        "result": "fail",
-        "session": "unset"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ANfYUmcBTFzn_XoLIJDK",
-    "source": {
-      "@timestamp": "2018-11-27T01:45:54.144Z",
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32408"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 186491,
-        "result": "fail"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "AdfYUmcBTFzn_XoLIJDK",
-    "source": {
-      "@timestamp": "2018-11-27T01:45:54.146Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32408",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "107.170.65.109"
-          }
-        },
-        "sequence": 186492,
-        "result": "fail"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "AtfYUmcBTFzn_XoLIJDK",
-    "source": {
-      "@timestamp": "2018-11-27T01:45:54.176Z",
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "107.170.65.109",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          }
-        },
-        "sequence": 186493,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32408"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "kNjeUmcBTFzn_XoLchqO",
-    "source": {
-      "@timestamp": "2018-11-27T01:52:48.274Z",
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "92.222.218.139",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184392,
-        "result": "fail"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "25980",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "92.222.218.139"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "kdjeUmcBTFzn_XoLchqO",
-    "source": {
-      "@timestamp": "2018-11-27T01:52:48.275Z",
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "25980"
-      },
-      "source": {
-        "ip": "92.222.218.139"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "92.222.218.139"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184393,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ktjeUmcBTFzn_XoLchqO",
-    "source": {
-      "@timestamp": "2018-11-27T01:52:48.381Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "25980",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "92.222.218.139"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "92.222.218.139"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "92.222.218.139"
-          }
-        },
-        "sequence": 184394,
-        "result": "fail"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ANjeUmcBTFzn_XoLgBst",
-    "source": {
-      "@timestamp": "2018-11-27T01:52:51.775Z",
-      "source": {
-        "ip": "174.138.17.18"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "174.138.17.18",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43202,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "12866"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "AdjeUmcBTFzn_XoLgBst",
-    "source": {
-      "@timestamp": "2018-11-27T01:52:51.775Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "12866"
-      },
-      "source": {
-        "ip": "174.138.17.18"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "174.138.17.18",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 43203,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "AtjeUmcBTFzn_XoLgBst",
-    "source": {
-      "@timestamp": "2018-11-27T01:52:51.851Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "beat": {
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "12868"
-      },
-      "source": {
-        "ip": "54.38.47.28"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 43204,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "54.38.47.28",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "A9jeUmcBTFzn_XoLgBst",
-    "source": {
-      "@timestamp": "2018-11-27T01:52:51.851Z",
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "12868",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "54.38.47.28"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 43205,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "54.38.47.28",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "BNjeUmcBTFzn_XoLgBst",
-    "source": {
-      "@timestamp": "2018-11-27T01:52:51.963Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "12868",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "54.38.47.28"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "auditd": {
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "54.38.47.28"
-        },
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "54.38.47.28",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 43206,
-        "result": "fail",
-        "session": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "BdjeUmcBTFzn_XoLgBst",
-    "source": {
-      "@timestamp": "2018-11-27T01:52:51.967Z",
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "12866",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "174.138.17.18"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "174.138.17.18",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "174.138.17.18",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43207
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "vtjdUmcBTFzn_XoLhQbg",
-    "source": {
-      "@timestamp": "2018-11-27T01:51:47.702Z",
-      "process": {
-        "pid": "25972",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "201.151.178.139"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 184389,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "201.151.178.139",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "v9jdUmcBTFzn_XoLhQbg",
-    "source": {
-      "@timestamp": "2018-11-27T01:51:47.704Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "25972",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "201.151.178.139"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "201.151.178.139",
-            "type": "user-session",
-            "primary": "sshd"
-          }
-        },
-        "sequence": 184390
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "wNjdUmcBTFzn_XoLhQbg",
-    "source": {
-      "@timestamp": "2018-11-27T01:51:47.788Z",
-      "process": {
-        "pid": "25972",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "201.151.178.139"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "201.151.178.139",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184391,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "201.151.178.139",
-          "terminal": "ssh"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "N9jdUmcBTFzn_XoLlgd5",
-    "source": {
-      "@timestamp": "2018-11-27T01:51:51.949Z",
-      "process": {
-        "pid": "19818",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "121.124.124.73"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "121.124.124.73"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          }
-        },
-        "sequence": 142389,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ONjdUmcBTFzn_XoLlgd5",
-    "source": {
-      "@timestamp": "2018-11-27T01:51:51.951Z",
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "19818",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "121.124.124.73"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "121.124.124.73",
-            "type": "user-session",
-            "primary": "sshd"
-          }
-        },
-        "sequence": 142390,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "OdjdUmcBTFzn_XoLlgd5",
-    "source": {
-      "@timestamp": "2018-11-27T01:51:52.141Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "19818",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "121.124.124.73"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "121.124.124.73"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "121.124.124.73"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142391
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "EdjfUmcBTFzn_XoLJSnD",
-    "source": {
-      "@timestamp": "2018-11-27T01:53:34.169Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "19831",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "79.137.64.132"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "79.137.64.132",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142392,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "EtjfUmcBTFzn_XoLJSnD",
-    "source": {
-      "@timestamp": "2018-11-27T01:53:34.170Z",
-      "source": {
-        "ip": "79.137.64.132"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "79.137.64.132"
-          }
-        },
-        "sequence": 142393,
-        "result": "fail",
-        "session": "unset"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "beat": {
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "19831",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "E9jfUmcBTFzn_XoLJSnD",
-    "source": {
-      "@timestamp": "2018-11-27T01:53:34.276Z",
-      "source": {
-        "ip": "79.137.64.132"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "79.137.64.132",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "79.137.64.132",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142394,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "19831",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ZtjfUmcBTFzn_XoLJila",
-    "source": {
-      "@timestamp": "2018-11-27T01:53:34.315Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "161.132.195.76",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 43211
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "process": {
-        "pid": "12877",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "161.132.195.76"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Z9jfUmcBTFzn_XoLJila",
-    "source": {
-      "@timestamp": "2018-11-27T01:53:34.315Z",
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "process": {
-        "pid": "12877",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "161.132.195.76"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "161.132.195.76",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43212,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "aNjfUmcBTFzn_XoLJila",
-    "source": {
-      "@timestamp": "2018-11-27T01:53:34.427Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "12877",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "161.132.195.76"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "ssh",
-          "hostname": "161.132.195.76",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "161.132.195.76",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43213,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Y9jdUmcBTFzn_XoLdARP",
-    "source": {
-      "@timestamp": "2018-11-27T01:51:43.201Z",
-      "auditd": {
-        "sequence": 43196,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "83.222.240.60"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "12856",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "source": {
-        "ip": "83.222.240.60"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ZNjdUmcBTFzn_XoLdARP",
-    "source": {
-      "@timestamp": "2018-11-27T01:51:43.205Z",
-      "source": {
-        "ip": "83.222.240.60"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 43197,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "83.222.240.60",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "12856"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ZdjdUmcBTFzn_XoLdARP",
-    "source": {
-      "@timestamp": "2018-11-27T01:51:43.309Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 43198,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "83.222.240.60"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "83.222.240.60",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "12856",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "83.222.240.60"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "INjdUmcBTFzn_XoLggVd",
-    "source": {
-      "@timestamp": "2018-11-27T01:51:46.789Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "secondary": "142.93.210.90",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 44207,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "30014",
-        "exe": "/usr/sbin/sshd"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "source": {
-        "ip": "142.93.210.90"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "IdjdUmcBTFzn_XoLggVd",
-    "source": {
-      "@timestamp": "2018-11-27T01:51:46.789Z",
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "30014",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "142.93.210.90"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "142.93.210.90"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44208,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ItjdUmcBTFzn_XoLggVd",
-    "source": {
-      "@timestamp": "2018-11-27T01:51:47.021Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "142.93.210.90"
-          }
-        },
-        "sequence": 44209,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "142.93.210.90"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "process": {
-        "pid": "30014",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "142.93.210.90"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "FtjdUmcBTFzn_XoLYAMi",
-    "source": {
-      "@timestamp": "2018-11-27T01:51:38.040Z",
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "19814",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "121.124.124.73"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "hostname": "121.124.124.73",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "121.124.124.73",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142385,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "rtjdUmcBTFzn_XoLaAOj",
-    "source": {
-      "@timestamp": "2018-11-27T01:51:40.216Z",
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "19816",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "121.124.124.73"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "121.124.124.73",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142386,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        }
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "r9jdUmcBTFzn_XoLaAOj",
-    "source": {
-      "@timestamp": "2018-11-27T01:51:40.217Z",
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "121.124.124.73",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142387,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        }
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "19816",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "121.124.124.73"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "sNjdUmcBTFzn_XoLaAOj",
-    "source": {
-      "@timestamp": "2018-11-27T01:51:40.395Z",
-      "auditd": {
-        "sequence": 142388,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "121.124.124.73"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "121.124.124.73",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "19816",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "121.124.124.73"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "FtjdUmcBTFzn_XoL0w1m",
-    "source": {
-      "@timestamp": "2018-11-27T01:52:07.547Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32446",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186509,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "107.170.65.109"
-          }
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "F9jdUmcBTFzn_XoL0w1m",
-    "source": {
-      "@timestamp": "2018-11-27T01:52:07.548Z",
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186510,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        }
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32446",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "GNjdUmcBTFzn_XoL0w1m",
-    "source": {
-      "@timestamp": "2018-11-27T01:52:07.578Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32446"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "hostname": "107.170.65.109",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "107.170.65.109",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186511,
-        "result": "fail"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "hdjeUmcBTFzn_XoLyiGI",
-    "source": {
-      "@timestamp": "2018-11-27T01:53:10.809Z",
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "128.199.128.215"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43208,
-        "result": "fail"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "12875",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "128.199.128.215"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "htjeUmcBTFzn_XoLyiGI",
-    "source": {
-      "@timestamp": "2018-11-27T01:53:10.813Z",
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "12875",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "128.199.128.215"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "128.199.128.215",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43209,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "h9jeUmcBTFzn_XoLyiGI",
-    "source": {
-      "@timestamp": "2018-11-27T01:53:11.005Z",
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "12875",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "128.199.128.215"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "128.199.128.215",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          }
-        },
-        "sequence": 43210,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "128.199.128.215",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "hdjeUmcBTFzn_XoL5SQF",
-    "source": {
-      "@timestamp": "2018-11-27T01:53:17.595Z",
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32449",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "107.170.65.109",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186512
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "htjeUmcBTFzn_XoL5SQF",
-    "source": {
-      "@timestamp": "2018-11-27T01:53:17.596Z",
-      "auditd": {
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186513,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32449"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "h9jeUmcBTFzn_XoL5SQF",
-    "source": {
-      "@timestamp": "2018-11-27T01:53:17.627Z",
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32449",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186514,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "107.170.65.109"
-        }
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ytjdUmcBTFzn_XoL0gs9",
-    "source": {
-      "@timestamp": "2018-11-27T01:52:07.159Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "153.19.40.20"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43199,
-        "result": "fail"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "12863",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "153.19.40.20"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "y9jdUmcBTFzn_XoL0gs9",
-    "source": {
-      "@timestamp": "2018-11-27T01:52:07.159Z",
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "12863"
-      },
-      "source": {
-        "ip": "153.19.40.20"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 43200,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "153.19.40.20"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "zNjdUmcBTFzn_XoL0gs9",
-    "source": {
-      "@timestamp": "2018-11-27T01:52:07.287Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "153.19.40.20"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "153.19.40.20"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43201,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "beat": {
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "process": {
-        "pid": "12863",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "153.19.40.20"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "KNjkUmcBTFzn_XoLfZ-j",
-    "source": {
-      "@timestamp": "2018-11-27T01:59:24.344Z",
-      "process": {
-        "pid": "783",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "source": {
-        "ip": "91.134.241.32"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "91.134.241.32"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192562
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "KdjkUmcBTFzn_XoLfZ-j",
-    "source": {
-      "@timestamp": "2018-11-27T01:59:24.345Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "91.134.241.32",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192563,
-        "result": "fail"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "783"
-      },
-      "source": {
-        "ip": "91.134.241.32"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "KtjkUmcBTFzn_XoLfZ-j",
-    "source": {
-      "@timestamp": "2018-11-27T01:59:24.452Z",
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "source": {
-        "ip": "91.134.241.32"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "91.134.241.32",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "91.134.241.32",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192564,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "783",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "QdjkUmcBTFzn_XoLgZ_0",
-    "source": {
-      "@timestamp": "2018-11-27T01:59:25.449Z",
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32500"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186542,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "QtjkUmcBTFzn_XoLgZ_0",
-    "source": {
-      "@timestamp": "2018-11-27T01:59:25.450Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32500",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186543,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Q9jkUmcBTFzn_XoLgZ_0",
-    "source": {
-      "@timestamp": "2018-11-27T01:59:25.481Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          }
-        },
-        "sequence": 186544,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "107.170.65.109",
-          "terminal": "ssh"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32500",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "jdjjUmcBTFzn_XoLToQx",
-    "source": {
-      "@timestamp": "2018-11-27T01:58:06.663Z",
-      "auditd": {
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          }
-        },
-        "sequence": 186539,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32492",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "jtjjUmcBTFzn_XoLToQx",
-    "source": {
-      "@timestamp": "2018-11-27T01:58:06.664Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "process": {
-        "pid": "32492",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186540,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          }
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "j9jjUmcBTFzn_XoLToQx",
-    "source": {
-      "@timestamp": "2018-11-27T01:58:06.694Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32492"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "107.170.65.109",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          }
-        },
-        "sequence": 186541
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ZdjiUmcBTFzn_XoLImvA",
-    "source": {
-      "@timestamp": "2018-11-27T01:56:50.005Z",
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "secondary": "107.170.65.109",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 186530
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32480",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ZtjiUmcBTFzn_XoLImvA",
-    "source": {
-      "@timestamp": "2018-11-27T01:56:50.006Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186531,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32480",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Z9jiUmcBTFzn_XoLImvA",
-    "source": {
-      "@timestamp": "2018-11-27T01:56:50.037Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32480",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "ssh",
-          "hostname": "107.170.65.109",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "107.170.65.109",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186532,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "etjlUmcBTFzn_XoLHawN",
-    "source": {
-      "@timestamp": "2018-11-27T02:00:05.155Z",
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "785"
-      },
-      "source": {
-        "ip": "212.159.18.107"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192565,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "secondary": "212.159.18.107",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          }
-        }
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "e9jlUmcBTFzn_XoLHawN",
-    "source": {
-      "@timestamp": "2018-11-27T02:00:05.156Z",
-      "process": {
-        "pid": "785",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "source": {
-        "ip": "212.159.18.107"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "212.159.18.107",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192566,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "fNjlUmcBTFzn_XoLHawN",
-    "source": {
-      "@timestamp": "2018-11-27T02:00:05.265Z",
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "source": {
-        "ip": "212.159.18.107"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "212.159.18.107",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "212.159.18.107",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192567,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "785",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ZtjjUmcBTFzn_XoLIYEi",
-    "source": {
-      "@timestamp": "2018-11-27T01:57:55.128Z",
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32490",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "190.153.219.50"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186536,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "190.153.219.50",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Z9jjUmcBTFzn_XoLIYEi",
-    "source": {
-      "@timestamp": "2018-11-27T01:57:55.129Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32490",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "190.153.219.50"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "190.153.219.50",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186537,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "aNjjUmcBTFzn_XoLIYEi",
-    "source": {
-      "@timestamp": "2018-11-27T01:57:55.284Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "sequence": 186538,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "190.153.219.50",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "190.153.219.50",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32490",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "190.153.219.50"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ItjiUmcBTFzn_XoLZXBu",
-    "source": {
-      "@timestamp": "2018-11-27T01:57:07.073Z",
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "12897",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "151.80.144.39"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "151.80.144.39"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43214,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "I9jiUmcBTFzn_XoLZXBu",
-    "source": {
-      "@timestamp": "2018-11-27T01:57:07.073Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "12897",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "151.80.144.39"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "151.80.144.39",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43215
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "JNjiUmcBTFzn_XoLZXBu",
-    "source": {
-      "@timestamp": "2018-11-27T01:57:07.181Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "151.80.144.39",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 43216,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "151.80.144.39",
-          "terminal": "ssh"
-        }
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "beat": {
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "12897"
-      },
-      "source": {
-        "ip": "151.80.144.39"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "1djjUmcBTFzn_XoLD39T",
-    "source": {
-      "@timestamp": "2018-11-27T01:57:50.568Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "61.73.98.60",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186533,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32487",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "61.73.98.60"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "1tjjUmcBTFzn_XoLD39T",
-    "source": {
-      "@timestamp": "2018-11-27T01:57:50.570Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32487",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "61.73.98.60"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "61.73.98.60"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186534,
-        "result": "fail"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "19jjUmcBTFzn_XoLD39T",
-    "source": {
-      "@timestamp": "2018-11-27T01:57:50.730Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32487",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "61.73.98.60"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186535,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "61.73.98.60",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "61.73.98.60",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "c9jiUmcBTFzn_XoL9X2Y",
-    "source": {
-      "@timestamp": "2018-11-27T01:57:43.982Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192559,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "193.70.39.84"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "process": {
-        "pid": "769",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "193.70.39.84"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "dNjiUmcBTFzn_XoL9X2Y",
-    "source": {
-      "@timestamp": "2018-11-27T01:57:43.983Z",
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "769"
-      },
-      "source": {
-        "ip": "193.70.39.84"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "193.70.39.84",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192560,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ddjiUmcBTFzn_XoL9X2Y",
-    "source": {
-      "@timestamp": "2018-11-27T01:57:44.094Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "769",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "193.70.39.84"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "193.70.39.84",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "193.70.39.84",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192561,
-        "result": "fail"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "lNjkUmcBTFzn_XoLRpqM",
-    "source": {
-      "@timestamp": "2018-11-27T01:59:10.239Z",
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "104.208.143.92",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44219,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "30166",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "104.208.143.92"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ldjkUmcBTFzn_XoLRpqM",
-    "source": {
-      "@timestamp": "2018-11-27T01:59:10.239Z",
-      "source": {
-        "ip": "104.208.143.92"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "104.208.143.92",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 44220,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "30166",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ltjkUmcBTFzn_XoLRpqM",
-    "source": {
-      "@timestamp": "2018-11-27T01:59:10.283Z",
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "30166"
-      },
-      "source": {
-        "ip": "104.208.143.92"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44221,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "104.208.143.92"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "104.208.143.92",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "beat": {
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "NdnsUmcBTFzn_XoLslKD",
-    "source": {
-      "@timestamp": "2018-11-27T02:08:22.166Z",
-      "process": {
-        "pid": "30352",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "110.36.221.182"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "110.36.221.182",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44231,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "NtnsUmcBTFzn_XoLslKD",
-    "source": {
-      "@timestamp": "2018-11-27T02:08:22.166Z",
-      "auditd": {
-        "sequence": 44232,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "110.36.221.182",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "beat": {
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "process": {
-        "pid": "30352",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "110.36.221.182"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "N9nsUmcBTFzn_XoLslKD",
-    "source": {
-      "@timestamp": "2018-11-27T02:08:22.414Z",
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "30352",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "110.36.221.182"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "110.36.221.182",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "110.36.221.182"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44233
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "9tnsUmcBTFzn_XoLt1Lw",
-    "source": {
-      "@timestamp": "2018-11-27T02:08:23.554Z",
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "30354"
-      },
-      "source": {
-        "ip": "61.73.98.60"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "auditd": {
-        "sequence": 44234,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "61.73.98.60",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "99nsUmcBTFzn_XoLt1Lw",
-    "source": {
-      "@timestamp": "2018-11-27T02:08:23.554Z",
-      "source": {
-        "ip": "61.73.98.60"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "61.73.98.60"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44235
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "30354",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "-NnsUmcBTFzn_XoLt1Lw",
-    "source": {
-      "@timestamp": "2018-11-27T02:08:23.714Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "61.73.98.60"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "61.73.98.60",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44236
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "30354"
-      },
-      "beat": {
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "source": {
-        "ip": "61.73.98.60"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "1dnpUmcBTFzn_XoLNAWm",
-    "source": {
-      "@timestamp": "2018-11-27T02:04:33.307Z",
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "26060",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "151.80.136.92"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "151.80.136.92",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184405,
-        "result": "fail"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "1tnpUmcBTFzn_XoLNAWm",
-    "source": {
-      "@timestamp": "2018-11-27T02:04:33.309Z",
-      "source": {
-        "ip": "151.80.136.92"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 184406,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "151.80.136.92",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "26060",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "19npUmcBTFzn_XoLNAWm",
-    "source": {
-      "@timestamp": "2018-11-27T02:04:33.423Z",
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "hostname": "151.80.136.92",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "151.80.136.92"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184407,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "26060",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "151.80.136.92"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "3tnpUmcBTFzn_XoLOwYm",
-    "source": {
-      "@timestamp": "2018-11-27T02:04:35.004Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "177.124.89.14",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "177.124.89.14",
-            "type": "user-session",
-            "primary": "ssh"
-          }
-        },
-        "sequence": 184408
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "26062",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "177.124.89.14"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "6tnpUmcBTFzn_XoLZAmP",
-    "source": {
-      "@timestamp": "2018-11-27T02:04:45.605Z",
-      "process": {
-        "pid": "32532",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          }
-        },
-        "sequence": 186557
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "69npUmcBTFzn_XoLZAmP",
-    "source": {
-      "@timestamp": "2018-11-27T02:04:45.606Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186558
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32532"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "7NnpUmcBTFzn_XoLZAmP",
-    "source": {
-      "@timestamp": "2018-11-27T02:04:45.638Z",
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32532",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "107.170.65.109"
-          }
-        },
-        "sequence": 186559,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "107.170.65.109"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "FNnsUmcBTFzn_XoLVUul",
-    "source": {
-      "@timestamp": "2018-11-27T02:07:58.394Z",
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "19916"
-      },
-      "source": {
-        "ip": "74.208.43.208"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 142410,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "74.208.43.208",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "FdnsUmcBTFzn_XoLVUul",
-    "source": {
-      "@timestamp": "2018-11-27T02:07:58.395Z",
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "19916",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "74.208.43.208"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "74.208.43.208"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142411,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "FtnsUmcBTFzn_XoLVUul",
-    "source": {
-      "@timestamp": "2018-11-27T02:07:58.422Z",
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "process": {
-        "pid": "19916",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "74.208.43.208"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 142412,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "74.208.43.208"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "74.208.43.208",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "rtnqUmcBTFzn_XoLniSL",
-    "source": {
-      "@timestamp": "2018-11-27T02:06:05.967Z",
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186560,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32540"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "r9nqUmcBTFzn_XoLniSL",
-    "source": {
-      "@timestamp": "2018-11-27T02:06:05.968Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186561,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32540",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "sNnqUmcBTFzn_XoLniSL",
-    "source": {
-      "@timestamp": "2018-11-27T02:06:05.999Z",
-      "process": {
-        "pid": "32540",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "hostname": "107.170.65.109",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "107.170.65.109"
-          }
-        },
-        "sequence": 186562,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "KtjoUmcBTFzn_XoLSvJx",
-    "source": {
-      "@timestamp": "2018-11-27T02:03:33.383Z",
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "26052",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "104.236.181.158"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 184402,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "104.236.181.158",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "K9joUmcBTFzn_XoLSvJx",
-    "source": {
-      "@timestamp": "2018-11-27T02:03:33.384Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "26052",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "104.236.181.158"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "104.236.181.158",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184403
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "LNjoUmcBTFzn_XoLSvJx",
-    "source": {
-      "@timestamp": "2018-11-27T02:03:33.426Z",
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "auditd": {
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "104.236.181.158"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "104.236.181.158"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184404,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "26052"
-      },
-      "source": {
-        "ip": "104.236.181.158"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "kdnrUmcBTFzn_XoL2j_v",
-    "source": {
-      "@timestamp": "2018-11-27T02:07:26.981Z",
-      "process": {
-        "pid": "32548",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186563,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ktnrUmcBTFzn_XoL2j_v",
-    "source": {
-      "@timestamp": "2018-11-27T02:07:26.982Z",
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186564
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32548",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "k9nrUmcBTFzn_XoL2j_v",
-    "source": {
-      "@timestamp": "2018-11-27T02:07:27.012Z",
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186565,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "107.170.65.109"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "process": {
-        "pid": "32548",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ntnpUmcBTFzn_XoLkg3n",
-    "source": {
-      "@timestamp": "2018-11-27T02:04:57.466Z",
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "process": {
-        "pid": "30281",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "89.156.152.134"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44225,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "89.156.152.134",
-            "type": "user-session",
-            "primary": "sshd"
-          }
-        }
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "n9npUmcBTFzn_XoLkg3n",
-    "source": {
-      "@timestamp": "2018-11-27T02:04:57.466Z",
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "30281"
-      },
-      "source": {
-        "ip": "89.156.152.134"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "89.156.152.134",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44226,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "oNnpUmcBTFzn_XoLkg3n",
-    "source": {
-      "@timestamp": "2018-11-27T02:04:57.574Z",
-      "process": {
-        "pid": "30281",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "89.156.152.134"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44227,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "89.156.152.134",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "89.156.152.134"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "VdnrUmcBTFzn_XoLLzF2",
-    "source": {
-      "@timestamp": "2018-11-27T02:06:43.078Z",
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "process": {
-        "pid": "30322",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "210.71.197.80"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "210.71.197.80",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44228,
-        "result": "fail",
-        "session": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "VtnrUmcBTFzn_XoLLzF2",
-    "source": {
-      "@timestamp": "2018-11-27T02:06:43.078Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "30322",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "210.71.197.80"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "auditd": {
-        "sequence": 44229,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "210.71.197.80",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "V9nrUmcBTFzn_XoLLzF2",
-    "source": {
-      "@timestamp": "2018-11-27T02:06:43.254Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "30322",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "210.71.197.80"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44230,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "210.71.197.80",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "210.71.197.80"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          }
-        }
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "8tnwUmcBTFzn_XoLk6fE",
-    "source": {
-      "@timestamp": "2018-11-27T02:12:36.443Z",
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "secondary": "37.187.195.209",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 192577
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "916",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "37.187.195.209"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "89nwUmcBTFzn_XoLk6fE",
-    "source": {
-      "@timestamp": "2018-11-27T02:12:36.443Z",
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "source": {
-        "ip": "37.187.195.209"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192578,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "37.187.195.209",
-            "type": "user-session"
-          }
-        }
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "916",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "9NnwUmcBTFzn_XoLk6fE",
-    "source": {
-      "@timestamp": "2018-11-27T02:12:36.550Z",
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "37.187.195.209"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "37.187.195.209",
-            "type": "user-session",
-            "primary": "ssh"
-          }
-        },
-        "sequence": 192579
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "916",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "37.187.195.209"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "D9nwUmcBTFzn_XoLlqgH",
-    "source": {
-      "@timestamp": "2018-11-27T02:12:37.021Z",
-      "source": {
-        "ip": "51.38.176.147"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 184424,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "51.38.176.147",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        }
-      },
-      "beat": {
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "26164"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ENnwUmcBTFzn_XoLlqgH",
-    "source": {
-      "@timestamp": "2018-11-27T02:12:37.022Z",
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "51.38.176.147",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184425,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "26164",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "51.38.176.147"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "EdnwUmcBTFzn_XoLlqgH",
-    "source": {
-      "@timestamp": "2018-11-27T02:12:37.127Z",
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "26164",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "51.38.176.147"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "51.38.176.147",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184426,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "51.38.176.147"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "HNnwUmcBTFzn_XoLl6g8",
-    "source": {
-      "@timestamp": "2018-11-27T02:12:37.327Z",
-      "process": {
-        "pid": "12992",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "81.174.227.27"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "81.174.227.27",
-            "type": "user-session"
-          }
-        },
-        "sequence": 43232,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "HdnwUmcBTFzn_XoLl6g8",
-    "source": {
-      "@timestamp": "2018-11-27T02:12:37.327Z",
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "81.174.227.27",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43233,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "12992",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "81.174.227.27"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "HtnwUmcBTFzn_XoLl6g8",
-    "source": {
-      "@timestamp": "2018-11-27T02:12:37.435Z",
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 43234,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "81.174.227.27",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "81.174.227.27"
-          }
-        }
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "12992",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "81.174.227.27"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "DdnwUmcBTFzn_XoLRqHL",
-    "source": {
-      "@timestamp": "2018-11-27T02:12:16.736Z",
-      "source": {
-        "ip": "159.65.225.184"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "159.65.225.184",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44250
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "30449"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "DtnwUmcBTFzn_XoLRqHL",
-    "source": {
-      "@timestamp": "2018-11-27T02:12:16.736Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "30449"
-      },
-      "source": {
-        "ip": "159.65.225.184"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44249,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "159.65.225.184",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        }
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "D9nwUmcBTFzn_XoLRqHL",
-    "source": {
-      "@timestamp": "2018-11-27T02:12:16.764Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "30449",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "159.65.225.184"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "auditd": {
-        "sequence": 44251,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "159.65.225.184",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "159.65.225.184",
-            "type": "user-session"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "qtnwUmcBTFzn_XoLUqId",
-    "source": {
-      "@timestamp": "2018-11-27T02:12:19.633Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 43226,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "185.91.116.197",
-            "type": "user-session"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "12988",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "185.91.116.197"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "q9nwUmcBTFzn_XoLUqId",
-    "source": {
-      "@timestamp": "2018-11-27T02:12:19.633Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "185.91.116.197"
-          }
-        },
-        "sequence": 43227,
-        "result": "fail"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "12988",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "185.91.116.197"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "rNnwUmcBTFzn_XoLUqId",
-    "source": {
-      "@timestamp": "2018-11-27T02:12:19.753Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "hostname": "185.91.116.197",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "185.91.116.197"
-          }
-        },
-        "sequence": 43228,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "12988"
-      },
-      "source": {
-        "ip": "185.91.116.197"
-      },
-      "beat": {
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "6NnwUmcBTFzn_XoLjqfh",
-    "source": {
-      "@timestamp": "2018-11-27T02:12:35.140Z",
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "26162",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "192.252.209.190"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "192.252.209.190",
-            "type": "user-session"
-          }
-        },
-        "sequence": 184421
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "6dnwUmcBTFzn_XoLjqfh",
-    "source": {
-      "@timestamp": "2018-11-27T02:12:35.141Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "26162",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "source": {
-        "ip": "192.252.209.190"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "object": {
-            "secondary": "192.252.209.190",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 184422,
-        "result": "fail"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "6tnwUmcBTFzn_XoLjqfh",
-    "source": {
-      "@timestamp": "2018-11-27T02:12:35.173Z",
-      "process": {
-        "pid": "26162",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "192.252.209.190"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 184423,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "192.252.209.190",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "192.252.209.190"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ctnvUmcBTFzn_XoLp5MU",
-    "source": {
-      "@timestamp": "2018-11-27T02:11:35.850Z",
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "912",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "105.16.153.210"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "auditd": {
-        "sequence": 192574,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "105.16.153.210",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "c9nvUmcBTFzn_XoLp5MU",
-    "source": {
-      "@timestamp": "2018-11-27T02:11:35.851Z",
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "105.16.153.210",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 192575,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "912"
-      },
-      "source": {
-        "ip": "105.16.153.210"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "dNnvUmcBTFzn_XoLp5MU",
-    "source": {
-      "@timestamp": "2018-11-27T02:11:36.114Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "105.16.153.210",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192576,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "105.16.153.210",
-          "terminal": "ssh"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "912"
-      },
-      "source": {
-        "ip": "105.16.153.210"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "2dnvUmcBTFzn_XoLwpV9",
-    "source": {
-      "@timestamp": "2018-11-27T02:11:42.866Z",
-      "process": {
-        "pid": "19940",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "167.99.212.179"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "167.99.212.179"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142419,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        }
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "2tnvUmcBTFzn_XoLwpV9",
-    "source": {
-      "@timestamp": "2018-11-27T02:11:42.867Z",
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "19940",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "167.99.212.179"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "167.99.212.179"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142420
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "29nvUmcBTFzn_XoLwpV9",
-    "source": {
-      "@timestamp": "2018-11-27T02:11:42.971Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "19940",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "167.99.212.179"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 142421,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "167.99.212.179",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "167.99.212.179",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "8tnvUmcBTFzn_XoLn5Ih",
-    "source": {
-      "@timestamp": "2018-11-27T02:11:33.815Z",
-      "process": {
-        "pid": "32575",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186575,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "89nvUmcBTFzn_XoLn5Ih",
-    "source": {
-      "@timestamp": "2018-11-27T02:11:33.816Z",
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32575"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186576,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "9NnvUmcBTFzn_XoLn5Ih",
-    "source": {
-      "@timestamp": "2018-11-27T02:11:33.846Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32575",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186577,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "107.170.65.109"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          }
-        }
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "L9nvUmcBTFzn_XoLVo3n",
-    "source": {
-      "@timestamp": "2018-11-27T02:11:15.325Z",
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "67.166.24.55",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 186572,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32573",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "67.166.24.55"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "MNnvUmcBTFzn_XoLVo3n",
-    "source": {
-      "@timestamp": "2018-11-27T02:11:15.326Z",
-      "source": {
-        "ip": "67.166.24.55"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186573,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "67.166.24.55",
-            "type": "user-session"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32573",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "MdnvUmcBTFzn_XoLVo3n",
-    "source": {
-      "@timestamp": "2018-11-27T02:11:15.490Z",
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "67.166.24.55"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186574,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "67.166.24.55",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "67.166.24.55",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32573",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "N9nvUmcBTFzn_XoL2Zh8",
-    "source": {
-      "@timestamp": "2018-11-27T02:11:48.750Z",
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "30433"
-      },
-      "source": {
-        "ip": "217.182.55.191"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "217.182.55.191",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          }
-        },
-        "sequence": 44246,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ONnvUmcBTFzn_XoL2Zh8",
-    "source": {
-      "@timestamp": "2018-11-27T02:11:48.750Z",
-      "source": {
-        "ip": "217.182.55.191"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "217.182.55.191",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44247
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "30433",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "OdnvUmcBTFzn_XoL2Zh8",
-    "source": {
-      "@timestamp": "2018-11-27T02:11:48.858Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "process": {
-        "pid": "30433",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "217.182.55.191"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44248,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "217.182.55.191",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "217.182.55.191"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "QNnwUmcBTFzn_XoLaKRf",
-    "source": {
-      "@timestamp": "2018-11-27T02:12:25.330Z",
-      "source": {
-        "ip": "94.16.115.155"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "94.16.115.155",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43229,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "12990",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "QdnwUmcBTFzn_XoLaKRf",
-    "source": {
-      "@timestamp": "2018-11-27T02:12:25.330Z",
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "process": {
-        "pid": "12990",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "94.16.115.155"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "94.16.115.155",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43230
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "QtnwUmcBTFzn_XoLaKRf",
-    "source": {
-      "@timestamp": "2018-11-27T02:12:25.442Z",
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "12990"
-      },
-      "source": {
-        "ip": "94.16.115.155"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "94.16.115.155"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "94.16.115.155",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43231
-      },
-      "beat": {
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "6dr0UmcBTFzn_XoLnQBb",
-    "source": {
-      "@timestamp": "2018-11-27T02:17:01.040Z",
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "26196",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "cron"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 184433,
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "op": "PAM:accounting",
-          "terminal": "cron",
-          "acct": "root"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_acct",
-        "action": "was-authorized"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "6tr0UmcBTFzn_XoLnQBb",
-    "source": {
-      "@timestamp": "2018-11-27T02:17:01.040Z",
-      "event": {
-        "category": "user-login",
-        "type": "cred_acq",
-        "action": "acquired-credentials",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "26196",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "sequence": 184434,
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "terminal": "cron",
-          "op": "PAM:setcred",
-          "acct": "root"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "69r0UmcBTFzn_XoLnQBb",
-    "source": {
-      "@timestamp": "2018-11-27T02:17:01.042Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "auid": "0"
-      },
-      "process": {
-        "pid": "26196",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "sequence": 184436,
-        "result": "success",
-        "session": "9861",
-        "data": {
-          "op": "PAM:session_open",
-          "acct": "root",
-          "terminal": "cron"
-        },
-        "summary": {
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_start",
-        "action": "started-session",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "7Nr0UmcBTFzn_XoLnQBb",
-    "source": {
-      "@timestamp": "2018-11-27T02:17:01.045Z",
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/cron",
-        "pid": "26196"
-      },
-      "auditd": {
-        "sequence": 184437,
-        "result": "success",
-        "session": "9861",
-        "data": {
-          "terminal": "cron",
-          "acct": "root",
-          "op": "PAM:setcred"
-        },
-        "summary": {
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "cred_disp",
-        "action": "disposed-credentials",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "auid": "0",
-        "uid": "0"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "7dr0UmcBTFzn_XoLnQBb",
-    "source": {
-      "@timestamp": "2018-11-27T02:17:01.045Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "auid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/cron",
-        "pid": "26196"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "auditd": {
-        "data": {
-          "acct": "root",
-          "op": "PAM:session_close",
-          "terminal": "cron"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "cron"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 184438,
-        "result": "success",
-        "session": "9861"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_end",
-        "action": "ended-session",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "8dr0UmcBTFzn_XoLnQD4",
-    "source": {
-      "@timestamp": "2018-11-27T02:17:01.194Z",
-      "process": {
-        "pid": "30546",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "acct": "root",
-          "terminal": "cron",
-          "op": "PAM:setcred"
-        },
-        "summary": {
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          }
-        },
-        "sequence": 44259
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "cred_acq",
-        "action": "acquired-credentials"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "8tr0UmcBTFzn_XoLnQD4",
-    "source": {
-      "@timestamp": "2018-11-27T02:17:01.194Z",
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "30546",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "op": "PAM:accounting",
-          "terminal": "cron",
-          "acct": "root"
-        },
-        "summary": {
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 44258
-      },
-      "beat": {
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_acct",
-        "action": "was-authorized"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "89r0UmcBTFzn_XoLnQD4",
-    "source": {
-      "@timestamp": "2018-11-27T02:17:01.194Z",
-      "event": {
-        "type": "user_start",
-        "action": "started-session",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "auid": "0",
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/cron",
-        "pid": "30546"
-      },
-      "auditd": {
-        "result": "success",
-        "session": "1445",
-        "data": {
-          "acct": "root",
-          "op": "PAM:session_open",
-          "terminal": "cron"
-        },
-        "summary": {
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          }
-        },
-        "sequence": 44261
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "9Nr0UmcBTFzn_XoLnQD4",
-    "source": {
-      "@timestamp": "2018-11-27T02:17:01.198Z",
-      "event": {
-        "type": "cred_disp",
-        "action": "disposed-credentials",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "auid": "0"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "process": {
-        "pid": "30546",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "result": "success",
-        "session": "1445",
-        "data": {
-          "terminal": "cron",
-          "acct": "root",
-          "op": "PAM:setcred"
-        },
-        "summary": {
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 44262
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "9dr0UmcBTFzn_XoLnQD4",
-    "source": {
-      "@timestamp": "2018-11-27T02:17:01.198Z",
-      "process": {
-        "pid": "30546",
-        "exe": "/usr/sbin/cron"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "auditd": {
-        "sequence": 44263,
-        "result": "success",
-        "session": "1445",
-        "data": {
-          "terminal": "cron",
-          "op": "PAM:session_close",
-          "acct": "root"
-        },
-        "summary": {
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_end",
-        "action": "ended-session",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "CNr0UmcBTFzn_XoLngEH",
-    "source": {
-      "@timestamp": "2018-11-27T02:17:01.212Z",
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/cron",
-        "pid": "19971"
-      },
-      "auditd": {
-        "sequence": 142422,
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "op": "PAM:accounting",
-          "acct": "root",
-          "terminal": "cron"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        }
-      },
-      "beat": {
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-haproxy-01"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "type": "user_acct",
-        "action": "was-authorized",
-        "module": "auditd",
-        "category": "user-login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Cdr0UmcBTFzn_XoLngEH",
-    "source": {
-      "@timestamp": "2018-11-27T02:17:01.213Z",
-      "process": {
-        "pid": "19971",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "data": {
-          "op": "PAM:setcred",
-          "acct": "root",
-          "terminal": "cron"
-        },
-        "summary": {
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          }
-        },
-        "sequence": 142423,
-        "result": "success",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "action": "acquired-credentials",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "cred_acq"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Ctr0UmcBTFzn_XoLngEH",
-    "source": {
-      "@timestamp": "2018-11-27T02:17:01.214Z",
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_start",
-        "action": "started-session"
-      },
-      "user": {
-        "auid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "19971",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "result": "success",
-        "session": "3504",
-        "data": {
-          "terminal": "cron",
-          "acct": "root",
-          "op": "PAM:session_open"
-        },
-        "summary": {
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "cron"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 142425
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "C9r0UmcBTFzn_XoLngEH",
-    "source": {
-      "@timestamp": "2018-11-27T02:17:01.217Z",
-      "user": {
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "auid": "0",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "19971",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "result": "success",
-        "session": "3504",
-        "data": {
-          "acct": "root",
-          "op": "PAM:setcred",
-          "terminal": "cron"
-        },
-        "summary": {
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 142426
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "cred_disp",
-        "action": "disposed-credentials",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "DNr0UmcBTFzn_XoLngEH",
-    "source": {
-      "@timestamp": "2018-11-27T02:17:01.218Z",
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "auid": "0"
-      },
-      "process": {
-        "pid": "19971",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "sequence": 142427,
-        "result": "success",
-        "session": "3504",
-        "data": {
-          "terminal": "cron",
-          "acct": "root",
-          "op": "PAM:session_close"
-        },
-        "summary": {
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_end",
-        "action": "ended-session",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Ddr0UmcBTFzn_XoLngEO",
-    "source": {
-      "@timestamp": "2018-11-27T02:17:01.220Z",
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "auditd": {
-        "data": {
-          "acct": "root",
-          "op": "PAM:accounting",
-          "terminal": "cron"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 192589,
-        "result": "success",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_acct",
-        "action": "was-authorized",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "947",
-        "exe": "/usr/sbin/cron"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Dtr0UmcBTFzn_XoLngEO",
-    "source": {
-      "@timestamp": "2018-11-27T02:17:01.220Z",
-      "event": {
-        "category": "user-login",
-        "type": "cred_acq",
-        "action": "acquired-credentials",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "947",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "root",
-          "terminal": "cron",
-          "op": "PAM:setcred"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 192590,
-        "result": "success"
-      },
-      "beat": {
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "D9r0UmcBTFzn_XoLngEO",
-    "source": {
-      "@timestamp": "2018-11-27T02:17:01.222Z",
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_start",
-        "action": "started-session",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "auid": "0"
-      },
-      "process": {
-        "pid": "947",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "session": "9865",
-        "data": {
-          "acct": "root",
-          "terminal": "cron",
-          "op": "PAM:session_open"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 192592,
-        "result": "success"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ENr0UmcBTFzn_XoLngEO",
-    "source": {
-      "@timestamp": "2018-11-27T02:17:01.225Z",
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "auditd": {
-        "result": "success",
-        "session": "9865",
-        "data": {
-          "acct": "root",
-          "op": "PAM:setcred",
-          "terminal": "cron"
-        },
-        "summary": {
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 192593
-      },
-      "event": {
-        "category": "user-login",
-        "type": "cred_disp",
-        "action": "disposed-credentials",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "auid": "0"
-      },
-      "process": {
-        "pid": "947",
-        "exe": "/usr/sbin/cron"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Edr0UmcBTFzn_XoLngEO",
-    "source": {
-      "@timestamp": "2018-11-27T02:17:01.226Z",
-      "user": {
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "0"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "process": {
-        "pid": "947",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "sequence": 192594,
-        "result": "success",
-        "session": "9865",
-        "data": {
-          "op": "PAM:session_close",
-          "acct": "root",
-          "terminal": "cron"
-        },
-        "summary": {
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "cron"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_end",
-        "action": "ended-session",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Etr0UmcBTFzn_XoLngEt",
-    "source": {
-      "@timestamp": "2018-11-27T02:17:01.245Z",
-      "process": {
-        "exe": "/usr/sbin/cron",
-        "pid": "13026"
-      },
-      "auditd": {
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "acct": "root",
-          "terminal": "cron",
-          "op": "PAM:accounting"
-        },
-        "summary": {
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 43247
-      },
-      "beat": {
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_acct",
-        "action": "was-authorized",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "E9r0UmcBTFzn_XoLngEt",
-    "source": {
-      "@timestamp": "2018-11-27T02:17:01.249Z",
-      "event": {
-        "category": "user-login",
-        "type": "cred_acq",
-        "action": "acquired-credentials",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "13026",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "sequence": 43248,
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "op": "PAM:setcred",
-          "terminal": "cron",
-          "acct": "root"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "FNr0UmcBTFzn_XoLngEt",
-    "source": {
-      "@timestamp": "2018-11-27T02:17:01.249Z",
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/cron",
-        "pid": "13026"
-      },
-      "auditd": {
-        "sequence": 43250,
-        "result": "success",
-        "session": "1253",
-        "data": {
-          "acct": "root",
-          "terminal": "cron",
-          "op": "PAM:session_open"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_start",
-        "action": "started-session",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "auid": "0"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Fdr0UmcBTFzn_XoLngEt",
-    "source": {
-      "@timestamp": "2018-11-27T02:17:01.257Z",
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "action": "disposed-credentials",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "cred_disp"
-      },
-      "user": {
-        "auid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "13026",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "session": "1253",
-        "data": {
-          "op": "PAM:setcred",
-          "acct": "root",
-          "terminal": "cron"
-        },
-        "summary": {
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "secondary": "root",
-            "primary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          }
-        },
-        "sequence": 43251,
-        "result": "success"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Ftr0UmcBTFzn_XoLngEt",
-    "source": {
-      "@timestamp": "2018-11-27T02:17:01.257Z",
-      "auditd": {
-        "sequence": 43252,
-        "result": "success",
-        "session": "1253",
-        "data": {
-          "terminal": "cron",
-          "op": "PAM:session_close",
-          "acct": "root"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_end",
-        "action": "ended-session",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "auid": "0"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/cron",
-        "pid": "13026"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "INr0UmcBTFzn_XoLoAHh",
-    "source": {
-      "@timestamp": "2018-11-27T02:17:01.906Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_acct",
-        "action": "was-authorized",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32605",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "sequence": 186590,
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "acct": "root",
-          "terminal": "cron",
-          "op": "PAM:accounting"
-        },
-        "summary": {
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          }
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Idr0UmcBTFzn_XoLoAHh",
-    "source": {
-      "@timestamp": "2018-11-27T02:17:01.907Z",
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "cred_acq",
-        "action": "acquired-credentials",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32605",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "root",
-          "op": "PAM:setcred",
-          "terminal": "cron"
-        },
-        "summary": {
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          }
-        },
-        "sequence": 186591,
-        "result": "success"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Itr0UmcBTFzn_XoLoAHh",
-    "source": {
-      "@timestamp": "2018-11-27T02:17:01.908Z",
-      "process": {
-        "pid": "32605",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "session": "3512",
-        "data": {
-          "op": "PAM:session_open",
-          "terminal": "cron",
-          "acct": "root"
-        },
-        "summary": {
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "secondary": "root",
-            "primary": "root"
-          }
-        },
-        "sequence": 186593,
-        "result": "success"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_start",
-        "action": "started-session",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "user": {
-        "auid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "I9r0UmcBTFzn_XoLoAHh",
-    "source": {
-      "@timestamp": "2018-11-27T02:17:01.911Z",
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "process": {
-        "pid": "32605",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "cron",
-          "acct": "root",
-          "op": "PAM:setcred"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "cron"
-          },
-          "how": "/usr/sbin/cron",
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          }
-        },
-        "sequence": 186594,
-        "result": "success",
-        "session": "3512"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "cred_disp",
-        "action": "disposed-credentials",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        },
-        "auid": "0"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "JNr0UmcBTFzn_XoLoAHh",
-    "source": {
-      "@timestamp": "2018-11-27T02:17:01.912Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_end",
-        "action": "ended-session",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "0",
-        "name_map": {
-          "auid": "root",
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32605",
-        "exe": "/usr/sbin/cron"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "root",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "cron",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/cron"
-        },
-        "sequence": 186595,
-        "result": "success",
-        "session": "3512",
-        "data": {
-          "op": "PAM:session_close",
-          "terminal": "cron",
-          "acct": "root"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "G9r1UmcBTFzn_XoLvBrE",
-    "source": {
-      "@timestamp": "2018-11-27T02:18:14.617Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "122.160.137.37",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142428
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "19981",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "122.160.137.37"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "HNr1UmcBTFzn_XoLvBrE",
-    "source": {
-      "@timestamp": "2018-11-27T02:18:14.619Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "122.160.137.37",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142429,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "19981",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "122.160.137.37"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Hdr1UmcBTFzn_XoLvBrE",
-    "source": {
-      "@timestamp": "2018-11-27T02:18:14.905Z",
-      "source": {
-        "ip": "122.160.137.37"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 142430,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "122.160.137.37",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "122.160.137.37",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "19981",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Htr1UmcBTFzn_XoLvRof",
-    "source": {
-      "@timestamp": "2018-11-27T02:18:14.709Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "process": {
-        "pid": "960",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "200.207.220.128"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192598,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "200.207.220.128",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "H9r1UmcBTFzn_XoLvRof",
-    "source": {
-      "@timestamp": "2018-11-27T02:18:14.710Z",
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "960",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "source": {
-        "ip": "200.207.220.128"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "200.207.220.128"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192599,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "INr1UmcBTFzn_XoLvRof",
-    "source": {
-      "@timestamp": "2018-11-27T02:18:14.895Z",
-      "auditd": {
-        "data": {
-          "hostname": "200.207.220.128",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "200.207.220.128"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192600,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "960",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "200.207.220.128"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "MtnzUmcBTFzn_XoLcefM",
-    "source": {
-      "@timestamp": "2018-11-27T02:15:44.351Z",
-      "source": {
-        "ip": "147.135.208.7"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "147.135.208.7",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43241
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "13016"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "M9nzUmcBTFzn_XoLcefM",
-    "source": {
-      "@timestamp": "2018-11-27T02:15:44.351Z",
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "13016",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "147.135.208.7"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "147.135.208.7",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 43242,
-        "result": "fail",
-        "session": "unset"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "NNnzUmcBTFzn_XoLcefM",
-    "source": {
-      "@timestamp": "2018-11-27T02:15:44.487Z",
-      "source": {
-        "ip": "147.135.208.7"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "147.135.208.7"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "147.135.208.7",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43243,
-        "result": "fail"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "13016",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "S9nzUmcBTFzn_XoLdeex",
-    "source": {
-      "@timestamp": "2018-11-27T02:15:45.351Z",
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32602",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186587,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "TNnzUmcBTFzn_XoLdeex",
-    "source": {
-      "@timestamp": "2018-11-27T02:15:45.352Z",
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186588,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        }
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32602",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "TdnzUmcBTFzn_XoLdeex",
-    "source": {
-      "@timestamp": "2018-11-27T02:15:45.383Z",
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "107.170.65.109",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 186589
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32602",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "J9r1UmcBTFzn_XoLwBpB",
-    "source": {
-      "@timestamp": "2018-11-27T02:18:15.507Z",
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "13035",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "109.75.216.201"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "109.75.216.201",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 43253,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "KNr1UmcBTFzn_XoLwBpB",
-    "source": {
-      "@timestamp": "2018-11-27T02:18:15.507Z",
-      "process": {
-        "pid": "13035",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "source": {
-        "ip": "109.75.216.201"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "109.75.216.201",
-            "type": "user-session"
-          }
-        },
-        "sequence": 43254,
-        "result": "fail"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Kdr1UmcBTFzn_XoLwBpB",
-    "source": {
-      "@timestamp": "2018-11-27T02:18:15.647Z",
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "13035",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "109.75.216.201"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "109.75.216.201",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 43255,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "109.75.216.201"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "htr1UmcBTFzn_XoLxhrF",
-    "source": {
-      "@timestamp": "2018-11-27T02:18:17.176Z",
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "165.227.5.206"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43256,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "13037"
-      },
-      "source": {
-        "ip": "165.227.5.206"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "h9r1UmcBTFzn_XoLxhrF",
-    "source": {
-      "@timestamp": "2018-11-27T02:18:17.176Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "165.227.5.206",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43257,
-        "result": "fail"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "13037"
-      },
-      "source": {
-        "ip": "165.227.5.206"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "iNr1UmcBTFzn_XoLxhrF",
-    "source": {
-      "@timestamp": "2018-11-27T02:18:17.220Z",
-      "auditd": {
-        "sequence": 43258,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "165.227.5.206",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "165.227.5.206",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "13037",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "source": {
-        "ip": "165.227.5.206"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "4tr2UmcBTFzn_XoLCyDa",
-    "source": {
-      "@timestamp": "2018-11-27T02:18:34.864Z",
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186599,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32621",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "49r2UmcBTFzn_XoLCyDa",
-    "source": {
-      "@timestamp": "2018-11-27T02:18:34.866Z",
-      "process": {
-        "pid": "32621",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186600,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "5Nr2UmcBTFzn_XoLCyDa",
-    "source": {
-      "@timestamp": "2018-11-27T02:18:34.896Z",
-      "process": {
-        "pid": "32621",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186601,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "107.170.65.109",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "object": {
-            "secondary": "107.170.65.109",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "A9r0UmcBTFzn_XoLvwRX",
-    "source": {
-      "@timestamp": "2018-11-27T02:17:09.740Z",
-      "process": {
-        "pid": "32613",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 186596,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "BNr0UmcBTFzn_XoLvwRX",
-    "source": {
-      "@timestamp": "2018-11-27T02:17:09.742Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 186597
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32613",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Bdr0UmcBTFzn_XoLvwRX",
-    "source": {
-      "@timestamp": "2018-11-27T02:17:09.772Z",
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "107.170.65.109",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "107.170.65.109",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186598,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32613",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Z9n0UmcBTFzn_XoLLvfV",
-    "source": {
-      "@timestamp": "2018-11-27T02:16:32.747Z",
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "process": {
-        "pid": "26188",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "104.131.79.34"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 184430,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "104.131.79.34"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "aNn0UmcBTFzn_XoLLvfV",
-    "source": {
-      "@timestamp": "2018-11-27T02:16:32.748Z",
-      "process": {
-        "pid": "26188",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "104.131.79.34"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 184431,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "104.131.79.34"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "adn0UmcBTFzn_XoLLvfV",
-    "source": {
-      "@timestamp": "2018-11-27T02:16:32.779Z",
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "104.131.79.34"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "104.131.79.34",
-            "type": "user-session"
-          }
-        },
-        "sequence": 184432,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "26188",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "104.131.79.34"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "wdr1UmcBTFzn_XoLdBNI",
-    "source": {
-      "@timestamp": "2018-11-27T02:17:56.062Z",
-      "source": {
-        "ip": "89.156.152.134"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "89.156.152.134",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192595,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "957",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "wtr1UmcBTFzn_XoLdBNI",
-    "source": {
-      "@timestamp": "2018-11-27T02:17:56.063Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192596,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "89.156.152.134",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "957",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "89.156.152.134"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "w9r1UmcBTFzn_XoLdBNI",
-    "source": {
-      "@timestamp": "2018-11-27T02:17:56.190Z",
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "89.156.152.134"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "89.156.152.134",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192597,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "957",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "89.156.152.134"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "UNnzUmcBTFzn_XoLwu4u",
-    "source": {
-      "@timestamp": "2018-11-27T02:16:04.928Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "13018",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "178.33.168.254"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "178.33.168.254",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43244,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "UdnzUmcBTFzn_XoLwu4u",
-    "source": {
-      "@timestamp": "2018-11-27T02:16:04.928Z",
-      "auditd": {
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "178.33.168.254",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 43245,
-        "result": "fail",
-        "session": "unset"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "13018"
-      },
-      "source": {
-        "ip": "178.33.168.254"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "UtnzUmcBTFzn_XoLwu4u",
-    "source": {
-      "@timestamp": "2018-11-27T02:16:05.048Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "13018",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "178.33.168.254"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "hostname": "178.33.168.254",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "178.33.168.254",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43246,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "DdsBU2cBTFzn_XoL2SOm",
-    "source": {
-      "@timestamp": "2018-11-27T02:31:28.442Z",
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "147.135.208.7",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43274,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "13130",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "147.135.208.7"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "DtsBU2cBTFzn_XoL2SOm",
-    "source": {
-      "@timestamp": "2018-11-27T02:31:28.442Z",
-      "process": {
-        "pid": "13130",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "147.135.208.7"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 43275,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "147.135.208.7"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "D9sBU2cBTFzn_XoL2SOm",
-    "source": {
-      "@timestamp": "2018-11-27T02:31:28.574Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "147.135.208.7"
-        },
-        "summary": {
-          "object": {
-            "secondary": "147.135.208.7",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          }
-        },
-        "sequence": 43276,
-        "result": "fail",
-        "session": "unset"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "beat": {
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "13130",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "147.135.208.7"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ENsBU2cBTFzn_XoL2SOm",
-    "source": {
-      "@timestamp": "2018-11-27T02:31:28.994Z",
-      "user": {
-        "suid": "0",
-        "name_map": {
-          "fsuid": "root",
-          "gid": "root",
-          "sgid": "root",
-          "suid": "root",
-          "uid": "root",
-          "egid": "root",
-          "euid": "root",
-          "fsgid": "root"
-        },
-        "gid": "0",
-        "auid": "unset",
-        "fsgid": "0",
-        "fsuid": "0",
-        "uid": "0",
-        "egid": "0",
-        "sgid": "0",
-        "euid": "0"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "process": {
-        "ppid": "1379",
-        "title": "/sbin/iptables -w -I sshguard -s 147.135.208.7 -j DROP",
-        "name": "iptables",
-        "exe": "/sbin/xtables-multi",
-        "pid": "13132"
-      },
-      "auditd": {
-        "result": "success",
-        "session": "unset",
-        "data": {
-          "syscall": "setsockopt",
-          "a0": "5",
-          "tty": "(none)",
-          "table": "filter",
-          "a2": "40",
-          "a3": "8ae870",
-          "a1": "0",
-          "family": "2",
-          "entries": "154",
-          "arch": "x86_64",
-          "exit": "0"
-        },
-        "summary": {
-          "object": {
-            "primary": "filter",
-            "type": "firewall"
-          },
-          "how": "/sbin/xtables-multi",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          }
-        },
-        "sequence": 43277
-      },
-      "event": {
-        "category": "configuration",
-        "type": "netfilter_cfg",
-        "action": "loaded-firewall-rule-to",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Ztr_UmcBTFzn_XoLP-rA",
-    "source": {
-      "@timestamp": "2018-11-27T02:28:37.974Z",
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          }
-        },
-        "sequence": 186620
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32675",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Z9r_UmcBTFzn_XoLP-rA",
-    "source": {
-      "@timestamp": "2018-11-27T02:28:37.975Z",
-      "auditd": {
-        "sequence": 186621,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "process": {
-        "pid": "32675",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "aNr_UmcBTFzn_XoLP-rA",
-    "source": {
-      "@timestamp": "2018-11-27T02:28:38.007Z",
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "107.170.65.109"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186622,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32675"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "-dsAU2cBTFzn_XoLlQYl",
-    "source": {
-      "@timestamp": "2018-11-27T02:30:05.371Z",
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32684"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186623,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "107.170.65.109",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "-tsAU2cBTFzn_XoLlQYl",
-    "source": {
-      "@timestamp": "2018-11-27T02:30:05.372Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32684"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 186624,
-        "result": "fail",
-        "session": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "-9sAU2cBTFzn_XoLlQYl",
-    "source": {
-      "@timestamp": "2018-11-27T02:30:05.403Z",
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32684"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186625,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "107.170.65.109",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "M9sBU2cBTFzn_XoLwCBF",
-    "source": {
-      "@timestamp": "2018-11-27T02:31:21.946Z",
-      "auditd": {
-        "sequence": 186626,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "118.25.133.243",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "32692"
-      },
-      "source": {
-        "ip": "118.25.133.243"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "NNsBU2cBTFzn_XoLwCBF",
-    "source": {
-      "@timestamp": "2018-11-27T02:31:21.947Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32692",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "118.25.133.243"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186627,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "118.25.133.243",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "NdsBU2cBTFzn_XoLwCBF",
-    "source": {
-      "@timestamp": "2018-11-27T02:31:22.162Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "process": {
-        "pid": "32692",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "118.25.133.243"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "118.25.133.243",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "118.25.133.243"
-          }
-        },
-        "sequence": 186628,
-        "result": "fail"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "D9oAU2cBTFzn_XoLOP8t",
-    "source": {
-      "@timestamp": "2018-11-27T02:29:41.565Z",
-      "beat": {
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "13117",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "128.0.121.176"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "128.0.121.176",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43271,
-        "result": "fail",
-        "session": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ENoAU2cBTFzn_XoLOP8t",
-    "source": {
-      "@timestamp": "2018-11-27T02:29:41.569Z",
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "128.0.121.176",
-            "type": "user-session"
-          }
-        },
-        "sequence": 43272,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "13117",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "128.0.121.176"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "EdoAU2cBTFzn_XoLOP8t",
-    "source": {
-      "@timestamp": "2018-11-27T02:29:41.677Z",
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "13117",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "128.0.121.176"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "128.0.121.176"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "128.0.121.176",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43273
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "dNsBU2cBTFzn_XoL7CTn",
-    "source": {
-      "@timestamp": "2018-11-27T02:31:33.373Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32694",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186629,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ddsBU2cBTFzn_XoL7CTn",
-    "source": {
-      "@timestamp": "2018-11-27T02:31:33.375Z",
-      "process": {
-        "pid": "32694",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186630,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "107.170.65.109"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "dtsBU2cBTFzn_XoL7CTn",
-    "source": {
-      "@timestamp": "2018-11-27T02:31:33.406Z",
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32694",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "107.170.65.109"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186631,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "107.170.65.109",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "107.170.65.109",
-            "type": "user-session",
-            "primary": "ssh"
-          }
-        }
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "G9sCU2cBTFzn_XoLvzai",
-    "source": {
-      "@timestamp": "2018-11-27T02:32:27.319Z",
-      "auditd": {
-        "sequence": 192613,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "198.27.80.211",
-            "type": "user-session"
-          }
-        }
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "1045"
-      },
-      "source": {
-        "ip": "198.27.80.211"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "HNsCU2cBTFzn_XoLvzai",
-    "source": {
-      "@timestamp": "2018-11-27T02:32:27.320Z",
-      "source": {
-        "ip": "198.27.80.211"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "198.27.80.211",
-            "type": "user-session"
-          }
-        },
-        "sequence": 192614,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "1045",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "HdsCU2cBTFzn_XoLvzai",
-    "source": {
-      "@timestamp": "2018-11-27T02:32:27.362Z",
-      "auditd": {
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "198.27.80.211"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "198.27.80.211",
-            "type": "user-session"
-          }
-        },
-        "sequence": 192615,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "1045",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "198.27.80.211"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Sdr-UmcBTFzn_XoLMtPX",
-    "source": {
-      "@timestamp": "2018-11-27T02:27:29.130Z",
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "13103",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "54.37.67.193"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "54.37.67.193"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43268
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Str-UmcBTFzn_XoLMtPX",
-    "source": {
-      "@timestamp": "2018-11-27T02:27:29.130Z",
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "13103"
-      },
-      "source": {
-        "ip": "54.37.67.193"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "54.37.67.193"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          }
-        },
-        "sequence": 43269,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "S9r-UmcBTFzn_XoLMtPX",
-    "source": {
-      "@timestamp": "2018-11-27T02:27:29.242Z",
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "beat": {
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "13103",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "54.37.67.193"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "hostname": "54.37.67.193",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "object": {
-            "secondary": "54.37.67.193",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 43270,
-        "result": "fail"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "q9sAU2cBTFzn_XoLYwI6",
-    "source": {
-      "@timestamp": "2018-11-27T02:29:52.590Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "process": {
-        "pid": "30802",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "128.0.118.65"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44276,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "secondary": "128.0.118.65",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          }
-        }
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "rNsAU2cBTFzn_XoLYwI6",
-    "source": {
-      "@timestamp": "2018-11-27T02:29:52.590Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "128.0.118.65",
-            "type": "user-session",
-            "primary": "sshd"
-          }
-        },
-        "sequence": 44277,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "30802"
-      },
-      "source": {
-        "ip": "128.0.118.65"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "rdsAU2cBTFzn_XoLYwI6",
-    "source": {
-      "@timestamp": "2018-11-27T02:29:52.694Z",
-      "beat": {
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "30802",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "128.0.118.65"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "128.0.118.65"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "128.0.118.65",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44278,
-        "result": "fail"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "0twMU2cBTFzn_XoL7xUF",
-    "source": {
-      "@timestamp": "2018-11-27T02:43:34.811Z",
-      "source": {
-        "ip": "167.99.54.4"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 184466,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "167.99.54.4"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "26446"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "09wMU2cBTFzn_XoL7xUF",
-    "source": {
-      "@timestamp": "2018-11-27T02:43:34.812Z",
-      "source": {
-        "ip": "167.99.54.4"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "167.99.54.4"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184467,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "26446"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "1NwMU2cBTFzn_XoL7xUF",
-    "source": {
-      "@timestamp": "2018-11-27T02:43:34.843Z",
-      "process": {
-        "pid": "26446",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "source": {
-        "ip": "167.99.54.4"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "hostname": "167.99.54.4",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "167.99.54.4",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184468,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "3dwMU2cBTFzn_XoL9RW0",
-    "source": {
-      "@timestamp": "2018-11-27T02:43:36.522Z",
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "26448",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "37.120.174.127"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 184469,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "37.120.174.127",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "3twMU2cBTFzn_XoL9RW0",
-    "source": {
-      "@timestamp": "2018-11-27T02:43:36.524Z",
-      "source": {
-        "ip": "37.120.174.127"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "37.120.174.127",
-            "type": "user-session"
-          }
-        },
-        "sequence": 184470
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "26448",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "39wMU2cBTFzn_XoL9RW0",
-    "source": {
-      "@timestamp": "2018-11-27T02:43:36.635Z",
-      "auditd": {
-        "sequence": 184471,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "37.120.174.127",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "37.120.174.127",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "26448",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "37.120.174.127"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "1twNU2cBTFzn_XoL_CyZ",
-    "source": {
-      "@timestamp": "2018-11-27T02:44:43.822Z",
-      "source": {
-        "ip": "104.248.123.206"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "104.248.123.206",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          }
-        },
-        "sequence": 142450,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "20137",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "19wNU2cBTFzn_XoL_CyZ",
-    "source": {
-      "@timestamp": "2018-11-27T02:44:43.823Z",
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "20137"
-      },
-      "source": {
-        "ip": "104.248.123.206"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "104.248.123.206",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142451,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "2NwNU2cBTFzn_XoL_CyZ",
-    "source": {
-      "@timestamp": "2018-11-27T02:44:43.854Z",
-      "process": {
-        "pid": "20137",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "104.248.123.206"
-      },
-      "beat": {
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-haproxy-01"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 142452,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "104.248.123.206",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "104.248.123.206",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "sdwMU2cBTFzn_XoLxRBj",
-    "source": {
-      "@timestamp": "2018-11-27T02:43:22.108Z",
-      "source": {
-        "ip": "35.189.59.154"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "35.189.59.154",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184463,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "26443",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "stwMU2cBTFzn_XoLxRBj",
-    "source": {
-      "@timestamp": "2018-11-27T02:43:22.109Z",
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "26443",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "35.189.59.154"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "object": {
-            "secondary": "35.189.59.154",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 184464,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "s9wMU2cBTFzn_XoLxRBj",
-    "source": {
-      "@timestamp": "2018-11-27T02:43:22.284Z",
-      "beat": {
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "ssh",
-          "hostname": "35.189.59.154",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "35.189.59.154"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184465,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "26443",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "35.189.59.154"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "S9wNU2cBTFzn_XoLwCiw",
-    "source": {
-      "@timestamp": "2018-11-27T02:44:28.486Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "209.240.59.106"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186642,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "209.240.59.106"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32760",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "TNwNU2cBTFzn_XoLwCiw",
-    "source": {
-      "@timestamp": "2018-11-27T02:44:28.487Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32760",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "209.240.59.106"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "209.240.59.106",
-            "type": "user-session"
-          }
-        },
-        "sequence": 186643,
-        "result": "fail",
-        "session": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "TdwNU2cBTFzn_XoLwCiw",
-    "source": {
-      "@timestamp": "2018-11-27T02:44:28.539Z",
-      "process": {
-        "pid": "32760",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "209.240.59.106"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "209.240.59.106",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186644,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "209.240.59.106",
-          "terminal": "ssh"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "FNwNU2cBTFzn_XoL4yrB",
-    "source": {
-      "@timestamp": "2018-11-27T02:44:37.463Z",
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32763",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "51.254.123.131"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "51.254.123.131",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186645,
-        "result": "fail"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "FdwNU2cBTFzn_XoL4yrB",
-    "source": {
-      "@timestamp": "2018-11-27T02:44:37.464Z",
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "51.254.123.131",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186646
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "32763",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "51.254.123.131"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "FtwNU2cBTFzn_XoL4yrB",
-    "source": {
-      "@timestamp": "2018-11-27T02:44:37.575Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "process": {
-        "pid": "32763",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "51.254.123.131"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "51.254.123.131"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "51.254.123.131",
-            "type": "user-session"
-          }
-        },
-        "sequence": 186647
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ldwMU2cBTFzn_XoLmw6z",
-    "source": {
-      "@timestamp": "2018-11-27T02:43:13.482Z",
-      "process": {
-        "pid": "1168",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "158.69.59.90"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "158.69.59.90"
-          }
-        },
-        "sequence": 192646,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ltwMU2cBTFzn_XoLmw6z",
-    "source": {
-      "@timestamp": "2018-11-27T02:43:13.483Z",
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "source": {
-        "ip": "158.69.59.90"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "158.69.59.90"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192647
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "1168",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "l9wMU2cBTFzn_XoLmw6z",
-    "source": {
-      "@timestamp": "2018-11-27T02:43:13.525Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "158.69.59.90",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "158.69.59.90",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192648
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "1168",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "158.69.59.90"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ZdwOU2cBTFzn_XoLGy-N",
-    "source": {
-      "@timestamp": "2018-11-27T02:44:51.746Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "71.174.75.11",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 186648,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      },
-      "process": {
-        "pid": "32765",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "71.174.75.11"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ZtwOU2cBTFzn_XoLGy-N",
-    "source": {
-      "@timestamp": "2018-11-27T02:44:51.747Z",
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "71.174.75.11",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          }
-        },
-        "sequence": 186649,
-        "result": "fail"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "32765",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "71.174.75.11"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Z9wOU2cBTFzn_XoLGy-N",
-    "source": {
-      "@timestamp": "2018-11-27T02:44:51.787Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "32765",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "71.174.75.11"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "hostname": "71.174.75.11",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "71.174.75.11",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186650,
-        "result": "fail"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "C9wPU2cBTFzn_XoLYUv1",
-    "source": {
-      "@timestamp": "2018-11-27T02:46:15.305Z",
-      "process": {
-        "pid": "13218",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "159.89.180.93"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "auditd": {
-        "sequence": 43288,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "159.89.180.93",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "DNwPU2cBTFzn_XoLYUv1",
-    "source": {
-      "@timestamp": "2018-11-27T02:46:15.305Z",
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "13218"
-      },
-      "source": {
-        "ip": "159.89.180.93"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 43289,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "159.89.180.93",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "DdwPU2cBTFzn_XoLYUv1",
-    "source": {
-      "@timestamp": "2018-11-27T02:46:15.337Z",
-      "source": {
-        "ip": "159.89.180.93"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "hostname": "159.89.180.93",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "159.89.180.93",
-            "type": "user-session"
-          }
-        },
-        "sequence": 43290,
-        "result": "fail"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "13218",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "_twNU2cBTFzn_XoLjiIW",
-    "source": {
-      "@timestamp": "2018-11-27T02:44:15.532Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "217.141.88.34"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "217.141.88.34"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142449
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "20129",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "217.141.88.34"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "5NwRU2cBTFzn_XoLtH2C",
-    "source": {
-      "@timestamp": "2018-11-27T02:48:47.512Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "auditd": {
-        "sequence": 142454,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "51.15.251.165"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "20159",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "51.15.251.165"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "5dwRU2cBTFzn_XoLtH2C",
-    "source": {
-      "@timestamp": "2018-11-27T02:48:47.513Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "20159"
-      },
-      "source": {
-        "ip": "51.15.251.165"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "object": {
-            "secondary": "51.15.251.165",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 142455,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        }
-      },
-      "beat": {
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-haproxy-01"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "5twRU2cBTFzn_XoLtH2C",
-    "source": {
-      "@timestamp": "2018-11-27T02:48:47.619Z",
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "20159",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "51.15.251.165"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "51.15.251.165",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "51.15.251.165",
-            "type": "user-session"
-          }
-        },
-        "sequence": 142456,
-        "result": "fail"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "sdwQU2cBTFzn_XoLA1gL",
-    "source": {
-      "@timestamp": "2018-11-27T02:46:56.545Z",
-      "process": {
-        "pid": "26473",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "35.243.183.165"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "35.243.183.165",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184472,
-        "result": "fail"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "stwQU2cBTFzn_XoLA1gL",
-    "source": {
-      "@timestamp": "2018-11-27T02:46:56.546Z",
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "26473",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "35.243.183.165"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "35.243.183.165",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 184473,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "s9wQU2cBTFzn_XoLA1gL",
-    "source": {
-      "@timestamp": "2018-11-27T02:46:56.586Z",
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "26473"
-      },
-      "source": {
-        "ip": "35.243.183.165"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "35.243.183.165",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 184474,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "35.243.183.165",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        }
-      },
-      "beat": {
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "mdwQU2cBTFzn_XoLL132",
-    "source": {
-      "@timestamp": "2018-11-27T02:47:08.044Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "1190",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "219.65.51.21"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "219.65.51.21",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 192649,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "mtwQU2cBTFzn_XoLL132",
-    "source": {
-      "@timestamp": "2018-11-27T02:47:08.045Z",
-      "process": {
-        "pid": "1190",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "source": {
-        "ip": "219.65.51.21"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "219.65.51.21",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192650
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "m9wQU2cBTFzn_XoLL132",
-    "source": {
-      "@timestamp": "2018-11-27T02:47:08.272Z",
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "1190",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "219.65.51.21"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "object": {
-            "secondary": "219.65.51.21",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 192651,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "219.65.51.21"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "EdwQU2cBTFzn_XoLXmE8",
-    "source": {
-      "@timestamp": "2018-11-27T02:47:19.890Z",
-      "auditd": {
-        "sequence": 184475,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "178.128.119.59",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        }
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "26475"
-      },
-      "source": {
-        "ip": "178.128.119.59"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "EtwQU2cBTFzn_XoLXmE8",
-    "source": {
-      "@timestamp": "2018-11-27T02:47:19.892Z",
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "178.128.119.59",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        },
-        "sequence": 184476,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "26475",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "178.128.119.59"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "E9wQU2cBTFzn_XoLXmE8",
-    "source": {
-      "@timestamp": "2018-11-27T02:47:20.084Z",
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "26475",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "178.128.119.59"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 184477,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "178.128.119.59",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "178.128.119.59",
-            "type": "user-session"
-          }
-        }
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "LNwRU2cBTFzn_XoLM3Pb",
-    "source": {
-      "@timestamp": "2018-11-27T02:48:14.577Z",
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "319"
-      },
-      "source": {
-        "ip": "120.197.130.118"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "120.197.130.118",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186654,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "LdwRU2cBTFzn_XoLM3Pb",
-    "source": {
-      "@timestamp": "2018-11-27T02:48:14.578Z",
-      "auditd": {
-        "sequence": 186655,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "120.197.130.118",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "319"
-      },
-      "source": {
-        "ip": "120.197.130.118"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "LtwRU2cBTFzn_XoLM3Pb",
-    "source": {
-      "@timestamp": "2018-11-27T02:48:14.782Z",
-      "process": {
-        "pid": "319",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "120.197.130.118"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "120.197.130.118",
-            "type": "user-session",
-            "primary": "ssh"
-          }
-        },
-        "sequence": 186656,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "120.197.130.118"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "gtwRU2cBTFzn_XoLA25t",
-    "source": {
-      "@timestamp": "2018-11-27T02:48:02.179Z",
-      "process": {
-        "pid": "26483",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "128.0.118.65"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "128.0.118.65"
-          }
-        },
-        "sequence": 184478,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        }
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "g9wRU2cBTFzn_XoLA25t",
-    "source": {
-      "@timestamp": "2018-11-27T02:48:02.180Z",
-      "process": {
-        "pid": "26483",
-        "exe": "/usr/sbin/sshd"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "source": {
-        "ip": "128.0.118.65"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 184479,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "128.0.118.65",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "hNwRU2cBTFzn_XoLA25t",
-    "source": {
-      "@timestamp": "2018-11-27T02:48:02.288Z",
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "128.0.118.65"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "128.0.118.65",
-            "type": "user-session",
-            "primary": "ssh"
-          }
-        },
-        "sequence": 184480,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "26483",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "128.0.118.65"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "1dwQU2cBTFzn_XoLnGVv",
-    "source": {
-      "@timestamp": "2018-11-27T02:47:35.813Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "312",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "169.61.96.71"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "169.61.96.71",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186651
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "1twQU2cBTFzn_XoLnGVv",
-    "source": {
-      "@timestamp": "2018-11-27T02:47:35.815Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "169.61.96.71",
-            "type": "user-session",
-            "primary": "sshd"
-          }
-        },
-        "sequence": 186652,
-        "result": "fail"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "312",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "169.61.96.71"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "19wQU2cBTFzn_XoLnGVv",
-    "source": {
-      "@timestamp": "2018-11-27T02:47:35.854Z",
-      "auditd": {
-        "data": {
-          "hostname": "169.61.96.71",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "169.61.96.71",
-            "type": "user-session"
-          }
-        },
-        "sequence": 186653,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "312",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "169.61.96.71"
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ItwQU2cBTFzn_XoL2Gtu",
-    "source": {
-      "@timestamp": "2018-11-27T02:47:51.172Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "20151"
-      },
-      "source": {
-        "ip": "104.248.157.6"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "hostname": "104.248.157.6",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "104.248.157.6",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142453,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "adwPU2cBTFzn_XoLb0w5",
-    "source": {
-      "@timestamp": "2018-11-27T02:46:18.698Z",
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "source": {
-        "ip": "5.196.69.191"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "5.196.69.191",
-            "type": "user-session"
-          }
-        },
-        "sequence": 44301,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "5.196.69.191"
-        }
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "31309",
-        "exe": "/usr/sbin/sshd"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "VNwTU2cBTFzn_XoL0qyL",
-    "source": {
-      "@timestamp": "2018-11-27T02:51:06.273Z",
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "217.182.170.81",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184484
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "26505",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-apache-01"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "source": {
-        "ip": "217.182.170.81"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "VdwTU2cBTFzn_XoL0qyL",
-    "source": {
-      "@timestamp": "2018-11-27T02:51:06.274Z",
-      "source": {
-        "ip": "217.182.170.81"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "217.182.170.81",
-            "type": "user-session"
-          }
-        },
-        "sequence": 184485,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        }
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "26505"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "VtwTU2cBTFzn_XoL0qyL",
-    "source": {
-      "@timestamp": "2018-11-27T02:51:06.381Z",
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "26505",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "217.182.170.81"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "ssh",
-          "hostname": "217.182.170.81",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "217.182.170.81",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184486,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "R9wSU2cBTFzn_XoLfY-L",
-    "source": {
-      "@timestamp": "2018-11-27T02:49:38.977Z",
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "188.123.122.128"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 186657,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "188.123.122.128",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "322"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "SNwSU2cBTFzn_XoLfY-L",
-    "source": {
-      "@timestamp": "2018-11-27T02:49:38.978Z",
-      "auditd": {
-        "sequence": 186658,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "188.123.122.128",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-redis-01"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "322"
-      },
-      "source": {
-        "ip": "188.123.122.128"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "SdwSU2cBTFzn_XoLfY-L",
-    "source": {
-      "@timestamp": "2018-11-27T02:49:39.106Z",
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "322"
-      },
-      "source": {
-        "ip": "188.123.122.128"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "188.123.122.128"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 186659,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "188.123.122.128",
-          "terminal": "ssh"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "MNwUU2cBTFzn_XoL4MOf",
-    "source": {
-      "@timestamp": "2018-11-27T02:52:15.413Z",
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "source": {
-        "ip": "37.187.0.20"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "37.187.0.20",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142457,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "20179",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-haproxy-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "MdwUU2cBTFzn_XoL4MOf",
-    "source": {
-      "@timestamp": "2018-11-27T02:52:15.414Z",
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "source": {
-        "ip": "37.187.0.20"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 142458,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(invalid user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "37.187.0.20"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "20179",
-        "exe": "/usr/sbin/sshd"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "MtwUU2cBTFzn_XoL4MOf",
-    "source": {
-      "@timestamp": "2018-11-27T02:52:15.522Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "20179"
-      },
-      "source": {
-        "ip": "37.187.0.20"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 142459,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "37.187.0.20",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "37.187.0.20",
-            "type": "user-session"
-          }
-        }
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "AdwTU2cBTFzn_XoLjKds",
-    "source": {
-      "@timestamp": "2018-11-27T02:50:48.323Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "26498",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "162.243.253.67"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "auditd": {
-        "sequence": 184481,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "162.243.253.67",
-            "type": "user-session"
-          }
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "AtwTU2cBTFzn_XoLjKds",
-    "source": {
-      "@timestamp": "2018-11-27T02:50:48.324Z",
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "auditd": {
-        "sequence": 184482,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "162.243.253.67",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "26498",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "162.243.253.67"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "A9wTU2cBTFzn_XoLjKds",
-    "source": {
-      "@timestamp": "2018-11-27T02:50:48.355Z",
-      "source": {
-        "ip": "162.243.253.67"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "hostname": "162.243.253.67",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "162.243.253.67",
-            "type": "user-session"
-          }
-        },
-        "sequence": 184483,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "process": {
-        "pid": "26498",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "KNwSU2cBTFzn_XoL6pgK",
-    "source": {
-      "@timestamp": "2018-11-27T02:50:06.744Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 43291,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "52.189.217.7"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "13243",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "source": {
-        "ip": "52.189.217.7"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "KdwSU2cBTFzn_XoL6pgK",
-    "source": {
-      "@timestamp": "2018-11-27T02:50:06.748Z",
-      "process": {
-        "pid": "13243",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "source": {
-        "ip": "52.189.217.7"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 43292,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "52.189.217.7",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "KtwSU2cBTFzn_XoL6pgK",
-    "source": {
-      "@timestamp": "2018-11-27T02:50:06.964Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "13243",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "52.189.217.7"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "52.189.217.7"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "52.189.217.7"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43293
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "pdwUU2cBTFzn_XoLmrwL",
-    "source": {
-      "@timestamp": "2018-11-27T02:51:57.342Z",
-      "process": {
-        "pid": "13252",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "45.122.222.185"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "45.122.222.185"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43294,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ptwUU2cBTFzn_XoLmrwL",
-    "source": {
-      "@timestamp": "2018-11-27T02:51:57.342Z",
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "source": {
-        "ip": "45.122.222.185"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "45.122.222.185",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43295,
-        "result": "fail"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "13252"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "p9wUU2cBTFzn_XoLmrwL",
-    "source": {
-      "@timestamp": "2018-11-27T02:51:57.590Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "13252",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "45.122.222.185"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 43296,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "45.122.222.185",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "45.122.222.185",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          }
-        }
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "0dwSU2cBTFzn_XoLxpVy",
-    "source": {
-      "@timestamp": "2018-11-27T02:49:57.640Z",
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "331"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "source": {
-        "ip": "62.93.166.91"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "62.93.166.91",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186660,
-        "result": "fail"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "0twSU2cBTFzn_XoLxpVy",
-    "source": {
-      "@timestamp": "2018-11-27T02:49:57.641Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "331",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "62.93.166.91"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "62.93.166.91",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186661,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "09wSU2cBTFzn_XoLxpVy",
-    "source": {
-      "@timestamp": "2018-11-27T02:49:57.762Z",
-      "process": {
-        "pid": "331",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "62.93.166.91"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "hostname": "62.93.166.91",
-          "op": "PAM:bad_ident",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "62.93.166.91"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 186662,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-redis-01",
-        "hostname": "demo-stack-redis-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-redis-01"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "UtwVU2cBTFzn_XoLNcpH",
-    "source": {
-      "@timestamp": "2018-11-27T02:52:37.083Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "86.104.220.26",
-            "type": "user-session",
-            "primary": "sshd"
-          }
-        },
-        "sequence": 44305
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "31435"
-      },
-      "source": {
-        "ip": "86.104.220.26"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "U9wVU2cBTFzn_XoLNcpH",
-    "source": {
-      "@timestamp": "2018-11-27T02:52:37.083Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44306,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "86.104.220.26",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "process": {
-        "pid": "31435",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "86.104.220.26"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "VNwVU2cBTFzn_XoLNcpH",
-    "source": {
-      "@timestamp": "2018-11-27T02:52:37.223Z",
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "hostname": "86.104.220.26",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "86.104.220.26",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44307,
-        "result": "fail"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "31435",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "86.104.220.26"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "qtwTU2cBTFzn_XoLRqAf",
-    "source": {
-      "@timestamp": "2018-11-27T02:50:30.321Z",
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "31389",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "178.62.61.192"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "178.62.61.192",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44302,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "q9wTU2cBTFzn_XoLRqAf",
-    "source": {
-      "@timestamp": "2018-11-27T02:50:30.321Z",
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "178.62.61.192"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44303,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        }
-      },
-      "beat": {
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "31389",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "178.62.61.192"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "rNwTU2cBTFzn_XoLRqAf",
-    "source": {
-      "@timestamp": "2018-11-27T02:50:30.421Z",
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "31389"
-      },
-      "source": {
-        "ip": "178.62.61.192"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "178.62.61.192",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44304,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "178.62.61.192"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "cdwXU2cBTFzn_XoLm_-X",
-    "source": {
-      "@timestamp": "2018-11-27T02:55:14.346Z",
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "144.217.42.212",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43300,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "13273",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "144.217.42.212"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ctwXU2cBTFzn_XoLm_-X",
-    "source": {
-      "@timestamp": "2018-11-27T02:55:14.346Z",
-      "process": {
-        "pid": "13273",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "144.217.42.212"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "144.217.42.212",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43301
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "c9wXU2cBTFzn_XoLm_-X",
-    "source": {
-      "@timestamp": "2018-11-27T02:55:14.386Z",
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "13273",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "144.217.42.212"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "144.217.42.212"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "144.217.42.212",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43302,
-        "result": "fail"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "ztwXU2cBTFzn_XoLn_8Q",
-    "source": {
-      "@timestamp": "2018-11-27T02:55:15.179Z",
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "1238",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "78.193.8.166"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192661,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "78.193.8.166",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "z9wXU2cBTFzn_XoLn_8Q",
-    "source": {
-      "@timestamp": "2018-11-27T02:55:15.185Z",
-      "beat": {
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "1238",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "78.193.8.166"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192662,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "78.193.8.166",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "0NwXU2cBTFzn_XoLn_8Q",
-    "source": {
-      "@timestamp": "2018-11-27T02:55:15.302Z",
-      "source": {
-        "ip": "78.193.8.166"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "object": {
-            "secondary": "78.193.8.166",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 192663,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "78.193.8.166",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "1238",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "8dwWU2cBTFzn_XoLK980",
-    "source": {
-      "@timestamp": "2018-11-27T02:53:40.043Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "1225",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "165.227.184.21"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192652,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "165.227.184.21",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "8twWU2cBTFzn_XoLK980",
-    "source": {
-      "@timestamp": "2018-11-27T02:53:40.044Z",
-      "process": {
-        "pid": "1225",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "165.227.184.21"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "165.227.184.21"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          }
-        },
-        "sequence": 192653
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "89wWU2cBTFzn_XoLK980",
-    "source": {
-      "@timestamp": "2018-11-27T02:53:40.074Z",
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "165.227.184.21"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "165.227.184.21",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192654,
-        "result": "fail"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "beat": {
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "1225",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "165.227.184.21"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "BdwWU2cBTFzn_XoLL-A3",
-    "source": {
-      "@timestamp": "2018-11-27T02:53:41.070Z",
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "1227",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "206.81.24.64"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192655,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "206.81.24.64"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "BtwWU2cBTFzn_XoLL-A3",
-    "source": {
-      "@timestamp": "2018-11-27T02:53:41.071Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192656,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(invalid user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "206.81.24.64"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "1227",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "206.81.24.64"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "B9wWU2cBTFzn_XoLL-A3",
-    "source": {
-      "@timestamp": "2018-11-27T02:53:41.179Z",
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "206.81.24.64",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "object": {
-            "secondary": "206.81.24.64",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          }
-        },
-        "sequence": 192657
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "1227",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "206.81.24.64"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "s9wWU2cBTFzn_XoLnOnq",
-    "source": {
-      "@timestamp": "2018-11-27T02:54:09.152Z",
-      "auditd": {
-        "sequence": 142460,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "103.100.209.44",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "20193",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "103.100.209.44"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "tNwWU2cBTFzn_XoLnOnq",
-    "source": {
-      "@timestamp": "2018-11-27T02:54:09.153Z",
-      "process": {
-        "pid": "20193",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "103.100.209.44"
-      },
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "103.100.209.44",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 142461,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        }
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "tdwWU2cBTFzn_XoLnOnq",
-    "source": {
-      "@timestamp": "2018-11-27T02:54:09.326Z",
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "auditd": {
-        "sequence": 142462,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "103.100.209.44"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "103.100.209.44"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "20193",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "103.100.209.44"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "wNwWU2cBTFzn_XoLUOIL",
-    "source": {
-      "@timestamp": "2018-11-27T02:53:49.472Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "81.66.86.4",
-            "type": "user-session",
-            "primary": "sshd"
-          }
-        },
-        "sequence": 192658,
-        "result": "fail"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "1229",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "81.66.86.4"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "wdwWU2cBTFzn_XoLUOIL",
-    "source": {
-      "@timestamp": "2018-11-27T02:53:49.473Z",
-      "auditd": {
-        "sequence": 192659,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "sshd",
-            "secondary": "81.66.86.4"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "1229",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "81.66.86.4"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "wtwWU2cBTFzn_XoLUOIL",
-    "source": {
-      "@timestamp": "2018-11-27T02:53:49.586Z",
-      "process": {
-        "pid": "1229",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "81.66.86.4"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192660,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "81.66.86.4"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "81.66.86.4",
-            "type": "user-session"
-          }
-        }
-      },
-      "beat": {
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "r9wWU2cBTFzn_XoLJ98E",
-    "source": {
-      "@timestamp": "2018-11-27T02:53:38.966Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "terminal": "sshd",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "122.15.119.41",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 43297
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "13265",
-        "exe": "/usr/sbin/sshd"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "source": {
-        "ip": "122.15.119.41"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "sNwWU2cBTFzn_XoLJ98E",
-    "source": {
-      "@timestamp": "2018-11-27T02:53:38.966Z",
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "122.15.119.41",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43298,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "13265"
-      },
-      "source": {
-        "ip": "122.15.119.41"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "sdwWU2cBTFzn_XoLJ98E",
-    "source": {
-      "@timestamp": "2018-11-27T02:53:39.222Z",
-      "process": {
-        "pid": "13265",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "source": {
-        "ip": "122.15.119.41"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "122.15.119.41",
-            "type": "user-session",
-            "primary": "ssh"
-          }
-        },
-        "sequence": 43299,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "122.15.119.41",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "4dwVU2cBTFzn_XoLtdX6",
-    "source": {
-      "@timestamp": "2018-11-27T02:53:10.025Z",
-      "process": {
-        "pid": "31449",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "159.203.168.217"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "159.203.168.217",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44308,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        }
-      },
-      "beat": {
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "4twVU2cBTFzn_XoLtdX6",
-    "source": {
-      "@timestamp": "2018-11-27T02:53:10.029Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "159.203.168.217",
-            "type": "user-session",
-            "primary": "sshd"
-          }
-        },
-        "sequence": 44309,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        }
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "31449",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "source": {
-        "ip": "159.203.168.217"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "49wVU2cBTFzn_XoLtdX6",
-    "source": {
-      "@timestamp": "2018-11-27T02:53:10.057Z",
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "31449",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "159.203.168.217"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44310,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "op": "PAM:bad_ident",
-          "hostname": "159.203.168.217"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "159.203.168.217",
-            "type": "user-session"
-          }
-        }
-      },
-      "beat": {
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-es-01"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "YNwVU2cBTFzn_XoLyNec",
-    "source": {
-      "@timestamp": "2018-11-27T02:53:14.798Z",
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "31453",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "178.33.45.156"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "178.33.45.156",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44311,
-        "result": "fail"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "YdwVU2cBTFzn_XoLyNec",
-    "source": {
-      "@timestamp": "2018-11-27T02:53:14.798Z",
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "178.33.45.156",
-            "type": "user-session"
-          }
-        },
-        "sequence": 44312
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "pid": "31453",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "178.33.45.156"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "YtwVU2cBTFzn_XoLyNec",
-    "source": {
-      "@timestamp": "2018-11-27T02:53:14.906Z",
-      "process": {
-        "pid": "31453",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "178.33.45.156"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 44313,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "178.33.45.156",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "secondary": "178.33.45.156",
-            "type": "user-session",
-            "primary": "ssh"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "zd0YU2cBTFzn_XoLHgkA",
-    "source": {
-      "@timestamp": "2018-11-27T02:55:47.730Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "46.148.192.41",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44315,
-        "result": "fail"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "31503",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "46.148.192.41"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "zt0YU2cBTFzn_XoLHgkA",
-    "source": {
-      "@timestamp": "2018-11-27T02:55:47.730Z",
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "31503",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "46.148.192.41"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "46.148.192.41",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44316,
-        "result": "fail"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "z90YU2cBTFzn_XoLHgkA",
-    "source": {
-      "@timestamp": "2018-11-27T02:55:47.874Z",
-      "auditd": {
-        "sequence": 44317,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "hostname": "46.148.192.41",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "46.148.192.41",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "31503",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "46.148.192.41"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "gdwVU2cBTFzn_XoL5dmB",
-    "source": {
-      "@timestamp": "2018-11-27T02:53:22.174Z",
-      "source": {
-        "ip": "149.202.54.124"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "hostname": "149.202.54.124",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "149.202.54.124",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 44314,
-        "result": "fail"
-      },
-      "beat": {
-        "name": "demo-stack-es-01",
-        "hostname": "demo-stack-es-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-es-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "31457",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "E90aU2cBTFzn_XoLNjl5",
-    "source": {
-      "@timestamp": "2018-11-27T02:58:05.071Z",
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          },
-          "object": {
-            "secondary": "217.8.49.195",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 192673,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "1272",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "217.8.49.195"
-      },
-      "beat": {
-        "version": "7.0.0-alpha1",
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "FN0aU2cBTFzn_XoLNjl5",
-    "source": {
-      "@timestamp": "2018-11-27T02:58:05.072Z",
-      "process": {
-        "pid": "1272",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "217.8.49.195"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192674,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "secondary": "217.8.49.195",
-            "type": "user-session",
-            "primary": "sshd"
-          }
-        }
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Fd0aU2cBTFzn_XoLNjl5",
-    "source": {
-      "@timestamp": "2018-11-27T02:58:05.216Z",
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "217.8.49.195",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "type": "user-session",
-            "primary": "ssh",
-            "secondary": "217.8.49.195"
-          }
-        },
-        "sequence": 192675,
-        "result": "fail"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "1272",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "217.8.49.195"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "5d0aU2cBTFzn_XoLw0Ro",
-    "source": {
-      "@timestamp": "2018-11-27T02:58:41.148Z",
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "13636"
-      },
-      "source": {
-        "ip": "197.53.106.203"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(unknown user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "secondary": "197.53.106.203",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43308,
-        "result": "fail",
-        "session": "unset"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "5t0aU2cBTFzn_XoLw0Ro",
-    "source": {
-      "@timestamp": "2018-11-27T02:58:41.148Z",
-      "process": {
-        "pid": "13636",
-        "exe": "/usr/sbin/sshd"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "source": {
-        "ip": "197.53.106.203"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 43309,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "197.53.106.203",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "590aU2cBTFzn_XoLw0Ro",
-    "source": {
-      "@timestamp": "2018-11-27T02:58:41.768Z",
-      "source": {
-        "ip": "197.53.106.203"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "hostname": "197.53.106.203",
-          "terminal": "ssh"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "197.53.106.203",
-            "type": "user-session"
-          }
-        },
-        "sequence": 43310
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "process": {
-        "pid": "13636",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "cN0bU2cBTFzn_XoLDkvX",
-    "source": {
-      "@timestamp": "2018-11-27T02:59:00.461Z",
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "1275",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "71.112.175.120"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 192676,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "71.112.175.120"
-        },
-        "summary": {
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "71.112.175.120",
-            "type": "user-session"
-          }
-        }
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "4t0bU2cBTFzn_XoLaVLG",
-    "source": {
-      "@timestamp": "2018-11-27T02:59:23.735Z",
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "198.100.156.214",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43311,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "13643",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "198.100.156.214"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "490bU2cBTFzn_XoLaVLG",
-    "source": {
-      "@timestamp": "2018-11-27T02:59:23.735Z",
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "terminal": "sshd",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "198.100.156.214",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43312,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "13643"
-      },
-      "source": {
-        "ip": "198.100.156.214"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "5N0bU2cBTFzn_XoLaVLG",
-    "source": {
-      "@timestamp": "2018-11-27T02:59:23.779Z",
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "terminal": "ssh",
-          "hostname": "198.100.156.214",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "secondary": "root",
-            "primary": "unset"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "198.100.156.214",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43313,
-        "result": "fail"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "13643",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "198.100.156.214"
-      },
-      "network": {
-        "direction": "incoming"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Xd0bU2cBTFzn_XoLclNQ",
-    "source": {
-      "@timestamp": "2018-11-27T02:59:25.924Z",
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "auid": "unset",
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0"
-      },
-      "process": {
-        "pid": "13645",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "91.121.110.50"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "data": {
-          "terminal": "sshd",
-          "acct": "(unknown user)",
-          "op": "login"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "91.121.110.50",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          }
-        },
-        "sequence": 43314,
-        "result": "fail",
-        "session": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Xt0bU2cBTFzn_XoLclNQ",
-    "source": {
-      "@timestamp": "2018-11-27T02:59:25.924Z",
-      "source": {
-        "ip": "91.121.110.50"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 43315,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "terminal": "sshd",
-          "op": "login",
-          "acct": "(invalid user)"
-        },
-        "summary": {
-          "object": {
-            "secondary": "91.121.110.50",
-            "type": "user-session",
-            "primary": "sshd"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "(invalid user)"
-          }
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "13645"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "X90bU2cBTFzn_XoLclNQ",
-    "source": {
-      "@timestamp": "2018-11-27T02:59:26.032Z",
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_err"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "13645",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "91.121.110.50"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 43316,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "PAM:bad_ident",
-          "terminal": "ssh",
-          "hostname": "91.121.110.50"
-        },
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "91.121.110.50",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        }
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "_t0bU2cBTFzn_XoLelQ5",
-    "source": {
-      "@timestamp": "2018-11-27T02:59:27.948Z",
-      "source": {
-        "ip": "51.38.82.60"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 43317,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "51.38.82.60",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(unknown user)",
-            "primary": "unset"
-          }
-        }
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "process": {
-        "pid": "13647",
-        "exe": "/usr/sbin/sshd"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "_90bU2cBTFzn_XoLelQ5",
-    "source": {
-      "@timestamp": "2018-11-27T02:59:27.948Z",
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "13647"
-      },
-      "source": {
-        "ip": "51.38.82.60"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "summary": {
-          "object": {
-            "primary": "sshd",
-            "secondary": "51.38.82.60",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "secondary": "(invalid user)",
-            "primary": "unset"
-          }
-        },
-        "sequence": 43318,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(invalid user)",
-          "terminal": "sshd"
-        }
-      },
-      "event": {
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login",
-        "type": "user_login"
-      },
-      "user": {
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "AN0bU2cBTFzn_XoLelU5",
-    "source": {
-      "@timestamp": "2018-11-27T02:59:28.060Z",
-      "auditd": {
-        "data": {
-          "hostname": "51.38.82.60",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "51.38.82.60",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43319,
-        "result": "fail",
-        "session": "unset"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "13647"
-      },
-      "source": {
-        "ip": "51.38.82.60"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Xa2ipWkBCQofM5eXEgsv",
-    "source": {
-      "@timestamp": "2018-11-27T02:59:28.060Z",
-      "auditd": {
-        "data": {
-          "hostname": "51.38.82.60",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          },
-          "object": {
-            "primary": "ssh",
-            "secondary": "51.38.82.60",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 43319,
-        "result": "fail",
-        "session": "unset"
-      },
-      "destination" : {
-        "ip" : "0.0.0.0",
-        "port" : "22"
-      },
-      "event": {
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user" : {
-        "group" : {
-          "name" : "root",
-          "id" : "0"
-        },
-        "id" : "0",
-        "name" : "root"
-      },
-      "process": {
-        "exe": "/usr/sbin/sshd",
-        "pid": "13647"
-      },
-      "source": {
-        "ip": "51.38.82.60"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-mysql-01",
-        "hostname": "demo-stack-mysql-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-mysql-01"
-      }
-    }
-  }
-}
diff --git a/x-pack/test/functional/es_archives/auditbeat/hosts/mappings.json b/x-pack/test/functional/es_archives/auditbeat/hosts/mappings.json
index 11e2aa22d5c0a6..759f9e7eb78f91 100644
--- a/x-pack/test/functional/es_archives/auditbeat/hosts/mappings.json
+++ b/x-pack/test/functional/es_archives/auditbeat/hosts/mappings.json
@@ -2601,10 +2601,6 @@
     },
     "settings": {
       "index": {
-        "lifecycle": {
-          "name": "auditbeat-8.0.0",
-          "rollover_alias": "auditbeat-8.0.0"
-        },
         "mapping": {
           "total_fields": {
             "limit": "10000"
diff --git a/x-pack/test/functional/es_archives/auditbeat/kpi_hosts/data.json b/x-pack/test/functional/es_archives/auditbeat/kpi_hosts/data.json
deleted file mode 100644
index 470e38e62ba51a..00000000000000
--- a/x-pack/test/functional/es_archives/auditbeat/kpi_hosts/data.json
+++ /dev/null
@@ -1,194 +0,0 @@
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "Rs93UmcBTFzn_XoLWT6M",
-    "source": {
-      "@timestamp": "2018-11-27T00:00:11.544Z",
-      "process": {
-        "pid": "31964",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "128.199.87.213"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-nginx-01",
-        "hostname": "demo-stack-nginx-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-nginx-01"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "hostname": "128.199.87.213",
-          "terminal": "ssh",
-          "op": "PAM:bad_ident"
-        },
-        "summary": {
-          "object": {
-            "primary": "ssh",
-            "secondary": "128.199.87.213",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd",
-          "actor": {
-            "primary": "unset",
-            "secondary": "root"
-          }
-        },
-        "sequence": 192383,
-        "result": "fail"
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_err",
-        "action": "error",
-        "module": "auditd"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "auid": "unset",
-        "uid": "0"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "6Nr4UmcBTFzn_XoL4l6d",
-    "source": {
-      "@timestamp": "2018-11-27T02:21:40.914Z",
-      "host": {
-        "name": "demo-stack-haproxy-01"
-      },
-      "user": {
-        "auid": "unset",
-        "uid": "0",
-        "name_map": {
-          "uid": "root"
-        }
-      },
-      "process": {
-        "pid": "20001",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "82.62.233.163"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "auditd": {
-        "sequence": 142431,
-        "result": "fail",
-        "session": "unset",
-        "data": {
-          "acct": "(unknown user)",
-          "op": "login",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "82.62.233.163",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        }
-      },
-      "event": {
-        "category": "user-login",
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd"
-      },
-      "beat": {
-        "name": "demo-stack-haproxy-01",
-        "hostname": "demo-stack-haproxy-01",
-        "version": "7.0.0-alpha1"
-      }
-    }
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "type": "doc",
-    "id": "sdwQU2cBTFzn_XoLA1gL",
-    "source": {
-      "@timestamp": "2018-11-27T02:46:56.545Z",
-      "process": {
-        "pid": "26473",
-        "exe": "/usr/sbin/sshd"
-      },
-      "source": {
-        "ip": "35.243.183.165"
-      },
-      "network": {
-        "direction": "incoming"
-      },
-      "beat": {
-        "name": "demo-stack-apache-01",
-        "hostname": "demo-stack-apache-01",
-        "version": "7.0.0-alpha1"
-      },
-      "host": {
-        "name": "demo-stack-apache-01"
-      },
-      "auditd": {
-        "session": "unset",
-        "data": {
-          "op": "login",
-          "acct": "(unknown user)",
-          "terminal": "sshd"
-        },
-        "summary": {
-          "actor": {
-            "primary": "unset",
-            "secondary": "(unknown user)"
-          },
-          "object": {
-            "primary": "sshd",
-            "secondary": "35.243.183.165",
-            "type": "user-session"
-          },
-          "how": "/usr/sbin/sshd"
-        },
-        "sequence": 184472,
-        "result": "fail"
-      },
-      "event": {
-        "type": "user_login",
-        "action": "logged-in",
-        "module": "auditd",
-        "category": "user-login"
-      },
-      "user": {
-        "name_map": {
-          "uid": "root"
-        },
-        "uid": "0",
-        "auid": "unset"
-      }
-    }
-  }
-}
diff --git a/x-pack/test/functional/es_archives/auditbeat/kpi_hosts/mappings.json b/x-pack/test/functional/es_archives/auditbeat/kpi_hosts/mappings.json
deleted file mode 100644
index 683b40041f3268..00000000000000
--- a/x-pack/test/functional/es_archives/auditbeat/kpi_hosts/mappings.json
+++ /dev/null
@@ -1,1904 +0,0 @@
-{
-  "type": "index",
-  "value": {
-    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
-    "settings": {
-      "index": {
-        "auto_expand_replicas": "0-1",
-        "codec": "best_compression",
-        "mapping": {
-          "total_fields": {
-            "limit": "10000"
-          }
-        },
-        "refresh_interval": "5s",
-        "number_of_shards": "1",
-        "query": {
-          "default_field": [
-            "beat.name",
-            "beat.hostname",
-            "beat.timezone",
-            "beat.version",
-            "tags",
-            "error.message",
-            "error.type",
-            "meta.cloud.provider",
-            "meta.cloud.instance_id",
-            "meta.cloud.instance_name",
-            "meta.cloud.machine_type",
-            "meta.cloud.availability_zone",
-            "meta.cloud.project_id",
-            "meta.cloud.region",
-            "docker.container.id",
-            "docker.container.image",
-            "docker.container.name",
-            "host.name",
-            "host.id",
-            "host.architecture",
-            "host.os.platform",
-            "host.os.version",
-            "host.os.family",
-            "host.mac",
-            "kubernetes.pod.name",
-            "kubernetes.pod.uid",
-            "kubernetes.namespace",
-            "kubernetes.node.name",
-            "kubernetes.container.name",
-            "kubernetes.container.image",
-            "event.module",
-            "event.action",
-            "file.path",
-            "raw",
-            "file.target_path",
-            "file.type",
-            "file.device",
-            "file.inode",
-            "file.uid",
-            "file.owner",
-            "file.gid",
-            "file.group",
-            "file.mode",
-            "file.origin",
-            "raw",
-            "file.selinux.user",
-            "file.selinux.role",
-            "file.selinux.domain",
-            "file.selinux.level",
-            "event.category",
-            "event.type",
-            "user.auid",
-            "user.uid",
-            "user.euid",
-            "user.fsuid",
-            "user.suid",
-            "user.gid",
-            "user.egid",
-            "user.sgid",
-            "user.fsgid",
-            "user.name_map.auid",
-            "user.name_map.uid",
-            "user.name_map.euid",
-            "user.name_map.fsuid",
-            "user.name_map.suid",
-            "user.name_map.gid",
-            "user.name_map.egid",
-            "user.name_map.sgid",
-            "user.name_map.fsgid",
-            "user.selinux.user",
-            "user.selinux.role",
-            "user.selinux.domain",
-            "user.selinux.level",
-            "user.selinux.category",
-            "process.pid",
-            "process.ppid",
-            "process.name",
-            "process.title",
-            "process.exe",
-            "process.cwd",
-            "process.args",
-            "source.port",
-            "source.hostname",
-            "source.path",
-            "destination.port",
-            "destination.hostname",
-            "destination.path",
-            "network.direction",
-            "auditd.session",
-            "auditd.result",
-            "auditd.summary.actor.primary",
-            "auditd.summary.actor.secondary",
-            "auditd.summary.object.type",
-            "auditd.summary.object.primary",
-            "auditd.summary.object.secondary",
-            "auditd.summary.how",
-            "auditd.paths.inode",
-            "auditd.paths.dev",
-            "auditd.paths.obj_user",
-            "auditd.paths.obj_role",
-            "auditd.paths.obj_domain",
-            "auditd.paths.obj_level",
-            "auditd.paths.objtype",
-            "auditd.paths.ouid",
-            "auditd.paths.rdev",
-            "auditd.paths.nametype",
-            "auditd.paths.ogid",
-            "auditd.paths.item",
-            "auditd.paths.mode",
-            "auditd.paths.name",
-            "auditd.data.action",
-            "auditd.data.minor",
-            "auditd.data.acct",
-            "auditd.data.addr",
-            "auditd.data.cipher",
-            "auditd.data.id",
-            "auditd.data.entries",
-            "auditd.data.kind",
-            "auditd.data.ksize",
-            "auditd.data.spid",
-            "auditd.data.arch",
-            "auditd.data.argc",
-            "auditd.data.major",
-            "auditd.data.unit",
-            "auditd.data.table",
-            "auditd.data.terminal",
-            "auditd.data.grantors",
-            "auditd.data.direction",
-            "auditd.data.op",
-            "auditd.data.tty",
-            "auditd.data.syscall",
-            "auditd.data.data",
-            "auditd.data.family",
-            "auditd.data.mac",
-            "auditd.data.pfs",
-            "auditd.data.items",
-            "auditd.data.a0",
-            "auditd.data.a1",
-            "auditd.data.a2",
-            "auditd.data.a3",
-            "auditd.data.hostname",
-            "auditd.data.lport",
-            "auditd.data.rport",
-            "auditd.data.exit",
-            "auditd.data.fp",
-            "auditd.data.laddr",
-            "auditd.data.sport",
-            "auditd.data.capability",
-            "auditd.data.nargs",
-            "auditd.data.new-enabled",
-            "auditd.data.audit_backlog_limit",
-            "auditd.data.dir",
-            "auditd.data.cap_pe",
-            "auditd.data.model",
-            "auditd.data.new_pp",
-            "auditd.data.old-enabled",
-            "auditd.data.oauid",
-            "auditd.data.old",
-            "auditd.data.banners",
-            "auditd.data.feature",
-            "auditd.data.vm-ctx",
-            "auditd.data.opid",
-            "auditd.data.seperms",
-            "auditd.data.seresult",
-            "auditd.data.new-rng",
-            "auditd.data.old-net",
-            "auditd.data.sigev_signo",
-            "auditd.data.ino",
-            "auditd.data.old_enforcing",
-            "auditd.data.old-vcpu",
-            "auditd.data.range",
-            "auditd.data.res",
-            "auditd.data.added",
-            "auditd.data.fam",
-            "auditd.data.nlnk-pid",
-            "auditd.data.subj",
-            "auditd.data.a[0-3]",
-            "auditd.data.cgroup",
-            "auditd.data.kernel",
-            "auditd.data.ocomm",
-            "auditd.data.new-net",
-            "auditd.data.permissive",
-            "auditd.data.class",
-            "auditd.data.compat",
-            "auditd.data.fi",
-            "auditd.data.changed",
-            "auditd.data.msg",
-            "auditd.data.dport",
-            "auditd.data.new-seuser",
-            "auditd.data.invalid_context",
-            "auditd.data.dmac",
-            "auditd.data.ipx-net",
-            "auditd.data.iuid",
-            "auditd.data.macproto",
-            "auditd.data.obj",
-            "auditd.data.ipid",
-            "auditd.data.new-fs",
-            "auditd.data.vm-pid",
-            "auditd.data.cap_pi",
-            "auditd.data.old-auid",
-            "auditd.data.oses",
-            "auditd.data.fd",
-            "auditd.data.igid",
-            "auditd.data.new-disk",
-            "auditd.data.parent",
-            "auditd.data.len",
-            "auditd.data.oflag",
-            "auditd.data.uuid",
-            "auditd.data.code",
-            "auditd.data.nlnk-grp",
-            "auditd.data.cap_fp",
-            "auditd.data.new-mem",
-            "auditd.data.seperm",
-            "auditd.data.enforcing",
-            "auditd.data.new-chardev",
-            "auditd.data.old-rng",
-            "auditd.data.outif",
-            "auditd.data.cmd",
-            "auditd.data.hook",
-            "auditd.data.new-level",
-            "auditd.data.sauid",
-            "auditd.data.sig",
-            "auditd.data.audit_backlog_wait_time",
-            "auditd.data.printer",
-            "auditd.data.old-mem",
-            "auditd.data.perm",
-            "auditd.data.old_pi",
-            "auditd.data.state",
-            "auditd.data.format",
-            "auditd.data.new_gid",
-            "auditd.data.tcontext",
-            "auditd.data.maj",
-            "auditd.data.watch",
-            "auditd.data.device",
-            "auditd.data.grp",
-            "auditd.data.bool",
-            "auditd.data.icmp_type",
-            "auditd.data.new_lock",
-            "auditd.data.old_prom",
-            "auditd.data.acl",
-            "auditd.data.ip",
-            "auditd.data.new_pi",
-            "auditd.data.default-context",
-            "auditd.data.inode_gid",
-            "auditd.data.new-log_passwd",
-            "auditd.data.new_pe",
-            "auditd.data.selected-context",
-            "auditd.data.cap_fver",
-            "auditd.data.file",
-            "auditd.data.net",
-            "auditd.data.virt",
-            "auditd.data.cap_pp",
-            "auditd.data.old-range",
-            "auditd.data.resrc",
-            "auditd.data.new-range",
-            "auditd.data.obj_gid",
-            "auditd.data.proto",
-            "auditd.data.old-disk",
-            "auditd.data.audit_failure",
-            "auditd.data.inif",
-            "auditd.data.vm",
-            "auditd.data.flags",
-            "auditd.data.nlnk-fam",
-            "auditd.data.old-fs",
-            "auditd.data.old-ses",
-            "auditd.data.seqno",
-            "auditd.data.fver",
-            "auditd.data.qbytes",
-            "auditd.data.seuser",
-            "auditd.data.cap_fe",
-            "auditd.data.new-vcpu",
-            "auditd.data.old-level",
-            "auditd.data.old_pp",
-            "auditd.data.daddr",
-            "auditd.data.old-role",
-            "auditd.data.ioctlcmd",
-            "auditd.data.smac",
-            "auditd.data.apparmor",
-            "auditd.data.fe",
-            "auditd.data.perm_mask",
-            "auditd.data.ses",
-            "auditd.data.cap_fi",
-            "auditd.data.obj_uid",
-            "auditd.data.reason",
-            "auditd.data.list",
-            "auditd.data.old_lock",
-            "auditd.data.bus",
-            "auditd.data.old_pe",
-            "auditd.data.new-role",
-            "auditd.data.prom",
-            "auditd.data.uri",
-            "auditd.data.audit_enabled",
-            "auditd.data.old-log_passwd",
-            "auditd.data.old-seuser",
-            "auditd.data.per",
-            "auditd.data.scontext",
-            "auditd.data.tclass",
-            "auditd.data.ver",
-            "auditd.data.new",
-            "auditd.data.val",
-            "auditd.data.img-ctx",
-            "auditd.data.old-chardev",
-            "auditd.data.old_val",
-            "auditd.data.success",
-            "auditd.data.inode_uid",
-            "auditd.data.removed",
-            "auditd.data.socket.port",
-            "auditd.data.socket.saddr",
-            "auditd.data.socket.addr",
-            "auditd.data.socket.family",
-            "auditd.data.socket.path",
-            "auditd.messages",
-            "auditd.warnings",
-            "geoip.continent_name",
-            "geoip.city_name",
-            "geoip.region_name",
-            "geoip.country_iso_code",
-            "hash.blake2b_256",
-            "hash.blake2b_384",
-            "hash.blake2b_512",
-            "hash.md5",
-            "hash.sha1",
-            "hash.sha224",
-            "hash.sha256",
-            "hash.sha384",
-            "hash.sha3_224",
-            "hash.sha3_256",
-            "hash.sha3_384",
-            "hash.sha3_512",
-            "hash.sha512",
-            "hash.sha512_224",
-            "hash.sha512_256",
-            "hash.xxh64",
-            "fields.*"
-          ]
-        },
-        "number_of_replicas": "0"
-      }
-    },
-    "mappings": {
-      "_meta": {
-        "version": "7.0.0-alpha1"
-      },
-      "dynamic_templates": [
-        {
-          "fields": {
-            "path_match": "fields.*",
-            "match_mapping_type": "string",
-            "mapping": {
-              "type": "keyword"
-            }
-          }
-        },
-        {
-          "docker.container.labels": {
-            "path_match": "docker.container.labels.*",
-            "match_mapping_type": "string",
-            "mapping": {
-              "type": "keyword"
-            }
-          }
-        },
-        {
-          "strings_as_keyword": {
-            "match_mapping_type": "string",
-            "mapping": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        }
-      ],
-      "date_detection": false,
-      "properties": {
-        "@timestamp": {
-          "type": "date"
-        },
-        "auditd": {
-          "properties": {
-            "data": {
-              "properties": {
-                "a0": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "a1": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "a2": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "a3": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "a[0-3]": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "acct": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "acl": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "action": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "added": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "addr": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "apparmor": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "arch": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "argc": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "audit_backlog_limit": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "audit_backlog_wait_time": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "audit_enabled": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "audit_failure": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "banners": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "bool": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "bus": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "cap_fe": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "cap_fi": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "cap_fp": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "cap_fver": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "cap_pe": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "cap_pi": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "cap_pp": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "capability": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "cgroup": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "changed": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "cipher": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "class": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "cmd": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "code": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "compat": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "daddr": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "data": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "default-context": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "device": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "dir": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "direction": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "dmac": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "dport": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "enforcing": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "entries": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "exit": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "fam": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "family": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "fd": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "fe": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "feature": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "fi": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "file": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "flags": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "format": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "fp": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "fver": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "grantors": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "grp": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "hook": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "hostname": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "icmp_type": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "id": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "igid": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "img-ctx": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "inif": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "ino": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "inode_gid": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "inode_uid": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "invalid_context": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "ioctlcmd": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "ip": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "ipid": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "ipx-net": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "items": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "iuid": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "kernel": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "kind": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "ksize": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "laddr": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "len": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "list": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "lport": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "mac": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "macproto": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "maj": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "major": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "minor": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "model": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "msg": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "nargs": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "net": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "new": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "new-chardev": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "new-disk": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "new-enabled": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "new-fs": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "new-level": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "new-log_passwd": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "new-mem": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "new-net": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "new-range": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "new-rng": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "new-role": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "new-seuser": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "new-vcpu": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "new_gid": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "new_lock": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "new_pe": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "new_pi": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "new_pp": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "nlnk-fam": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "nlnk-grp": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "nlnk-pid": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "oauid": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "obj": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "obj_gid": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "obj_uid": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "ocomm": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "oflag": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "old": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "old-auid": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "old-chardev": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "old-disk": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "old-enabled": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "old-fs": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "old-level": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "old-log_passwd": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "old-mem": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "old-net": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "old-range": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "old-rng": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "old-role": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "old-ses": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "old-seuser": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "old-vcpu": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "old_enforcing": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "old_lock": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "old_pe": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "old_pi": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "old_pp": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "old_prom": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "old_val": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "op": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "opid": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "oses": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "outif": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "parent": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "per": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "perm": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "perm_mask": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "permissive": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "pfs": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "printer": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "prom": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "proto": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "qbytes": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "range": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "reason": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "removed": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "res": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "resrc": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "rport": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "sauid": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "scontext": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "selected-context": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "seperm": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "seperms": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "seqno": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "seresult": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "ses": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "seuser": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "sig": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "sigev_signo": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "smac": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "socket": {
-                  "properties": {
-                    "addr": {
-                      "type": "keyword",
-                      "ignore_above": 1024
-                    },
-                    "family": {
-                      "type": "keyword",
-                      "ignore_above": 1024
-                    },
-                    "path": {
-                      "type": "keyword",
-                      "ignore_above": 1024
-                    },
-                    "port": {
-                      "type": "keyword",
-                      "ignore_above": 1024
-                    },
-                    "saddr": {
-                      "type": "keyword",
-                      "ignore_above": 1024
-                    }
-                  }
-                },
-                "spid": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "sport": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "state": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "subj": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "success": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "syscall": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "table": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "tclass": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "tcontext": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "terminal": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "tty": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "unit": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "uri": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "uuid": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "val": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "ver": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "virt": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "vm": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "vm-ctx": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "vm-pid": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "watch": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                }
-              }
-            },
-            "messages": {
-              "type": "text",
-              "norms": false
-            },
-            "paths": {
-              "properties": {
-                "dev": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "inode": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "item": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "mode": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "name": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "nametype": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "obj_domain": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "obj_level": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "obj_role": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "obj_user": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "objtype": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "ogid": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "ouid": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "rdev": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                }
-              }
-            },
-            "result": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "sequence": {
-              "type": "long"
-            },
-            "session": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "summary": {
-              "properties": {
-                "actor": {
-                  "properties": {
-                    "primary": {
-                      "type": "keyword",
-                      "ignore_above": 1024
-                    },
-                    "secondary": {
-                      "type": "keyword",
-                      "ignore_above": 1024
-                    }
-                  }
-                },
-                "how": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "object": {
-                  "properties": {
-                    "primary": {
-                      "type": "keyword",
-                      "ignore_above": 1024
-                    },
-                    "secondary": {
-                      "type": "keyword",
-                      "ignore_above": 1024
-                    },
-                    "type": {
-                      "type": "keyword",
-                      "ignore_above": 1024
-                    }
-                  }
-                }
-              }
-            },
-            "warnings": {
-              "type": "keyword",
-              "ignore_above": 1024
-            }
-          }
-        },
-        "beat": {
-          "properties": {
-            "hostname": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "name": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "timezone": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "version": {
-              "type": "keyword",
-              "ignore_above": 1024
-            }
-          }
-        },
-        "destination": {
-          "properties": {
-            "hostname": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "path": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "port": {
-              "type": "keyword",
-              "ignore_above": 1024
-            }
-          }
-        },
-        "docker": {
-          "properties": {
-            "container": {
-              "properties": {
-                "id": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "image": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "labels": {
-                  "type": "object"
-                },
-                "name": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                }
-              }
-            }
-          }
-        },
-        "error": {
-          "properties": {
-            "code": {
-              "type": "long"
-            },
-            "message": {
-              "type": "text",
-              "norms": false
-            },
-            "type": {
-              "type": "keyword",
-              "ignore_above": 1024
-            }
-          }
-        },
-        "event": {
-          "properties": {
-            "action": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "category": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "module": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "type": {
-              "type": "keyword",
-              "ignore_above": 1024
-            }
-          }
-        },
-        "fields": {
-          "type": "object"
-        },
-        "file": {
-          "properties": {
-            "ctime": {
-              "type": "date"
-            },
-            "device": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "gid": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "group": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "inode": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "mode": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "mtime": {
-              "type": "date"
-            },
-            "origin": {
-              "type": "text",
-              "norms": false,
-              "fields": {
-                "raw": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                }
-              }
-            },
-            "owner": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "path": {
-              "type": "text",
-              "norms": false,
-              "fields": {
-                "raw": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                }
-              }
-            },
-            "selinux": {
-              "properties": {
-                "domain": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "level": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "role": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "user": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                }
-              }
-            },
-            "setgid": {
-              "type": "boolean"
-            },
-            "setuid": {
-              "type": "boolean"
-            },
-            "size": {
-              "type": "long"
-            },
-            "target_path": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "type": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "uid": {
-              "type": "keyword",
-              "ignore_above": 1024
-            }
-          }
-        },
-        "geoip": {
-          "properties": {
-            "city_name": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "continent_name": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "country_iso_code": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "location": {
-              "type": "geo_point"
-            },
-            "region_name": {
-              "type": "keyword",
-              "ignore_above": 1024
-            }
-          }
-        },
-        "hash": {
-          "properties": {
-            "blake2b_256": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "blake2b_384": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "blake2b_512": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "md5": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "sha1": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "sha224": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "sha256": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "sha384": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "sha3_224": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "sha3_256": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "sha3_384": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "sha3_512": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "sha512": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "sha512_224": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "sha512_256": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "xxh64": {
-              "type": "keyword",
-              "ignore_above": 1024
-            }
-          }
-        },
-        "host": {
-          "properties": {
-            "architecture": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "id": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "name": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "os": {
-              "properties": {
-                "family": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "platform": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "version": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                }
-              }
-            }
-          }
-        },
-        "kubernetes": {
-          "properties": {
-            "annotations": {
-              "type": "object"
-            },
-            "container": {
-              "properties": {
-                "image": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "name": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                }
-              }
-            },
-            "labels": {
-              "type": "object"
-            },
-            "namespace": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "node": {
-              "properties": {
-                "name": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                }
-              }
-            },
-            "pod": {
-              "properties": {
-                "name": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "uid": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                }
-              }
-            }
-          }
-        },
-        "meta": {
-          "properties": {
-            "cloud": {
-              "properties": {
-                "availability_zone": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "instance_id": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "instance_name": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "machine_type": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "project_id": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "provider": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "region": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                }
-              }
-            }
-          }
-        },
-        "network": {
-          "properties": {
-            "direction": {
-              "type": "keyword",
-              "ignore_above": 1024
-            }
-          }
-        },
-        "process": {
-          "properties": {
-            "args": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "cwd": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "exe": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "name": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "pid": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "ppid": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "title": {
-              "type": "keyword",
-              "ignore_above": 1024
-            }
-          }
-        },
-        "source": {
-          "properties": {
-            "hostname": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "path": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "port": {
-              "type": "keyword",
-              "ignore_above": 1024
-            }
-          }
-        },
-        "tags": {
-          "type": "keyword",
-          "ignore_above": 1024
-        },
-        "user": {
-          "properties": {
-            "auid": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "egid": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "euid": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "fsgid": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "fsuid": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "gid": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "name_map": {
-              "properties": {
-                "auid": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "egid": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "euid": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "fsgid": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "fsuid": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "gid": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "sgid": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "suid": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "uid": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                }
-              }
-            },
-            "selinux": {
-              "properties": {
-                "category": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "domain": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "level": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "role": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                },
-                "user": {
-                  "type": "keyword",
-                  "ignore_above": 1024
-                }
-              }
-            },
-            "sgid": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "suid": {
-              "type": "keyword",
-              "ignore_above": 1024
-            },
-            "uid": {
-              "type": "keyword",
-              "ignore_above": 1024
-            }
-          }
-        }
-      }
-    },
-    "aliases": {}
-  }
-}
diff --git a/x-pack/test/functional/es_archives/auditbeat/overview/mappings.json b/x-pack/test/functional/es_archives/auditbeat/overview/mappings.json
index 64056a0e61653d..9bb3f1b808c218 100644
--- a/x-pack/test/functional/es_archives/auditbeat/overview/mappings.json
+++ b/x-pack/test/functional/es_archives/auditbeat/overview/mappings.json
@@ -2601,10 +2601,6 @@
     },
     "settings": {
       "index": {
-        "lifecycle": {
-          "name": "auditbeat-8.0.0",
-          "rollover_alias": "auditbeat-8.0.0"
-        },
         "mapping": {
           "total_fields": {
             "limit": "10000"
diff --git a/x-pack/test/functional/es_archives/auditbeat/uncommon_processes/mappings.json b/x-pack/test/functional/es_archives/auditbeat/uncommon_processes/mappings.json
index 474946d2ce888b..45fd5ddb1a9f82 100644
--- a/x-pack/test/functional/es_archives/auditbeat/uncommon_processes/mappings.json
+++ b/x-pack/test/functional/es_archives/auditbeat/uncommon_processes/mappings.json
@@ -2601,10 +2601,6 @@
     },
     "settings": {
       "index": {
-        "lifecycle": {
-          "name": "auditbeat-8.0.0",
-          "rollover_alias": "auditbeat-8.0.0"
-        },
         "mapping": {
           "total_fields": {
             "limit": "10000"
diff --git a/x-pack/test/functional/es_archives/filebeat/default/mappings.json b/x-pack/test/functional/es_archives/filebeat/default/mappings.json
index 5fdf9bfdaa75a0..0114948351fc7b 100644
--- a/x-pack/test/functional/es_archives/filebeat/default/mappings.json
+++ b/x-pack/test/functional/es_archives/filebeat/default/mappings.json
@@ -5419,10 +5419,6 @@
     "settings": {
       "index": {
         "auto_expand_replicas": "0-1",
-        "lifecycle": {
-          "name": "filebeat-7.0.0",
-          "rollover_alias": "filebeat-7.0.0"
-        },
         "mapping": {
           "total_fields": {
             "limit": "10000"
diff --git a/x-pack/test/functional/es_archives/filebeat/kpi_hosts/mappings.json b/x-pack/test/functional/es_archives/filebeat/kpi_hosts/mappings.json
index 5fdf9bfdaa75a0..0114948351fc7b 100644
--- a/x-pack/test/functional/es_archives/filebeat/kpi_hosts/mappings.json
+++ b/x-pack/test/functional/es_archives/filebeat/kpi_hosts/mappings.json
@@ -5419,10 +5419,6 @@
     "settings": {
       "index": {
         "auto_expand_replicas": "0-1",
-        "lifecycle": {
-          "name": "filebeat-7.0.0",
-          "rollover_alias": "filebeat-7.0.0"
-        },
         "mapping": {
           "total_fields": {
             "limit": "10000"
diff --git a/x-pack/test/functional/es_archives/filebeat/threat_intel/mappings.json b/x-pack/test/functional/es_archives/filebeat/threat_intel/mappings.json
index 1d40909c5372fc..eda2430daef92c 100644
--- a/x-pack/test/functional/es_archives/filebeat/threat_intel/mappings.json
+++ b/x-pack/test/functional/es_archives/filebeat/threat_intel/mappings.json
@@ -226,10 +226,6 @@
     "settings": {
       "index": {
         "auto_expand_replicas": "0-1",
-        "lifecycle": {
-          "name": "filebeat-8.0.0",
-          "rollover_alias": "filebeat-filebeat-8.0.0"
-        },
         "mapping": {
           "total_fields": {
             "limit": "10000"
diff --git a/x-pack/test/functional/es_archives/packetbeat/default/mappings.json b/x-pack/test/functional/es_archives/packetbeat/default/mappings.json
index 941b278a833907..7b65387c5e6851 100644
--- a/x-pack/test/functional/es_archives/packetbeat/default/mappings.json
+++ b/x-pack/test/functional/es_archives/packetbeat/default/mappings.json
@@ -2849,10 +2849,6 @@
     },
     "settings": {
       "index": {
-        "lifecycle": {
-          "name": "packetbeat-8.0.0",
-          "rollover_alias": "packetbeat-8.0.0"
-        },
         "mapping": {
           "total_fields": {
             "limit": "10000"
@@ -3285,4 +3281,4 @@
       }
     }
   }
-}
\ No newline at end of file
+}
diff --git a/x-pack/test/functional/es_archives/packetbeat/dns/mappings.json b/x-pack/test/functional/es_archives/packetbeat/dns/mappings.json
index 904a4b23c17aa7..d6659138f3e7df 100644
--- a/x-pack/test/functional/es_archives/packetbeat/dns/mappings.json
+++ b/x-pack/test/functional/es_archives/packetbeat/dns/mappings.json
@@ -3092,10 +3092,6 @@
     },
     "settings": {
       "index": {
-        "lifecycle": {
-          "name": "packetbeat-7.0.0",
-          "rollover_alias": "packetbeat-7.0.0"
-        },
         "mapping": {
           "total_fields": {
             "limit": "10000"
@@ -3528,4 +3524,4 @@
       }
     }
   }
-}
\ No newline at end of file
+}
diff --git a/x-pack/test/functional/es_archives/packetbeat/overview/mappings.json b/x-pack/test/functional/es_archives/packetbeat/overview/mappings.json
index 05d77666d30ab8..7b65387c5e6851 100644
--- a/x-pack/test/functional/es_archives/packetbeat/overview/mappings.json
+++ b/x-pack/test/functional/es_archives/packetbeat/overview/mappings.json
@@ -2849,10 +2849,6 @@
     },
     "settings": {
       "index": {
-        "lifecycle": {
-          "name": "packetbeat-8.0.0",
-          "rollover_alias": "packetbeat-8.0.0"
-        },
         "mapping": {
           "total_fields": {
             "limit": "10000"
diff --git a/x-pack/test/functional/es_archives/packetbeat/tls/mappings.json b/x-pack/test/functional/es_archives/packetbeat/tls/mappings.json
index 2b5ed05c7e8a9c..6e5b2b801145e3 100644
--- a/x-pack/test/functional/es_archives/packetbeat/tls/mappings.json
+++ b/x-pack/test/functional/es_archives/packetbeat/tls/mappings.json
@@ -4679,11 +4679,6 @@
     },
     "settings": {
       "index": {
-        "lifecycle": {
-          "indexing_complete": "true",
-          "name": "packetbeat",
-          "rollover_alias": "packetbeat-7.6.0"
-        },
         "mapping": {
           "total_fields": {
             "limit": "10000"
@@ -9052,10 +9047,6 @@
       "index": {
         "auto_expand_replicas": "0-1",
         "codec": "best_compression",
-        "lifecycle": {
-          "name": "packetbeat-8.0.0",
-          "rollover_alias": "packetbeat-8.0.0"
-        },
         "mapping": {
           "total_fields": {
             "limit": "10000"
@@ -9580,4 +9571,4 @@
       }
     }
   }
-}
\ No newline at end of file
+}
diff --git a/x-pack/test/functional/page_objects/security_page.ts b/x-pack/test/functional/page_objects/security_page.ts
index dc5ee34475ae6e..f839bc3e499148 100644
--- a/x-pack/test/functional/page_objects/security_page.ts
+++ b/x-pack/test/functional/page_objects/security_page.ts
@@ -6,7 +6,7 @@
  */
 
 import { adminTestUser } from '@kbn/test';
-import { AuthenticatedUser, Role } from '@kbn/security-plugin/common';
+import { AuthenticatedUser, Role, RoleRemoteClusterPrivilege } from '@kbn/security-plugin/common';
 import type { UserFormValues } from '@kbn/security-plugin/public/management/users/edit_user/user_form';
 import { Key } from 'selenium-webdriver';
 import { FtrService } from '../ftr_provider_context';
@@ -600,9 +600,54 @@ export class SecurityPageObject extends FtrService {
     return confirmText;
   }
 
+  async addRemoteClusterPrivilege(privilege: RoleRemoteClusterPrivilege, index = 0) {
+    this.log.debug('addRemoteClusterPrivilege, index = ', index);
+
+    await this.testSubjects.click('addRemoteClusterPrivilegesButton');
+
+    for (const cluster of privilege.clusters) {
+      await this.comboBox.setCustom(`remoteClusterClustersInput${index}`, cluster);
+    }
+
+    for (const clusterPrivilege of privilege.privileges) {
+      await this.comboBox.setCustom(`remoteClusterPrivilegesInput${index}`, clusterPrivilege);
+    }
+  }
+
+  async saveRole() {
+    this.log.debug('click save button');
+    await this.testSubjects.click('roleFormSaveButton');
+
+    // Signifies that the role management page redirected back to the role grid page,
+    // and successfully refreshed the grid
+    await this.testSubjects.existOrFail('roleRow');
+  }
+
+  async deleteRemoteClusterPrivilege(index: number) {
+    this.log.debug('deleteRemoteClusterPrivilege, index = ', index);
+
+    await this.testSubjects.click(`deleteRemoteClusterPrivilegesButton${index}`);
+  }
+
+  async getRemoteClusterPrivilege(index: number) {
+    this.log.debug('getRemoteClusterPrivilege, index = ', index);
+    const clusterOptions = await this.comboBox.getComboBoxSelectedOptions(
+      `remoteClusterClustersInput${index}`
+    );
+
+    const privilegeOptions = await this.comboBox.getComboBoxSelectedOptions(
+      `remoteClusterPrivilegesInput${index}`
+    );
+
+    return {
+      clusters: clusterOptions,
+      privileges: privilegeOptions,
+    };
+  }
+
   async addRole(
     roleName: string,
-    roleObj: { elasticsearch: Pick<Role['elasticsearch'], 'indices'> }
+    roleObj: { elasticsearch: Pick<Role['elasticsearch'], 'indices' | 'remote_cluster'> }
   ) {
     const self = this;
 
@@ -667,12 +712,18 @@ export class SecurityPageObject extends FtrService {
       await addGrantedField(roleObj.elasticsearch.indices[0].field_security!.grant!);
     }
 
-    this.log.debug('click save button');
-    await this.testSubjects.click('roleFormSaveButton');
+    if (roleObj.elasticsearch.remote_cluster) {
+      this.log.debug('adding remote_cluster privileges');
 
-    // Signifies that the role management page redirected back to the role grid page,
-    // and successfully refreshed the grid
-    await this.testSubjects.existOrFail('roleRow');
+      for (const [
+        index,
+        remoteClusterPrivilege,
+      ] of roleObj.elasticsearch.remote_cluster.entries()) {
+        await this.addRemoteClusterPrivilege(remoteClusterPrivilege, index);
+      }
+    }
+
+    await this.saveRole();
   }
 
   async selectRole(role: string) {
diff --git a/x-pack/test/functional/services/index.ts b/x-pack/test/functional/services/index.ts
index 03ad1ea2361e3d..d7aab70c44cbca 100644
--- a/x-pack/test/functional/services/index.ts
+++ b/x-pack/test/functional/services/index.ts
@@ -69,7 +69,7 @@ import { RulesServiceProvider } from './rules';
 import { AiopsProvider } from './aiops';
 import { SampleDataServiceProvider } from './sample_data';
 import { DataStreamProvider } from './data_stream';
-
+import { SloUiServiceProvider } from './slo';
 // define the name and providers for services that should be
 // available to your tests. If you don't specify anything here
 // only the built-in services will be available
@@ -131,4 +131,7 @@ export const services = {
   aiops: AiopsProvider,
   sampleData: SampleDataServiceProvider,
   dataStreams: DataStreamProvider,
+  slo: kibanaXPackApiIntegrationServices.slo,
+  dataViewApi: kibanaXPackApiIntegrationServices.dataViewApi,
+  sloUi: SloUiServiceProvider,
 };
diff --git a/x-pack/test/functional/services/ml/alerting.ts b/x-pack/test/functional/services/ml/alerting.ts
index 300e009d256fb6..74c6eb735ea34f 100644
--- a/x-pack/test/functional/services/ml/alerting.ts
+++ b/x-pack/test/functional/services/ml/alerting.ts
@@ -121,7 +121,7 @@ export function MachineLearningAlertingProvider(
       });
     },
 
-    async assertLookbackInterval(expectedValue: string) {
+    async assertLookbackInterval(expectedValue: string, expectError = false) {
       await this.ensureAdvancedSectionOpen();
       const actualValue = await testSubjects.getAttribute(
         'mlAnomalyAlertLookbackInterval',
@@ -131,27 +131,47 @@ export function MachineLearningAlertingProvider(
         expectedValue,
         `Expected lookback interval to equal ${expectedValue}, got ${actualValue}`
       );
+
+      if (expectError) {
+        const formRowEl = await testSubjects.find('mlAnomalyAlertAdvancedSettingsLookbackInterval');
+        // Assert error state
+        const labelEl = await formRowEl.findByClassName('euiFormRow__label');
+        expect(await labelEl.elementHasClass('euiFormLabel-isInvalid')).to.be(true);
+
+        // Assert error message
+        const errorEl = await formRowEl.findByClassName('euiFormErrorText');
+        const errorMessage = await errorEl.getVisibleText();
+        expect(errorMessage).to.eql(
+          `${expectedValue} is not a valid time interval format e.g. 30s, 10m, 1h, 7d. It also needs to be higher than zero.`
+        );
+      }
     },
 
-    async assertTopNBuckets(expectedNumberOfBuckets: number) {
+    async assertTopNBuckets(expectedNumberOfBuckets: number, expectError = false) {
       await this.ensureAdvancedSectionOpen();
       const actualValue = await testSubjects.getAttribute('mlAnomalyAlertTopNBuckets', 'value');
       expect(actualValue).to.eql(
         expectedNumberOfBuckets,
         `Expected number of buckets to equal ${expectedNumberOfBuckets}, got ${actualValue}`
       );
+      if (expectError) {
+        const formRowEl = await testSubjects.find('mlAnomalyAlertTopNBucketsFormRow');
+        // Assert error state
+        const labelEl = await formRowEl.findByClassName('euiFormRow__label');
+        expect(await labelEl.elementHasClass('euiFormLabel-isInvalid')).to.be(true);
+      }
     },
 
-    async setLookbackInterval(interval: string) {
+    async setLookbackInterval(interval: string, isInvalid = false) {
       await this.ensureAdvancedSectionOpen();
       await testSubjects.setValue('mlAnomalyAlertLookbackInterval', interval);
-      await this.assertLookbackInterval(interval);
+      await this.assertLookbackInterval(interval, isInvalid);
     },
 
-    async setTopNBuckets(numberOfBuckets: number) {
+    async setTopNBuckets(numberOfBuckets: number, isInvalid = false) {
       await this.ensureAdvancedSectionOpen();
       await testSubjects.setValue('mlAnomalyAlertTopNBuckets', numberOfBuckets.toString());
-      await this.assertTopNBuckets(numberOfBuckets);
+      await this.assertTopNBuckets(numberOfBuckets, isInvalid);
     },
 
     async isAdvancedSectionOpened() {
diff --git a/x-pack/test/functional/services/ml/data_visualizer.ts b/x-pack/test/functional/services/ml/data_visualizer.ts
index 39a1450aea3200..33d4e2f8f68ba0 100644
--- a/x-pack/test/functional/services/ml/data_visualizer.ts
+++ b/x-pack/test/functional/services/ml/data_visualizer.ts
@@ -72,14 +72,14 @@ export function MachineLearningDataVisualizerProvider({ getService }: FtrProvide
       await testSubjects.existOrFail('dataVisualizerPageFileUpload');
     },
 
-    async setESQLQuery(
-      query: string,
-      refreshOrUpdateBtnSelector:
-        | 'superDatePickerApplyTimeButton'
-        | 'mlDatePickerRefreshPageButton loaded' = 'mlDatePickerRefreshPageButton loaded'
-    ) {
+    async setESQLQuery(query: string) {
       await retry.tryForTime(5000, async () => {
-        await testSubjects.existOrFail(refreshOrUpdateBtnSelector);
+        const superDatePickerApplyTimeButton = await testSubjects.exists(
+          'superDatePickerApplyTimeButton'
+        );
+        const refreshOrUpdateBtnSelector = superDatePickerApplyTimeButton
+          ? 'superDatePickerApplyTimeButton'
+          : 'mlDatePickerRefreshPageButton loaded';
         const visibleText = await testSubjects.getVisibleText(refreshOrUpdateBtnSelector);
 
         expect(visibleText).to.eql('Refresh');
diff --git a/x-pack/test/functional/services/ml/job_wizard_geo.ts b/x-pack/test/functional/services/ml/job_wizard_geo.ts
index 39202125669323..be2848985a6a26 100644
--- a/x-pack/test/functional/services/ml/job_wizard_geo.ts
+++ b/x-pack/test/functional/services/ml/job_wizard_geo.ts
@@ -46,7 +46,7 @@ export function MachineLearningJobWizardGeoProvider({ getService }: FtrProviderC
       );
 
       await testSubjects.existOrFail('mlGeoJobWizardMap');
-      await testSubjects.existOrFail('mlEmbeddedMapContent');
+      await testSubjects.existOrFail('mapContainer');
     },
   };
 }
diff --git a/x-pack/test/functional/services/slo/common.ts b/x-pack/test/functional/services/slo/common.ts
new file mode 100644
index 00000000000000..b46284c915c3a3
--- /dev/null
+++ b/x-pack/test/functional/services/slo/common.ts
@@ -0,0 +1,138 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import expect from '@kbn/expect';
+import { FtrProviderContext } from '../../ftr_provider_context';
+import { sloData } from '../../../api_integration/apis/slos/fixtures/create_slo';
+
+const OVERVIEW_MODE_SELECTOR = 'sloOverviewModeSelector';
+const SLO_CONFIRM_BUTTON = 'sloConfirmButton';
+const SINGLE_SLO_SELECTOR = 'singleSloSelector';
+const SLO_SINGLE_OVERVIEW_CONFIGURATION = 'sloSingleOverviewConfiguration';
+const SLO_GROUP_OVERVIEW_CONFIGURATION = 'sloGroupOverviewConfiguration';
+const SLO_GROUP_OVERVIEW_CONFIGURATION_GROUP_BY = 'sloGroupOverviewConfigurationGroupBy';
+const SLO_GROUP_OVERVIEW_CONFIGURATION_GROUP = 'sloGroupOverviewConfigurationGroup';
+const SLO_GROUP_OVERVIEW_CONFIGURATION_KQLBAR = 'sloGroupOverviewConfigurationKqlBar';
+const SLO_SINGLE_OVERVIEW_PANEL = 'sloSingleOverviewPanel';
+const SLO_GROUP_OVERVIEW_PANEL = 'sloGroupOverviewPanel';
+
+export function SloUiCommonServiceProvider({ getService }: FtrProviderContext) {
+  const testSubjects = getService('testSubjects');
+  const comboBox = getService('comboBox');
+  const find = getService('find');
+  const toasts = getService('toasts');
+  const retry = getService('retry');
+
+  return {
+    async assertSloOverviewConfigurationExists() {
+      await retry.tryForTime(60 * 1000, async () => {
+        await testSubjects.existOrFail(SLO_SINGLE_OVERVIEW_CONFIGURATION);
+      });
+    },
+    async assertOverviewSloSelectorExists() {
+      await retry.tryForTime(60 * 1000, async () => {
+        await testSubjects.existOrFail(SINGLE_SLO_SELECTOR);
+      });
+    },
+    async setComboBoxSloSelection() {
+      await retry.tryForTime(60 * 1000, async () => {
+        await testSubjects.click('sloSelector');
+        await comboBox.set('sloSelector > comboBoxInput', sloData.name);
+      });
+    },
+    async assertOverviewConfigurationSaveButtonIsEnabled(subj: string) {
+      await retry.tryForTime(60 * 1000, async () => {
+        await testSubjects.existOrFail(subj);
+        await testSubjects.isEnabled(subj);
+      });
+    },
+    async clickOverviewCofigurationSaveButton() {
+      await retry.tryForTime(60 * 1000, async () => {
+        await this.assertOverviewConfigurationSaveButtonIsEnabled(SLO_CONFIRM_BUTTON);
+        await testSubjects.clickWhenNotDisabledWithoutRetry(SLO_CONFIRM_BUTTON);
+      });
+    },
+
+    async assertOverviewModeSelectorExists() {
+      await retry.tryForTime(60 * 1000, async () => {
+        await testSubjects.existOrFail(OVERVIEW_MODE_SELECTOR);
+      });
+    },
+
+    async clickOverviewMode() {
+      await retry.tryForTime(60 * 1000, async () => {
+        await this.assertOverviewModeSelectorExists();
+        await testSubjects.click(OVERVIEW_MODE_SELECTOR);
+      });
+    },
+
+    async assertSloConfigurationGroupOverviewModeIsSelected() {
+      await retry.tryForTime(60 * 1000, async () => {
+        await testSubjects.existOrFail(SLO_GROUP_OVERVIEW_CONFIGURATION);
+      });
+    },
+
+    async assertGroupOverviewConfigurationGroupByExists() {
+      await retry.tryForTime(60 * 1000, async () => {
+        await testSubjects.existOrFail(SLO_GROUP_OVERVIEW_CONFIGURATION_GROUP_BY);
+      });
+    },
+
+    async assertGroupOverviewConfigurationGroupExists() {
+      await retry.tryForTime(60 * 1000, async () => {
+        await testSubjects.existOrFail(SLO_GROUP_OVERVIEW_CONFIGURATION_GROUP);
+      });
+    },
+
+    async assertGroupOverviewConfigurationKqlBarExists() {
+      await retry.tryForTime(60 * 1000, async () => {
+        await testSubjects.existOrFail(SLO_GROUP_OVERVIEW_CONFIGURATION_KQLBAR);
+      });
+    },
+
+    async dismissAllToasts() {
+      await retry.tryForTime(60 * 1000, async () => {
+        await toasts.dismissAll();
+      });
+    },
+
+    async assertSingleOverviewPanelExists() {
+      await retry.tryForTime(60 * 1000, async () => {
+        await testSubjects.existOrFail(SLO_SINGLE_OVERVIEW_PANEL);
+      });
+    },
+
+    async getSloCardTitle() {
+      const container = await testSubjects.find(SLO_SINGLE_OVERVIEW_PANEL);
+      return await (await container.findByClassName('echMetricText__title')).getVisibleText();
+    },
+
+    async assertSingleOverviewPanelContentExists() {
+      await retry.tryForTime(2000, async () => {
+        expect(
+          await find.existsByCssSelector(
+            `[data-test-subj="${SLO_SINGLE_OVERVIEW_PANEL}"] .echChart`
+          )
+        ).to.eql(true);
+
+        expect(
+          await find.existsByCssSelector(
+            `[data-test-subj="${SLO_SINGLE_OVERVIEW_PANEL}"] .echMetricText__title`
+          )
+        ).to.eql(true);
+
+        expect(await this.getSloCardTitle()).to.eql(sloData.name);
+      });
+    },
+
+    async assertGroupOverviewPanelExists() {
+      await retry.tryForTime(60 * 1000, async () => {
+        await testSubjects.existOrFail(SLO_GROUP_OVERVIEW_PANEL);
+      });
+    },
+  };
+}
diff --git a/x-pack/test/functional/services/slo/index.ts b/x-pack/test/functional/services/slo/index.ts
new file mode 100644
index 00000000000000..75339f41dfe3a1
--- /dev/null
+++ b/x-pack/test/functional/services/slo/index.ts
@@ -0,0 +1,15 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { FtrProviderContext } from '../../ftr_provider_context';
+import { SloUiCommonServiceProvider } from './common';
+
+export function SloUiServiceProvider(context: FtrProviderContext) {
+  return {
+    common: SloUiCommonServiceProvider(context),
+  };
+}
diff --git a/x-pack/test/functional_with_es_ssl/apps/discover_ml_uptime/ml/alert_flyout.ts b/x-pack/test/functional_with_es_ssl/apps/discover_ml_uptime/ml/alert_flyout.ts
index 037e33267dfdb5..58c72ef9d1a27e 100644
--- a/x-pack/test/functional_with_es_ssl/apps/discover_ml_uptime/ml/alert_flyout.ts
+++ b/x-pack/test/functional_with_es_ssl/apps/discover_ml_uptime/ml/alert_flyout.ts
@@ -114,6 +114,14 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
         await ml.alerting.assertTopNBuckets(1);
         await ml.alerting.assertLookbackInterval('123m');
 
+        await ml.testExecution.logTestStep(
+          'should support updating the advanced settings section with valid values only'
+        );
+        await ml.alerting.setTopNBuckets(0, true);
+        await ml.alerting.setTopNBuckets(2);
+        await ml.alerting.setLookbackInterval('invalid_value', true);
+        await ml.alerting.setLookbackInterval('2h');
+
         await ml.testExecution.logTestStep('should preview the alert condition');
         await ml.alerting.assertPreviewButtonState(false);
         await ml.alerting.setTestInterval('5y');
diff --git a/x-pack/test/observability_onboarding_api_integration/tests/logs/environment.spec.ts b/x-pack/test/observability_onboarding_api_integration/tests/logs/environment.spec.ts
index 95626901d452a0..41a14061b40599 100644
--- a/x-pack/test/observability_onboarding_api_integration/tests/logs/environment.spec.ts
+++ b/x-pack/test/observability_onboarding_api_integration/tests/logs/environment.spec.ts
@@ -27,8 +27,10 @@ export default function ApiTest({ getService }: FtrProviderContext) {
       expect(request.body.apiEndpoint).to.be(
         `${MOCKED_PUBLIC_BASE_URL}/internal/observability_onboarding`
       );
-      expect(request.body.scriptDownloadUrl).to.be(
-        `${MOCKED_PUBLIC_BASE_URL}/plugins/observabilityOnboarding/assets/standalone_agent_setup.sh`
+      expect(request.body.scriptDownloadUrl).to.match(
+        new RegExp(
+          `${MOCKED_PUBLIC_BASE_URL}/.+?/plugins/observabilityOnboarding/assets/standalone_agent_setup.sh`
+        )
       );
     });
   });
@@ -41,8 +43,10 @@ export default function ApiTest({ getService }: FtrProviderContext) {
       expect(request.body.apiEndpoint).to.be(
         `${MOCKED_KIBANA_URL}/internal/observability_onboarding`
       );
-      expect(request.body.scriptDownloadUrl).to.be(
-        `${MOCKED_KIBANA_URL}/plugins/observabilityOnboarding/assets/standalone_agent_setup.sh`
+      expect(request.body.scriptDownloadUrl).to.match(
+        new RegExp(
+          `${MOCKED_KIBANA_URL}/.+?/plugins/observabilityOnboarding/assets/standalone_agent_setup.sh`
+        )
       );
     });
   });
diff --git a/x-pack/test/plugin_functional/test_suites/global_search/global_search_providers.ts b/x-pack/test/plugin_functional/test_suites/global_search/global_search_providers.ts
index daf1821ef5c054..684633d4aac13f 100644
--- a/x-pack/test/plugin_functional/test_suites/global_search/global_search_providers.ts
+++ b/x-pack/test/plugin_functional/test_suites/global_search/global_search_providers.ts
@@ -87,7 +87,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
     describe('Applications provider', function () {
       it('can search for root-level applications', async () => {
         const results = await findResultsWithApi('discover');
-        expect(results.length).to.be(1);
+        expect(results.length).to.be(2);
         expect(results[0].title).to.be('Discover');
       });
 
diff --git a/x-pack/test/reporting_api_integration/reporting_and_security/generate_csv_discover.ts b/x-pack/test/reporting_api_integration/reporting_and_security/generate_csv_discover.ts
index 2313a9f1ed7d64..b93bd8d5560ebb 100644
--- a/x-pack/test/reporting_api_integration/reporting_and_security/generate_csv_discover.ts
+++ b/x-pack/test/reporting_api_integration/reporting_and_security/generate_csv_discover.ts
@@ -84,6 +84,7 @@ export default function ({ getService }: FtrProviderContext) {
       });
 
       after(async () => {
+        await reportingAPI.deleteAllReports();
         await esArchiver.unload(archives.ecommerce.data);
         await kibanaServer.importExport.unload(archives.ecommerce.savedObjects);
       });
@@ -684,6 +685,7 @@ export default function ({ getService }: FtrProviderContext) {
       });
 
       after(async () => {
+        await reportingAPI.deleteAllReports();
         await esArchiver.unload(archives.ecommerce.data);
         await kibanaServer.importExport.unload(archives.ecommerce.savedObjects);
       });
diff --git a/x-pack/test/security_solution_api_integration/config/ess/services.ts b/x-pack/test/security_solution_api_integration/config/ess/services.ts
new file mode 100644
index 00000000000000..d6a3c415f29df1
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/config/ess/services.ts
@@ -0,0 +1,14 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { SpacesServiceProvider } from '../../../common/services/spaces';
+import { services as essServices } from '../../../api_integration/services';
+
+export const services = {
+  ...essServices,
+  spaces: SpacesServiceProvider,
+};
diff --git a/x-pack/test/security_solution_api_integration/config/serverless/config.base.ts b/x-pack/test/security_solution_api_integration/config/serverless/config.base.ts
index 026f8cad10395d..a44c88d1bdcc35 100644
--- a/x-pack/test/security_solution_api_integration/config/serverless/config.base.ts
+++ b/x-pack/test/security_solution_api_integration/config/serverless/config.base.ts
@@ -5,14 +5,15 @@
  * 2.0.
  */
 import { FtrConfigProviderContext } from '@kbn/test';
+import { services } from './services';
+import { PRECONFIGURED_ACTION_CONNECTORS } from '../shared';
+
 export interface CreateTestConfigOptions {
   testFiles: string[];
   junit: { reportName: string };
   kbnTestServerArgs?: string[];
   kbnTestServerEnv?: Record<string, string>;
 }
-import { services } from '../../../../test_serverless/api_integration/services';
-import { PRECONFIGURED_ACTION_CONNECTORS } from '../shared';
 
 export function createTestConfig(options: CreateTestConfigOptions) {
   return async ({ readConfigFile }: FtrConfigProviderContext) => {
diff --git a/x-pack/test/security_solution_api_integration/config/serverless/services.ts b/x-pack/test/security_solution_api_integration/config/serverless/services.ts
new file mode 100644
index 00000000000000..c033d11d1d2a4f
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/config/serverless/services.ts
@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { SpacesServiceProvider } from '../../../common/services/spaces';
+import { BsearchSecureService } from '../../../../test_serverless/shared/services/bsearch_secure';
+import { services as serverlessServices } from '../../../../test_serverless/api_integration/services';
+
+export const services = {
+  ...serverlessServices,
+  spaces: SpacesServiceProvider,
+  secureBsearch: BsearchSecureService,
+};
diff --git a/x-pack/test/security_solution_api_integration/ftr_provider_context.d.ts b/x-pack/test/security_solution_api_integration/ftr_provider_context.d.ts
index 3a44ea9db01fec..b06c5cebe7e1c5 100644
--- a/x-pack/test/security_solution_api_integration/ftr_provider_context.d.ts
+++ b/x-pack/test/security_solution_api_integration/ftr_provider_context.d.ts
@@ -6,6 +6,6 @@
  */
 import { GenericFtrProviderContext } from '@kbn/test';
 
-import { services } from '../../test_serverless/api_integration/services';
+import { services } from './config/serverless/services';
 
 export type FtrProviderContext = GenericFtrProviderContext<typeof services, {}>;
diff --git a/x-pack/test/security_solution_api_integration/ftr_provider_context_with_spaces.d.ts b/x-pack/test/security_solution_api_integration/ftr_provider_context_with_spaces.d.ts
index f6f4e00f0b4a3f..b38f47a3c6956e 100644
--- a/x-pack/test/security_solution_api_integration/ftr_provider_context_with_spaces.d.ts
+++ b/x-pack/test/security_solution_api_integration/ftr_provider_context_with_spaces.d.ts
@@ -5,12 +5,6 @@
  * 2.0.
  */
 import { GenericFtrProviderContext } from '@kbn/test';
+import { services } from './config/ess/services';
 
-import { SpacesServiceProvider } from '../common/services/spaces';
-import { services as serverlessServices } from '../../test_serverless/api_integration/services';
-
-const services = {
-  ...serverlessServices,
-  spaces: SpacesServiceProvider,
-};
 export type FtrProviderContextWithSpaces = GenericFtrProviderContext<typeof services, {}>;
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/alerts/basic_license_essentials_tier/alert_status/alert_status.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/alerts/basic_license_essentials_tier/alert_status/alert_status.ts
index 17e4590bc0023b..0f9f863161e35d 100644
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/alerts/basic_license_essentials_tier/alert_status/alert_status.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/alerts/basic_license_essentials_tier/alert_status/alert_status.ts
@@ -43,9 +43,9 @@ export default ({ getService }: FtrProviderContext) => {
   const dataPathBuilder = new EsArchivePathBuilder(isServerless);
   const path = dataPathBuilder.getPath('auditbeat/hosts');
 
-  // Failing: See https://github.com/elastic/kibana/issues/179704
-  describe.skip('@ess @serverless change alert status endpoints', () => {
-    describe('validation checks', () => {
+  describe('@ess @serverless change alert status endpoints', () => {
+    // Flakey: See https://github.com/elastic/kibana/issues/179704
+    describe.skip('validation checks', () => {
       describe('update by ids', () => {
         it('should not give errors when querying and the alerts index does not exist yet', async () => {
           const { body } = await supertest
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/alerts/basic_license_essentials_tier/set_alert_tags.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/alerts/basic_license_essentials_tier/set_alert_tags.ts
index 25ed0c62d0d58a..e0b09a111ae0ce 100644
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/alerts/basic_license_essentials_tier/set_alert_tags.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/alerts/basic_license_essentials_tier/set_alert_tags.ts
@@ -40,7 +40,7 @@ export default ({ getService }: FtrProviderContext) => {
   const dataPathBuilder = new EsArchivePathBuilder(isServerless);
   const path = dataPathBuilder.getPath('auditbeat/hosts');
 
-  describe('@ess @serverless set_alert_tags', () => {
+  describe('@ess @serverless @serverlessQA set_alert_tags', () => {
     describe('validation checks', () => {
       it('should give errors when no alert ids are provided', async () => {
         const { body } = await supertest
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/alerts/trial_license_complete_tier/assignments/assignments.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/alerts/trial_license_complete_tier/assignments/assignments.ts
index 4e4ecb21ca1578..0a2e64df60534e 100644
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/alerts/trial_license_complete_tier/assignments/assignments.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/alerts/trial_license_complete_tier/assignments/assignments.ts
@@ -39,7 +39,7 @@ export default ({ getService }: FtrProviderContext) => {
   const dataPathBuilder = new EsArchivePathBuilder(isServerless);
   const path = dataPathBuilder.getPath('auditbeat/hosts');
 
-  describe('@ess @serverless Alert User Assignment - ESS & Serverless', () => {
+  describe('@ess @serverless @serverlessQA Alert User Assignment - ESS & Serverless', () => {
     describe('validation checks', () => {
       it('should give errors when no alert ids are provided', async () => {
         const { body } = await supertest
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/alerts/trial_license_complete_tier/assignments/assignments_serverless.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/alerts/trial_license_complete_tier/assignments/assignments_serverless.ts
index 7064f27cfd3bd6..7282f0f7f7dcc0 100644
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/alerts/trial_license_complete_tier/assignments/assignments_serverless.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/alerts/trial_license_complete_tier/assignments/assignments_serverless.ts
@@ -33,7 +33,9 @@ export default ({ getService }: FtrProviderContext) => {
   const dataPathBuilder = new EsArchivePathBuilder(isServerless);
   const path = dataPathBuilder.getPath('auditbeat/hosts');
 
-  describe('@serverless Alert User Assignment - Serverless', () => {
+  // See https://github.com/elastic/kibana/issues/182878 for
+  // background on @skipInSrverlessMKI - action needed
+  describe('@serverless @skipInServerlessMKI Alert User Assignment - Serverless', () => {
     before(async () => {
       await esArchiver.load(path);
     });
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/alerts/trial_license_complete_tier/document_level_security.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/alerts/trial_license_complete_tier/document_level_security.ts
index 5c2f0333c4a0e2..2c8c0c2a599c4f 100644
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/alerts/trial_license_complete_tier/document_level_security.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/alerts/trial_license_complete_tier/document_level_security.ts
@@ -73,8 +73,9 @@ export default ({ getService }: FtrProviderContext) => {
   const supertestWithoutAuth = getService('supertestWithoutAuth');
   const esArchiver = getService('esArchiver');
   const security = getService('security');
-
-  describe('@ess @serverless @skipInServerless find alert with/without doc level security', () => {
+  // Notes: Similar tests should be added for serverless once infrastructure
+  // is in place to test roles in MKI enviornment.
+  describe('@ess @skipInServerless find alert with/without doc level security', () => {
     before(async () => {
       await security.role.create(
         roleToAccessSecuritySolution.name,
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/exceptions/workflows/basic_license_essentials_tier/exception_comments_serverless.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/exceptions/workflows/basic_license_essentials_tier/exception_comments_serverless.ts
index 9fd4433e01f383..cda1ed3ca1517b 100644
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/exceptions/workflows/basic_license_essentials_tier/exception_comments_serverless.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/exceptions/workflows/basic_license_essentials_tier/exception_comments_serverless.ts
@@ -26,7 +26,8 @@ export default ({ getService }: FtrProviderContext) => {
   const log = getService('log');
   const supertestWithoutAuth = getService('supertestWithoutAuth');
 
-  describe('@serverless exception item comments - serverless specific behavior', () => {
+  // Skipping in MKI due to roles testing not yet being available
+  describe('@serverless @skipInServerlessMKI exception item comments - serverless specific behavior', () => {
     // FLAKY: https://github.com/elastic/kibana/issues/181507
     describe.skip('Rule Exceptions', () => {
       afterEach(async () => {
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/exceptions/workflows/basic_license_essentials_tier/prebuilt_rules.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/exceptions/workflows/basic_license_essentials_tier/prebuilt_rules.ts
index 7ce1ec3bd5a3f6..5ed8d5d66c5dc7 100644
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/exceptions/workflows/basic_license_essentials_tier/prebuilt_rules.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/exceptions/workflows/basic_license_essentials_tier/prebuilt_rules.ts
@@ -37,7 +37,9 @@ export default ({ getService }: FtrProviderContext) => {
   const log = getService('log');
   const es = getService('es');
 
-  describe('@serverless @ess exceptions workflows for prebuilt rules', () => {
+  // See https://github.com/elastic/kibana/issues/182889 for details
+  // on skipping in MKI
+  describe('@serverless @ess @skipInServerlessMKI exceptions workflows for prebuilt rules', () => {
     describe('creating rules with exceptions', () => {
       beforeEach(async () => {
         await createAlertsIndex(supertest, log);
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/exceptions/workflows/basic_license_essentials_tier/rule_exceptions_execution.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/exceptions/workflows/basic_license_essentials_tier/rule_exceptions_execution.ts
index 550bb16d1dfe86..126e76c8df7c12 100644
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/exceptions/workflows/basic_license_essentials_tier/rule_exceptions_execution.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/exceptions/workflows/basic_license_essentials_tier/rule_exceptions_execution.ts
@@ -67,7 +67,8 @@ export default ({ getService }: FtrProviderContext) => {
       await esArchiver.unload(path);
     });
 
-    describe('creating rules with exceptions', () => {
+    // FLAKY: https://github.com/elastic/kibana/issues/181887
+    describe.skip('creating rules with exceptions', () => {
       beforeEach(async () => {
         await createAlertsIndex(supertest, log);
       });
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_bulk_actions/trial_license_complete_tier/perform_bulk_action_ess.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_bulk_actions/trial_license_complete_tier/perform_bulk_action_ess.ts
index 7295ebe9b769d6..846fd9f7d42049 100644
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_bulk_actions/trial_license_complete_tier/perform_bulk_action_ess.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_bulk_actions/trial_license_complete_tier/perform_bulk_action_ess.ts
@@ -46,8 +46,7 @@ export default ({ getService }: FtrProviderContext): void => {
   const createWebHookConnector = () => createConnector(getWebHookAction());
 
   // Failing: See https://github.com/elastic/kibana/issues/173804
-  // Failing: See https://github.com/elastic/kibana/issues/182512
-  describe.skip('@ess perform_bulk_action - ESS specific logic', () => {
+  describe('@ess perform_bulk_action - ESS specific logic', () => {
     beforeEach(async () => {
       await deleteAllRules(supertest, log);
     });
@@ -107,7 +106,7 @@ export default ({ getService }: FtrProviderContext): void => {
               webhookUrl: 'http://localhost:1234',
             },
           }),
-        createRule(supertest, log, getSimpleRule(ruleId, false)),
+        createRule(supertest, log, { ...getSimpleRule(ruleId, false), index: ['*'] }),
       ]);
       await createLegacyRuleAction(supertest, rule1.id, connector.body.id);
 
diff --git a/x-pack/test/security_solution_api_integration/test_suites/entity_analytics/risk_engine/trial_license_complete_tier/risk_scoring_task/task_execution_nondefault_spaces.ts b/x-pack/test/security_solution_api_integration/test_suites/entity_analytics/risk_engine/trial_license_complete_tier/risk_scoring_task/task_execution_nondefault_spaces.ts
index f61e64ba89bbf0..c88fab3a897a7a 100644
--- a/x-pack/test/security_solution_api_integration/test_suites/entity_analytics/risk_engine/trial_license_complete_tier/risk_scoring_task/task_execution_nondefault_spaces.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/entity_analytics/risk_engine/trial_license_complete_tier/risk_scoring_task/task_execution_nondefault_spaces.ts
@@ -20,7 +20,7 @@ import {
   deleteRiskScoreIndices,
 } from '../../../utils';
 
-import { FtrProviderContextWithSpaces } from '../../../../../ftr_provider_context_with_spaces';
+import type { FtrProviderContextWithSpaces } from '../../../../../ftr_provider_context_with_spaces';
 
 export default ({ getService }: FtrProviderContextWithSpaces): void => {
   const supertest = getService('supertest');
diff --git a/x-pack/test/security_solution_api_integration/test_suites/explore/hosts/trial_license_complete_tier/configs/ess.config.ts b/x-pack/test/security_solution_api_integration/test_suites/explore/hosts/trial_license_complete_tier/configs/ess.config.ts
new file mode 100644
index 00000000000000..fffc126c3692c4
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/explore/hosts/trial_license_complete_tier/configs/ess.config.ts
@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { FtrConfigProviderContext } from '@kbn/test';
+
+export default async function ({ readConfigFile }: FtrConfigProviderContext) {
+  const functionalConfig = await readConfigFile(
+    require.resolve('../../../../../config/ess/config.base.trial')
+  );
+
+  return {
+    ...functionalConfig.getAll(),
+    testFiles: [require.resolve('../ess')],
+    junit: {
+      reportName: 'Explore - Hosts Integration Tests - ESS Env - Trial License',
+    },
+  };
+}
diff --git a/x-pack/test/security_solution_api_integration/test_suites/explore/hosts/trial_license_complete_tier/configs/serverless.config.ts b/x-pack/test/security_solution_api_integration/test_suites/explore/hosts/trial_license_complete_tier/configs/serverless.config.ts
new file mode 100644
index 00000000000000..da6d987c970d14
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/explore/hosts/trial_license_complete_tier/configs/serverless.config.ts
@@ -0,0 +1,23 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { createTestConfig } from '../../../../../config/serverless/config.base';
+
+export default createTestConfig({
+  kbnTestServerArgs: [
+    `--xpack.securitySolution.enableExperimental=${JSON.stringify([])}`,
+    `--xpack.securitySolutionServerless.productTypes=${JSON.stringify([
+      { product_line: 'security', product_tier: 'complete' },
+      { product_line: 'endpoint', product_tier: 'complete' },
+      { product_line: 'cloud', product_tier: 'complete' },
+    ])}`,
+  ],
+  testFiles: [require.resolve('../serverless')],
+  junit: {
+    reportName: 'Explore - Hosts Integration Tests - Serverless Env - Complete Tier',
+  },
+});
diff --git a/x-pack/test/security_solution_api_integration/test_suites/explore/hosts/trial_license_complete_tier/ess/host_details.ts b/x-pack/test/security_solution_api_integration/test_suites/explore/hosts/trial_license_complete_tier/ess/host_details.ts
new file mode 100644
index 00000000000000..d02e686be56d0f
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/explore/hosts/trial_license_complete_tier/ess/host_details.ts
@@ -0,0 +1,53 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import expect from '@kbn/expect';
+import {
+  HostDetailsStrategyResponse,
+  HostsQueries,
+} from '@kbn/security-solution-plugin/common/search_strategy';
+import { FtrProviderContextWithSpaces } from '../../../../../ftr_provider_context_with_spaces';
+import { hostDetailsFilebeatExpectedResult } from '../mocks/host_details';
+
+export default function ({ getService }: FtrProviderContextWithSpaces) {
+  const esArchiver = getService('esArchiver');
+  const bsearch = getService('bsearch');
+  const supertest = getService('supertest');
+
+  describe('Host Details', () => {
+    describe('With filebeat', () => {
+      before(
+        async () => await esArchiver.load('x-pack/test/functional/es_archives/filebeat/default')
+      );
+      after(
+        async () => await esArchiver.unload('x-pack/test/functional/es_archives/filebeat/default')
+      );
+
+      const FROM = '2000-01-01T00:00:00.000Z';
+      const TO = '3000-01-01T00:00:00.000Z';
+
+      it('Make sure that we get HostDetails data', async () => {
+        const { hostDetails } = await bsearch.send<HostDetailsStrategyResponse>({
+          supertest,
+          options: {
+            factoryQueryType: HostsQueries.details,
+            timerange: {
+              interval: '12h',
+              to: TO,
+              from: FROM,
+            },
+            defaultIndex: ['filebeat-*'],
+            hostName: 'raspberrypi',
+            inspect: false,
+          },
+          strategy: 'securitySolutionSearchStrategy',
+        });
+        expect(hostDetails).to.eql(hostDetailsFilebeatExpectedResult.hostDetails);
+      });
+    });
+  });
+}
diff --git a/x-pack/test/api_integration/apis/security_solution/hosts.ts b/x-pack/test/security_solution_api_integration/test_suites/explore/hosts/trial_license_complete_tier/ess/hosts.ts
similarity index 96%
rename from x-pack/test/api_integration/apis/security_solution/hosts.ts
rename to x-pack/test/security_solution_api_integration/test_suites/explore/hosts/trial_license_complete_tier/ess/hosts.ts
index a55a019588abd1..ed4de3ad0546ad 100644
--- a/x-pack/test/api_integration/apis/security_solution/hosts.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/explore/hosts/trial_license_complete_tier/ess/hosts.ts
@@ -16,7 +16,7 @@ import {
   FirstLastSeenStrategyResponse,
 } from '@kbn/security-solution-plugin/common/search_strategy';
 
-import { FtrProviderContext } from '../../ftr_provider_context';
+import { FtrProviderContextWithSpaces } from '../../../../../ftr_provider_context_with_spaces';
 
 const FROM = '2000-01-01T00:00:00.000Z';
 const TO = '3000-01-01T00:00:00.000Z';
@@ -27,7 +27,7 @@ const TOTAL_COUNT = 7;
 const EDGE_LENGTH = 1;
 const CURSOR_ID = '2ab45fc1c41e4c84bbd02202a7e5761f';
 
-export default function ({ getService }: FtrProviderContext) {
+export default function ({ getService }: FtrProviderContextWithSpaces) {
   const esArchiver = getService('esArchiver');
   const supertest = getService('supertest');
   const bsearch = getService('bsearch');
diff --git a/x-pack/test/security_solution_api_integration/test_suites/explore/hosts/trial_license_complete_tier/ess/index.ts b/x-pack/test/security_solution_api_integration/test_suites/explore/hosts/trial_license_complete_tier/ess/index.ts
new file mode 100644
index 00000000000000..e77610753708f1
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/explore/hosts/trial_license_complete_tier/ess/index.ts
@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { FtrProviderContextWithSpaces } from '../../../../../ftr_provider_context_with_spaces';
+
+export default function ({ loadTestFile }: FtrProviderContextWithSpaces) {
+  describe('@ess SecuritySolution Explore Hosts', () => {
+    loadTestFile(require.resolve('./hosts'));
+    loadTestFile(require.resolve('./host_details'));
+    loadTestFile(require.resolve('./uncommon_processes'));
+  });
+}
diff --git a/x-pack/test/api_integration/apis/security_solution/uncommon_processes.ts b/x-pack/test/security_solution_api_integration/test_suites/explore/hosts/trial_license_complete_tier/ess/uncommon_processes.ts
similarity index 89%
rename from x-pack/test/api_integration/apis/security_solution/uncommon_processes.ts
rename to x-pack/test/security_solution_api_integration/test_suites/explore/hosts/trial_license_complete_tier/ess/uncommon_processes.ts
index eaacd6edf7e054..f6e675889c07cc 100644
--- a/x-pack/test/api_integration/apis/security_solution/uncommon_processes.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/explore/hosts/trial_license_complete_tier/ess/uncommon_processes.ts
@@ -11,7 +11,7 @@ import {
   HostsQueries,
   HostsUncommonProcessesStrategyResponse,
 } from '@kbn/security-solution-plugin/common/search_strategy';
-import { FtrProviderContext } from '../../ftr_provider_context';
+import { FtrProviderContextWithSpaces } from '../../../../../ftr_provider_context_with_spaces';
 
 const FROM = '2000-01-01T00:00:00.000Z';
 const TO = '3000-01-01T00:00:00.000Z';
@@ -19,20 +19,18 @@ const TO = '3000-01-01T00:00:00.000Z';
 // typical values that have to change after an update from "scripts/es_archiver"
 const TOTAL_COUNT = 3;
 
-export default function ({ getService }: FtrProviderContext) {
+export default function ({ getService }: FtrProviderContextWithSpaces) {
   const esArchiver = getService('esArchiver');
-  const supertest = getService('supertest');
   const bsearch = getService('bsearch');
+  const supertest = getService('supertest');
 
-  describe('uncommon_processes', () => {
-    before(
-      async () =>
-        await esArchiver.load('x-pack/test/functional/es_archives/auditbeat/uncommon_processes')
-    );
-    after(
-      async () =>
-        await esArchiver.unload('x-pack/test/functional/es_archives/auditbeat/uncommon_processes')
-    );
+  describe('hosts', () => {
+    before(async () => {
+      await esArchiver.load('x-pack/test/functional/es_archives/auditbeat/uncommon_processes');
+    });
+    after(async () => {
+      await esArchiver.unload('x-pack/test/functional/es_archives/auditbeat/uncommon_processes');
+    });
 
     it('should return an edge of length 1 when given a pagination of length 1', async () => {
       const response = await bsearch.send<HostsUncommonProcessesStrategyResponse>({
@@ -56,6 +54,7 @@ export default function ({ getService }: FtrProviderContext) {
         },
         strategy: 'securitySolutionSearchStrategy',
       });
+
       expect(response.edges.length).to.be(1);
     });
 
diff --git a/x-pack/test/security_solution_api_integration/test_suites/explore/hosts/trial_license_complete_tier/mocks/host_details.ts b/x-pack/test/security_solution_api_integration/test_suites/explore/hosts/trial_license_complete_tier/mocks/host_details.ts
new file mode 100644
index 00000000000000..9af4a9129f84f4
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/explore/hosts/trial_license_complete_tier/mocks/host_details.ts
@@ -0,0 +1,187 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export const hostDetailsFilebeatExpectedResult = {
+  isPartial: false,
+  isRunning: false,
+  rawResponse: {
+    took: 12,
+    timed_out: false,
+    _shards: {
+      total: 1,
+      successful: 1,
+      skipped: 0,
+      failed: 0,
+    },
+    hits: {
+      total: 6157,
+      max_score: null,
+      hits: [],
+    },
+    aggregations: {
+      cloud_instance_id: {
+        doc_count_error_upper_bound: 0,
+        sum_other_doc_count: 0,
+        buckets: [],
+      },
+      host_mac: {
+        doc_count_error_upper_bound: 0,
+        sum_other_doc_count: 0,
+        buckets: [],
+      },
+      host_ip: {
+        doc_count_error_upper_bound: 0,
+        sum_other_doc_count: 0,
+        buckets: [
+          {
+            key: '151.205.0.17',
+            doc_count: 1,
+            timestamp: {
+              value: 1549766627000,
+              value_as_string: '2019-02-10T02:43:47.000Z',
+            },
+          },
+        ],
+      },
+      cloud_machine_type: {
+        doc_count_error_upper_bound: 0,
+        sum_other_doc_count: 0,
+        buckets: [],
+      },
+      cloud_region: {
+        doc_count_error_upper_bound: 0,
+        sum_other_doc_count: 0,
+        buckets: [],
+      },
+      host_os_version: {
+        doc_count_error_upper_bound: 0,
+        sum_other_doc_count: 0,
+        buckets: [
+          {
+            key: '9 (stretch)',
+            doc_count: 6157,
+            timestamp: {
+              value: 1549767613001,
+              value_as_string: '2019-02-10T03:00:13.001Z',
+            },
+          },
+        ],
+      },
+      host_architecture: {
+        doc_count_error_upper_bound: 0,
+        sum_other_doc_count: 0,
+        buckets: [
+          {
+            key: 'armv7l',
+            doc_count: 6157,
+            timestamp: {
+              value: 1549767613001,
+              value_as_string: '2019-02-10T03:00:13.001Z',
+            },
+          },
+        ],
+      },
+      cloud_provider: {
+        doc_count_error_upper_bound: 0,
+        sum_other_doc_count: 0,
+        buckets: [],
+      },
+      host_os_platform: {
+        doc_count_error_upper_bound: 0,
+        sum_other_doc_count: 0,
+        buckets: [
+          {
+            key: 'raspbian',
+            doc_count: 6157,
+            timestamp: {
+              value: 1549767613001,
+              value_as_string: '2019-02-10T03:00:13.001Z',
+            },
+          },
+        ],
+      },
+      host_os_name: {
+        doc_count_error_upper_bound: 0,
+        sum_other_doc_count: 0,
+        buckets: [
+          {
+            key: 'Raspbian GNU/Linux',
+            doc_count: 6157,
+            timestamp: {
+              value: 1549767613001,
+              value_as_string: '2019-02-10T03:00:13.001Z',
+            },
+          },
+        ],
+      },
+      host_os_family: {
+        doc_count_error_upper_bound: 0,
+        sum_other_doc_count: 0,
+        buckets: [
+          {
+            key: '',
+            doc_count: 6157,
+            timestamp: {
+              value: 1549767613001,
+              value_as_string: '2019-02-10T03:00:13.001Z',
+            },
+          },
+        ],
+      },
+      host_name: {
+        doc_count_error_upper_bound: 0,
+        sum_other_doc_count: 0,
+        buckets: [
+          {
+            key: 'raspberrypi',
+            doc_count: 6157,
+            timestamp: {
+              value: 1549767613001,
+              value_as_string: '2019-02-10T03:00:13.001Z',
+            },
+          },
+        ],
+      },
+      host_id: {
+        doc_count_error_upper_bound: 0,
+        sum_other_doc_count: 0,
+        buckets: [
+          {
+            key: 'b19a781f683541a7a25ee345133aa399',
+            doc_count: 6157,
+            timestamp: {
+              value: 1549767613001,
+              value_as_string: '2019-02-10T03:00:13.001Z',
+            },
+          },
+        ],
+      },
+    },
+  },
+  total: 1,
+  loaded: 1,
+  inspect: {
+    dsl: [
+      '{\n  "allowNoIndices": true,\n  "index": [\n    "filebeat-*"\n  ],\n  "ignoreUnavailable": true,\n  "body": {\n    "aggregations": {\n      "host_architecture": {\n        "terms": {\n          "field": "host.architecture",\n          "size": 10,\n          "order": {\n            "timestamp": "desc"\n          }\n        },\n        "aggs": {\n          "timestamp": {\n            "max": {\n              "field": "@timestamp"\n            }\n          }\n        }\n      },\n      "host_id": {\n        "terms": {\n          "field": "host.id",\n          "size": 10,\n          "order": {\n            "timestamp": "desc"\n          }\n        },\n        "aggs": {\n          "timestamp": {\n            "max": {\n              "field": "@timestamp"\n            }\n          }\n        }\n      },\n      "host_ip": {\n        "terms": {\n          "field": "host.ip",\n          "size": 10,\n          "order": {\n            "timestamp": "desc"\n          }\n        },\n        "aggs": {\n          "timestamp": {\n            "max": {\n              "field": "@timestamp"\n            }\n          }\n        }\n      },\n      "host_mac": {\n        "terms": {\n          "field": "host.mac",\n          "size": 10,\n          "order": {\n            "timestamp": "desc"\n          }\n        },\n        "aggs": {\n          "timestamp": {\n            "max": {\n              "field": "@timestamp"\n            }\n          }\n        }\n      },\n      "host_name": {\n        "terms": {\n          "field": "host.name",\n          "size": 10,\n          "order": {\n            "timestamp": "desc"\n          }\n        },\n        "aggs": {\n          "timestamp": {\n            "max": {\n              "field": "@timestamp"\n            }\n          }\n        }\n      },\n      "host_os_family": {\n        "terms": {\n          "field": "host.os.family",\n          "size": 10,\n          "order": {\n            "timestamp": "desc"\n          }\n        },\n        "aggs": {\n          "timestamp": {\n            "max": {\n              "field": "@timestamp"\n            }\n          }\n        }\n      },\n      "host_os_name": {\n        "terms": {\n          "field": "host.os.name",\n          "size": 10,\n          "order": {\n            "timestamp": "desc"\n          }\n        },\n        "aggs": {\n          "timestamp": {\n            "max": {\n              "field": "@timestamp"\n            }\n          }\n        }\n      },\n      "host_os_platform": {\n        "terms": {\n          "field": "host.os.platform",\n          "size": 10,\n          "order": {\n            "timestamp": "desc"\n          }\n        },\n        "aggs": {\n          "timestamp": {\n            "max": {\n              "field": "@timestamp"\n            }\n          }\n        }\n      },\n      "host_os_version": {\n        "terms": {\n          "field": "host.os.version",\n          "size": 10,\n          "order": {\n            "timestamp": "desc"\n          }\n        },\n        "aggs": {\n          "timestamp": {\n            "max": {\n              "field": "@timestamp"\n            }\n          }\n        }\n      },\n      "cloud_instance_id": {\n        "terms": {\n          "field": "cloud.instance.id",\n          "size": 10,\n          "order": {\n            "timestamp": "desc"\n          }\n        },\n        "aggs": {\n          "timestamp": {\n            "max": {\n              "field": "@timestamp"\n            }\n          }\n        }\n      },\n      "cloud_machine_type": {\n        "terms": {\n          "field": "cloud.machine.type",\n          "size": 10,\n          "order": {\n            "timestamp": "desc"\n          }\n        },\n        "aggs": {\n          "timestamp": {\n            "max": {\n              "field": "@timestamp"\n            }\n          }\n        }\n      },\n      "cloud_provider": {\n        "terms": {\n          "field": "cloud.provider",\n          "size": 10,\n          "order": {\n            "timestamp": "desc"\n          }\n        },\n        "aggs": {\n          "timestamp": {\n            "max": {\n              "field": "@timestamp"\n            }\n          }\n        }\n      },\n      "cloud_region": {\n        "terms": {\n          "field": "cloud.region",\n          "size": 10,\n          "order": {\n            "timestamp": "desc"\n          }\n        },\n        "aggs": {\n          "timestamp": {\n            "max": {\n              "field": "@timestamp"\n            }\n          }\n        }\n      }\n    },\n    "query": {\n      "bool": {\n        "filter": [\n          {\n            "term": {\n              "host.name": "raspberrypi"\n            }\n          },\n          {\n            "range": {\n              "@timestamp": {\n                "format": "strict_date_optional_time",\n                "gte": "2000-01-01T00:00:00.000Z",\n                "lte": "3000-01-01T00:00:00.000Z"\n              }\n            }\n          }\n        ]\n      }\n    },\n    "size": 0,\n    "track_total_hits": false\n  }\n}',
+    ],
+  },
+  hostDetails: {
+    _id: 'raspberrypi',
+    host: {
+      architecture: ['armv7l'],
+      id: ['b19a781f683541a7a25ee345133aa399'],
+      ip: ['151.205.0.17'],
+      name: ['raspberrypi'],
+      os: {
+        family: [''],
+        name: ['Raspbian GNU/Linux'],
+        platform: ['raspbian'],
+        version: ['9 (stretch)'],
+      },
+    },
+  },
+};
diff --git a/x-pack/test/security_solution_api_integration/test_suites/explore/hosts/trial_license_complete_tier/serverless/host_details.ts b/x-pack/test/security_solution_api_integration/test_suites/explore/hosts/trial_license_complete_tier/serverless/host_details.ts
new file mode 100644
index 00000000000000..68b43b83a9fc6a
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/explore/hosts/trial_license_complete_tier/serverless/host_details.ts
@@ -0,0 +1,59 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import expect from '@kbn/expect';
+import {
+  HostDetailsStrategyResponse,
+  HostsQueries,
+} from '@kbn/security-solution-plugin/common/search_strategy';
+import { FtrProviderContext } from '../../../../../ftr_provider_context';
+import { RoleCredentials } from '../../../../../../../test_serverless/shared/services';
+import { hostDetailsFilebeatExpectedResult } from '../mocks/host_details';
+
+export default function ({ getService }: FtrProviderContext) {
+  const esArchiver = getService('esArchiver');
+  const secureBsearch = getService('secureBsearch');
+  const supertestWithoutAuth = getService('supertestWithoutAuth');
+  const svlUserManager = getService('svlUserManager');
+  let roleAuthc: RoleCredentials;
+  describe('Host Details', () => {
+    describe('With filebeat', () => {
+      before(async () => {
+        await esArchiver.load('x-pack/test/functional/es_archives/filebeat/default');
+        roleAuthc = await svlUserManager.createApiKeyForRole('admin');
+      });
+      after(async () => {
+        await esArchiver.unload('x-pack/test/functional/es_archives/filebeat/default');
+        await svlUserManager.invalidateApiKeyForRole(roleAuthc);
+      });
+
+      const FROM = '2000-01-01T00:00:00.000Z';
+      const TO = '3000-01-01T00:00:00.000Z';
+
+      it('Make sure that we get HostDetails data', async () => {
+        const { hostDetails } = await secureBsearch.send<HostDetailsStrategyResponse>({
+          supertestWithoutAuth,
+          apiKeyHeader: roleAuthc.apiKeyHeader,
+          internalOrigin: 'Kibana',
+          options: {
+            factoryQueryType: HostsQueries.details,
+            timerange: {
+              interval: '12h',
+              to: TO,
+              from: FROM,
+            },
+            defaultIndex: ['filebeat-*'],
+            hostName: 'raspberrypi',
+            inspect: false,
+          },
+          strategy: 'securitySolutionSearchStrategy',
+        });
+        expect(hostDetails).to.eql(hostDetailsFilebeatExpectedResult.hostDetails);
+      });
+    });
+  });
+}
diff --git a/x-pack/test/security_solution_api_integration/test_suites/explore/hosts/trial_license_complete_tier/serverless/hosts.ts b/x-pack/test/security_solution_api_integration/test_suites/explore/hosts/trial_license_complete_tier/serverless/hosts.ts
new file mode 100644
index 00000000000000..ccdfa2945b21c9
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/explore/hosts/trial_license_complete_tier/serverless/hosts.ts
@@ -0,0 +1,188 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import expect from '@kbn/expect';
+import {
+  HostsQueries,
+  Direction,
+  HostsFields,
+  HostsStrategyResponse,
+  HostDetailsStrategyResponse,
+  FirstLastSeenQuery,
+  FirstLastSeenStrategyResponse,
+} from '@kbn/security-solution-plugin/common/search_strategy';
+
+import { FtrProviderContext } from '../../../../../ftr_provider_context';
+import { RoleCredentials } from '../../../../../../../test_serverless/shared/services';
+
+const FROM = '2000-01-01T00:00:00.000Z';
+const TO = '3000-01-01T00:00:00.000Z';
+
+// typical values that have to change after an update from "scripts/es_archiver"
+const HOST_NAME = 'Ubuntu';
+const TOTAL_COUNT = 7;
+const EDGE_LENGTH = 1;
+const CURSOR_ID = '2ab45fc1c41e4c84bbd02202a7e5761f';
+
+export default function ({ getService }: FtrProviderContext) {
+  const esArchiver = getService('esArchiver');
+  const secureBsearch = getService('secureBsearch');
+  const supertestWithoutAuth = getService('supertestWithoutAuth');
+  const svlUserManager = getService('svlUserManager');
+  let roleAuthc: RoleCredentials;
+  describe('hosts', () => {
+    before(async () => {
+      await esArchiver.load('x-pack/test/functional/es_archives/auditbeat/hosts');
+      roleAuthc = await svlUserManager.createApiKeyForRole('admin');
+    });
+
+    after(async () => {
+      await esArchiver.unload('x-pack/test/functional/es_archives/auditbeat/hosts');
+      await svlUserManager.invalidateApiKeyForRole(roleAuthc);
+    });
+
+    it('Make sure that we get Hosts Table data', async () => {
+      const hosts = await secureBsearch.send<HostsStrategyResponse>({
+        supertestWithoutAuth,
+        apiKeyHeader: roleAuthc.apiKeyHeader,
+        internalOrigin: 'Kibana',
+        options: {
+          factoryQueryType: HostsQueries.hosts,
+          timerange: {
+            interval: '12h',
+            to: TO,
+            from: FROM,
+          },
+          defaultIndex: ['auditbeat-*'],
+          sort: {
+            field: HostsFields.lastSeen,
+            direction: Direction.asc,
+          },
+          pagination: {
+            activePage: 0,
+            cursorStart: 0,
+            fakePossibleCount: 3,
+            querySize: 1,
+          },
+          inspect: false,
+        },
+        strategy: 'securitySolutionSearchStrategy',
+      });
+
+      expect(hosts.edges.length).to.be(EDGE_LENGTH);
+      expect(hosts.totalCount).to.be(TOTAL_COUNT);
+      expect(hosts.pageInfo.fakeTotalCount).to.equal(3);
+    });
+
+    it('Make sure that pagination is working in Hosts Table query', async () => {
+      const hosts = await secureBsearch.send<HostsStrategyResponse>({
+        supertestWithoutAuth,
+        apiKeyHeader: roleAuthc.apiKeyHeader,
+        internalOrigin: 'Kibana',
+        options: {
+          factoryQueryType: HostsQueries.hosts,
+          timerange: {
+            interval: '12h',
+            to: TO,
+            from: FROM,
+          },
+          sort: {
+            field: HostsFields.lastSeen,
+            direction: Direction.asc,
+          },
+          defaultIndex: ['auditbeat-*'],
+          pagination: {
+            activePage: 2,
+            cursorStart: 1,
+            fakePossibleCount: 5,
+            querySize: 2,
+          },
+          inspect: false,
+        },
+        strategy: 'securitySolutionSearchStrategy',
+      });
+      expect(hosts.edges.length).to.be(EDGE_LENGTH);
+      expect(hosts.totalCount).to.be(TOTAL_COUNT);
+      expect(hosts.edges[0].node.host?.os?.name).to.eql([HOST_NAME]);
+    });
+
+    it('Make sure that we get Host details data', async () => {
+      const { hostDetails } = await secureBsearch.send<HostDetailsStrategyResponse>({
+        supertestWithoutAuth,
+        apiKeyHeader: roleAuthc.apiKeyHeader,
+        internalOrigin: 'Kibana',
+        options: {
+          factoryQueryType: HostsQueries.details,
+          hostName: 'zeek-sensor-san-francisco',
+          timerange: {
+            interval: '12h',
+            to: TO,
+            from: FROM,
+          },
+          defaultIndex: ['auditbeat-*'],
+          inspect: false,
+        },
+        strategy: 'securitySolutionSearchStrategy',
+      });
+      expect(hostDetails).to.eql({
+        _id: 'zeek-sensor-san-francisco',
+        host: {
+          architecture: ['x86_64'],
+          id: [CURSOR_ID],
+          name: ['zeek-sensor-san-francisco'],
+          os: {
+            family: ['debian'],
+            name: [HOST_NAME],
+            platform: ['ubuntu'],
+            version: ['18.04.2 LTS (Bionic Beaver)'],
+          },
+        },
+        cloud: {
+          instance: {
+            id: ['132972452'],
+          },
+          provider: ['digitalocean'],
+          region: ['sfo2'],
+        },
+      });
+    });
+
+    it('Make sure that we get First Seen for a Host', async () => {
+      const firstLastSeenHost = await secureBsearch.send<FirstLastSeenStrategyResponse>({
+        supertestWithoutAuth,
+        apiKeyHeader: roleAuthc.apiKeyHeader,
+        internalOrigin: 'Kibana',
+        options: {
+          factoryQueryType: FirstLastSeenQuery,
+          defaultIndex: ['auditbeat-*'],
+          field: 'host.name',
+          value: 'zeek-sensor-san-francisco',
+          order: 'asc',
+        },
+        strategy: 'securitySolutionSearchStrategy',
+      });
+      expect(firstLastSeenHost.firstSeen).to.eql('2019-02-19T19:36:23.561Z');
+    });
+
+    it('Make sure that we get Last Seen for a Host', async () => {
+      const firstLastSeenHost = await secureBsearch.send<FirstLastSeenStrategyResponse>({
+        supertestWithoutAuth,
+        apiKeyHeader: roleAuthc.apiKeyHeader,
+        internalOrigin: 'Kibana',
+        options: {
+          factoryQueryType: FirstLastSeenQuery,
+          defaultIndex: ['auditbeat-*'],
+          field: 'host.name',
+          value: 'zeek-sensor-san-francisco',
+          order: 'desc',
+        },
+        strategy: 'securitySolutionSearchStrategy',
+      });
+      expect(firstLastSeenHost.lastSeen).to.eql('2019-02-19T20:42:33.561Z');
+    });
+  });
+}
diff --git a/x-pack/test/security_solution_api_integration/test_suites/explore/hosts/trial_license_complete_tier/serverless/index.ts b/x-pack/test/security_solution_api_integration/test_suites/explore/hosts/trial_license_complete_tier/serverless/index.ts
new file mode 100644
index 00000000000000..ca77384e41b3ba
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/explore/hosts/trial_license_complete_tier/serverless/index.ts
@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { FtrProviderContextWithSpaces } from '../../../../../ftr_provider_context_with_spaces';
+
+export default function ({ loadTestFile, getService }: FtrProviderContextWithSpaces) {
+  describe('@serverless SecuritySolution Explore Hosts', () => {
+    loadTestFile(require.resolve('./hosts'));
+    loadTestFile(require.resolve('./host_details'));
+    loadTestFile(require.resolve('./uncommon_processes'));
+  });
+}
diff --git a/x-pack/test/security_solution_api_integration/test_suites/explore/hosts/trial_license_complete_tier/serverless/uncommon_processes.ts b/x-pack/test/security_solution_api_integration/test_suites/explore/hosts/trial_license_complete_tier/serverless/uncommon_processes.ts
new file mode 100644
index 00000000000000..71458e690131a4
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/explore/hosts/trial_license_complete_tier/serverless/uncommon_processes.ts
@@ -0,0 +1,154 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import expect from '@kbn/expect';
+
+import {
+  HostsQueries,
+  HostsUncommonProcessesStrategyResponse,
+} from '@kbn/security-solution-plugin/common/search_strategy';
+import { FtrProviderContext } from '../../../../../ftr_provider_context';
+import { RoleCredentials } from '../../../../../../../test_serverless/shared/services';
+
+const FROM = '2019-01-01T00:00:00.000Z';
+const TO = '3000-01-01T00:00:00.000Z';
+
+// typical values that have to change after an update from "scripts/es_archiver"
+const TOTAL_COUNT = 3;
+
+export default function ({ getService }: FtrProviderContext) {
+  const esArchiver = getService('esArchiver');
+  const secureBsearch = getService('secureBsearch');
+  const supertestWithoutAuth = getService('supertestWithoutAuth');
+  const svlUserManager = getService('svlUserManager');
+  let roleAuthc: RoleCredentials;
+  describe('hosts', () => {
+    before(async () => {
+      await esArchiver.load('x-pack/test/functional/es_archives/auditbeat/uncommon_processes');
+      roleAuthc = await svlUserManager.createApiKeyForRole('admin');
+    });
+    after(async () => {
+      await esArchiver.unload('x-pack/test/functional/es_archives/auditbeat/uncommon_processes');
+      await svlUserManager.invalidateApiKeyForRole(roleAuthc);
+    });
+
+    it('should return an edge of length 1 when given a pagination of length 1', async () => {
+      const response = await secureBsearch.send<HostsUncommonProcessesStrategyResponse>({
+        supertestWithoutAuth,
+        apiKeyHeader: roleAuthc.apiKeyHeader,
+        internalOrigin: 'Kibana',
+        options: {
+          factoryQueryType: HostsQueries.uncommonProcesses,
+          sourceId: 'default',
+          timerange: {
+            interval: '12h',
+            to: TO,
+            from: FROM,
+          },
+          pagination: {
+            activePage: 0,
+            cursorStart: 0,
+            fakePossibleCount: 3,
+            querySize: 1,
+          },
+          defaultIndex: ['auditbeat-uncommon-processes'],
+          inspect: false,
+        },
+        strategy: 'securitySolutionSearchStrategy',
+      });
+
+      expect(response.edges.length).to.be(1);
+    });
+
+    describe('when given a pagination of length 2', () => {
+      it('should return an edge of length 2 ', async () => {
+        const response = await secureBsearch.send<HostsUncommonProcessesStrategyResponse>({
+          supertestWithoutAuth,
+          apiKeyHeader: roleAuthc.apiKeyHeader,
+          internalOrigin: 'Kibana',
+          options: {
+            factoryQueryType: HostsQueries.uncommonProcesses,
+            sourceId: 'default',
+            timerange: {
+              interval: '12h',
+              to: TO,
+              from: FROM,
+            },
+            pagination: {
+              activePage: 0,
+              cursorStart: 0,
+              fakePossibleCount: 3,
+              querySize: 2,
+            },
+            defaultIndex: ['auditbeat-uncommon-processes'],
+            inspect: false,
+          },
+          strategy: 'securitySolutionSearchStrategy',
+        });
+        expect(response.edges.length).to.be(2);
+      });
+    });
+
+    describe('when given a pagination of length 1', () => {
+      let response: HostsUncommonProcessesStrategyResponse | null = null;
+      before(async () => {
+        response = await secureBsearch.send<HostsUncommonProcessesStrategyResponse>({
+          supertestWithoutAuth,
+          apiKeyHeader: roleAuthc.apiKeyHeader,
+          internalOrigin: 'Kibana',
+          options: {
+            factoryQueryType: HostsQueries.uncommonProcesses,
+            sourceId: 'default',
+            timerange: {
+              interval: '12h',
+              to: TO,
+              from: FROM,
+            },
+            pagination: {
+              activePage: 0,
+              cursorStart: 0,
+              fakePossibleCount: 3,
+              querySize: 1,
+            },
+            defaultIndex: ['auditbeat-uncommon-processes'],
+            inspect: false,
+          },
+          strategy: 'securitySolutionSearchStrategy',
+        });
+      });
+
+      it('should return an edge of length 1 ', () => {
+        expect(response?.edges.length).to.be(1);
+      });
+
+      it('should return a total count of elements', () => {
+        expect(response?.totalCount).to.be(TOTAL_COUNT);
+      });
+
+      it('should return a single data set with pagination of 1', () => {
+        const expected = {
+          _id: 'HCFxB2kBR346wHgnL4ik',
+          instances: 1,
+          process: {
+            name: ['kworker/u2:0'],
+          },
+          user: {
+            id: ['0'],
+            name: ['root'],
+          },
+          hosts: [
+            {
+              id: ['zeek-sensor-san-francisco'],
+              name: ['zeek-sensor-san-francisco'],
+            },
+          ],
+        };
+        expect(response?.edges[0].node).to.eql(expected);
+      });
+    });
+  });
+}
diff --git a/x-pack/test/security_solution_api_integration/test_suites/explore/network/trial_license_complete_tier/configs/ess.config.ts b/x-pack/test/security_solution_api_integration/test_suites/explore/network/trial_license_complete_tier/configs/ess.config.ts
new file mode 100644
index 00000000000000..6439b163d054a0
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/explore/network/trial_license_complete_tier/configs/ess.config.ts
@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { FtrConfigProviderContext } from '@kbn/test';
+
+export default async function ({ readConfigFile }: FtrConfigProviderContext) {
+  const functionalConfig = await readConfigFile(
+    require.resolve('../../../../../config/ess/config.base.trial')
+  );
+
+  return {
+    ...functionalConfig.getAll(),
+    testFiles: [require.resolve('../ess')],
+    junit: {
+      reportName: 'Explore - Network Integration Tests - ESS Env - Trial License',
+    },
+  };
+}
diff --git a/x-pack/test/security_solution_api_integration/test_suites/explore/network/trial_license_complete_tier/configs/serverless.config.ts b/x-pack/test/security_solution_api_integration/test_suites/explore/network/trial_license_complete_tier/configs/serverless.config.ts
new file mode 100644
index 00000000000000..50aa606520261c
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/explore/network/trial_license_complete_tier/configs/serverless.config.ts
@@ -0,0 +1,23 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { createTestConfig } from '../../../../../config/serverless/config.base';
+
+export default createTestConfig({
+  kbnTestServerArgs: [
+    `--xpack.securitySolution.enableExperimental=${JSON.stringify([])}`,
+    `--xpack.securitySolutionServerless.productTypes=${JSON.stringify([
+      { product_line: 'security', product_tier: 'complete' },
+      { product_line: 'endpoint', product_tier: 'complete' },
+      { product_line: 'cloud', product_tier: 'complete' },
+    ])}`,
+  ],
+  testFiles: [require.resolve('../serverless')],
+  junit: {
+    reportName: 'Explore - Network Integration Tests - Serverless Env - Complete Tier',
+  },
+});
diff --git a/x-pack/test/security_solution_api_integration/test_suites/explore/network/trial_license_complete_tier/ess/index.ts b/x-pack/test/security_solution_api_integration/test_suites/explore/network/trial_license_complete_tier/ess/index.ts
new file mode 100644
index 00000000000000..4c67d06c62852f
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/explore/network/trial_license_complete_tier/ess/index.ts
@@ -0,0 +1,17 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { FtrProviderContextWithSpaces } from '../../../../../ftr_provider_context_with_spaces';
+
+export default function ({ loadTestFile }: FtrProviderContextWithSpaces) {
+  describe('@ess SecuritySolution Explore Network', () => {
+    loadTestFile(require.resolve('./network_details'));
+    loadTestFile(require.resolve('./network_dns'));
+    loadTestFile(require.resolve('./network_top_n_flow'));
+    loadTestFile(require.resolve('./tls'));
+  });
+}
diff --git a/x-pack/test/api_integration/apis/security_solution/network_details.ts b/x-pack/test/security_solution_api_integration/test_suites/explore/network/trial_license_complete_tier/ess/network_details.ts
similarity index 93%
rename from x-pack/test/api_integration/apis/security_solution/network_details.ts
rename to x-pack/test/security_solution_api_integration/test_suites/explore/network/trial_license_complete_tier/ess/network_details.ts
index 40ea8906661bdd..fa5811a524c80f 100644
--- a/x-pack/test/api_integration/apis/security_solution/network_details.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/explore/network/trial_license_complete_tier/ess/network_details.ts
@@ -11,12 +11,12 @@ import {
   NetworkQueries,
 } from '@kbn/security-solution-plugin/common/search_strategy';
 
-import { FtrProviderContext } from '../../ftr_provider_context';
+import { FtrProviderContextWithSpaces } from '../../../../../ftr_provider_context_with_spaces';
 
-export default function ({ getService }: FtrProviderContext) {
+export default function ({ getService }: FtrProviderContextWithSpaces) {
   const esArchiver = getService('esArchiver');
-  const supertest = getService('supertest');
   const bsearch = getService('bsearch');
+  const supertest = getService('supertest');
 
   describe('Network details', () => {
     describe('With filebeat', () => {
diff --git a/x-pack/test/api_integration/apis/security_solution/network_dns.ts b/x-pack/test/security_solution_api_integration/test_suites/explore/network/trial_license_complete_tier/ess/network_dns.ts
similarity index 95%
rename from x-pack/test/api_integration/apis/security_solution/network_dns.ts
rename to x-pack/test/security_solution_api_integration/test_suites/explore/network/trial_license_complete_tier/ess/network_dns.ts
index 194394fbe3ae55..8b6915294eb373 100644
--- a/x-pack/test/api_integration/apis/security_solution/network_dns.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/explore/network/trial_license_complete_tier/ess/network_dns.ts
@@ -14,12 +14,12 @@ import {
   NetworkDnsStrategyResponse,
 } from '@kbn/security-solution-plugin/common/search_strategy';
 
-import { FtrProviderContext } from '../../ftr_provider_context';
+import { FtrProviderContextWithSpaces } from '../../../../../ftr_provider_context_with_spaces';
 
-export default function ({ getService }: FtrProviderContext) {
+export default function ({ getService }: FtrProviderContextWithSpaces) {
   const esArchiver = getService('esArchiver');
-  const supertest = getService('supertest');
   const bsearch = getService('bsearch');
+  const supertest = getService('supertest');
 
   describe('Network DNS', () => {
     describe('With packetbeat', () => {
diff --git a/x-pack/test/api_integration/apis/security_solution/network_top_n_flow.ts b/x-pack/test/security_solution_api_integration/test_suites/explore/network/trial_license_complete_tier/ess/network_top_n_flow.ts
similarity index 89%
rename from x-pack/test/api_integration/apis/security_solution/network_top_n_flow.ts
rename to x-pack/test/security_solution_api_integration/test_suites/explore/network/trial_license_complete_tier/ess/network_top_n_flow.ts
index b0d9844187c34e..7dd225c0cbf800 100644
--- a/x-pack/test/api_integration/apis/security_solution/network_top_n_flow.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/explore/network/trial_license_complete_tier/ess/network_top_n_flow.ts
@@ -15,14 +15,14 @@ import {
   NetworkTopNFlowStrategyResponse,
 } from '@kbn/security-solution-plugin/common/search_strategy';
 
-import { FtrProviderContext } from '../../ftr_provider_context';
+import { FtrProviderContextWithSpaces } from '../../../../../ftr_provider_context_with_spaces';
 
 const EDGE_LENGTH = 10;
 
-export default function ({ getService }: FtrProviderContext) {
+export default function ({ getService }: FtrProviderContextWithSpaces) {
   const esArchiver = getService('esArchiver');
-  const supertest = getService('supertest');
   const bsearch = getService('bsearch');
+  const supertest = getService('supertest');
 
   describe('Network Top N Flow', () => {
     describe('With filebeat', () => {
@@ -36,26 +36,6 @@ export default function ({ getService }: FtrProviderContext) {
       const FROM = '2019-02-09T01:57:24.870Z';
       const TO = '2019-02-12T01:57:24.870Z';
 
-      it('should get Source NetworkTopNFlowCount total count', async () => {
-        const networkTopNFlow = await bsearch.send<NetworkTopNFlowStrategyResponse>({
-          supertest,
-          options: {
-            defaultIndex: ['filebeat-*'],
-            factoryQueryType: NetworkQueries.topNFlowCount,
-            flowTarget: FlowTargetSourceDest.source,
-            timerange: {
-              interval: '12h',
-              to: TO,
-              from: FROM,
-            },
-            inspect: false,
-          },
-          strategy: 'securitySolutionSearchStrategy',
-        });
-
-        expect(networkTopNFlow.totalCount).to.be(121);
-      });
-
       it('should get Source NetworkTopNFlow data with bytes_in descending sort', async () => {
         const networkTopNFlow = await bsearch.send<NetworkTopNFlowStrategyResponse>({
           supertest,
diff --git a/x-pack/test/api_integration/apis/security_solution/tls.ts b/x-pack/test/security_solution_api_integration/test_suites/explore/network/trial_license_complete_tier/ess/tls.ts
similarity index 97%
rename from x-pack/test/api_integration/apis/security_solution/tls.ts
rename to x-pack/test/security_solution_api_integration/test_suites/explore/network/trial_license_complete_tier/ess/tls.ts
index 501cff3b1095de..52da3a9b467814 100644
--- a/x-pack/test/api_integration/apis/security_solution/tls.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/explore/network/trial_license_complete_tier/ess/tls.ts
@@ -14,7 +14,7 @@ import {
   NetworkTlsStrategyResponse,
 } from '@kbn/security-solution-plugin/common/search_strategy';
 
-import { FtrProviderContext } from '../../ftr_provider_context';
+import { FtrProviderContextWithSpaces } from '../../../../../ftr_provider_context_with_spaces';
 
 const FROM = '2000-01-01T00:00:00.000Z';
 const TO = '3000-01-01T00:00:00.000Z';
@@ -81,7 +81,7 @@ const expectedOverviewSourceResult = {
   totalCount: 3,
 };
 
-export default function ({ getService }: FtrProviderContext) {
+export default function ({ getService }: FtrProviderContextWithSpaces) {
   const esArchiver = getService('esArchiver');
   const supertest = getService('supertest');
   const bsearch = getService('bsearch');
diff --git a/x-pack/test/security_solution_api_integration/test_suites/explore/network/trial_license_complete_tier/serverless/index.ts b/x-pack/test/security_solution_api_integration/test_suites/explore/network/trial_license_complete_tier/serverless/index.ts
new file mode 100644
index 00000000000000..c045e15ca1a1d2
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/explore/network/trial_license_complete_tier/serverless/index.ts
@@ -0,0 +1,17 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { FtrProviderContext } from '../../../../../ftr_provider_context';
+
+export default function ({ loadTestFile }: FtrProviderContext) {
+  describe('@serverless SecuritySolution Explore Network', () => {
+    loadTestFile(require.resolve('./network_details'));
+    loadTestFile(require.resolve('./network_dns'));
+    loadTestFile(require.resolve('./network_top_n_flow'));
+    loadTestFile(require.resolve('./tls'));
+  });
+}
diff --git a/x-pack/test/security_solution_api_integration/test_suites/explore/network/trial_license_complete_tier/serverless/network_details.ts b/x-pack/test/security_solution_api_integration/test_suites/explore/network/trial_license_complete_tier/serverless/network_details.ts
new file mode 100644
index 00000000000000..fb4fe3f3f5a80b
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/explore/network/trial_license_complete_tier/serverless/network_details.ts
@@ -0,0 +1,83 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import expect from '@kbn/expect';
+import {
+  NetworkDetailsStrategyResponse,
+  NetworkQueries,
+} from '@kbn/security-solution-plugin/common/search_strategy';
+import { FtrProviderContext } from '../../../../../ftr_provider_context';
+import { RoleCredentials } from '../../../../../../../test_serverless/shared/services';
+
+export default function ({ getService }: FtrProviderContext) {
+  const esArchiver = getService('esArchiver');
+  const secureBsearch = getService('secureBsearch');
+  const supertestWithoutAuth = getService('supertestWithoutAuth');
+  const svlUserManager = getService('svlUserManager');
+  let roleAuthc: RoleCredentials;
+  describe('Network details', () => {
+    describe('With filebeat', () => {
+      before(async () => {
+        await esArchiver.load('x-pack/test/functional/es_archives/filebeat/default');
+        roleAuthc = await svlUserManager.createApiKeyForRole('admin');
+      });
+      after(async () => {
+        await esArchiver.unload('x-pack/test/functional/es_archives/filebeat/default');
+        await svlUserManager.invalidateApiKeyForRole(roleAuthc);
+      });
+
+      it('Make sure that we get Network details data', async () => {
+        const body = await secureBsearch.send<NetworkDetailsStrategyResponse>({
+          supertestWithoutAuth,
+          apiKeyHeader: roleAuthc.apiKeyHeader,
+          internalOrigin: 'Kibana',
+          options: {
+            ip: '151.205.0.17',
+            defaultIndex: ['filebeat-*'],
+            factoryQueryType: NetworkQueries.details,
+            inspect: false,
+          },
+          strategy: 'securitySolutionSearchStrategy',
+        });
+
+        expect(body.networkDetails.source?.geo.continent_name).to.eql(['North America']);
+        expect(body.networkDetails.source?.geo.location?.lat!).to.eql([37.751]);
+        expect(body.networkDetails.host?.os?.platform).to.eql(['raspbian']);
+      });
+    });
+
+    describe('With packetbeat', () => {
+      before(async () => {
+        await esArchiver.load('x-pack/test/functional/es_archives/packetbeat/default');
+        roleAuthc = await svlUserManager.createApiKeyForRole('admin');
+      });
+      after(async () => {
+        await esArchiver.unload('x-pack/test/functional/es_archives/packetbeat/default');
+        await svlUserManager.invalidateApiKeyForRole(roleAuthc);
+      });
+
+      it('Make sure that we get Network details data', async () => {
+        const body = await secureBsearch.send<NetworkDetailsStrategyResponse>({
+          supertestWithoutAuth,
+          apiKeyHeader: roleAuthc.apiKeyHeader,
+          internalOrigin: 'Kibana',
+          options: {
+            ip: '185.53.91.88',
+            defaultIndex: ['packetbeat-*'],
+            factoryQueryType: NetworkQueries.details,
+            inspect: false,
+          },
+          strategy: 'securitySolutionSearchStrategy',
+        });
+
+        expect(body.networkDetails.host?.id).to.eql(['2ce8b1e7d69e4a1d9c6bcddc473da9d9']);
+        expect(body.networkDetails.host?.name).to.eql(['zeek-sensor-amsterdam']);
+        expect(body.networkDetails.host?.os?.platform!).to.eql(['ubuntu']);
+      });
+    });
+  });
+}
diff --git a/x-pack/test/security_solution_api_integration/test_suites/explore/network/trial_license_complete_tier/serverless/network_dns.ts b/x-pack/test/security_solution_api_integration/test_suites/explore/network/trial_license_complete_tier/serverless/network_dns.ts
new file mode 100644
index 00000000000000..a4721ba1a4b3c0
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/explore/network/trial_license_complete_tier/serverless/network_dns.ts
@@ -0,0 +1,109 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import expect from '@kbn/expect';
+import {
+  NetworkQueries,
+  NetworkDnsEdges,
+  Direction,
+  NetworkDnsFields,
+  NetworkDnsStrategyResponse,
+} from '@kbn/security-solution-plugin/common/search_strategy';
+
+import { FtrProviderContext } from '../../../../../ftr_provider_context';
+import { RoleCredentials } from '../../../../../../../test_serverless/shared/services';
+
+export default function ({ getService }: FtrProviderContext) {
+  const esArchiver = getService('esArchiver');
+  const secureBsearch = getService('secureBsearch');
+  const supertestWithoutAuth = getService('supertestWithoutAuth');
+  const svlUserManager = getService('svlUserManager');
+  let roleAuthc: RoleCredentials;
+
+  describe('Network DNS', () => {
+    describe('With packetbeat', () => {
+      before(async () => {
+        await esArchiver.load('x-pack/test/functional/es_archives/packetbeat/dns');
+        roleAuthc = await svlUserManager.createApiKeyForRole('admin');
+      });
+      after(async () => {
+        await esArchiver.unload('x-pack/test/functional/es_archives/packetbeat/dns');
+        await svlUserManager.invalidateApiKeyForRole(roleAuthc);
+      });
+
+      const FROM = '2000-01-01T00:00:00.000Z';
+      const TO = '3000-01-01T00:00:00.000Z';
+
+      it('Make sure that we get Dns data and sorting by uniqueDomains ascending', async () => {
+        const networkDns = await secureBsearch.send<NetworkDnsStrategyResponse>({
+          supertestWithoutAuth,
+          apiKeyHeader: roleAuthc.apiKeyHeader,
+
+          internalOrigin: 'Kibana',
+          options: {
+            defaultIndex: ['packetbeat-*'],
+            factoryQueryType: NetworkQueries.dns,
+            filterQuery:
+              '{"bool":{"must":[],"filter":[{"match_all":{}}],"should":[],"must_not":[]}}',
+            isPtrIncluded: false,
+            pagination: { activePage: 0, cursorStart: 0, fakePossibleCount: 30, querySize: 10 },
+            sort: { field: NetworkDnsFields.uniqueDomains, direction: Direction.asc },
+            timerange: {
+              interval: '12h',
+              to: TO,
+              from: FROM,
+            },
+          },
+          strategy: 'securitySolutionSearchStrategy',
+        });
+
+        expect(networkDns.edges.length).to.be(10);
+        expect(networkDns.totalCount).to.be(44);
+        expect(networkDns.edges.map((i: NetworkDnsEdges) => i.node.dnsName).join(',')).to.be(
+          'aaplimg.com,adgrx.com,akadns.net,akamaiedge.net,amazonaws.com,cbsistatic.com,cdn-apple.com,connman.net,d1oxlq5h9kq8q5.cloudfront.net,d3epxf4t8a32oh.cloudfront.net'
+        );
+        expect(networkDns.pageInfo.fakeTotalCount).to.equal(30);
+      });
+
+      it('Make sure that we get Dns data and sorting by uniqueDomains descending', async () => {
+        const networkDns = await secureBsearch.send<NetworkDnsStrategyResponse>({
+          supertestWithoutAuth,
+          apiKeyHeader: roleAuthc.apiKeyHeader,
+
+          internalOrigin: 'Kibana',
+          options: {
+            ip: '151.205.0.17',
+            defaultIndex: ['packetbeat-*'],
+            factoryQueryType: NetworkQueries.dns,
+            inspect: false,
+            pagination: {
+              activePage: 0,
+              cursorStart: 0,
+              fakePossibleCount: 30,
+              querySize: 10,
+            },
+            sort: { field: NetworkDnsFields.uniqueDomains, direction: Direction.desc },
+            stackByField: 'dns.question.registered_domain',
+            timerange: {
+              interval: '12h',
+              to: TO,
+              from: FROM,
+            },
+          },
+          strategy: 'securitySolutionSearchStrategy',
+        });
+
+        expect(networkDns.edges.length).to.be(10);
+        expect(networkDns.totalCount).to.be(44);
+        expect(networkDns.edges.map((i: NetworkDnsEdges) => i.node.dnsName).join(',')).to.be(
+          'nflxvideo.net,apple.com,netflix.com,samsungcloudsolution.com,samsungqbe.com,samsungelectronics.com,internetat.tv,samsungcloudsolution.net,samsungosp.com,cbsnews.com'
+        );
+        expect(networkDns.pageInfo.fakeTotalCount).to.equal(30);
+      });
+    });
+  });
+}
diff --git a/x-pack/test/security_solution_api_integration/test_suites/explore/network/trial_license_complete_tier/serverless/network_top_n_flow.ts b/x-pack/test/security_solution_api_integration/test_suites/explore/network/trial_license_complete_tier/serverless/network_top_n_flow.ts
new file mode 100644
index 00000000000000..872222c96e785f
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/explore/network/trial_license_complete_tier/serverless/network_top_n_flow.ts
@@ -0,0 +1,186 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import expect from '@kbn/expect';
+import {
+  NetworkQueries,
+  NetworkTopNFlowEdges,
+  Direction,
+  FlowTargetSourceDest,
+  NetworkTopTablesFields,
+  NetworkTopNFlowStrategyResponse,
+} from '@kbn/security-solution-plugin/common/search_strategy';
+
+import { FtrProviderContext } from '../../../../../ftr_provider_context';
+import { RoleCredentials } from '../../../../../../../test_serverless/shared/services';
+
+const EDGE_LENGTH = 10;
+
+export default function ({ getService }: FtrProviderContext) {
+  const esArchiver = getService('esArchiver');
+  const secureBsearch = getService('secureBsearch');
+  const supertestWithoutAuth = getService('supertestWithoutAuth');
+  const svlUserManager = getService('svlUserManager');
+  let roleAuthc: RoleCredentials;
+  describe('Network Top N Flow', () => {
+    describe('With filebeat', () => {
+      before(async () => {
+        await esArchiver.load('x-pack/test/functional/es_archives/filebeat/default');
+        roleAuthc = await svlUserManager.createApiKeyForRole('admin');
+      });
+      after(async () => {
+        await esArchiver.unload('x-pack/test/functional/es_archives/filebeat/default');
+        await svlUserManager.invalidateApiKeyForRole(roleAuthc);
+      });
+
+      const FROM = '2019-02-09T01:57:24.870Z';
+      const TO = '2019-02-12T01:57:24.870Z';
+
+      it('should get Source NetworkTopNFlow data with bytes_in descending sort', async () => {
+        const networkTopNFlow = await secureBsearch.send<NetworkTopNFlowStrategyResponse>({
+          supertestWithoutAuth,
+          apiKeyHeader: roleAuthc.apiKeyHeader,
+          internalOrigin: 'Kibana',
+          options: {
+            defaultIndex: ['filebeat-*'],
+            factoryQueryType: NetworkQueries.topNFlow,
+            flowTarget: FlowTargetSourceDest.source,
+            sort: { field: NetworkTopTablesFields.bytes_in, direction: Direction.desc },
+            pagination: {
+              activePage: 0,
+              cursorStart: 0,
+              fakePossibleCount: 0,
+              querySize: 10,
+            },
+            timerange: {
+              interval: '12h',
+              to: TO,
+              from: FROM,
+            },
+            inspect: false,
+          },
+          strategy: 'securitySolutionSearchStrategy',
+        });
+
+        expect(networkTopNFlow.edges.length).to.be(EDGE_LENGTH);
+        expect(
+          networkTopNFlow.edges.map((i: NetworkTopNFlowEdges) => i.node.source!.ip).join(',')
+        ).to.be(
+          '10.100.7.196,10.100.7.199,10.100.7.197,10.100.7.198,3.82.33.170,17.249.172.100,10.100.4.1,8.248.209.244,8.248.211.247,8.248.213.244'
+        );
+        expect(networkTopNFlow.edges[0].node.destination).to.be(undefined);
+        expect(networkTopNFlow.edges[0].node.source!.flows).to.be(498);
+        expect(networkTopNFlow.edges[0].node.source!.destination_ips).to.be(132);
+      });
+
+      it('should get Source NetworkTopNFlow data with bytes_in ascending sort ', async () => {
+        const networkTopNFlow = await secureBsearch.send<NetworkTopNFlowStrategyResponse>({
+          supertestWithoutAuth,
+          apiKeyHeader: roleAuthc.apiKeyHeader,
+          internalOrigin: 'Kibana',
+          options: {
+            defaultIndex: ['filebeat-*'],
+            factoryQueryType: NetworkQueries.topNFlow,
+            filterQuery:
+              '{"bool":{"must":[],"filter":[{"match_all":{}}],"should":[],"must_not":[]}}',
+            flowTarget: FlowTargetSourceDest.source,
+            sort: { field: NetworkTopTablesFields.bytes_in, direction: Direction.asc },
+            pagination: {
+              activePage: 0,
+              cursorStart: 0,
+              fakePossibleCount: 0,
+              querySize: 10,
+            },
+            timerange: {
+              interval: '12h',
+              to: TO,
+              from: FROM,
+            },
+            inspect: false,
+          },
+          strategy: 'securitySolutionSearchStrategy',
+        });
+
+        expect(networkTopNFlow.edges.length).to.be(EDGE_LENGTH);
+        expect(
+          networkTopNFlow.edges.map((i: NetworkTopNFlowEdges) => i.node.source!.ip).join(',')
+        ).to.be(
+          '8.248.209.244,8.248.211.247,8.248.213.244,8.248.223.246,8.250.107.245,8.250.121.236,8.250.125.244,8.253.38.231,8.253.157.112,8.253.157.240'
+        );
+        expect(networkTopNFlow.edges[0].node.destination).to.be(undefined);
+        expect(networkTopNFlow.edges[0].node.source!.flows).to.be(12);
+        expect(networkTopNFlow.edges[0].node.source!.destination_ips).to.be(1);
+      });
+
+      it('should get Destination NetworkTopNFlow data', async () => {
+        const networkTopNFlow = await secureBsearch.send<NetworkTopNFlowStrategyResponse>({
+          supertestWithoutAuth,
+          apiKeyHeader: roleAuthc.apiKeyHeader,
+          internalOrigin: 'Kibana',
+          options: {
+            defaultIndex: ['filebeat-*'],
+            factoryQueryType: 'topNFlow',
+            filterQuery:
+              '{"bool":{"must":[],"filter":[{"match_all":{}}],"should":[],"must_not":[]}}',
+            sort: { field: NetworkTopTablesFields.bytes_in, direction: Direction.desc },
+            flowTarget: FlowTargetSourceDest.destination,
+            pagination: {
+              activePage: 0,
+              cursorStart: 0,
+              fakePossibleCount: 0,
+              querySize: 10,
+            },
+            timerange: {
+              interval: '12h',
+              to: TO,
+              from: FROM,
+            },
+            inspect: false,
+          },
+          strategy: 'securitySolutionSearchStrategy',
+        });
+
+        expect(networkTopNFlow.edges.length).to.be(EDGE_LENGTH);
+        expect(networkTopNFlow.edges[0].node.destination!.flows).to.be(19);
+        expect(networkTopNFlow.edges[0].node.destination!.source_ips).to.be(1);
+        expect(networkTopNFlow.edges[0].node.source).to.be(undefined);
+      });
+
+      it('should paginate NetworkTopNFlow query', async () => {
+        const networkTopNFlow = await secureBsearch.send<NetworkTopNFlowStrategyResponse>({
+          supertestWithoutAuth,
+          apiKeyHeader: roleAuthc.apiKeyHeader,
+          internalOrigin: 'Kibana',
+          options: {
+            defaultIndex: ['filebeat-*'],
+            factoryQueryType: 'topNFlow',
+            filterQuery:
+              '{"bool":{"must":[],"filter":[{"match_all":{}}],"should":[],"must_not":[]}}',
+            sort: { field: NetworkTopTablesFields.bytes_in, direction: Direction.desc },
+            flowTarget: FlowTargetSourceDest.source,
+            pagination: {
+              activePage: 1,
+              cursorStart: 10,
+              fakePossibleCount: 0,
+              querySize: 20,
+            },
+            timerange: {
+              interval: '12h',
+              to: TO,
+              from: FROM,
+            },
+            inspect: false,
+          },
+          strategy: 'securitySolutionSearchStrategy',
+        });
+
+        expect(networkTopNFlow.edges.length).to.be(EDGE_LENGTH);
+        expect(networkTopNFlow.edges[0].node.source!.ip).to.be('8.248.223.246');
+      });
+    });
+  });
+}
diff --git a/x-pack/test/security_solution_api_integration/test_suites/explore/network/trial_license_complete_tier/serverless/tls.ts b/x-pack/test/security_solution_api_integration/test_suites/explore/network/trial_license_complete_tier/serverless/tls.ts
new file mode 100644
index 00000000000000..6cc9721e67c1eb
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/explore/network/trial_license_complete_tier/serverless/tls.ts
@@ -0,0 +1,239 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import expect from '@kbn/expect';
+import {
+  NetworkQueries,
+  Direction,
+  NetworkTlsFields,
+  FlowTarget,
+  NetworkTlsStrategyResponse,
+} from '@kbn/security-solution-plugin/common/search_strategy';
+
+import { FtrProviderContext } from '../../../../../ftr_provider_context';
+import { RoleCredentials } from '../../../../../../../test_serverless/shared/services';
+
+const FROM = '2000-01-01T00:00:00.000Z';
+const TO = '3000-01-01T00:00:00.000Z';
+const SOURCE_IP = '10.128.0.35';
+const DESTINATION_IP = '74.125.129.95';
+
+const expectedResult = {
+  _id: '16989191B1A93ECECD5FE9E63EBD4B5C3B606D26',
+  subjects: ['CN=edgecert.googleapis.com,O=Google LLC,L=Mountain View,ST=California,C=US'],
+  issuers: ['CN=GTS CA 1O1,O=Google Trust Services,C=US'],
+  ja3: ['bd12d76eb0b6787e6a78a14d2ff96c2b'],
+  notAfter: ['2020-05-06T11:52:15.000Z'],
+};
+
+const expectedOverviewDestinationResult = {
+  edges: [
+    {
+      cursor: {
+        tiebreaker: null,
+        value: 'EB4E81DD7C55BA9715652ECF5647FB8877E55A8F',
+      },
+      node: {
+        _id: 'EB4E81DD7C55BA9715652ECF5647FB8877E55A8F',
+        subjects: [
+          'CN=*.cdn.mozilla.net,OU=Cloud Services,O=Mozilla Corporation,L=Mountain View,ST=California,C=US',
+        ],
+        issuers: ['CN=DigiCert SHA2 Secure Server CA,O=DigiCert Inc,C=US'],
+        ja3: ['b20b44b18b853ef29ab773e921b03422'],
+        notAfter: ['2020-12-09T12:00:00.000Z'],
+      },
+    },
+  ],
+  pageInfo: {
+    activePage: 0,
+    fakeTotalCount: 3,
+    showMorePagesIndicator: false,
+  },
+  totalCount: 3,
+};
+
+const expectedOverviewSourceResult = {
+  edges: [
+    {
+      cursor: {
+        tiebreaker: null,
+        value: 'EB4E81DD7C55BA9715652ECF5647FB8877E55A8F',
+      },
+      node: {
+        _id: 'EB4E81DD7C55BA9715652ECF5647FB8877E55A8F',
+        subjects: [
+          'CN=*.cdn.mozilla.net,OU=Cloud Services,O=Mozilla Corporation,L=Mountain View,ST=California,C=US',
+        ],
+        issuers: ['CN=DigiCert SHA2 Secure Server CA,O=DigiCert Inc,C=US'],
+        ja3: ['b20b44b18b853ef29ab773e921b03422'],
+        notAfter: ['2020-12-09T12:00:00.000Z'],
+      },
+    },
+  ],
+  pageInfo: {
+    activePage: 0,
+    fakeTotalCount: 3,
+    showMorePagesIndicator: false,
+  },
+  totalCount: 3,
+};
+
+export default function ({ getService }: FtrProviderContext) {
+  const esArchiver = getService('esArchiver');
+  const supertestWithoutAuth = getService('supertestWithoutAuth');
+  const secureBsearch = getService('secureBsearch');
+  const svlUserManager = getService('svlUserManager');
+  let roleAuthc: RoleCredentials;
+
+  describe('Tls Test with Packetbeat', () => {
+    describe('Tls Test', () => {
+      before(async () => {
+        await esArchiver.load('x-pack/test/functional/es_archives/packetbeat/tls');
+        roleAuthc = await svlUserManager.createApiKeyForRole('admin');
+      });
+      after(async () => {
+        await esArchiver.unload('x-pack/test/functional/es_archives/packetbeat/tls');
+        await svlUserManager.invalidateApiKeyForRole(roleAuthc);
+      });
+
+      it('Ensure data is returned for FlowTarget.Source', async () => {
+        const tls = await secureBsearch.send<NetworkTlsStrategyResponse>({
+          supertestWithoutAuth,
+          apiKeyHeader: roleAuthc.apiKeyHeader,
+          internalOrigin: 'Kibana',
+          options: {
+            factoryQueryType: NetworkQueries.tls,
+            timerange: {
+              interval: '12h',
+              to: TO,
+              from: FROM,
+            },
+            ip: SOURCE_IP,
+            flowTarget: FlowTarget.source,
+            sort: { field: NetworkTlsFields._id, direction: Direction.desc },
+            pagination: {
+              activePage: 0,
+              cursorStart: 0,
+              fakePossibleCount: 30,
+              querySize: 10,
+            },
+            defaultIndex: ['packetbeat-*'],
+            inspect: false,
+          },
+          strategy: 'securitySolutionSearchStrategy',
+        });
+        expect(tls.edges.length).to.be(1);
+        expect(tls.totalCount).to.be(1);
+        expect(tls.edges[0].node).to.eql(expectedResult);
+      });
+
+      it('Ensure data is returned for FlowTarget.Destination', async () => {
+        const tls = await secureBsearch.send<NetworkTlsStrategyResponse>({
+          supertestWithoutAuth,
+          apiKeyHeader: roleAuthc.apiKeyHeader,
+          internalOrigin: 'Kibana',
+          options: {
+            factoryQueryType: NetworkQueries.tls,
+            timerange: {
+              interval: '12h',
+              to: TO,
+              from: FROM,
+            },
+            ip: DESTINATION_IP,
+            flowTarget: FlowTarget.destination,
+            sort: { field: NetworkTlsFields._id, direction: Direction.desc },
+            pagination: {
+              activePage: 0,
+              cursorStart: 0,
+              fakePossibleCount: 30,
+              querySize: 10,
+            },
+            defaultIndex: ['packetbeat-*'],
+            inspect: false,
+          },
+          strategy: 'securitySolutionSearchStrategy',
+        });
+        expect(tls.edges.length).to.be(1);
+        expect(tls.totalCount).to.be(1);
+        expect(tls.edges[0].node).to.eql(expectedResult);
+      });
+    });
+
+    describe('Tls Overview Test', () => {
+      before(async () => {
+        await esArchiver.load('x-pack/test/functional/es_archives/packetbeat/tls');
+        roleAuthc = await svlUserManager.createApiKeyForRole('admin');
+      });
+      after(async () => {
+        await esArchiver.unload('x-pack/test/functional/es_archives/packetbeat/tls');
+        await svlUserManager.invalidateApiKeyForRole(roleAuthc);
+      });
+
+      it('Ensure data is returned for FlowTarget.Source', async () => {
+        const tls = await secureBsearch.send<NetworkTlsStrategyResponse>({
+          supertestWithoutAuth,
+          apiKeyHeader: roleAuthc.apiKeyHeader,
+          internalOrigin: 'Kibana',
+          options: {
+            factoryQueryType: NetworkQueries.tls,
+            timerange: {
+              interval: '12h',
+              to: TO,
+              from: FROM,
+            },
+            ip: '',
+            flowTarget: FlowTarget.source,
+            sort: { field: NetworkTlsFields._id, direction: Direction.desc },
+            pagination: {
+              activePage: 0,
+              cursorStart: 0,
+              fakePossibleCount: 30,
+              querySize: 10,
+            },
+            defaultIndex: ['packetbeat-*'],
+            inspect: false,
+          },
+          strategy: 'securitySolutionSearchStrategy',
+        });
+
+        expect(tls.pageInfo).to.eql(expectedOverviewSourceResult.pageInfo);
+        expect(tls.edges[0]).to.eql(expectedOverviewSourceResult.edges[0]);
+      });
+
+      it('Ensure data is returned for FlowTarget.Destination', async () => {
+        const tls = await secureBsearch.send<NetworkTlsStrategyResponse>({
+          supertestWithoutAuth,
+          apiKeyHeader: roleAuthc.apiKeyHeader,
+          internalOrigin: 'Kibana',
+          options: {
+            factoryQueryType: NetworkQueries.tls,
+            timerange: {
+              interval: '12h',
+              to: TO,
+              from: FROM,
+            },
+            ip: '',
+            flowTarget: FlowTarget.destination,
+            sort: { field: NetworkTlsFields._id, direction: Direction.desc },
+            pagination: {
+              activePage: 0,
+              cursorStart: 0,
+              fakePossibleCount: 30,
+              querySize: 10,
+            },
+            defaultIndex: ['packetbeat-*'],
+            inspect: false,
+          },
+          strategy: 'securitySolutionSearchStrategy',
+        });
+
+        expect(tls.pageInfo).to.eql(expectedOverviewDestinationResult.pageInfo);
+        expect(tls.edges[0]).to.eql(expectedOverviewDestinationResult.edges[0]);
+      });
+    });
+  });
+}
diff --git a/x-pack/test/security_solution_api_integration/test_suites/explore/overview/trial_license_complete_tier/configs/ess.config.ts b/x-pack/test/security_solution_api_integration/test_suites/explore/overview/trial_license_complete_tier/configs/ess.config.ts
new file mode 100644
index 00000000000000..c94840cb0709d7
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/explore/overview/trial_license_complete_tier/configs/ess.config.ts
@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { FtrConfigProviderContext } from '@kbn/test';
+
+export default async function ({ readConfigFile }: FtrConfigProviderContext) {
+  const functionalConfig = await readConfigFile(
+    require.resolve('../../../../../config/ess/config.base.trial')
+  );
+
+  return {
+    ...functionalConfig.getAll(),
+    testFiles: [require.resolve('../ess')],
+    junit: {
+      reportName: 'Explore - Overview Integration Tests - ESS Env - Trial License',
+    },
+  };
+}
diff --git a/x-pack/test/security_solution_api_integration/test_suites/explore/overview/trial_license_complete_tier/configs/serverless.config.ts b/x-pack/test/security_solution_api_integration/test_suites/explore/overview/trial_license_complete_tier/configs/serverless.config.ts
new file mode 100644
index 00000000000000..91dc13bc762812
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/explore/overview/trial_license_complete_tier/configs/serverless.config.ts
@@ -0,0 +1,23 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { createTestConfig } from '../../../../../config/serverless/config.base';
+
+export default createTestConfig({
+  kbnTestServerArgs: [
+    `--xpack.securitySolution.enableExperimental=${JSON.stringify([])}`,
+    `--xpack.securitySolutionServerless.productTypes=${JSON.stringify([
+      { product_line: 'security', product_tier: 'complete' },
+      { product_line: 'endpoint', product_tier: 'complete' },
+      { product_line: 'cloud', product_tier: 'complete' },
+    ])}`,
+  ],
+  testFiles: [require.resolve('../serverless')],
+  junit: {
+    reportName: 'Explore - Overview Integration Tests - Serverless Env - Complete Tier',
+  },
+});
diff --git a/x-pack/test/security_solution_api_integration/test_suites/explore/overview/trial_license_complete_tier/ess/index.ts b/x-pack/test/security_solution_api_integration/test_suites/explore/overview/trial_license_complete_tier/ess/index.ts
new file mode 100644
index 00000000000000..1967dec3cd9d89
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/explore/overview/trial_license_complete_tier/ess/index.ts
@@ -0,0 +1,15 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { FtrProviderContextWithSpaces } from '../../../../../ftr_provider_context_with_spaces';
+
+export default function ({ loadTestFile }: FtrProviderContextWithSpaces) {
+  describe('@ess SecuritySolution Explore Overview', () => {
+    loadTestFile(require.resolve('./overview_host'));
+    loadTestFile(require.resolve('./overview_network'));
+  });
+}
diff --git a/x-pack/test/api_integration/apis/security_solution/overview_host.ts b/x-pack/test/security_solution_api_integration/test_suites/explore/overview/trial_license_complete_tier/ess/overview_host.ts
similarity index 92%
rename from x-pack/test/api_integration/apis/security_solution/overview_host.ts
rename to x-pack/test/security_solution_api_integration/test_suites/explore/overview/trial_license_complete_tier/ess/overview_host.ts
index 1cf7e9cc0b5981..a528a02eae7188 100644
--- a/x-pack/test/api_integration/apis/security_solution/overview_host.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/explore/overview/trial_license_complete_tier/ess/overview_host.ts
@@ -11,12 +11,12 @@ import {
   HostsQueries,
   HostsOverviewStrategyResponse,
 } from '@kbn/security-solution-plugin/common/search_strategy';
-import { FtrProviderContext } from '../../ftr_provider_context';
+import { FtrProviderContextWithSpaces } from '../../../../../ftr_provider_context_with_spaces';
 
-export default function ({ getService }: FtrProviderContext) {
+export default function ({ getService }: FtrProviderContextWithSpaces) {
   const esArchiver = getService('esArchiver');
-  const supertest = getService('supertest');
   const bsearch = getService('bsearch');
+  const supertest = getService('supertest');
 
   describe('Overview Host', () => {
     describe('With auditbeat', () => {
diff --git a/x-pack/test/api_integration/apis/security_solution/overview_network.ts b/x-pack/test/security_solution_api_integration/test_suites/explore/overview/trial_license_complete_tier/ess/overview_network.ts
similarity index 96%
rename from x-pack/test/api_integration/apis/security_solution/overview_network.ts
rename to x-pack/test/security_solution_api_integration/test_suites/explore/overview/trial_license_complete_tier/ess/overview_network.ts
index 9fd5b107fa5f29..76c2c0b45efe1e 100644
--- a/x-pack/test/api_integration/apis/security_solution/overview_network.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/explore/overview/trial_license_complete_tier/ess/overview_network.ts
@@ -10,12 +10,12 @@ import {
   NetworkOverviewStrategyResponse,
   NetworkQueries,
 } from '@kbn/security-solution-plugin/common/search_strategy';
-import { FtrProviderContext } from '../../ftr_provider_context';
+import { FtrProviderContextWithSpaces } from '../../../../../ftr_provider_context_with_spaces';
 
-export default function ({ getService }: FtrProviderContext) {
+export default function ({ getService }: FtrProviderContextWithSpaces) {
   const esArchiver = getService('esArchiver');
-  const supertest = getService('supertest');
   const bsearch = getService('bsearch');
+  const supertest = getService('supertest');
 
   describe('Overview Network', () => {
     describe('With filebeat', () => {
diff --git a/x-pack/test/security_solution_api_integration/test_suites/explore/overview/trial_license_complete_tier/serverless/index.ts b/x-pack/test/security_solution_api_integration/test_suites/explore/overview/trial_license_complete_tier/serverless/index.ts
new file mode 100644
index 00000000000000..dee32eba5b386a
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/explore/overview/trial_license_complete_tier/serverless/index.ts
@@ -0,0 +1,15 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { FtrProviderContext } from '../../../../../ftr_provider_context';
+
+export default function ({ loadTestFile, getService }: FtrProviderContext) {
+  describe('@serverless SecuritySolution Explore Overview', () => {
+    loadTestFile(require.resolve('./overview_host'));
+    loadTestFile(require.resolve('./overview_network'));
+  });
+}
diff --git a/x-pack/test/security_solution_api_integration/test_suites/explore/overview/trial_license_complete_tier/serverless/overview_host.ts b/x-pack/test/security_solution_api_integration/test_suites/explore/overview/trial_license_complete_tier/serverless/overview_host.ts
new file mode 100644
index 00000000000000..f0ae3005241504
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/explore/overview/trial_license_complete_tier/serverless/overview_host.ts
@@ -0,0 +1,76 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import expect from '@kbn/expect';
+
+import {
+  HostsQueries,
+  HostsOverviewStrategyResponse,
+} from '@kbn/security-solution-plugin/common/search_strategy';
+import { FtrProviderContext } from '../../../../../ftr_provider_context';
+import { RoleCredentials } from '../../../../../../../test_serverless/shared/services';
+
+export default function ({ getService }: FtrProviderContext) {
+  const esArchiver = getService('esArchiver');
+  const secureBsearch = getService('secureBsearch');
+  const supertestWithoutAuth = getService('supertestWithoutAuth');
+  const svlUserManager = getService('svlUserManager');
+  let roleAuthc: RoleCredentials;
+  describe('Overview Host', () => {
+    describe('With auditbeat', () => {
+      before(async () => {
+        await esArchiver.load('x-pack/test/functional/es_archives/auditbeat/overview');
+        roleAuthc = await svlUserManager.createApiKeyForRole('admin');
+      });
+      after(async () => {
+        await esArchiver.unload('x-pack/test/functional/es_archives/auditbeat/overview');
+        await svlUserManager.invalidateApiKeyForRole(roleAuthc);
+      });
+
+      const FROM = '2000-01-01T00:00:00.000Z';
+      const TO = '3000-01-01T00:00:00.000Z';
+      const expectedResult = {
+        auditbeatAuditd: 2194,
+        auditbeatFIM: 4,
+        auditbeatLogin: 2810,
+        auditbeatPackage: 3,
+        auditbeatProcess: 7,
+        auditbeatUser: 6,
+        endgameDns: 1,
+        endgameFile: 2,
+        endgameImageLoad: 1,
+        endgameNetwork: 4,
+        endgameProcess: 2,
+        endgameRegistry: 1,
+        endgameSecurity: 4,
+        filebeatSystemModule: 0,
+        winlogbeatSecurity: 0,
+        winlogbeatMWSysmonOperational: 0,
+      };
+
+      it('Make sure that we get OverviewHost data', async () => {
+        const { overviewHost } = await secureBsearch.send<HostsOverviewStrategyResponse>({
+          supertestWithoutAuth,
+          apiKeyHeader: roleAuthc.apiKeyHeader,
+          internalOrigin: 'Kibana',
+          options: {
+            defaultIndex: ['auditbeat-*'],
+            factoryQueryType: HostsQueries.overview,
+            timerange: {
+              interval: '12h',
+              to: TO,
+              from: FROM,
+            },
+            inspect: false,
+          },
+          strategy: 'securitySolutionSearchStrategy',
+        });
+        expect(overviewHost).to.eql(expectedResult);
+      });
+    });
+  });
+}
diff --git a/x-pack/test/security_solution_api_integration/test_suites/explore/overview/trial_license_complete_tier/serverless/overview_network.ts b/x-pack/test/security_solution_api_integration/test_suites/explore/overview/trial_license_complete_tier/serverless/overview_network.ts
new file mode 100644
index 00000000000000..bd4647ac2ec260
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/explore/overview/trial_license_complete_tier/serverless/overview_network.ts
@@ -0,0 +1,160 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import expect from '@kbn/expect';
+import {
+  NetworkOverviewStrategyResponse,
+  NetworkQueries,
+} from '@kbn/security-solution-plugin/common/search_strategy';
+import { FtrProviderContext } from '../../../../../ftr_provider_context';
+import { RoleCredentials } from '../../../../../../../test_serverless/shared/services';
+
+export default function ({ getService }: FtrProviderContext) {
+  const esArchiver = getService('esArchiver');
+  const secureBsearch = getService('secureBsearch');
+  const supertestWithoutAuth = getService('supertestWithoutAuth');
+  const svlUserManager = getService('svlUserManager');
+  let roleAuthc: RoleCredentials;
+
+  describe('Overview Network', () => {
+    describe('With filebeat', () => {
+      before(async () => {
+        await esArchiver.load('x-pack/test/functional/es_archives/filebeat/default');
+        roleAuthc = await svlUserManager.createApiKeyForRole('admin');
+      });
+      after(async () => {
+        await esArchiver.unload('x-pack/test/functional/es_archives/filebeat/default');
+        await svlUserManager.invalidateApiKeyForRole(roleAuthc);
+      });
+
+      const FROM = '2000-01-01T00:00:00.000Z';
+      const TO = '3000-01-01T00:00:00.000Z';
+
+      const expectedResult = {
+        auditbeatSocket: 0,
+        filebeatCisco: 0,
+        filebeatNetflow: 1273,
+        filebeatPanw: 0,
+        filebeatSuricata: 4547,
+        filebeatZeek: 0,
+        packetbeatDNS: 0,
+        packetbeatFlow: 0,
+        packetbeatTLS: 0,
+      };
+
+      it('Make sure that we get OverviewNetwork data', async () => {
+        const { overviewNetwork } = await secureBsearch.send<NetworkOverviewStrategyResponse>({
+          supertestWithoutAuth,
+          apiKeyHeader: roleAuthc.apiKeyHeader,
+          internalOrigin: 'Kibana',
+          options: {
+            defaultIndex: ['filebeat-*'],
+            factoryQueryType: NetworkQueries.overview,
+            timerange: {
+              interval: '12h',
+              to: TO,
+              from: FROM,
+            },
+            inspect: false,
+          },
+          strategy: 'securitySolutionSearchStrategy',
+        });
+        expect(overviewNetwork).to.eql(expectedResult);
+      });
+    });
+
+    describe('With packetbeat', () => {
+      before(async () => {
+        await esArchiver.load('x-pack/test/functional/es_archives/packetbeat/overview');
+        roleAuthc = await svlUserManager.createApiKeyForRole('admin');
+      });
+      after(async () => {
+        await esArchiver.unload('x-pack/test/functional/es_archives/packetbeat/overview');
+        await svlUserManager.invalidateApiKeyForRole(roleAuthc);
+      });
+
+      const FROM = '2000-01-01T00:00:00.000Z';
+      const TO = '3000-01-01T00:00:00.000Z';
+      const expectedResult = {
+        auditbeatSocket: 0,
+        filebeatCisco: 0,
+        filebeatNetflow: 0,
+        filebeatPanw: 0,
+        filebeatSuricata: 0,
+        filebeatZeek: 0,
+        packetbeatDNS: 44,
+        packetbeatFlow: 588,
+        packetbeatTLS: 0,
+      };
+
+      it('Make sure that we get OverviewNetwork data', async () => {
+        const { overviewNetwork } = await secureBsearch.send<NetworkOverviewStrategyResponse>({
+          supertestWithoutAuth,
+          apiKeyHeader: roleAuthc.apiKeyHeader,
+          internalOrigin: 'Kibana',
+          options: {
+            defaultIndex: ['packetbeat-*'],
+            factoryQueryType: NetworkQueries.overview,
+            timerange: {
+              interval: '12h',
+              to: TO,
+              from: FROM,
+            },
+            inspect: false,
+          },
+          strategy: 'securitySolutionSearchStrategy',
+        });
+        expect(overviewNetwork).to.eql(expectedResult);
+      });
+    });
+
+    describe('With auditbeat', () => {
+      before(async () => {
+        await esArchiver.load('x-pack/test/functional/es_archives/auditbeat/overview');
+        roleAuthc = await svlUserManager.createApiKeyForRole('admin');
+      });
+      after(async () => {
+        await esArchiver.unload('x-pack/test/functional/es_archives/auditbeat/overview');
+        await svlUserManager.invalidateApiKeyForRole(roleAuthc);
+      });
+
+      const FROM = '2000-01-01T00:00:00.000Z';
+      const TO = '3000-01-01T00:00:00.000Z';
+      const expectedResult = {
+        auditbeatSocket: 45,
+        filebeatCisco: 0,
+        filebeatNetflow: 0,
+        filebeatPanw: 0,
+        filebeatSuricata: 0,
+        filebeatZeek: 0,
+        packetbeatDNS: 0,
+        packetbeatFlow: 0,
+        packetbeatTLS: 0,
+      };
+
+      it('Make sure that we get OverviewNetwork data', async () => {
+        const { overviewNetwork } = await secureBsearch.send<NetworkOverviewStrategyResponse>({
+          supertestWithoutAuth,
+          apiKeyHeader: roleAuthc.apiKeyHeader,
+          internalOrigin: 'Kibana',
+          options: {
+            defaultIndex: ['auditbeat-*'],
+            factoryQueryType: NetworkQueries.overview,
+            timerange: {
+              interval: '12h',
+              to: TO,
+              from: FROM,
+            },
+            inspect: false,
+          },
+          strategy: 'securitySolutionSearchStrategy',
+        });
+        expect(overviewNetwork).to.eql(expectedResult);
+      });
+    });
+  });
+}
diff --git a/x-pack/test/security_solution_api_integration/test_suites/explore/users/trial_license_complete_tier/configs/ess.config.ts b/x-pack/test/security_solution_api_integration/test_suites/explore/users/trial_license_complete_tier/configs/ess.config.ts
new file mode 100644
index 00000000000000..fc5c840bfc2afe
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/explore/users/trial_license_complete_tier/configs/ess.config.ts
@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { FtrConfigProviderContext } from '@kbn/test';
+
+export default async function ({ readConfigFile }: FtrConfigProviderContext) {
+  const functionalConfig = await readConfigFile(
+    require.resolve('../../../../../config/ess/config.base.trial')
+  );
+
+  return {
+    ...functionalConfig.getAll(),
+    testFiles: [require.resolve('../ess')],
+    junit: {
+      reportName: 'Explore - Users Integration Tests - ESS Env - Trial License',
+    },
+  };
+}
diff --git a/x-pack/test/security_solution_api_integration/test_suites/explore/users/trial_license_complete_tier/configs/serverless.config.ts b/x-pack/test/security_solution_api_integration/test_suites/explore/users/trial_license_complete_tier/configs/serverless.config.ts
new file mode 100644
index 00000000000000..18415c5fbbbc24
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/explore/users/trial_license_complete_tier/configs/serverless.config.ts
@@ -0,0 +1,23 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { createTestConfig } from '../../../../../config/serverless/config.base';
+
+export default createTestConfig({
+  kbnTestServerArgs: [
+    `--xpack.securitySolution.enableExperimental=${JSON.stringify([])}`,
+    `--xpack.securitySolutionServerless.productTypes=${JSON.stringify([
+      { product_line: 'security', product_tier: 'complete' },
+      { product_line: 'endpoint', product_tier: 'complete' },
+      { product_line: 'cloud', product_tier: 'complete' },
+    ])}`,
+  ],
+  testFiles: [require.resolve('../serverless')],
+  junit: {
+    reportName: 'Explore - Users Integration Tests - Serverless Env - Complete Tier',
+  },
+});
diff --git a/x-pack/test/api_integration/apis/security_solution/authentications.ts b/x-pack/test/security_solution_api_integration/test_suites/explore/users/trial_license_complete_tier/ess/authentications.ts
similarity index 95%
rename from x-pack/test/api_integration/apis/security_solution/authentications.ts
rename to x-pack/test/security_solution_api_integration/test_suites/explore/users/trial_license_complete_tier/ess/authentications.ts
index b65c93995156b8..95c9bf4d6a0372 100644
--- a/x-pack/test/api_integration/apis/security_solution/authentications.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/explore/users/trial_license_complete_tier/ess/authentications.ts
@@ -14,7 +14,7 @@ import {
 } from '@kbn/security-solution-plugin/common/search_strategy';
 import type { UserAuthenticationsRequestOptions } from '@kbn/security-solution-plugin/common/api/search_strategy';
 
-import { FtrProviderContext } from '../../ftr_provider_context';
+import { FtrProviderContextWithSpaces } from '../../../../../ftr_provider_context_with_spaces';
 
 const FROM = '2000-01-01T00:00:00.000Z';
 const TO = '3000-01-01T00:00:00.000Z';
@@ -25,10 +25,10 @@ const LAST_SUCCESS_SOURCE_IP = '8.42.77.171';
 const TOTAL_COUNT = 3;
 const EDGE_LENGTH = 1;
 
-export default function ({ getService }: FtrProviderContext) {
+export default function ({ getService }: FtrProviderContextWithSpaces) {
   const esArchiver = getService('esArchiver');
-  const supertest = getService('supertest');
   const bsearch = getService('bsearch');
+  const supertest = getService('supertest');
 
   describe('authentications', () => {
     before(async () => await esArchiver.load('x-pack/test/functional/es_archives/auditbeat/hosts'));
diff --git a/x-pack/test/security_solution_api_integration/test_suites/explore/users/trial_license_complete_tier/ess/index.ts b/x-pack/test/security_solution_api_integration/test_suites/explore/users/trial_license_complete_tier/ess/index.ts
new file mode 100644
index 00000000000000..9b84129d0b98f8
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/explore/users/trial_license_complete_tier/ess/index.ts
@@ -0,0 +1,15 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { FtrProviderContextWithSpaces } from '../../../../../ftr_provider_context_with_spaces';
+
+export default function ({ loadTestFile }: FtrProviderContextWithSpaces) {
+  describe('@ess SecuritySolution Explore Users', () => {
+    loadTestFile(require.resolve('./authentications'));
+    loadTestFile(require.resolve('./users'));
+  });
+}
diff --git a/x-pack/test/api_integration/apis/security_solution/users.ts b/x-pack/test/security_solution_api_integration/test_suites/explore/users/trial_license_complete_tier/ess/users.ts
similarity index 93%
rename from x-pack/test/api_integration/apis/security_solution/users.ts
rename to x-pack/test/security_solution_api_integration/test_suites/explore/users/trial_license_complete_tier/ess/users.ts
index b04a3595b0a050..c204ea64bd1c23 100644
--- a/x-pack/test/api_integration/apis/security_solution/users.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/explore/users/trial_license_complete_tier/ess/users.ts
@@ -14,16 +14,16 @@ import {
   NetworkUsersStrategyResponse,
 } from '@kbn/security-solution-plugin/common/search_strategy';
 
-import { FtrProviderContext } from '../../ftr_provider_context';
+import { FtrProviderContextWithSpaces } from '../../../../../ftr_provider_context_with_spaces';
 
 const FROM = '2000-01-01T00:00:00.000Z';
 const TO = '3000-01-01T00:00:00.000Z';
 const IP = '0.0.0.0';
 
-export default function ({ getService }: FtrProviderContext) {
+export default function ({ getService }: FtrProviderContextWithSpaces) {
   const esArchiver = getService('esArchiver');
-  const supertest = getService('supertest');
   const bsearch = getService('bsearch');
+  const supertest = getService('supertest');
 
   describe('Users', () => {
     describe('With auditbeat', () => {
diff --git a/x-pack/test/security_solution_api_integration/test_suites/explore/users/trial_license_complete_tier/serverless/authentications.ts b/x-pack/test/security_solution_api_integration/test_suites/explore/users/trial_license_complete_tier/serverless/authentications.ts
new file mode 100644
index 00000000000000..d611f1aa47a5cc
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/explore/users/trial_license_complete_tier/serverless/authentications.ts
@@ -0,0 +1,115 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import expect from '@kbn/expect';
+import {
+  AuthStackByField,
+  Direction,
+  UserAuthenticationsStrategyResponse,
+  UsersQueries,
+} from '@kbn/security-solution-plugin/common/search_strategy';
+import type { UserAuthenticationsRequestOptions } from '@kbn/security-solution-plugin/common/api/search_strategy';
+
+import { FtrProviderContext } from '../../../../../ftr_provider_context';
+import { RoleCredentials } from '../../../../../../../test_serverless/shared/services';
+
+const FROM = '2000-01-01T00:00:00.000Z';
+const TO = '3000-01-01T00:00:00.000Z';
+
+// typical values that have to change after an update from "scripts/es_archiver"
+const HOST_NAME = 'zeek-newyork-sha-aa8df15';
+const LAST_SUCCESS_SOURCE_IP = '8.42.77.171';
+const TOTAL_COUNT = 3;
+const EDGE_LENGTH = 1;
+
+export default function ({ getService }: FtrProviderContext) {
+  const esArchiver = getService('esArchiver');
+  const secureBsearch = getService('secureBsearch');
+  const supertestWithoutAuth = getService('supertestWithoutAuth');
+  const svlUserManager = getService('svlUserManager');
+  let roleAuthc: RoleCredentials;
+  describe('authentications', () => {
+    before(async () => {
+      await esArchiver.load('x-pack/test/functional/es_archives/auditbeat/hosts');
+      roleAuthc = await svlUserManager.createApiKeyForRole('admin');
+    });
+
+    after(async () => {
+      await esArchiver.unload('x-pack/test/functional/es_archives/auditbeat/hosts');
+      await svlUserManager.invalidateApiKeyForRole(roleAuthc);
+    });
+
+    it('Make sure that we get Authentication data', async () => {
+      const requestOptions: UserAuthenticationsRequestOptions = {
+        factoryQueryType: UsersQueries.authentications,
+        timerange: {
+          interval: '12h',
+          to: TO,
+          from: FROM,
+        },
+        pagination: {
+          activePage: 0,
+          cursorStart: 0,
+          fakePossibleCount: 3,
+          querySize: 1,
+        },
+        defaultIndex: ['auditbeat-*'],
+        stackByField: AuthStackByField.userName,
+        sort: { field: 'timestamp', direction: Direction.asc },
+        filterQuery: '',
+      };
+
+      const authentications = await secureBsearch.send<UserAuthenticationsStrategyResponse>({
+        supertestWithoutAuth,
+        apiKeyHeader: roleAuthc.apiKeyHeader,
+        internalOrigin: 'Kibana',
+        options: requestOptions,
+        strategy: 'securitySolutionSearchStrategy',
+      });
+
+      expect(authentications.edges.length).to.be(EDGE_LENGTH);
+      expect(authentications.totalCount).to.be(TOTAL_COUNT);
+      expect(authentications.pageInfo.fakeTotalCount).to.equal(3);
+    });
+
+    it('Make sure that pagination is working in Authentications query', async () => {
+      const requestOptions: UserAuthenticationsRequestOptions = {
+        factoryQueryType: UsersQueries.authentications,
+        timerange: {
+          interval: '12h',
+          to: TO,
+          from: FROM,
+        },
+        pagination: {
+          activePage: 2,
+          cursorStart: 1,
+          fakePossibleCount: 5,
+          querySize: 2,
+        },
+        defaultIndex: ['auditbeat-*'],
+        stackByField: AuthStackByField.userName,
+        sort: { field: 'timestamp', direction: Direction.asc },
+        filterQuery: '',
+      };
+
+      const authentications = await secureBsearch.send<UserAuthenticationsStrategyResponse>({
+        supertestWithoutAuth,
+        apiKeyHeader: roleAuthc.apiKeyHeader,
+        internalOrigin: 'Kibana',
+        options: requestOptions,
+        strategy: 'securitySolutionSearchStrategy',
+      });
+
+      expect(authentications.edges.length).to.be(EDGE_LENGTH);
+      expect(authentications.totalCount).to.be(TOTAL_COUNT);
+      expect(authentications.edges[0].node.lastSuccess?.source?.ip).to.eql([
+        LAST_SUCCESS_SOURCE_IP,
+      ]);
+      expect(authentications.edges[0].node.lastSuccess?.host?.name).to.eql([HOST_NAME]);
+    });
+  });
+}
diff --git a/x-pack/test/security_solution_api_integration/test_suites/explore/users/trial_license_complete_tier/serverless/index.ts b/x-pack/test/security_solution_api_integration/test_suites/explore/users/trial_license_complete_tier/serverless/index.ts
new file mode 100644
index 00000000000000..aabf2a0fd30224
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/explore/users/trial_license_complete_tier/serverless/index.ts
@@ -0,0 +1,15 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { FtrProviderContext } from '../../../../../ftr_provider_context';
+
+export default function ({ loadTestFile }: FtrProviderContext) {
+  describe('@serverless SecuritySolution Explore Users', () => {
+    loadTestFile(require.resolve('./authentications'));
+    loadTestFile(require.resolve('./users'));
+  });
+}
diff --git a/x-pack/test/security_solution_api_integration/test_suites/explore/users/trial_license_complete_tier/serverless/users.ts b/x-pack/test/security_solution_api_integration/test_suites/explore/users/trial_license_complete_tier/serverless/users.ts
new file mode 100644
index 00000000000000..55cc317cebdf64
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/explore/users/trial_license_complete_tier/serverless/users.ts
@@ -0,0 +1,79 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import expect from '@kbn/expect';
+import {
+  NetworkQueries,
+  Direction,
+  NetworkUsersFields,
+  FlowTarget,
+  NetworkUsersStrategyResponse,
+} from '@kbn/security-solution-plugin/common/search_strategy';
+
+import { FtrProviderContext } from '../../../../../ftr_provider_context';
+import { RoleCredentials } from '../../../../../../../test_serverless/shared/services';
+
+const FROM = '2000-01-01T00:00:00.000Z';
+const TO = '3000-01-01T00:00:00.000Z';
+const IP = '0.0.0.0';
+
+export default function ({ getService }: FtrProviderContext) {
+  const esArchiver = getService('esArchiver');
+  const secureBsearch = getService('secureBsearch');
+  const supertestWithoutAuth = getService('supertestWithoutAuth');
+  const svlUserManager = getService('svlUserManager');
+  let roleAuthc: RoleCredentials;
+
+  describe('Users', () => {
+    describe('With auditbeat', () => {
+      before(async () => {
+        await esArchiver.load('x-pack/test/functional/es_archives/auditbeat/users');
+        roleAuthc = await svlUserManager.createApiKeyForRole('admin');
+      });
+      after(async () => {
+        await esArchiver.unload('x-pack/test/functional/es_archives/auditbeat/users');
+        await svlUserManager.invalidateApiKeyForRole(roleAuthc);
+      });
+
+      it('Ensure data is returned from auditbeat', async () => {
+        const users = await secureBsearch.send<NetworkUsersStrategyResponse>({
+          supertestWithoutAuth,
+          apiKeyHeader: roleAuthc.apiKeyHeader,
+          internalOrigin: 'Kibana',
+          options: {
+            factoryQueryType: NetworkQueries.users,
+            sourceId: 'default',
+            timerange: {
+              interval: '12h',
+              to: TO,
+              from: FROM,
+            },
+            defaultIndex: ['auditbeat-users'],
+            ip: IP,
+            flowTarget: FlowTarget.destination,
+            sort: { field: NetworkUsersFields.name, direction: Direction.asc },
+            pagination: {
+              activePage: 0,
+              cursorStart: 0,
+              fakePossibleCount: 30,
+              querySize: 10,
+            },
+            inspect: false,
+          },
+          strategy: 'securitySolutionSearchStrategy',
+        });
+        expect(users.edges.length).to.be(1);
+        expect(users.totalCount).to.be(1);
+        expect(users.edges[0].node.user?.id).to.eql(['0']);
+        expect(users.edges[0].node.user?.name).to.be('root');
+        expect(users.edges[0].node.user?.groupId).to.eql(['0']);
+        expect(users.edges[0].node.user?.groupName).to.eql(['root']);
+        expect(users.edges[0].node.user?.count).to.be(1);
+      });
+    });
+  });
+}
diff --git a/x-pack/test/security_solution_api_integration/test_suites/investigation/saved_objects/trial_license_complete_tier/configs/ess.config.ts b/x-pack/test/security_solution_api_integration/test_suites/investigation/saved_objects/trial_license_complete_tier/configs/ess.config.ts
new file mode 100644
index 00000000000000..fa7c8aaaab2e12
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/investigation/saved_objects/trial_license_complete_tier/configs/ess.config.ts
@@ -0,0 +1,28 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { FtrConfigProviderContext } from '@kbn/test';
+export default async function ({ readConfigFile }: FtrConfigProviderContext) {
+  const functionalConfig = await readConfigFile(
+    require.resolve('../../../../../config/ess/config.base.basic')
+  );
+
+  return {
+    ...functionalConfig.getAll(),
+    kbnTestServer: {
+      ...functionalConfig.get('kbnTestServer'),
+      serverArgs: [
+        ...functionalConfig.get('kbnTestServer.serverArgs'),
+        `--xpack.securitySolution.enableExperimental=${JSON.stringify([])}`,
+      ],
+    },
+    testFiles: [require.resolve('..')],
+    junit: {
+      reportName: 'Saved Objects Integration Tests - ESS Env - Basic License',
+    },
+  };
+}
diff --git a/x-pack/test/security_solution_api_integration/test_suites/investigation/saved_objects/trial_license_complete_tier/configs/serverless.config.ts b/x-pack/test/security_solution_api_integration/test_suites/investigation/saved_objects/trial_license_complete_tier/configs/serverless.config.ts
new file mode 100644
index 00000000000000..b7d273add372bc
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/investigation/saved_objects/trial_license_complete_tier/configs/serverless.config.ts
@@ -0,0 +1,23 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { createTestConfig } from '../../../../../config/serverless/config.base';
+
+export default createTestConfig({
+  kbnTestServerArgs: [
+    `--xpack.securitySolution.enableExperimental=${JSON.stringify([])}`,
+    `--xpack.securitySolutionServerless.productTypes=${JSON.stringify([
+      { product_line: 'security', product_tier: 'essentials' },
+      { product_line: 'endpoint', product_tier: 'essentials' },
+      { product_line: 'cloud', product_tier: 'essentials' },
+    ])}`,
+  ],
+  testFiles: [require.resolve('..')],
+  junit: {
+    reportName: 'Saved Objects Integration Tests - Serverless Env - Essentials Tier',
+  },
+});
diff --git a/x-pack/test/api_integration/apis/security_solution/saved_objects/draft_timeline.ts b/x-pack/test/security_solution_api_integration/test_suites/investigation/saved_objects/trial_license_complete_tier/draft_timeline.ts
similarity index 98%
rename from x-pack/test/api_integration/apis/security_solution/saved_objects/draft_timeline.ts
rename to x-pack/test/security_solution_api_integration/test_suites/investigation/saved_objects/trial_license_complete_tier/draft_timeline.ts
index 40e323b3c37f52..f084afa62d6af2 100644
--- a/x-pack/test/api_integration/apis/security_solution/saved_objects/draft_timeline.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/investigation/saved_objects/trial_license_complete_tier/draft_timeline.ts
@@ -7,7 +7,7 @@
 
 import expect from '@kbn/expect';
 
-import { FtrProviderContext } from '../../../ftr_provider_context';
+import { FtrProviderContext } from '../../../../../api_integration/ftr_provider_context';
 
 export default function ({ getService }: FtrProviderContext) {
   const kibanaServer = getService('kibanaServer');
diff --git a/x-pack/test/api_integration/apis/security_solution/saved_objects/helpers.ts b/x-pack/test/security_solution_api_integration/test_suites/investigation/saved_objects/trial_license_complete_tier/helpers.ts
similarity index 100%
rename from x-pack/test/api_integration/apis/security_solution/saved_objects/helpers.ts
rename to x-pack/test/security_solution_api_integration/test_suites/investigation/saved_objects/trial_license_complete_tier/helpers.ts
diff --git a/x-pack/test/security_solution_api_integration/test_suites/investigation/saved_objects/trial_license_complete_tier/index.ts b/x-pack/test/security_solution_api_integration/test_suites/investigation/saved_objects/trial_license_complete_tier/index.ts
new file mode 100644
index 00000000000000..e3402e0c6b80ef
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/investigation/saved_objects/trial_license_complete_tier/index.ts
@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { FtrProviderContext } from '../../../../ftr_provider_context';
+
+export default function ({ loadTestFile }: FtrProviderContext) {
+  describe('@ess @serverless SecuritySolution Saved Objects', () => {
+    loadTestFile(require.resolve('./notes'));
+    loadTestFile(require.resolve('./pinned_events'));
+    loadTestFile(require.resolve('./timeline'));
+  });
+}
diff --git a/x-pack/test/api_integration/apis/security_solution/saved_objects/notes.ts b/x-pack/test/security_solution_api_integration/test_suites/investigation/saved_objects/trial_license_complete_tier/notes.ts
similarity index 96%
rename from x-pack/test/api_integration/apis/security_solution/saved_objects/notes.ts
rename to x-pack/test/security_solution_api_integration/test_suites/investigation/saved_objects/trial_license_complete_tier/notes.ts
index 80db8b736dac30..666e36325fd7f5 100644
--- a/x-pack/test/api_integration/apis/security_solution/saved_objects/notes.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/investigation/saved_objects/trial_license_complete_tier/notes.ts
@@ -7,7 +7,7 @@
 
 import expect from '@kbn/expect';
 
-import { FtrProviderContext } from '../../../ftr_provider_context';
+import { FtrProviderContext } from '../../../../../api_integration/ftr_provider_context';
 
 export default function ({ getService }: FtrProviderContext) {
   const kibanaServer = getService('kibanaServer');
diff --git a/x-pack/test/api_integration/apis/security_solution/saved_objects/pinned_events.ts b/x-pack/test/security_solution_api_integration/test_suites/investigation/saved_objects/trial_license_complete_tier/pinned_events.ts
similarity index 96%
rename from x-pack/test/api_integration/apis/security_solution/saved_objects/pinned_events.ts
rename to x-pack/test/security_solution_api_integration/test_suites/investigation/saved_objects/trial_license_complete_tier/pinned_events.ts
index f7a16989b692d8..9273a5d6c6a5eb 100644
--- a/x-pack/test/api_integration/apis/security_solution/saved_objects/pinned_events.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/investigation/saved_objects/trial_license_complete_tier/pinned_events.ts
@@ -7,7 +7,7 @@
 
 import expect from '@kbn/expect';
 
-import { FtrProviderContext } from '../../../ftr_provider_context';
+import { FtrProviderContext } from '../../../../../api_integration/ftr_provider_context';
 
 export default function ({ getService }: FtrProviderContext) {
   const kibanaServer = getService('kibanaServer');
diff --git a/x-pack/test/api_integration/apis/security_solution/saved_objects/timeline.ts b/x-pack/test/security_solution_api_integration/test_suites/investigation/saved_objects/trial_license_complete_tier/timeline.ts
similarity index 99%
rename from x-pack/test/api_integration/apis/security_solution/saved_objects/timeline.ts
rename to x-pack/test/security_solution_api_integration/test_suites/investigation/saved_objects/trial_license_complete_tier/timeline.ts
index f253b3d5dec38a..21270c6d362896 100644
--- a/x-pack/test/api_integration/apis/security_solution/saved_objects/timeline.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/investigation/saved_objects/trial_license_complete_tier/timeline.ts
@@ -7,7 +7,7 @@
 
 import expect from '@kbn/expect';
 import { TimelineResult, TimelineType } from '@kbn/security-solution-plugin/common/api/timeline';
-import { FtrProviderContext } from '../../../ftr_provider_context';
+import { FtrProviderContext } from '../../../../../api_integration/ftr_provider_context';
 
 import { createBasicTimeline } from './helpers';
 
diff --git a/x-pack/test/security_solution_api_integration/test_suites/investigation/timeline/trial_license_complete_tier/configs/ess.config.ts b/x-pack/test/security_solution_api_integration/test_suites/investigation/timeline/trial_license_complete_tier/configs/ess.config.ts
new file mode 100644
index 00000000000000..58365fff896a6f
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/investigation/timeline/trial_license_complete_tier/configs/ess.config.ts
@@ -0,0 +1,28 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { FtrConfigProviderContext } from '@kbn/test';
+export default async function ({ readConfigFile }: FtrConfigProviderContext) {
+  const functionalConfig = await readConfigFile(
+    require.resolve('../../../../../config/ess/config.base.trial')
+  );
+
+  return {
+    ...functionalConfig.getAll(),
+    kbnTestServer: {
+      ...functionalConfig.get('kbnTestServer'),
+      serverArgs: [
+        ...functionalConfig.get('kbnTestServer.serverArgs'),
+        `--xpack.securitySolution.enableExperimental=${JSON.stringify([])}`,
+      ],
+    },
+    testFiles: [require.resolve('../ess')],
+    junit: {
+      reportName: 'Timeline Integration Tests - ESS Env - Basic License',
+    },
+  };
+}
diff --git a/x-pack/test/security_solution_api_integration/test_suites/investigation/timeline/trial_license_complete_tier/configs/serverless.config.ts b/x-pack/test/security_solution_api_integration/test_suites/investigation/timeline/trial_license_complete_tier/configs/serverless.config.ts
new file mode 100644
index 00000000000000..2c92778eae3aac
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/investigation/timeline/trial_license_complete_tier/configs/serverless.config.ts
@@ -0,0 +1,23 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { createTestConfig } from '../../../../../config/serverless/config.base';
+
+export default createTestConfig({
+  kbnTestServerArgs: [
+    `--xpack.securitySolution.enableExperimental=${JSON.stringify([])}`,
+    `--xpack.securitySolutionServerless.productTypes=${JSON.stringify([
+      { product_line: 'security', product_tier: 'complete' },
+      { product_line: 'endpoint', product_tier: 'complete' },
+      { product_line: 'cloud', product_tier: 'complete' },
+    ])}`,
+  ],
+  testFiles: [require.resolve('../serverless')],
+  junit: {
+    reportName: 'Timeline Integration Tests - Serverless Env - Complete Tier',
+  },
+});
diff --git a/x-pack/test/api_integration/apis/security_solution/events.ts b/x-pack/test/security_solution_api_integration/test_suites/investigation/timeline/trial_license_complete_tier/ess/events.ts
similarity index 92%
rename from x-pack/test/api_integration/apis/security_solution/events.ts
rename to x-pack/test/security_solution_api_integration/test_suites/investigation/timeline/trial_license_complete_tier/ess/events.ts
index c5a4ba97fc4787..dd89246000443b 100644
--- a/x-pack/test/api_integration/apis/security_solution/events.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/investigation/timeline/trial_license_complete_tier/ess/events.ts
@@ -13,8 +13,8 @@ import {
   TimelineEventsQueries,
   TimelineEventsAllStrategyResponse,
 } from '@kbn/security-solution-plugin/common/search_strategy';
-import { FtrProviderContext } from '../../ftr_provider_context';
-import { getFieldsToRequest, getFilterValue } from './utils';
+import { FtrProviderContextWithSpaces } from '../../../../../ftr_provider_context_with_spaces';
+import { getFieldsToRequest, getFilterValue } from '../../../../utils';
 
 const TO = '3000-01-01T00:00:00.000Z';
 const FROM = '2000-01-01T00:00:00.000Z';
@@ -27,10 +27,10 @@ const ACTIVE_PAGE = 0;
 const PAGE_SIZE = 25;
 const LIMITED_PAGE_SIZE = 2;
 
-export default function ({ getService }: FtrProviderContext) {
+export default function ({ getService }: FtrProviderContextWithSpaces) {
   const esArchiver = getService('esArchiver');
-  const supertest = getService('supertest');
   const bsearch = getService('bsearch');
+  const supertest = getService('supertest');
 
   const getPostBody = (): JsonObject => ({
     defaultIndex: ['auditbeat-*'],
@@ -74,7 +74,6 @@ export default function ({ getService }: FtrProviderContext) {
         },
         strategy: 'timelineSearchStrategy',
       });
-
       expect(timeline.edges.length).to.be(EDGE_LENGTH);
       expect(timeline.edges[0].node.data.length).to.be(DATA_COUNT);
       expect(timeline.totalCount).to.be(TOTAL_COUNT);
diff --git a/x-pack/test/security_solution_api_integration/test_suites/investigation/timeline/trial_license_complete_tier/ess/index.ts b/x-pack/test/security_solution_api_integration/test_suites/investigation/timeline/trial_license_complete_tier/ess/index.ts
new file mode 100644
index 00000000000000..7cd50e294c1c65
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/investigation/timeline/trial_license_complete_tier/ess/index.ts
@@ -0,0 +1,17 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { FtrProviderContextWithSpaces } from '../../../../../ftr_provider_context_with_spaces';
+
+export default function ({ loadTestFile }: FtrProviderContextWithSpaces) {
+  describe('@ess SecuritySolution Timeline', () => {
+    loadTestFile(require.resolve('./events'));
+    loadTestFile(require.resolve('./timeline_details'));
+    loadTestFile(require.resolve('./timeline'));
+    loadTestFile(require.resolve('./timeline_migrations'));
+  });
+}
diff --git a/x-pack/test/api_integration/apis/security_solution/timeline.ts b/x-pack/test/security_solution_api_integration/test_suites/investigation/timeline/trial_license_complete_tier/ess/timeline.ts
similarity index 93%
rename from x-pack/test/api_integration/apis/security_solution/timeline.ts
rename to x-pack/test/security_solution_api_integration/test_suites/investigation/timeline/trial_license_complete_tier/ess/timeline.ts
index 191cf7e396b33a..80eefe0b5f6b5c 100644
--- a/x-pack/test/api_integration/apis/security_solution/timeline.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/investigation/timeline/trial_license_complete_tier/ess/timeline.ts
@@ -8,10 +8,13 @@
 import expect from '@kbn/expect';
 import { SavedTimeline, TimelineType } from '@kbn/security-solution-plugin/common/api/timeline';
 
-import { FtrProviderContext } from '../../ftr_provider_context';
-import { createBasicTimeline, createBasicTimelineTemplate } from './saved_objects/helpers';
+import { FtrProviderContextWithSpaces } from '../../../../../ftr_provider_context_with_spaces';
+import {
+  createBasicTimeline,
+  createBasicTimelineTemplate,
+} from '../../../saved_objects/trial_license_complete_tier/helpers';
 
-export default function ({ getService }: FtrProviderContext) {
+export default function ({ getService }: FtrProviderContextWithSpaces) {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
 
@@ -72,7 +75,6 @@ export default function ({ getService }: FtrProviderContext) {
         const resp = await supertest
           .get('/api/timeline/resolve')
           .query({ id: '8dc70950-1012-11ec-9ad3-2d7c6600c0f7' });
-
         expect(resp.body.data.outcome).to.be('exactMatch');
         expect(resp.body.data.alias_target_id).to.be(undefined);
         expect(resp.body.data.timeline.title).to.be('Awesome Timeline');
diff --git a/x-pack/test/security_solution_api_integration/test_suites/investigation/timeline/trial_license_complete_tier/ess/timeline_details.ts b/x-pack/test/security_solution_api_integration/test_suites/investigation/timeline/trial_license_complete_tier/ess/timeline_details.ts
new file mode 100644
index 00000000000000..cd918c89094415
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/investigation/timeline/trial_license_complete_tier/ess/timeline_details.ts
@@ -0,0 +1,75 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import expect from '@kbn/expect';
+import { sortBy } from 'lodash';
+import {
+  TimelineEventsQueries,
+  TimelineEventsDetailsStrategyResponse,
+  TimelineKpiStrategyResponse,
+} from '@kbn/security-solution-plugin/common/search_strategy';
+
+import { FtrProviderContextWithSpaces } from '../../../../../ftr_provider_context_with_spaces';
+import { timelineDetailsFilebeatExpectedResults as EXPECTED_DATA } from '../mocks/timeline_details';
+
+// typical values that have to change after an update from "scripts/es_archiver"
+const INDEX_NAME = 'filebeat-7.0.0-iot-2019.06';
+const ID = 'QRhG1WgBqd-n62SwZYDT';
+
+const EXPECTED_KPI_COUNTS = {
+  destinationIpCount: 154,
+  hostCount: 1,
+  processCount: 0,
+  sourceIpCount: 121,
+  userCount: 0,
+};
+
+export default function ({ getService }: FtrProviderContextWithSpaces) {
+  const esArchiver = getService('esArchiver');
+  const supertest = getService('supertest');
+  const bsearch = getService('bsearch');
+
+  describe('Timeline Details', () => {
+    before(
+      async () => await esArchiver.load('x-pack/test/functional/es_archives/filebeat/default')
+    );
+    after(
+      async () => await esArchiver.unload('x-pack/test/functional/es_archives/filebeat/default')
+    );
+
+    it('Make sure that we get Event Details data', async () => {
+      const { data: detailsData } = await bsearch.send<TimelineEventsDetailsStrategyResponse>({
+        supertest,
+        options: {
+          factoryQueryType: TimelineEventsQueries.details,
+          indexName: INDEX_NAME,
+          inspect: false,
+          eventId: ID,
+        },
+        strategy: 'timelineSearchStrategy',
+      });
+      expect(sortBy(detailsData, 'field')).to.eql(sortBy(EXPECTED_DATA, 'field'));
+    });
+
+    it('Make sure that we get kpi data', async () => {
+      const { destinationIpCount, hostCount, processCount, sourceIpCount, userCount } =
+        await bsearch.send<TimelineKpiStrategyResponse>({
+          supertest,
+          options: {
+            factoryQueryType: TimelineEventsQueries.kpi,
+            indexName: INDEX_NAME,
+            inspect: false,
+            eventId: ID,
+          },
+          strategy: 'timelineSearchStrategy',
+        });
+      expect({ destinationIpCount, hostCount, processCount, sourceIpCount, userCount }).to.eql(
+        EXPECTED_KPI_COUNTS
+      );
+    });
+  });
+}
diff --git a/x-pack/test/api_integration/apis/security_solution/timeline_migrations.ts b/x-pack/test/security_solution_api_integration/test_suites/investigation/timeline/trial_license_complete_tier/ess/timeline_migrations.ts
similarity index 97%
rename from x-pack/test/api_integration/apis/security_solution/timeline_migrations.ts
rename to x-pack/test/security_solution_api_integration/test_suites/investigation/timeline/trial_license_complete_tier/ess/timeline_migrations.ts
index fad8b6b444fe05..c91d4ce24ce51a 100644
--- a/x-pack/test/api_integration/apis/security_solution/timeline_migrations.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/investigation/timeline/trial_license_complete_tier/ess/timeline_migrations.ts
@@ -16,8 +16,8 @@ import {
   BarePinnedEventWithoutExternalRefs,
   TimelineWithoutExternalRefs,
 } from '@kbn/security-solution-plugin/common/api/timeline';
-import { FtrProviderContext } from '../../ftr_provider_context';
-import { getSavedObjectFromES } from './utils';
+import type { FtrProviderContextWithSpaces } from '../../../../../ftr_provider_context_with_spaces';
+import { getSavedObjectFromES } from '../../../../utils';
 
 interface TimelineWithoutSavedQueryId {
   [timelineSavedObjectType]: TimelineWithoutExternalRefs;
@@ -31,7 +31,7 @@ interface PinnedEventWithoutTimelineId {
   [pinnedEventSavedObjectType]: BarePinnedEventWithoutExternalRefs;
 }
 
-export default function ({ getService }: FtrProviderContext) {
+export default function ({ getService }: FtrProviderContextWithSpaces) {
   const supertest = getService('supertest');
 
   describe('Timeline migrations', () => {
diff --git a/x-pack/test/api_integration/apis/security_solution/timeline_details.ts b/x-pack/test/security_solution_api_integration/test_suites/investigation/timeline/trial_license_complete_tier/mocks/timeline_details.ts
similarity index 87%
rename from x-pack/test/api_integration/apis/security_solution/timeline_details.ts
rename to x-pack/test/security_solution_api_integration/test_suites/investigation/timeline/trial_license_complete_tier/mocks/timeline_details.ts
index 6358d9dc3104cd..a2d78021718965 100644
--- a/x-pack/test/api_integration/apis/security_solution/timeline_details.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/investigation/timeline/trial_license_complete_tier/mocks/timeline_details.ts
@@ -4,21 +4,7 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-
-import expect from '@kbn/expect';
-import { sortBy } from 'lodash';
-import {
-  TimelineEventsQueries,
-  TimelineEventsDetailsStrategyResponse,
-  TimelineKpiStrategyResponse,
-} from '@kbn/security-solution-plugin/common/search_strategy';
-
-import { FtrProviderContext } from '../../ftr_provider_context';
-
-// typical values that have to change after an update from "scripts/es_archiver"
-const INDEX_NAME = 'filebeat-7.0.0-iot-2019.06';
-const ID = 'QRhG1WgBqd-n62SwZYDT';
-const EXPECTED_DATA = [
+export const timelineDetailsFilebeatExpectedResults = [
   {
     category: 'base',
     field: '@timestamp',
@@ -649,56 +635,3 @@ const EXPECTED_DATA = [
     isObjectArray: false,
   },
 ];
-const EXPECTED_KPI_COUNTS = {
-  destinationIpCount: 154,
-  hostCount: 1,
-  processCount: 0,
-  sourceIpCount: 121,
-  userCount: 0,
-};
-
-export default function ({ getService }: FtrProviderContext) {
-  const esArchiver = getService('esArchiver');
-  const supertest = getService('supertest');
-  const bsearch = getService('bsearch');
-
-  describe('Timeline Details', () => {
-    before(
-      async () => await esArchiver.load('x-pack/test/functional/es_archives/filebeat/default')
-    );
-    after(
-      async () => await esArchiver.unload('x-pack/test/functional/es_archives/filebeat/default')
-    );
-
-    it('Make sure that we get Event Details data', async () => {
-      const { data: detailsData } = await bsearch.send<TimelineEventsDetailsStrategyResponse>({
-        supertest,
-        options: {
-          factoryQueryType: TimelineEventsQueries.details,
-          indexName: INDEX_NAME,
-          inspect: false,
-          eventId: ID,
-        },
-        strategy: 'timelineSearchStrategy',
-      });
-      expect(sortBy(detailsData, 'field')).to.eql(sortBy(EXPECTED_DATA, 'field'));
-    });
-
-    it('Make sure that we get kpi data', async () => {
-      const { destinationIpCount, hostCount, processCount, sourceIpCount, userCount } =
-        await bsearch.send<TimelineKpiStrategyResponse>({
-          supertest,
-          options: {
-            factoryQueryType: TimelineEventsQueries.kpi,
-            indexName: INDEX_NAME,
-            inspect: false,
-            eventId: ID,
-          },
-          strategy: 'timelineSearchStrategy',
-        });
-      expect({ destinationIpCount, hostCount, processCount, sourceIpCount, userCount }).to.eql(
-        EXPECTED_KPI_COUNTS
-      );
-    });
-  });
-}
diff --git a/x-pack/test/security_solution_api_integration/test_suites/investigation/timeline/trial_license_complete_tier/serverless/events.ts b/x-pack/test/security_solution_api_integration/test_suites/investigation/timeline/trial_license_complete_tier/serverless/events.ts
new file mode 100644
index 00000000000000..2783cc25ff4364
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/investigation/timeline/trial_license_complete_tier/serverless/events.ts
@@ -0,0 +1,112 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import expect from '@kbn/expect';
+import { JsonObject } from '@kbn/utility-types';
+
+import {
+  Direction,
+  TimelineEventsQueries,
+  TimelineEventsAllStrategyResponse,
+} from '@kbn/security-solution-plugin/common/search_strategy';
+import { FtrProviderContext } from '../../../../../ftr_provider_context';
+import { getFieldsToRequest, getFilterValue } from '../../../../utils';
+import { RoleCredentials } from '../../../../../../../test_serverless/shared/services';
+
+const TO = '3000-01-01T00:00:00.000Z';
+const FROM = '2000-01-01T00:00:00.000Z';
+// typical values that have to change after an update from "scripts/es_archiver"
+const DATA_COUNT = 7;
+const HOST_NAME = 'suricata-sensor-amsterdam';
+const TOTAL_COUNT = 96;
+const EDGE_LENGTH = 25;
+const ACTIVE_PAGE = 0;
+const PAGE_SIZE = 25;
+const LIMITED_PAGE_SIZE = 2;
+
+export default function ({ getService }: FtrProviderContext) {
+  const esArchiver = getService('esArchiver');
+  const secureBsearch = getService('secureBsearch');
+  const supertestWithoutAuth = getService('supertestWithoutAuth');
+  const svlUserManager = getService('svlUserManager');
+  let roleAuthc: RoleCredentials;
+  const getPostBody = (): JsonObject => ({
+    defaultIndex: ['auditbeat-*'],
+    factoryQueryType: TimelineEventsQueries.all,
+    entityType: 'events',
+    fieldRequested: getFieldsToRequest(),
+    fields: [],
+    filterQuery: getFilterValue(HOST_NAME, FROM, TO),
+    pagination: {
+      activePage: 0,
+      querySize: 25,
+    },
+    language: 'kuery',
+    sort: [
+      {
+        field: '@timestamp',
+        direction: Direction.desc,
+        esTypes: ['date'],
+      },
+    ],
+    timerange: {
+      from: FROM,
+      to: TO,
+      interval: '12h',
+    },
+  });
+
+  describe('Timeline', () => {
+    before(async () => {
+      await esArchiver.load('x-pack/test/functional/es_archives/auditbeat/hosts');
+      roleAuthc = await svlUserManager.createApiKeyForRole('admin');
+    });
+    after(async () => {
+      await esArchiver.unload('x-pack/test/functional/es_archives/auditbeat/hosts');
+      await svlUserManager.invalidateApiKeyForRole(roleAuthc);
+    });
+
+    it('returns Timeline data', async () => {
+      const timeline = await secureBsearch.send<TimelineEventsAllStrategyResponse>({
+        supertestWithoutAuth,
+        apiKeyHeader: roleAuthc.apiKeyHeader,
+        internalOrigin: 'Kibana',
+        options: {
+          ...getPostBody(),
+        },
+        strategy: 'timelineSearchStrategy',
+      });
+
+      expect(timeline.edges.length).to.be(EDGE_LENGTH);
+      expect(timeline.edges[0].node.data.length).to.be(DATA_COUNT);
+      expect(timeline.totalCount).to.be(TOTAL_COUNT);
+      expect(timeline.pageInfo.activePage).to.equal(ACTIVE_PAGE);
+      expect(timeline.pageInfo.querySize).to.equal(PAGE_SIZE);
+    });
+
+    it('returns paginated Timeline query', async () => {
+      const timeline = await secureBsearch.send<TimelineEventsAllStrategyResponse>({
+        supertestWithoutAuth,
+        apiKeyHeader: roleAuthc.apiKeyHeader,
+        internalOrigin: 'Kibana',
+        options: {
+          ...getPostBody(),
+          pagination: {
+            activePage: 0,
+            querySize: LIMITED_PAGE_SIZE,
+          },
+        },
+        strategy: 'timelineSearchStrategy',
+      });
+      expect(timeline.edges.length).to.be(LIMITED_PAGE_SIZE);
+      expect(timeline.edges[0].node.data.length).to.be(DATA_COUNT);
+      expect(timeline.totalCount).to.be(TOTAL_COUNT);
+      expect(timeline.edges[0].node.data.length).to.be(DATA_COUNT);
+      expect(timeline.edges[0]!.node.ecs.host!.name).to.eql([HOST_NAME]);
+    });
+  });
+}
diff --git a/x-pack/test/security_solution_api_integration/test_suites/investigation/timeline/trial_license_complete_tier/serverless/index.ts b/x-pack/test/security_solution_api_integration/test_suites/investigation/timeline/trial_license_complete_tier/serverless/index.ts
new file mode 100644
index 00000000000000..a914f99212376e
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/investigation/timeline/trial_license_complete_tier/serverless/index.ts
@@ -0,0 +1,15 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { FtrProviderContext } from '../../../../../ftr_provider_context';
+
+export default function ({ loadTestFile }: FtrProviderContext) {
+  describe('@serverless SecuritySolution Timeline', () => {
+    loadTestFile(require.resolve('./events'));
+    loadTestFile(require.resolve('./timeline_details'));
+  });
+}
diff --git a/x-pack/test/security_solution_api_integration/test_suites/investigation/timeline/trial_license_complete_tier/serverless/timeline_details.ts b/x-pack/test/security_solution_api_integration/test_suites/investigation/timeline/trial_license_complete_tier/serverless/timeline_details.ts
new file mode 100644
index 00000000000000..75c822cac33dde
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/investigation/timeline/trial_license_complete_tier/serverless/timeline_details.ts
@@ -0,0 +1,86 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import expect from '@kbn/expect';
+import { sortBy } from 'lodash';
+import {
+  TimelineEventsQueries,
+  TimelineEventsDetailsStrategyResponse,
+  TimelineKpiStrategyResponse,
+} from '@kbn/security-solution-plugin/common/search_strategy';
+
+import { FtrProviderContext } from '../../../../../ftr_provider_context';
+import { RoleCredentials } from '../../../../../../../test_serverless/shared/services';
+import { timelineDetailsFilebeatExpectedResults as EXPECTED_DATA } from '../mocks/timeline_details';
+
+// typical values that have to change after an update from "scripts/es_archiver"
+const INDEX_NAME = 'filebeat-7.0.0-iot-2019.06';
+const ID = 'QRhG1WgBqd-n62SwZYDT';
+
+const EXPECTED_KPI_COUNTS = {
+  destinationIpCount: 154,
+  hostCount: 1,
+  processCount: 0,
+  sourceIpCount: 121,
+  userCount: 0,
+};
+
+export default function ({ getService }: FtrProviderContext) {
+  const esArchiver = getService('esArchiver');
+  const secureBsearch = getService('secureBsearch');
+  const supertestWithoutAuth = getService('supertestWithoutAuth');
+  const svlUserManager = getService('svlUserManager');
+  let roleAuthc: RoleCredentials;
+
+  describe('Timeline Details', () => {
+    before(async () => {
+      await esArchiver.load('x-pack/test/functional/es_archives/filebeat/default');
+      roleAuthc = await svlUserManager.createApiKeyForRole('admin');
+    });
+    after(async () => {
+      await esArchiver.unload('x-pack/test/functional/es_archives/filebeat/default');
+      await svlUserManager.invalidateApiKeyForRole(roleAuthc);
+    });
+
+    it('Make sure that we get Event Details data', async () => {
+      const { data: detailsData } = await secureBsearch.send<TimelineEventsDetailsStrategyResponse>(
+        {
+          supertestWithoutAuth,
+          apiKeyHeader: roleAuthc.apiKeyHeader,
+          internalOrigin: 'Kibana',
+          options: {
+            factoryQueryType: TimelineEventsQueries.details,
+            indexName: INDEX_NAME,
+            inspect: false,
+            eventId: ID,
+          },
+          strategy: 'timelineSearchStrategy',
+        }
+      );
+      expect(sortBy(detailsData, 'field')).to.eql(sortBy(EXPECTED_DATA, 'field'));
+    });
+
+    it('Make sure that we get kpi data', async () => {
+      const { destinationIpCount, hostCount, processCount, sourceIpCount, userCount } =
+        await secureBsearch.send<TimelineKpiStrategyResponse>({
+          supertestWithoutAuth,
+          apiKeyHeader: roleAuthc.apiKeyHeader,
+          internalOrigin: 'Kibana',
+          options: {
+            factoryQueryType: TimelineEventsQueries.kpi,
+            indexName: INDEX_NAME,
+            inspect: false,
+            eventId: ID,
+          },
+          strategy: 'timelineSearchStrategy',
+        });
+      expect({ destinationIpCount, hostCount, processCount, sourceIpCount, userCount }).to.eql(
+        EXPECTED_KPI_COUNTS
+      );
+    });
+  });
+}
diff --git a/x-pack/test/security_solution_api_integration/test_suites/lists_and_exception_lists/lists_items/trial_license_complete_tier/lists/read_list_privileges.ts b/x-pack/test/security_solution_api_integration/test_suites/lists_and_exception_lists/lists_items/trial_license_complete_tier/lists/read_list_privileges.ts
index 85e4309d048a20..0ab363ce961d07 100644
--- a/x-pack/test/security_solution_api_integration/test_suites/lists_and_exception_lists/lists_items/trial_license_complete_tier/lists/read_list_privileges.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/lists_and_exception_lists/lists_items/trial_license_complete_tier/lists/read_list_privileges.ts
@@ -9,7 +9,7 @@ import expect from '@kbn/expect';
 
 import { LIST_PRIVILEGES_URL } from '@kbn/securitysolution-list-constants';
 import { getReadPrivilegeMock } from '@kbn/lists-plugin/server/routes/list_privileges/read_list_privileges_route.mock';
-import { FtrProviderContextWithSpaces } from '../../../../../ftr_provider_context_with_spaces';
+import type { FtrProviderContextWithSpaces } from '../../../../../ftr_provider_context_with_spaces';
 
 export default ({ getService }: FtrProviderContextWithSpaces) => {
   const supertest = getService('supertest');
diff --git a/x-pack/test/security_solution_api_integration/test_suites/sources/indices/trial_license_complete_tier/configs/ess.config.ts b/x-pack/test/security_solution_api_integration/test_suites/sources/indices/trial_license_complete_tier/configs/ess.config.ts
new file mode 100644
index 00000000000000..53268f985b611f
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/sources/indices/trial_license_complete_tier/configs/ess.config.ts
@@ -0,0 +1,28 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { FtrConfigProviderContext } from '@kbn/test';
+export default async function ({ readConfigFile }: FtrConfigProviderContext) {
+  const functionalConfig = await readConfigFile(
+    require.resolve('../../../../../config/ess/config.base.trial')
+  );
+
+  return {
+    ...functionalConfig.getAll(),
+    kbnTestServer: {
+      ...functionalConfig.get('kbnTestServer'),
+      serverArgs: [
+        ...functionalConfig.get('kbnTestServer.serverArgs'),
+        `--xpack.securitySolution.enableExperimental=${JSON.stringify([])}`,
+      ],
+    },
+    testFiles: [require.resolve('..')],
+    junit: {
+      reportName: 'Sources Integration Tests - ESS Env - Basic License',
+    },
+  };
+}
diff --git a/x-pack/test/security_solution_api_integration/test_suites/sources/indices/trial_license_complete_tier/configs/serverless.config.ts b/x-pack/test/security_solution_api_integration/test_suites/sources/indices/trial_license_complete_tier/configs/serverless.config.ts
new file mode 100644
index 00000000000000..12ee41efb49bf8
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/sources/indices/trial_license_complete_tier/configs/serverless.config.ts
@@ -0,0 +1,23 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { createTestConfig } from '../../../../../config/serverless/config.base';
+
+export default createTestConfig({
+  kbnTestServerArgs: [
+    `--xpack.securitySolution.enableExperimental=${JSON.stringify([])}`,
+    `--xpack.securitySolutionServerless.productTypes=${JSON.stringify([
+      { product_line: 'security', product_tier: 'complete' },
+      { product_line: 'endpoint', product_tier: 'complete' },
+      { product_line: 'cloud', product_tier: 'complete' },
+    ])}`,
+  ],
+  testFiles: [require.resolve('..')],
+  junit: {
+    reportName: 'Sources Integration Tests - Serverless Env - Complete Tier',
+  },
+});
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/hooks/use_experimental_onboarding_flag.ts b/x-pack/test/security_solution_api_integration/test_suites/sources/indices/trial_license_complete_tier/index.ts
similarity index 51%
rename from x-pack/plugins/observability_solution/observability_onboarding/public/hooks/use_experimental_onboarding_flag.ts
rename to x-pack/test/security_solution_api_integration/test_suites/sources/indices/trial_license_complete_tier/index.ts
index ac0451b996d680..229ceb7619ce3f 100644
--- a/x-pack/plugins/observability_solution/observability_onboarding/public/hooks/use_experimental_onboarding_flag.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/sources/indices/trial_license_complete_tier/index.ts
@@ -4,10 +4,10 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
+import { FtrProviderContext } from '../../../../ftr_provider_context';
 
-import { useContext } from 'react';
-import { ExperimentalOnboardingFeatureFlag } from '../context/experimental_onboarding_enabled';
-
-export const useExperimentalOnboardingFlag = () => {
-  return useContext(ExperimentalOnboardingFeatureFlag);
-};
+export default function ({ loadTestFile }: FtrProviderContext) {
+  describe('@ess SecuritySolution Sources', () => {
+    loadTestFile(require.resolve('./sources'));
+  });
+}
diff --git a/x-pack/test/api_integration/apis/security_solution/sources.ts b/x-pack/test/security_solution_api_integration/test_suites/sources/indices/trial_license_complete_tier/sources.ts
similarity index 97%
rename from x-pack/test/api_integration/apis/security_solution/sources.ts
rename to x-pack/test/security_solution_api_integration/test_suites/sources/indices/trial_license_complete_tier/sources.ts
index e0d76301f700a5..7b3f52cc678af0 100644
--- a/x-pack/test/api_integration/apis/security_solution/sources.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/sources/indices/trial_license_complete_tier/sources.ts
@@ -8,7 +8,7 @@
 import expect from '@kbn/expect';
 
 import { ELASTIC_HTTP_VERSION_HEADER } from '@kbn/core-http-common';
-import { FtrProviderContext } from '../../ftr_provider_context';
+import { FtrProviderContext } from '../../../../../api_integration/ftr_provider_context';
 
 export default function ({ getService }: FtrProviderContext) {
   const esArchiver = getService('esArchiver');
diff --git a/x-pack/test/api_integration/apis/security_solution/utils.ts b/x-pack/test/security_solution_api_integration/test_suites/utils.ts
similarity index 100%
rename from x-pack/test/api_integration/apis/security_solution/utils.ts
rename to x-pack/test/security_solution_api_integration/test_suites/utils.ts
diff --git a/x-pack/test/security_solution_api_integration/tsconfig.json b/x-pack/test/security_solution_api_integration/tsconfig.json
index 2a1f9eba804cdb..4a18f10b90dd51 100644
--- a/x-pack/test/security_solution_api_integration/tsconfig.json
+++ b/x-pack/test/security_solution_api_integration/tsconfig.json
@@ -43,5 +43,6 @@
     "@kbn/ftr-common-functional-services",
     "@kbn/actions-plugin",
     "@kbn/task-manager-plugin",
+    "@kbn/utility-types",
   ]
 }
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/rule_creation/custom_query_rule_data_view.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/rule_creation/custom_query_rule_data_view.cy.ts
index bbb34c7a7997a6..cb107d169d9aab 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/rule_creation/custom_query_rule_data_view.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/rule_creation/custom_query_rule_data_view.cy.ts
@@ -46,6 +46,7 @@ import {
   TIMELINE_TEMPLATE_DETAILS,
   DATA_VIEW_DETAILS,
   EDIT_RULE_SETTINGS_LINK,
+  INTERVAL_ABBR_VALUE,
 } from '../../../../screens/rule_details';
 import { GLOBAL_SEARCH_BAR_FILTER_ITEM } from '../../../../screens/search_bar';
 
@@ -143,12 +144,16 @@ describe('Custom query rules', { tags: ['@ess', '@serverless'] }, () => {
       });
       cy.get(DEFINITION_DETAILS).should('not.contain', INDEX_PATTERNS_DETAILS);
       cy.get(SCHEDULE_DETAILS).within(() => {
-        getDetails(RUNS_EVERY_DETAILS).should('have.text', `${rule.interval}`);
+        getDetails(RUNS_EVERY_DETAILS)
+          .find(INTERVAL_ABBR_VALUE)
+          .should('have.text', `${rule.interval}`);
         const humanizedDuration = getHumanizedDuration(
           rule.from ?? 'now-6m',
           rule.interval ?? '5m'
         );
-        getDetails(ADDITIONAL_LOOK_BACK_DETAILS).should('have.text', `${humanizedDuration}`);
+        getDetails(ADDITIONAL_LOOK_BACK_DETAILS)
+          .find(INTERVAL_ABBR_VALUE)
+          .should('have.text', `${humanizedDuration}`);
       });
 
       waitForTheRuleToBeExecuted();
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/rule_creation/event_correlation_rule.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/rule_creation/event_correlation_rule.cy.ts
index 17b767be45565b..df9d7b28ac864b 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/rule_creation/event_correlation_rule.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/rule_creation/event_correlation_rule.cy.ts
@@ -39,6 +39,7 @@ import {
   SEVERITY_DETAILS,
   TAGS_DETAILS,
   TIMELINE_TEMPLATE_DETAILS,
+  INTERVAL_ABBR_VALUE,
 } from '../../../../screens/rule_details';
 
 import { getDetails, waitForTheRuleToBeExecuted } from '../../../../tasks/rule_details';
@@ -125,12 +126,16 @@ describe('EQL rules', { tags: ['@ess', '@serverless'] }, () => {
         getDetails(TIMELINE_TEMPLATE_DETAILS).should('have.text', 'None');
       });
       cy.get(SCHEDULE_DETAILS).within(() => {
-        getDetails(RUNS_EVERY_DETAILS).should('have.text', `${rule.interval}`);
+        getDetails(RUNS_EVERY_DETAILS)
+          .find(INTERVAL_ABBR_VALUE)
+          .should('have.text', `${rule.interval}`);
         const humanizedDuration = getHumanizedDuration(
           rule.from ?? 'now-6m',
           rule.interval ?? '5m'
         );
-        getDetails(ADDITIONAL_LOOK_BACK_DETAILS).should('have.text', `${humanizedDuration}`);
+        getDetails(ADDITIONAL_LOOK_BACK_DETAILS)
+          .find(INTERVAL_ABBR_VALUE)
+          .should('have.text', `${humanizedDuration}`);
       });
 
       waitForTheRuleToBeExecuted();
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/rule_creation/indicator_match_rule.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/rule_creation/indicator_match_rule.cy.ts
index fb90eccb289fc0..9ce45a93a79677 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/rule_creation/indicator_match_rule.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/rule_creation/indicator_match_rule.cy.ts
@@ -40,6 +40,7 @@ import {
   INDICATOR_INDEX_QUERY,
   INDICATOR_MAPPING,
   INDICATOR_PREFIX_OVERRIDE,
+  INTERVAL_ABBR_VALUE,
   INVESTIGATION_NOTES_MARKDOWN,
   INVESTIGATION_NOTES_TOGGLE,
   MITRE_ATTACK_DETAILS,
@@ -478,12 +479,16 @@ describe('indicator match', { tags: ['@ess', '@serverless'] }, () => {
         });
 
         cy.get(SCHEDULE_DETAILS).within(() => {
-          getDetails(RUNS_EVERY_DETAILS).should('have.text', `${rule.interval}`);
+          getDetails(RUNS_EVERY_DETAILS)
+            .find(INTERVAL_ABBR_VALUE)
+            .should('have.text', `${rule.interval}`);
           const humanizedDuration = getHumanizedDuration(
             rule.from ?? 'now-6m',
             rule.interval ?? '5m'
           );
-          getDetails(ADDITIONAL_LOOK_BACK_DETAILS).should('have.text', `${humanizedDuration}`);
+          getDetails(ADDITIONAL_LOOK_BACK_DETAILS)
+            .find(INTERVAL_ABBR_VALUE)
+            .should('have.text', `${humanizedDuration}`);
         });
 
         waitForTheRuleToBeExecuted();
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/rule_creation/machine_learning_rule.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/rule_creation/machine_learning_rule.cy.ts
index 463d6b2e151c08..9121e524ddbb40 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/rule_creation/machine_learning_rule.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/rule_creation/machine_learning_rule.cy.ts
@@ -37,6 +37,7 @@ import {
   SEVERITY_DETAILS,
   TAGS_DETAILS,
   TIMELINE_TEMPLATE_DETAILS,
+  INTERVAL_ABBR_VALUE,
 } from '../../../../screens/rule_details';
 
 import { getDetails } from '../../../../tasks/rule_details';
@@ -114,12 +115,16 @@ describe('Machine Learning rules', { tags: ['@ess', '@serverless'] }, () => {
       cy.get(MACHINE_LEARNING_JOB_ID).should('have.text', machineLearningJobsArray.join(''));
     });
     cy.get(SCHEDULE_DETAILS).within(() => {
-      getDetails(RUNS_EVERY_DETAILS).should('have.text', `${mlRule.interval}`);
+      getDetails(RUNS_EVERY_DETAILS)
+        .find(INTERVAL_ABBR_VALUE)
+        .should('have.text', `${mlRule.interval}`);
       const humanizedDuration = getHumanizedDuration(
         mlRule.from ?? 'now-6m',
         mlRule.interval ?? '5m'
       );
-      getDetails(ADDITIONAL_LOOK_BACK_DETAILS).should('have.text', `${humanizedDuration}`);
+      getDetails(ADDITIONAL_LOOK_BACK_DETAILS)
+        .find(INTERVAL_ABBR_VALUE)
+        .should('have.text', `${humanizedDuration}`);
     });
   });
 });
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/rule_creation/new_terms_rule.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/rule_creation/new_terms_rule.cy.ts
index 18675ed9b84a12..bb4acbd6746e29 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/rule_creation/new_terms_rule.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/rule_creation/new_terms_rule.cy.ts
@@ -44,6 +44,7 @@ import {
   SUPPRESS_BY_DETAILS,
   SUPPRESS_FOR_DETAILS,
   SUPPRESS_MISSING_FIELD,
+  INTERVAL_ABBR_VALUE,
 } from '../../../../screens/rule_details';
 
 import { getDetails, waitForTheRuleToBeExecuted } from '../../../../tasks/rule_details';
@@ -136,12 +137,16 @@ describe(
           getDetails(NEW_TERMS_HISTORY_WINDOW_DETAILS).should('have.text', '51000h');
         });
         cy.get(SCHEDULE_DETAILS).within(() => {
-          getDetails(RUNS_EVERY_DETAILS).should('have.text', `${rule.interval}`);
+          getDetails(RUNS_EVERY_DETAILS)
+            .find(INTERVAL_ABBR_VALUE)
+            .should('have.text', `${rule.interval}`);
           const humanizedDuration = getHumanizedDuration(
             rule.from ?? 'now-6m',
             rule.interval ?? '5m'
           );
-          getDetails(ADDITIONAL_LOOK_BACK_DETAILS).should('have.text', `${humanizedDuration}`);
+          getDetails(ADDITIONAL_LOOK_BACK_DETAILS)
+            .find(INTERVAL_ABBR_VALUE)
+            .should('have.text', `${humanizedDuration}`);
         });
 
         waitForTheRuleToBeExecuted();
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/rule_creation/override.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/rule_creation/override.cy.ts
index 841fc1b4fef8e3..5f5e546c586d18 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/rule_creation/override.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/rule_creation/override.cy.ts
@@ -49,6 +49,7 @@ import {
   TAGS_DETAILS,
   TIMELINE_TEMPLATE_DETAILS,
   TIMESTAMP_OVERRIDE_DETAILS,
+  INTERVAL_ABBR_VALUE,
 } from '../../../../screens/rule_details';
 
 import { deleteAlertsAndRules } from '../../../../tasks/api_calls/common';
@@ -139,9 +140,13 @@ describe('Rules override', { tags: ['@ess', '@serverless'] }, () => {
       getDetails(TIMELINE_TEMPLATE_DETAILS).should('have.text', 'None');
     });
     cy.get(SCHEDULE_DETAILS).within(() => {
-      getDetails(RUNS_EVERY_DETAILS).should('have.text', `${rule.interval}`);
+      getDetails(RUNS_EVERY_DETAILS)
+        .find(INTERVAL_ABBR_VALUE)
+        .should('have.text', `${rule.interval}`);
       const humanizedDuration = getHumanizedDuration(rule.from ?? 'now-6m', rule.interval ?? '5m');
-      getDetails(ADDITIONAL_LOOK_BACK_DETAILS).should('have.text', `${humanizedDuration}`);
+      getDetails(ADDITIONAL_LOOK_BACK_DETAILS)
+        .find(INTERVAL_ABBR_VALUE)
+        .should('have.text', `${humanizedDuration}`);
     });
 
     waitForTheRuleToBeExecuted();
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/rule_creation/threshold_rule.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/rule_creation/threshold_rule.cy.ts
index 3a09073b71f388..cc7354965ae2aa 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/rule_creation/threshold_rule.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/rule_creation/threshold_rule.cy.ts
@@ -42,6 +42,7 @@ import {
   THRESHOLD_DETAILS,
   TIMELINE_TEMPLATE_DETAILS,
   SUPPRESS_FOR_DETAILS,
+  INTERVAL_ABBR_VALUE,
 } from '../../../../screens/rule_details';
 import { expectNumberOfRules, goToRuleDetailsOf } from '../../../../tasks/alerts_detection_rules';
 import { deleteAlertsAndRules } from '../../../../tasks/api_calls/common';
@@ -134,12 +135,16 @@ describe(
         assertDetailsNotExist(SUPPRESS_FOR_DETAILS);
       });
       cy.get(SCHEDULE_DETAILS).within(() => {
-        getDetails(RUNS_EVERY_DETAILS).should('have.text', `${rule.interval}`);
+        getDetails(RUNS_EVERY_DETAILS)
+          .find(INTERVAL_ABBR_VALUE)
+          .should('have.text', `${rule.interval}`);
         const humanizedDuration = getHumanizedDuration(
           rule.from ?? 'now-6m',
           rule.interval ?? '5m'
         );
-        getDetails(ADDITIONAL_LOOK_BACK_DETAILS).should('have.text', `${humanizedDuration}`);
+        getDetails(ADDITIONAL_LOOK_BACK_DETAILS)
+          .find(INTERVAL_ABBR_VALUE)
+          .should('have.text', `${humanizedDuration}`);
       });
 
       waitForTheRuleToBeExecuted();
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/rule_edit/custom_query_rule.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/rule_edit/custom_query_rule.cy.ts
index 11f2cf86a20f08..613bb4d49d54be 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/rule_edit/custom_query_rule.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/rule_edit/custom_query_rule.cy.ts
@@ -36,6 +36,7 @@ import {
   CUSTOM_QUERY_DETAILS,
   DEFINITION_DETAILS,
   INDEX_PATTERNS_DETAILS,
+  INTERVAL_ABBR_VALUE,
   INVESTIGATION_NOTES_TOGGLE,
   RISK_SCORE_DETAILS,
   RULE_NAME_HEADER,
@@ -149,7 +150,9 @@ describe('Custom query rules', { tags: ['@ess', '@serverless'] }, () => {
       });
       if (getEditedRule().interval) {
         cy.get(SCHEDULE_DETAILS).within(() => {
-          getDetails(RUNS_EVERY_DETAILS).should('have.text', getEditedRule().interval);
+          getDetails(RUNS_EVERY_DETAILS)
+            .find(INTERVAL_ABBR_VALUE)
+            .should('have.text', getEditedRule().interval);
         });
       }
     });
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/sourcerer/create_runtime_field.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/sourcerer/create_runtime_field.cy.ts
index 9ef5238295ed82..982ec93a55e0ed 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/sourcerer/create_runtime_field.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/sourcerer/create_runtime_field.cy.ts
@@ -26,7 +26,8 @@ import { deleteRuntimeField } from '../../../../tasks/api_calls/sourcerer';
 const alertRunTimeField = 'field.name.alert.page';
 const timelineRuntimeField = 'field.name.timeline';
 
-describe('Create DataView runtime field', { tags: ['@ess', '@serverless'] }, () => {
+// FLAKY: https://github.com/elastic/kibana/issues/183104
+describe.skip('Create DataView runtime field', { tags: ['@ess', '@serverless'] }, () => {
   beforeEach(() => {
     login();
     deleteRuntimeField('security-solution-default', alertRunTimeField);
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/value_lists/value_list_items.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/value_lists/value_list_items.cy.ts
index 43d84c2f45315d..9e9a6ec8fdf612 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/value_lists/value_list_items.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/value_lists/value_list_items.cy.ts
@@ -39,6 +39,7 @@ import {
   VALUE_LIST_ITEMS_MODAL_TITLE,
 } from '../../../../screens/lists';
 import { RULES_MANAGEMENT_URL } from '../../../../urls/rules_management';
+import { getDefaultUsername } from '../../../../tasks/common/users';
 
 describe(
   'Value list items',
@@ -72,7 +73,7 @@ describe(
       // check modal title and info
       cy.get(VALUE_LIST_ITEMS_MODAL_TITLE).should('have.text', KNOWN_VALUE_LIST_FILES.TEXT);
       cy.get(VALUE_LIST_ITEMS_MODAL_INFO).contains('Type: keyword');
-      cy.get(VALUE_LIST_ITEMS_MODAL_INFO).contains('Updated by: system_indices_superuse');
+      cy.get(VALUE_LIST_ITEMS_MODAL_INFO).contains(`Updated by: ${getDefaultUsername()}`);
       checkTotalItems(totalItems);
 
       // search working
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/rule_management/rule_actions/bulk_actions/bulk_edit_rules.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/rule_management/rule_actions/bulk_actions/bulk_edit_rules.cy.ts
index 4584c0d5719e57..1c7bb46c4cbc1d 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/rule_management/rule_actions/bulk_actions/bulk_edit_rules.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/rule_management/rule_actions/bulk_actions/bulk_edit_rules.cy.ts
@@ -578,7 +578,8 @@ describe('Detection rules, bulk edit', { tags: ['@ess', '@serverless'] }, () =>
     });
   });
 
-  describe('Investigation fields actions', () => {
+  // https://github.com/elastic/kibana/issues/182834
+  describe('Investigation fields actions', { tags: ['@skipInServerlessMKI'] }, () => {
     it('Add investigation fields to custom rules', () => {
       getRulesManagementTableRows().then((rows) => {
         const fieldsToBeAdded = ['source.ip', 'destination.ip'];
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/rule_management/rule_details/common_flows.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/rule_management/rule_details/common_flows.cy.ts
index 7bbc5601a4f5db..e881fd76860d86 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/rule_management/rule_details/common_flows.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/rule_management/rule_details/common_flows.cy.ts
@@ -41,6 +41,7 @@ import {
   THREAT_TACTIC,
   THREAT_TECHNIQUE,
   TIMELINE_TEMPLATE_DETAILS,
+  INTERVAL_ABBR_VALUE,
 } from '../../../../screens/rule_details';
 
 import { createTimeline } from '../../../../tasks/api_calls/timelines';
@@ -153,8 +154,10 @@ describe('Common rule detail flows', { tags: ['@ess', '@serverless'] }, function
       getDetails(TIMELINE_TEMPLATE_DETAILS).should('have.text', 'Security Timeline');
     });
     cy.get(SCHEDULE_DETAILS).within(() => {
-      getDetails(RUNS_EVERY_DETAILS).should('have.text', ruleFields.ruleInterval);
-      getDetails(ADDITIONAL_LOOK_BACK_DETAILS).should('have.text', '55m');
+      getDetails(RUNS_EVERY_DETAILS)
+        .find(INTERVAL_ABBR_VALUE)
+        .should('have.text', ruleFields.ruleInterval);
+      getDetails(ADDITIONAL_LOOK_BACK_DETAILS).find(INTERVAL_ABBR_VALUE).should('have.text', '55m');
     });
   });
 
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/explore/navigation/search_bar.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/explore/navigation/search_bar.cy.ts
index 14afab3600f549..c11878fcc4916e 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/explore/navigation/search_bar.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/explore/navigation/search_bar.cy.ts
@@ -23,7 +23,8 @@ import { getHostIpFilter } from '../../../objects/filter';
 import { hostsUrl } from '../../../urls/navigation';
 import { waitForAllHostsToBeLoaded } from '../../../tasks/hosts/all_hosts';
 
-describe('SearchBar', { tags: ['@ess', '@serverless'] }, () => {
+// Failing: See https://github.com/elastic/kibana/issues/182932
+describe.skip('SearchBar', { tags: ['@ess', '@serverless'] }, () => {
   beforeEach(() => {
     login();
     visitWithTimeRange(hostsUrl('allHosts'));
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/filters.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/filters.cy.ts
index 8426a4c178a3dd..7b2f6796a05eb4 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/filters.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/filters.cy.ts
@@ -17,10 +17,9 @@ import { ALERTS_URL } from '../../../urls/navigation';
 import { getTimeline } from '../../../objects/timeline';
 import {
   GET_TIMELINE_GRID_CELL,
-  TIMELINE_FILTER_FOR,
-  TIMELINE_FILTER_OUT,
   TIMELINE_EVENT,
   TIMELINE_FILTER_BADGE_ENABLED,
+  HOVER_ACTIONS,
 } from '../../../screens/timeline';
 
 const mockTimeline = getTimeline();
@@ -40,13 +39,13 @@ describe(
     });
     it('filter in', () => {
       cy.get(GET_TIMELINE_GRID_CELL('event.category')).trigger('mouseover');
-      cy.get(TIMELINE_FILTER_FOR).should('be.visible').click();
+      cy.get(HOVER_ACTIONS.FILTER_FOR).should('be.visible').click();
       cy.get(TIMELINE_FILTER_BADGE_ENABLED).should('be.visible');
     });
 
     it('filter out', () => {
       cy.get(GET_TIMELINE_GRID_CELL('event.category')).trigger('mouseover');
-      cy.get(TIMELINE_FILTER_OUT).should('be.visible').click();
+      cy.get(HOVER_ACTIONS.FILTER_OUT).should('be.visible').click();
       cy.get(TIMELINE_EVENT).should('not.exist');
     });
   }
diff --git a/x-pack/test/security_solution_cypress/cypress/screens/alerts.ts b/x-pack/test/security_solution_cypress/cypress/screens/alerts.ts
index e21d7fe46fea7f..a348cc98d12ec6 100644
--- a/x-pack/test/security_solution_cypress/cypress/screens/alerts.ts
+++ b/x-pack/test/security_solution_cypress/cypress/screens/alerts.ts
@@ -180,7 +180,7 @@ export const ALERT_TABLE_EVENT_RENDERED_VIEW_OPTION = '[data-test-subj="eventRen
 export const ALERT_RENDERER_HOST_NAME =
   '[data-test-subj="alertFieldBadge"] [data-test-subj="render-content-host.name"]';
 
-export const HOVER_ACTIONS_CONTAINER = getDataTestSubjectSelector('hover-actions-container');
+export const HOVER_ACTIONS_CONTAINER = getDataTestSubjectSelector('hoverActionsPopover');
 
 export const SECURITY_SOLUTION_USERS_AVATAR = (user: string) =>
   `[data-test-subj="securitySolutionUsersAvatar-${user}"]`;
diff --git a/x-pack/test/security_solution_cypress/cypress/screens/rule_details.ts b/x-pack/test/security_solution_cypress/cypress/screens/rule_details.ts
index 53237cac7ec8bd..15a4d1864e00fc 100644
--- a/x-pack/test/security_solution_cypress/cypress/screens/rule_details.ts
+++ b/x-pack/test/security_solution_cypress/cypress/screens/rule_details.ts
@@ -17,6 +17,8 @@ export const ABOUT_DETAILS =
 
 export const ADDITIONAL_LOOK_BACK_DETAILS = 'Additional look-back time';
 
+export const INTERVAL_ABBR_VALUE = '[data-test-subj="interval-abbr-value"]';
+
 export const ALERTS_TAB = '[data-test-subj="navigation-alerts"]';
 
 export const ANOMALY_SCORE_DETAILS = 'Anomaly score';
diff --git a/x-pack/test/security_solution_cypress/cypress/screens/timeline.ts b/x-pack/test/security_solution_cypress/cypress/screens/timeline.ts
index 5576a6c498f0f4..8d24d64a38cd6d 100644
--- a/x-pack/test/security_solution_cypress/cypress/screens/timeline.ts
+++ b/x-pack/test/security_solution_cypress/cypress/screens/timeline.ts
@@ -284,17 +284,13 @@ export const TIMELINE_VIEW_IN_ANALYZER = '[data-test-subj="view-in-analyzer"]';
 export const EMPTY_DATA_PROVIDER_AREA = `.timeline-drop-area-empty`;
 
 export const HOVER_ACTIONS = {
-  ADD_TO_TIMELINE: '[data-test-subj="hover-actions-add-timeline"]',
-  FILTER_FOR: '[data-test-subj="hover-actions-filter-for"]',
-  FILTER_OUT: '[data-test-subj="hovhover-actions-filter-out"]',
-  COPY: '[data-test-subj="hover-actions-copy-button"]',
-  SHOW_TOP: '[data-test-subj=show-top-field]',
+  ADD_TO_TIMELINE: '[data-test-subj="actionItem-security-default-cellActions-addToTimeline"]',
+  FILTER_FOR: '[data-test-subj="actionItem-security-default-cellActions-filterIn"]',
+  FILTER_OUT: '[data-test-subj="actionItem-security-default-cellActions-filterOut"]',
+  COPY: '[data-test-subj="actionItem-security-default-cellActions-copyToClipboard"]',
+  SHOW_TOP: '[data-test-subj="actionItem-security-default-cellActions-showTopN"]',
 };
 
-export const TIMELINE_FILTER_OUT = '[data-test-subj="filter-out-value"]';
-
-export const TIMELINE_FILTER_FOR = '[data-test-subj="filter-for-value"]';
-
 export const TIMELINE_FILTER_BADGE_ENABLED = '[data-test-subj~="filter-enabled"]';
 
 export const GET_TIMELINE_HEADER = (fieldName: string) => {
diff --git a/x-pack/test/security_solution_cypress/cypress/tasks/common/users.ts b/x-pack/test/security_solution_cypress/cypress/tasks/common/users.ts
new file mode 100644
index 00000000000000..f9184299376874
--- /dev/null
+++ b/x-pack/test/security_solution_cypress/cypress/tasks/common/users.ts
@@ -0,0 +1,15 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { CLOUD_SERVERLESS } from '../../env_var_names_constants';
+
+type DefaultUsername = 'testing-internal' | 'system_indices_superuser';
+
+export const getDefaultUsername = (): DefaultUsername => {
+  const isMKIserverless: boolean = Cypress.env(CLOUD_SERVERLESS);
+  return isMKIserverless ? 'testing-internal' : 'system_indices_superuser';
+};
diff --git a/x-pack/test/security_solution_cypress/cypress/tasks/search_bar.ts b/x-pack/test/security_solution_cypress/cypress/tasks/search_bar.ts
index bd6ca6775c12f5..2ac369e61b68df 100644
--- a/x-pack/test/security_solution_cypress/cypress/tasks/search_bar.ts
+++ b/x-pack/test/security_solution_cypress/cypress/tasks/search_bar.ts
@@ -52,16 +52,23 @@ export const removeKqlFilter = () => {
 };
 
 export const fillAddFilterForm = ({ key, operator, value }: SearchBarFilter) => {
-  cy.get(ADD_FILTER_FORM_FIELD_INPUT).type(`${key}{downarrow}{enter}`);
+  // workaround for field input sometimes rerenders losing focus
+  cy.waitUntil(() => {
+    cy.get(ADD_FILTER_FORM_FIELD_INPUT).should('be.enabled');
+    cy.get(ADD_FILTER_FORM_FIELD_INPUT).focus();
+    cy.get(ADD_FILTER_FORM_FIELD_INPUT).invoke('val', ''); // .clear() not working well
+    cy.get(ADD_FILTER_FORM_FIELD_INPUT).type(`${key}{downarrow}{enter}`);
+    return cy.get(ADD_FILTER_FORM_OPERATOR_FIELD).then(($el) => !$el.attr('disabled'));
+  }).then(() => {
+    cy.get(ADD_FILTER_FORM_OPERATOR_FIELD).type(`${operator}{downarrow}{enter}`);
 
-  cy.get(ADD_FILTER_FORM_OPERATOR_FIELD).type(`${operator}{downarrow}{enter}`);
+    if (value) {
+      cy.get(ADD_FILTER_FORM_FILTER_VALUE_INPUT).type(value);
+    }
 
-  if (value) {
-    cy.get(ADD_FILTER_FORM_FILTER_VALUE_INPUT).type(value);
-  }
-
-  cy.get(ADD_FILTER_FORM_SAVE_BUTTON).click();
-  cy.get(ADD_FILTER_FORM_SAVE_BUTTON).should('not.exist');
+    cy.get(ADD_FILTER_FORM_SAVE_BUTTON).click();
+    cy.get(ADD_FILTER_FORM_SAVE_BUTTON).should('not.exist');
+  });
 };
 
 export const fillLocalSearchBar = (query: string) => {
diff --git a/x-pack/test/security_solution_endpoint/apps/integrations/artifact_entries_list.ts b/x-pack/test/security_solution_endpoint/apps/integrations/artifact_entries_list.ts
index fc179681388aea..58ffde0d7611f0 100644
--- a/x-pack/test/security_solution_endpoint/apps/integrations/artifact_entries_list.ts
+++ b/x-pack/test/security_solution_endpoint/apps/integrations/artifact_entries_list.ts
@@ -54,7 +54,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
 
   describe('For each artifact list under management', function () {
     // It's flaky only in Serverless
-    targetTags(this, ['@ess', '@skipInServerless']);
+    targetTags(this, ['@ess', '@serverless']);
 
     this.timeout(60_000 * 5);
     let indexedData: IndexedHostsAndAlertsResponse;
@@ -155,10 +155,13 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
         } else if (formAction.type === 'click') {
           await testSubjects.click(formAction.selector);
         } else if (formAction.type === 'input') {
-          await testSubjects.setValue(
-            formAction.selector,
-            (formAction.value || '') + (suffix ? suffix : '')
-          );
+          const newValue = (formAction.value || '') + (suffix ? suffix : '');
+          await testSubjects.setValue(formAction.selector, newValue);
+          await testSubjects.getAttribute(formAction.selector, 'value').then((value) => {
+            if (value !== newValue) {
+              return testSubjects.setValue(formAction.selector, newValue);
+            }
+          });
         } else if (formAction.type === 'clear') {
           await (
             await (await testSubjects.find(formAction.selector)).findByCssSelector('button')
diff --git a/x-pack/test_serverless/api_integration/services/index.ts b/x-pack/test_serverless/api_integration/services/index.ts
index cbf6a099966d42..844c9339cf8ac7 100644
--- a/x-pack/test_serverless/api_integration/services/index.ts
+++ b/x-pack/test_serverless/api_integration/services/index.ts
@@ -11,7 +11,6 @@ import { services as svlSharedServices } from '../../shared/services';
 
 import { AlertingApiProvider } from './alerting_api';
 import { SamlToolsProvider } from './saml_tools';
-import { DataViewApiProvider } from './data_view_api';
 import { SvlCasesServiceProvider } from './svl_cases';
 import { SloApiProvider } from './slo_api';
 import { TransformProvider } from './transform';
@@ -24,7 +23,6 @@ export const services = {
   ...svlSharedServices,
   alertingApi: AlertingApiProvider,
   samlTools: SamlToolsProvider,
-  dataViewApi: DataViewApiProvider,
   svlCases: SvlCasesServiceProvider,
   sloApi: SloApiProvider,
   transform: TransformProvider,
diff --git a/x-pack/test_serverless/api_integration/test_suites/common/data_views/fields_for_wildcard_route/conflicts.ts b/x-pack/test_serverless/api_integration/test_suites/common/data_views/fields_for_wildcard_route/conflicts.ts
index 33d708c2753a63..915cce91ca0eec 100644
--- a/x-pack/test_serverless/api_integration/test_suites/common/data_views/fields_for_wildcard_route/conflicts.ts
+++ b/x-pack/test_serverless/api_integration/test_suites/common/data_views/fields_for_wildcard_route/conflicts.ts
@@ -17,7 +17,6 @@ export default function ({ getService }: FtrProviderContext) {
   const svlCommonApi = getService('svlCommonApi');
 
   describe('conflicts', function () {
-    this.tags('failsOnMKI');
     before(() =>
       esArchiver.load('test/api_integration/fixtures/es_archiver/index_patterns/conflicts')
     );
@@ -31,7 +30,7 @@ export default function ({ getService }: FtrProviderContext) {
         .set(ELASTIC_HTTP_VERSION_HEADER, INITIAL_REST_VERSION_INTERNAL)
         // TODO: API requests in Serverless require internal request headers
         .set(svlCommonApi.getInternalRequestHeader())
-        .query({ pattern: 'logs-*' })
+        .query({ pattern: 'logs-2017.01.*' })
         .expect(200)
         .then((resp) => {
           expect(resp.body).to.eql({
diff --git a/x-pack/test_serverless/api_integration/test_suites/common/index_management/index_component_templates.ts b/x-pack/test_serverless/api_integration/test_suites/common/index_management/index_component_templates.ts
index fce7e3c7c7a44a..b1f26ac5624144 100644
--- a/x-pack/test_serverless/api_integration/test_suites/common/index_management/index_component_templates.ts
+++ b/x-pack/test_serverless/api_integration/test_suites/common/index_management/index_component_templates.ts
@@ -15,7 +15,10 @@ export default function ({ getService }: FtrProviderContext) {
   const log = getService('log');
   const indexManagementService = getService('indexManagement');
 
-  describe('component templates', () => {
+  // Failing: See https://github.com/elastic/kibana/issues/182792
+  // Failing: See https://github.com/elastic/kibana/issues/182797
+  // Failing: See https://github.com/elastic/kibana/issues/182791
+  describe.skip('component templates', () => {
     // Api methods
     let getAllComponentTemplates: typeof indexManagementService['componentTemplates']['api']['getAllComponentTemplates'];
     let getOneComponentTemplate: typeof indexManagementService['componentTemplates']['api']['getOneComponentTemplate'];
diff --git a/x-pack/test_serverless/api_integration/test_suites/common/reporting/generate_csv_discover.ts b/x-pack/test_serverless/api_integration/test_suites/common/reporting/generate_csv_discover.ts
index 9aafefdff51ce9..89e5f5a0de4a7e 100644
--- a/x-pack/test_serverless/api_integration/test_suites/common/reporting/generate_csv_discover.ts
+++ b/x-pack/test_serverless/api_integration/test_suites/common/reporting/generate_csv_discover.ts
@@ -68,8 +68,6 @@ export default function ({ getService }: FtrProviderContext) {
    * Tests
    */
   describe('Generate CSV from SearchSource', function () {
-    // failsOnMKI, see https://github.com/elastic/kibana/issues/179456
-    this.tags(['failsOnMKI']);
     beforeEach(async () => {
       await kibanaServer.uiSettings.update({
         'csv:quoteValues': true,
@@ -84,6 +82,7 @@ export default function ({ getService }: FtrProviderContext) {
       });
 
       after(async () => {
+        await reportingAPI.deleteAllReports();
         await esArchiver.unload(archives.ecommerce.data);
         await kibanaServer.importExport.unload(archives.ecommerce.savedObjects);
       });
diff --git a/x-pack/test_serverless/functional/es_archives/kibana_sample_data_flights_index_pattern/data.json.gz b/x-pack/test_serverless/functional/es_archives/kibana_sample_data_flights_index_pattern/data.json.gz
index 45c293daa472c4..1022230a86b797 100644
Binary files a/x-pack/test_serverless/functional/es_archives/kibana_sample_data_flights_index_pattern/data.json.gz and b/x-pack/test_serverless/functional/es_archives/kibana_sample_data_flights_index_pattern/data.json.gz differ
diff --git a/x-pack/test_serverless/functional/page_objects/index.ts b/x-pack/test_serverless/functional/page_objects/index.ts
index f1604d48508e2f..ebc85de7d332c2 100644
--- a/x-pack/test_serverless/functional/page_objects/index.ts
+++ b/x-pack/test_serverless/functional/page_objects/index.ts
@@ -21,6 +21,7 @@ import { SvlRuleDetailsPageProvider } from './svl_rule_details_ui_page';
 import { SvlSearchConnectorsPageProvider } from './svl_search_connectors_page';
 import { SvlManagementPageProvider } from './svl_management_page';
 import { SvlIngestPipelines } from './svl_ingest_pipelines';
+import { SvlPlaygroundPageProvider } from './svl_playground_page';
 
 export const pageObjects = {
   ...xpackFunctionalPageObjects,
@@ -38,4 +39,5 @@ export const pageObjects = {
   svlRuleDetailsUI: SvlRuleDetailsPageProvider,
   svlManagementPage: SvlManagementPageProvider,
   svlIngestPipelines: SvlIngestPipelines,
+  svlPlaygroundUI: SvlPlaygroundPageProvider,
 };
diff --git a/x-pack/test_serverless/functional/page_objects/svl_playground_page.ts b/x-pack/test_serverless/functional/page_objects/svl_playground_page.ts
new file mode 100644
index 00000000000000..e0c26c031eb50d
--- /dev/null
+++ b/x-pack/test_serverless/functional/page_objects/svl_playground_page.ts
@@ -0,0 +1,26 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { FtrProviderContext } from '../ftr_provider_context';
+
+export function SvlPlaygroundPageProvider({ getService }: FtrProviderContext) {
+  const testSubjects = getService('testSubjects');
+  return {
+    PlaygrounStartChatPage: {
+      async expectPlaygroundStartChatPageComponentsToExist() {
+        await testSubjects.existOrFail('chat-playground-home-page-title');
+        await testSubjects.existOrFail('selectIndicesChatPanel');
+        await testSubjects.existOrFail('startChatButton');
+      },
+
+      async expectPlaygroundHeaderComponentsToExist() {
+        await testSubjects.existOrFail('playground-header-actions');
+        await testSubjects.existOrFail('playground-documentation-link');
+      },
+    },
+  };
+}
diff --git a/x-pack/test_serverless/functional/services/deployment_agnostic_services.ts b/x-pack/test_serverless/functional/services/deployment_agnostic_services.ts
index 0bbae5c25cdd50..f710dca0816683 100644
--- a/x-pack/test_serverless/functional/services/deployment_agnostic_services.ts
+++ b/x-pack/test_serverless/functional/services/deployment_agnostic_services.ts
@@ -52,6 +52,7 @@ const deploymentAgnosticFunctionalServices = _.pick(functionalServices, [
   'menuToggle',
   'ml',
   'monacoEditor',
+  'esql',
   'pieChart',
   'pipelineEditor',
   'pipelineList',
diff --git a/x-pack/test_serverless/functional/test_suites/common/discover/esql/_esql_view.ts b/x-pack/test_serverless/functional/test_suites/common/discover/esql/_esql_view.ts
new file mode 100644
index 00000000000000..5f051ac77bba0f
--- /dev/null
+++ b/x-pack/test_serverless/functional/test_suites/common/discover/esql/_esql_view.ts
@@ -0,0 +1,530 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import expect from '@kbn/expect';
+import { FtrProviderContext } from '../../../../ftr_provider_context';
+
+export default function ({ getService, getPageObjects }: FtrProviderContext) {
+  const esArchiver = getService('esArchiver');
+  const kibanaServer = getService('kibanaServer');
+  const log = getService('log');
+  const dataGrid = getService('dataGrid');
+  const testSubjects = getService('testSubjects');
+  const monacoEditor = getService('monacoEditor');
+  const inspector = getService('inspector');
+  const retry = getService('retry');
+  const browser = getService('browser');
+  const find = getService('find');
+  const esql = getService('esql');
+  const dashboardAddPanel = getService('dashboardAddPanel');
+  const PageObjects = getPageObjects([
+    'svlCommonPage',
+    'common',
+    'discover',
+    'dashboard',
+    'header',
+    'timePicker',
+    'unifiedFieldList',
+  ]);
+
+  const defaultSettings = {
+    defaultIndex: 'logstash-*',
+  };
+
+  describe('discover esql view', async function () {
+    before(async () => {
+      await kibanaServer.savedObjects.cleanStandardList();
+      log.debug('load kibana index with default index pattern');
+      await kibanaServer.importExport.load('test/functional/fixtures/kbn_archiver/discover');
+      // and load a set of makelogs data
+      await esArchiver.loadIfNeeded('test/functional/fixtures/es_archiver/logstash_functional');
+      await kibanaServer.uiSettings.replace(defaultSettings);
+      await PageObjects.svlCommonPage.loginAsAdmin();
+      await PageObjects.common.navigateToApp('discover');
+      await PageObjects.header.waitUntilLoadingHasFinished();
+      await PageObjects.timePicker.setDefaultAbsoluteRange();
+    });
+
+    describe('test', () => {
+      it('should render esql view correctly', async function () {
+        await PageObjects.unifiedFieldList.waitUntilSidebarHasLoaded();
+
+        await testSubjects.existOrFail('showQueryBarMenu');
+        await testSubjects.existOrFail('superDatePickerToggleQuickMenuButton');
+        await testSubjects.existOrFail('addFilter');
+        await testSubjects.existOrFail('dscViewModeDocumentButton');
+        await testSubjects.existOrFail('unifiedHistogramChart');
+        await testSubjects.existOrFail('discoverQueryHits');
+        await testSubjects.existOrFail('discoverAlertsButton');
+        await testSubjects.existOrFail('shareTopNavButton');
+        await testSubjects.existOrFail('docTableExpandToggleColumn');
+        await testSubjects.existOrFail('dataGridColumnSortingButton');
+        await testSubjects.existOrFail('fieldListFiltersFieldSearch');
+        await testSubjects.existOrFail('fieldListFiltersFieldTypeFilterToggle');
+        await testSubjects.click('field-@message-showDetails');
+        await testSubjects.existOrFail('discoverFieldListPanelEdit-@message');
+
+        await PageObjects.discover.selectTextBaseLang();
+        await PageObjects.unifiedFieldList.waitUntilSidebarHasLoaded();
+
+        await testSubjects.existOrFail('fieldListFiltersFieldSearch');
+        await testSubjects.existOrFail('TextBasedLangEditor');
+        await testSubjects.existOrFail('superDatePickerToggleQuickMenuButton');
+
+        await testSubjects.missingOrFail('showQueryBarMenu');
+        await testSubjects.missingOrFail('addFilter');
+        await testSubjects.missingOrFail('dscViewModeDocumentButton');
+        // when Lens suggests a table, we render an ESQL based histogram
+        await testSubjects.existOrFail('unifiedHistogramChart');
+        await testSubjects.existOrFail('discoverQueryHits');
+        await testSubjects.existOrFail('discoverAlertsButton');
+        await testSubjects.existOrFail('shareTopNavButton');
+        await testSubjects.existOrFail('dataGridColumnSortingButton');
+        await testSubjects.existOrFail('docTableExpandToggleColumn');
+        await testSubjects.existOrFail('fieldListFiltersFieldTypeFilterToggle');
+        await testSubjects.click('field-@message-showDetails');
+        await testSubjects.missingOrFail('discoverFieldListPanelEditItem');
+      });
+
+      it('should perform test query correctly', async function () {
+        await PageObjects.discover.selectTextBaseLang();
+        const testQuery = `from logstash-* | limit 10 | stats countB = count(bytes) by geo.dest | sort countB`;
+
+        await monacoEditor.setCodeEditorValue(testQuery);
+        await testSubjects.click('querySubmitButton');
+        await PageObjects.header.waitUntilLoadingHasFinished();
+        await PageObjects.discover.waitUntilSearchingHasFinished();
+        // here Lens suggests a XY so it is rendered
+        await testSubjects.existOrFail('unifiedHistogramChart');
+        await testSubjects.existOrFail('xyVisChart');
+        const cell = await dataGrid.getCellElement(0, 2);
+        expect(await cell.getVisibleText()).to.be('1');
+      });
+
+      it('should render when switching to a time range with no data, then back to a time range with data', async () => {
+        await PageObjects.discover.selectTextBaseLang();
+        const testQuery = `from logstash-* | limit 10 | stats countB = count(bytes) by geo.dest | sort countB`;
+        await monacoEditor.setCodeEditorValue(testQuery);
+        await testSubjects.click('querySubmitButton');
+        await PageObjects.header.waitUntilLoadingHasFinished();
+        await PageObjects.discover.waitUntilSearchingHasFinished();
+        let cell = await dataGrid.getCellElement(0, 2);
+        expect(await cell.getVisibleText()).to.be('1');
+        await PageObjects.timePicker.setAbsoluteRange(
+          'Sep 19, 2015 @ 06:31:44.000',
+          'Sep 19, 2015 @ 06:31:44.000'
+        );
+        await PageObjects.header.waitUntilLoadingHasFinished();
+        await PageObjects.discover.waitUntilSearchingHasFinished();
+        await testSubjects.existOrFail('discoverNoResults');
+        await PageObjects.timePicker.setDefaultAbsoluteRange();
+        await PageObjects.header.waitUntilLoadingHasFinished();
+        await PageObjects.discover.waitUntilSearchingHasFinished();
+        cell = await dataGrid.getCellElement(0, 2);
+        expect(await cell.getVisibleText()).to.be('1');
+      });
+
+      it('should query an index pattern that doesnt translate to a dataview correctly', async function () {
+        await PageObjects.discover.selectTextBaseLang();
+        const testQuery = `from logstash* | limit 10 | stats countB = count(bytes) by geo.dest | sort countB`;
+
+        await monacoEditor.setCodeEditorValue(testQuery);
+        await testSubjects.click('querySubmitButton');
+        await PageObjects.header.waitUntilLoadingHasFinished();
+
+        const cell = await dataGrid.getCellElement(0, 2);
+        expect(await cell.getVisibleText()).to.be('1');
+      });
+
+      it('should render correctly if there are empty fields', async function () {
+        await PageObjects.discover.selectTextBaseLang();
+        const testQuery = `from logstash-* | limit 10 | keep machine.ram_range, bytes`;
+
+        await monacoEditor.setCodeEditorValue(testQuery);
+        await testSubjects.click('querySubmitButton');
+        await PageObjects.header.waitUntilLoadingHasFinished();
+        await PageObjects.discover.waitUntilSearchingHasFinished();
+        const cell = await dataGrid.getCellElement(0, 3);
+        expect(await cell.getVisibleText()).to.be(' - ');
+        expect(await dataGrid.getHeaders()).to.eql([
+          'Control column',
+          'Select column',
+          'Numberbytes',
+          'machine.ram_range',
+        ]);
+      });
+
+      it('should work without a FROM statement', async function () {
+        await PageObjects.discover.selectTextBaseLang();
+        const testQuery = `ROW a = 1, b = "two", c = null`;
+
+        await monacoEditor.setCodeEditorValue(testQuery);
+        await testSubjects.click('querySubmitButton');
+        await PageObjects.header.waitUntilLoadingHasFinished();
+
+        await PageObjects.discover.dragFieldToTable('a');
+        const cell = await dataGrid.getCellElement(0, 2);
+        expect(await cell.getVisibleText()).to.be('1');
+      });
+    });
+
+    describe('errors', () => {
+      it('should show error messages for syntax errors in query', async function () {
+        await PageObjects.discover.selectTextBaseLang();
+        const brokenQueries = [
+          'from logstash-* | limit 10*',
+          'from logstash-* | limit A',
+          'from logstash-* | where a*',
+          'limit 10',
+        ];
+        for (const testQuery of brokenQueries) {
+          await monacoEditor.setCodeEditorValue(testQuery);
+          await testSubjects.click('querySubmitButton');
+          await PageObjects.header.waitUntilLoadingHasFinished();
+          await PageObjects.discover.waitUntilSearchingHasFinished();
+          // error in fetching documents because of the invalid query
+          await PageObjects.discover.showsErrorCallout();
+          const message = await testSubjects.getVisibleText('discoverErrorCalloutMessage');
+          expect(message).to.contain(
+            "[esql] > Couldn't parse Elasticsearch ES|QL query. Check your query and try again."
+          );
+          expect(message).to.not.contain('undefined');
+          if (message.includes('line')) {
+            expect((await monacoEditor.getCurrentMarkers('kibanaCodeEditor')).length).to.eql(1);
+          }
+        }
+      });
+    });
+
+    describe('switch modal', () => {
+      beforeEach(async () => {
+        await PageObjects.common.navigateToApp('discover');
+        await PageObjects.timePicker.setDefaultAbsoluteRange();
+      });
+
+      it('should show switch modal when switching to a data view', async () => {
+        await PageObjects.discover.selectTextBaseLang();
+        await PageObjects.header.waitUntilLoadingHasFinished();
+        await PageObjects.discover.waitUntilSearchingHasFinished();
+        await PageObjects.discover.selectIndexPattern('logstash-*', false);
+        await retry.try(async () => {
+          await testSubjects.existOrFail('unifiedSearch_switch_modal');
+        });
+      });
+
+      it('should not show switch modal when switching to a data view while a saved search is open', async () => {
+        await PageObjects.discover.selectTextBaseLang();
+        const testQuery = 'from logstash-* | limit 100 | drop @timestamp';
+        await monacoEditor.setCodeEditorValue(testQuery);
+        await testSubjects.click('querySubmitButton');
+        await PageObjects.header.waitUntilLoadingHasFinished();
+        await PageObjects.discover.waitUntilSearchingHasFinished();
+        await PageObjects.discover.selectIndexPattern('logstash-*', false);
+        await retry.try(async () => {
+          await testSubjects.existOrFail('unifiedSearch_switch_modal');
+        });
+        await find.clickByCssSelector(
+          '[data-test-subj="unifiedSearch_switch_modal"] .euiModal__closeIcon'
+        );
+        await retry.try(async () => {
+          await testSubjects.missingOrFail('unifiedSearch_switch_modal');
+        });
+        await PageObjects.discover.saveSearch('esql_test');
+        await PageObjects.discover.selectIndexPattern('logstash-*');
+        await testSubjects.missingOrFail('unifiedSearch_switch_modal');
+      });
+
+      it('should show switch modal when switching to a data view while a saved search with unsaved changes is open', async () => {
+        await PageObjects.discover.selectTextBaseLang();
+        await PageObjects.header.waitUntilLoadingHasFinished();
+        await PageObjects.discover.waitUntilSearchingHasFinished();
+        await PageObjects.discover.saveSearch('esql_test2');
+        const testQuery = 'from logstash-* | limit 100 | drop @timestamp';
+        await monacoEditor.setCodeEditorValue(testQuery);
+        await testSubjects.click('querySubmitButton');
+        await PageObjects.header.waitUntilLoadingHasFinished();
+        await PageObjects.discover.waitUntilSearchingHasFinished();
+        await PageObjects.discover.selectIndexPattern('logstash-*', false);
+        await retry.try(async () => {
+          await testSubjects.existOrFail('unifiedSearch_switch_modal');
+        });
+      });
+    });
+
+    describe('inspector', () => {
+      beforeEach(async () => {
+        await PageObjects.common.navigateToApp('discover');
+        await PageObjects.timePicker.setDefaultAbsoluteRange();
+      });
+
+      it('shows Discover and Lens requests in Inspector', async () => {
+        await PageObjects.discover.selectTextBaseLang();
+        await PageObjects.header.waitUntilLoadingHasFinished();
+        await PageObjects.discover.waitUntilSearchingHasFinished();
+        await inspector.open();
+        const requestNames = await inspector.getRequestNames();
+        expect(requestNames).to.contain('Table');
+        expect(requestNames).to.contain('Visualization');
+      });
+    });
+
+    describe('query history', () => {
+      beforeEach(async () => {
+        await PageObjects.common.navigateToApp('discover');
+        await PageObjects.timePicker.setDefaultAbsoluteRange();
+      });
+
+      it('should see my current query in the history', async () => {
+        await PageObjects.discover.selectTextBaseLang();
+        await PageObjects.header.waitUntilLoadingHasFinished();
+        await PageObjects.discover.waitUntilSearchingHasFinished();
+        await PageObjects.unifiedFieldList.waitUntilSidebarHasLoaded();
+
+        await testSubjects.click('TextBasedLangEditor-expand');
+        await testSubjects.click('TextBasedLangEditor-toggle-query-history-button');
+        const historyItems = await esql.getHistoryItems();
+        log.debug(historyItems);
+        const queryAdded = historyItems.some((item) => {
+          return item[1] === 'from logstash-* | limit 10';
+        });
+
+        expect(queryAdded).to.be(true);
+      });
+
+      it('updating the query should add this to the history', async () => {
+        await PageObjects.discover.selectTextBaseLang();
+        await PageObjects.header.waitUntilLoadingHasFinished();
+        await PageObjects.discover.waitUntilSearchingHasFinished();
+        await PageObjects.unifiedFieldList.waitUntilSidebarHasLoaded();
+
+        const testQuery = 'from logstash-* | limit 100 | drop @timestamp';
+        await monacoEditor.setCodeEditorValue(testQuery);
+        await testSubjects.click('querySubmitButton');
+        await PageObjects.header.waitUntilLoadingHasFinished();
+        await PageObjects.discover.waitUntilSearchingHasFinished();
+
+        await testSubjects.click('TextBasedLangEditor-expand');
+        await testSubjects.click('TextBasedLangEditor-toggle-query-history-button');
+        const historyItems = await esql.getHistoryItems();
+        log.debug(historyItems);
+        const queryAdded = historyItems.some((item) => {
+          return item[1] === 'from logstash-* | limit 100 | drop @timestamp';
+        });
+
+        expect(queryAdded).to.be(true);
+      });
+
+      it('should select a query from the history and submit it', async () => {
+        await PageObjects.discover.selectTextBaseLang();
+        await PageObjects.header.waitUntilLoadingHasFinished();
+        await PageObjects.discover.waitUntilSearchingHasFinished();
+        await PageObjects.unifiedFieldList.waitUntilSidebarHasLoaded();
+
+        await testSubjects.click('TextBasedLangEditor-expand');
+        await testSubjects.click('TextBasedLangEditor-toggle-query-history-button');
+        // click a history item
+        await esql.clickHistoryItem(1);
+
+        const historyItems = await esql.getHistoryItems();
+        log.debug(historyItems);
+        const queryAdded = historyItems.some((item) => {
+          return item[1] === 'from logstash-* | limit 100 | drop @timestamp';
+        });
+
+        expect(queryAdded).to.be(true);
+      });
+
+      it('should add a failed query to the history', async () => {
+        await PageObjects.discover.selectTextBaseLang();
+        await PageObjects.header.waitUntilLoadingHasFinished();
+        await PageObjects.discover.waitUntilSearchingHasFinished();
+        await PageObjects.unifiedFieldList.waitUntilSidebarHasLoaded();
+
+        const testQuery = 'from logstash-* | limit 100 | woof and meow';
+        await monacoEditor.setCodeEditorValue(testQuery);
+        await testSubjects.click('querySubmitButton');
+        await PageObjects.header.waitUntilLoadingHasFinished();
+        await PageObjects.discover.waitUntilSearchingHasFinished();
+        await PageObjects.unifiedFieldList.waitUntilSidebarHasLoaded();
+        await testSubjects.click('TextBasedLangEditor-expand');
+        await testSubjects.click('TextBasedLangEditor-toggle-query-history-button');
+        await testSubjects.click('TextBasedLangEditor-queryHistory-runQuery-button');
+        const historyItem = await esql.getHistoryItem(0);
+        await historyItem.findByTestSubject('TextBasedLangEditor-queryHistory-error');
+      });
+    });
+
+    describe('sorting', () => {
+      it('should sort correctly', async () => {
+        const savedSearchName = 'testSorting';
+
+        await PageObjects.discover.selectTextBaseLang();
+        await PageObjects.header.waitUntilLoadingHasFinished();
+        await PageObjects.discover.waitUntilSearchingHasFinished();
+
+        const testQuery = 'from logstash-* | sort @timestamp | limit 100';
+        await monacoEditor.setCodeEditorValue(testQuery);
+        await testSubjects.click('querySubmitButton');
+        await PageObjects.header.waitUntilLoadingHasFinished();
+        await PageObjects.discover.waitUntilSearchingHasFinished();
+        await PageObjects.unifiedFieldList.waitUntilSidebarHasLoaded();
+
+        await PageObjects.unifiedFieldList.clickFieldListItemAdd('bytes');
+
+        await PageObjects.header.waitUntilLoadingHasFinished();
+        await PageObjects.discover.waitUntilSearchingHasFinished();
+
+        await retry.waitFor('first cell contains an initial value', async () => {
+          const cell = await dataGrid.getCellElement(0, 2);
+          const text = await cell.getVisibleText();
+          return text === '1,623';
+        });
+
+        expect(await testSubjects.getVisibleText('dataGridColumnSortingButton')).to.be(
+          'Sort fields'
+        );
+
+        await dataGrid.clickDocSortDesc('bytes', 'Sort High-Low');
+
+        await PageObjects.discover.waitUntilSearchingHasFinished();
+
+        await retry.waitFor('first cell contains the highest value', async () => {
+          const cell = await dataGrid.getCellElement(0, 2);
+          const text = await cell.getVisibleText();
+          return text === '483';
+        });
+
+        expect(await testSubjects.getVisibleText('dataGridColumnSortingButton')).to.be(
+          'Sort fields\n1'
+        );
+
+        await PageObjects.discover.saveSearch(savedSearchName);
+
+        await PageObjects.header.waitUntilLoadingHasFinished();
+        await PageObjects.discover.waitUntilSearchingHasFinished();
+
+        await retry.waitFor('first cell contains the same highest value', async () => {
+          const cell = await dataGrid.getCellElement(0, 2);
+          const text = await cell.getVisibleText();
+          return text === '483';
+        });
+
+        await browser.refresh();
+
+        await PageObjects.header.waitUntilLoadingHasFinished();
+        await PageObjects.discover.waitUntilSearchingHasFinished();
+
+        await retry.waitFor('first cell contains the same highest value after reload', async () => {
+          const cell = await dataGrid.getCellElement(0, 2);
+          const text = await cell.getVisibleText();
+          return text === '483';
+        });
+
+        await PageObjects.discover.clickNewSearchButton();
+
+        await PageObjects.header.waitUntilLoadingHasFinished();
+        await PageObjects.discover.waitUntilSearchingHasFinished();
+
+        await PageObjects.discover.loadSavedSearch(savedSearchName);
+
+        await PageObjects.header.waitUntilLoadingHasFinished();
+        await PageObjects.discover.waitUntilSearchingHasFinished();
+
+        await retry.waitFor(
+          'first cell contains the same highest value after reopening',
+          async () => {
+            const cell = await dataGrid.getCellElement(0, 2);
+            const text = await cell.getVisibleText();
+            return text === '483';
+          }
+        );
+
+        await dataGrid.clickDocSortDesc('bytes', 'Sort Low-High');
+
+        await PageObjects.discover.waitUntilSearchingHasFinished();
+
+        await retry.waitFor('first cell contains the lowest value', async () => {
+          const cell = await dataGrid.getCellElement(0, 2);
+          const text = await cell.getVisibleText();
+          return text === '0';
+        });
+
+        expect(await testSubjects.getVisibleText('dataGridColumnSortingButton')).to.be(
+          'Sort fields\n1'
+        );
+
+        await PageObjects.unifiedFieldList.clickFieldListItemAdd('extension');
+
+        await PageObjects.header.waitUntilLoadingHasFinished();
+        await PageObjects.discover.waitUntilSearchingHasFinished();
+
+        await dataGrid.clickDocSortDesc('extension', 'Sort A-Z');
+
+        await retry.waitFor('first cell contains the lowest value for extension', async () => {
+          const cell = await dataGrid.getCellElement(0, 3);
+          const text = await cell.getVisibleText();
+          return text === 'css';
+        });
+
+        expect(await testSubjects.getVisibleText('dataGridColumnSortingButton')).to.be(
+          'Sort fields\n2'
+        );
+
+        await browser.refresh();
+
+        await PageObjects.header.waitUntilLoadingHasFinished();
+        await PageObjects.discover.waitUntilSearchingHasFinished();
+
+        await retry.waitFor('first cell contains the same lowest value after reload', async () => {
+          const cell = await dataGrid.getCellElement(0, 2);
+          const text = await cell.getVisibleText();
+          return text === '0';
+        });
+
+        await retry.waitFor(
+          'first cell contains the same lowest value for extension after reload',
+          async () => {
+            const cell = await dataGrid.getCellElement(0, 3);
+            const text = await cell.getVisibleText();
+            return text === 'css';
+          }
+        );
+
+        await PageObjects.discover.saveSearch(savedSearchName);
+
+        await PageObjects.common.navigateToApp('dashboard');
+        await PageObjects.dashboard.clickNewDashboard();
+        await PageObjects.timePicker.setDefaultAbsoluteRange();
+        await dashboardAddPanel.clickOpenAddPanel();
+        await dashboardAddPanel.addSavedSearch(savedSearchName);
+        await PageObjects.header.waitUntilLoadingHasFinished();
+
+        await retry.waitFor(
+          'first cell contains the same lowest value as dashboard panel',
+          async () => {
+            const cell = await dataGrid.getCellElement(0, 2);
+            const text = await cell.getVisibleText();
+            return text === '0';
+          }
+        );
+
+        await retry.waitFor(
+          'first cell contains the lowest value for extension as dashboard panel',
+          async () => {
+            const cell = await dataGrid.getCellElement(0, 3);
+            const text = await cell.getVisibleText();
+            return text === 'css';
+          }
+        );
+
+        expect(await testSubjects.getVisibleText('dataGridColumnSortingButton')).to.be(
+          'Sort fields\n2'
+        );
+      });
+    });
+  });
+}
diff --git a/x-pack/test/api_integration/apis/ml/indices/index.ts b/x-pack/test_serverless/functional/test_suites/common/discover/esql/index.ts
similarity index 66%
rename from x-pack/test/api_integration/apis/ml/indices/index.ts
rename to x-pack/test_serverless/functional/test_suites/common/discover/esql/index.ts
index 563a0de4d20d8c..54122d2ca827d5 100644
--- a/x-pack/test/api_integration/apis/ml/indices/index.ts
+++ b/x-pack/test_serverless/functional/test_suites/common/discover/esql/index.ts
@@ -5,10 +5,10 @@
  * 2.0.
  */
 
-import { FtrProviderContext } from '../../../ftr_provider_context';
+import { FtrProviderContext } from '../../../../ftr_provider_context';
 
 export default function ({ loadTestFile }: FtrProviderContext) {
-  describe('system', function () {
-    loadTestFile(require.resolve('./field_caps'));
+  describe('discover/esql', function () {
+    loadTestFile(require.resolve('./_esql_view'));
   });
 }
diff --git a/x-pack/test_serverless/functional/test_suites/common/discover/group2/_data_grid_doc_table.ts b/x-pack/test_serverless/functional/test_suites/common/discover/group2/_data_grid_doc_table.ts
index 3745b1223d6152..2ca4c5f8569377 100644
--- a/x-pack/test_serverless/functional/test_suites/common/discover/group2/_data_grid_doc_table.ts
+++ b/x-pack/test_serverless/functional/test_suites/common/discover/group2/_data_grid_doc_table.ts
@@ -33,8 +33,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const testSubjects = getService('testSubjects');
   const security = getService('security');
 
-  // FLAKY: https://github.com/elastic/kibana/issues/182125
-  describe.skip('discover data grid doc table', function describeIndexTests() {
+  describe('discover data grid doc table', function describeIndexTests() {
     before(async function () {
       await security.testUser.setRoles(['kibana_admin', 'test_logstash_reader']);
       log.debug('load kibana index with default index pattern');
diff --git a/x-pack/test_serverless/functional/test_suites/common/discover/group2/index.ts b/x-pack/test_serverless/functional/test_suites/common/discover/group2/index.ts
index be8a043327a7d0..658b92845ffca6 100644
--- a/x-pack/test_serverless/functional/test_suites/common/discover/group2/index.ts
+++ b/x-pack/test_serverless/functional/test_suites/common/discover/group2/index.ts
@@ -11,8 +11,7 @@ export default function ({ getService, loadTestFile }: FtrProviderContext) {
   const esArchiver = getService('esArchiver');
   const browser = getService('browser');
 
-  // FLAKY: https://github.com/elastic/kibana/issues/182126
-  describe.skip('discover/group2', function () {
+  describe('discover/group2', function () {
     before(async function () {
       await browser.setWindowSize(1600, 1200);
     });
diff --git a/x-pack/test_serverless/functional/test_suites/common/management/data_views/_data_view_create_delete.ts b/x-pack/test_serverless/functional/test_suites/common/management/data_views/_data_view_create_delete.ts
index ca7bc4bc555695..6834288b92b0d6 100644
--- a/x-pack/test_serverless/functional/test_suites/common/management/data_views/_data_view_create_delete.ts
+++ b/x-pack/test_serverless/functional/test_suites/common/management/data_views/_data_view_create_delete.ts
@@ -19,8 +19,6 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const PageObjects = getPageObjects(['settings', 'common', 'header']);
 
   describe('creating and deleting default data view', function describeIndexTests() {
-    // failsOnMKI, see https://github.com/elastic/kibana/issues/171479
-    this.tags(['failsOnMKI']);
     before(async function () {
       // TODO: emptyKibanaIndex fails in Serverless with
       // "index_not_found_exception: no such index [.kibana_ingest]",
@@ -31,7 +29,11 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       await esArchiver.loadIfNeeded(
         'x-pack/test_serverless/functional/es_archives/kibana_sample_data_flights_index_pattern'
       );
+      await kibanaServer.importExport.load(
+        'test/functional/fixtures/kbn_archiver/kibana_sample_data_flights_index_pattern'
+      );
       await esArchiver.loadIfNeeded('test/functional/fixtures/es_archiver/logstash_functional');
+
       await kibanaServer.uiSettings.replace({});
       // TODO: Navigation to Data View Management is different in Serverless
       await PageObjects.common.navigateToApp('management');
@@ -41,10 +43,13 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
     after(async function () {
       // TODO: Loading this from `es_archives` in `test_serverless`
       // instead since minor modifications were required
+
       await esArchiver.unload(
         'x-pack/test_serverless/functional/es_archives/kibana_sample_data_flights_index_pattern'
       );
-
+      await kibanaServer.importExport.unload(
+        'test/functional/fixtures/kbn_archiver/kibana_sample_data_flights_index_pattern'
+      );
       await esArchiver.unload('test/functional/fixtures/es_archiver/logstash_functional');
     });
 
diff --git a/x-pack/test_serverless/functional/test_suites/common/management/data_views/_edit_field.ts b/x-pack/test_serverless/functional/test_suites/common/management/data_views/_edit_field.ts
index afb3728db3e6d8..b14687ad120031 100644
--- a/x-pack/test_serverless/functional/test_suites/common/management/data_views/_edit_field.ts
+++ b/x-pack/test_serverless/functional/test_suites/common/management/data_views/_edit_field.ts
@@ -15,8 +15,6 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const testSubjects = getService('testSubjects');
 
   describe('edit field', function () {
-    // failsOnMKI, see https://github.com/elastic/kibana/issues/180568
-    this.tags(['failsOnMKI']);
     before(async function () {
       await kibanaServer.importExport.load('test/functional/fixtures/kbn_archiver/discover');
     });
diff --git a/x-pack/test_serverless/functional/test_suites/common/management/data_views/_index_pattern_filter.ts b/x-pack/test_serverless/functional/test_suites/common/management/data_views/_index_pattern_filter.ts
index 029c3a302efd69..9b8a51feac10ff 100644
--- a/x-pack/test_serverless/functional/test_suites/common/management/data_views/_index_pattern_filter.ts
+++ b/x-pack/test_serverless/functional/test_suites/common/management/data_views/_index_pattern_filter.ts
@@ -16,8 +16,6 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const es = getService('es');
 
   describe('index pattern filter', function describeIndexTests() {
-    // https://github.com/elastic/kibana/issues/178733
-    this.tags('failsOnMKI');
     before(async function () {
       await kibanaServer.savedObjects.cleanStandardList();
       await kibanaServer.uiSettings.replace({});
diff --git a/x-pack/test_serverless/functional/test_suites/common/management/data_views/_runtime_fields.ts b/x-pack/test_serverless/functional/test_suites/common/management/data_views/_runtime_fields.ts
index 49f1e5ff6da4f2..8fe28ffed7e970 100644
--- a/x-pack/test_serverless/functional/test_suites/common/management/data_views/_runtime_fields.ts
+++ b/x-pack/test_serverless/functional/test_suites/common/management/data_views/_runtime_fields.ts
@@ -17,8 +17,6 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const testSubjects = getService('testSubjects');
 
   describe('runtime fields', function () {
-    // Bug: https://github.com/elastic/kibana/issues/178939
-    this.tags('failsOnMKI');
     before(async function () {
       await browser.setWindowSize(1200, 800);
       await kibanaServer.importExport.load('test/functional/fixtures/kbn_archiver/discover');
diff --git a/x-pack/test_serverless/functional/test_suites/observability/cases/attachment_framework.ts b/x-pack/test_serverless/functional/test_suites/observability/cases/attachment_framework.ts
index 51ed4457e3de24..2dda21ca852151 100644
--- a/x-pack/test_serverless/functional/test_suites/observability/cases/attachment_framework.ts
+++ b/x-pack/test_serverless/functional/test_suites/observability/cases/attachment_framework.ts
@@ -21,9 +21,9 @@ export default ({ getPageObject, getService }: FtrProviderContext) => {
   const svlCases = getService('svlCases');
   const find = getService('find');
   const toasts = getService('toasts');
+  const retry = getService('retry');
 
-  // FLAKY: https://github.com/elastic/kibana/issues/180219
-  describe.skip('Cases persistable attachments', function () {
+  describe('Cases persistable attachments', function () {
     describe('lens visualization', () => {
       before(async () => {
         await svlCommonPage.login();
@@ -59,17 +59,27 @@ export default ({ getPageObject, getService }: FtrProviderContext) => {
         await testSubjects.click('embeddablePanelToggleMenuIcon');
         await testSubjects.click('embeddablePanelMore-mainMenu');
         await testSubjects.click('embeddablePanelAction-embeddable_addToExistingCase');
-        await testSubjects.click('cases-table-add-case-filter-bar');
 
-        await testSubjects.existOrFail('create-case-flyout');
+        await retry.waitFor('wait for the modal to open', async () => {
+          return (
+            (await testSubjects.exists('all-cases-modal')) &&
+            (await testSubjects.exists('cases-table-add-case-filter-bar'))
+          );
+        });
 
-        await testSubjects.setValue('input', caseTitle);
+        await retry.waitFor('wait for the flyout to open', async () => {
+          if (await testSubjects.exists('cases-table-add-case-filter-bar')) {
+            await testSubjects.click('cases-table-add-case-filter-bar');
+          }
+
+          return testSubjects.exists('create-case-flyout');
+        });
 
+        await testSubjects.setValue('input', caseTitle);
         await testSubjects.setValue('euiMarkdownEditorTextArea', 'test description');
 
         // verify that solution picker is not visible
         await testSubjects.missingOrFail('caseOwnerSelector');
-
         await testSubjects.click('create-case-submit');
 
         await cases.common.expectToasterToContain(`${caseTitle} has been updated`);
@@ -84,7 +94,9 @@ export default ({ getPageObject, getService }: FtrProviderContext) => {
         const title = await find.byCssSelector('[data-test-subj="editable-title-header-value"]');
         expect(await title.getVisibleText()).toEqual(caseTitle);
 
-        await testSubjects.existOrFail('comment-persistableState-.lens');
+        await retry.waitFor('wait for the visualization to exist', async () => {
+          return testSubjects.exists('comment-persistableState-.lens');
+        });
       });
 
       it('adds lens visualization to an existing case from dashboard', async () => {
diff --git a/x-pack/test_serverless/functional/test_suites/observability/common_configs/config.group6.ts b/x-pack/test_serverless/functional/test_suites/observability/common_configs/config.group6.ts
index 9891e7b8ee488a..be9fb04bb40b86 100644
--- a/x-pack/test_serverless/functional/test_suites/observability/common_configs/config.group6.ts
+++ b/x-pack/test_serverless/functional/test_suites/observability/common_configs/config.group6.ts
@@ -17,6 +17,7 @@ export default async function ({ readConfigFile }: FtrConfigProviderContext) {
       require.resolve('../../common/discover/x_pack'),
       require.resolve('../../common/discover_ml_uptime/discover'),
       require.resolve('../../common/context'),
+      require.resolve('../../common/discover/esql'),
     ],
     junit: {
       reportName: 'Serverless Observability Functional Tests - Common Group 6',
diff --git a/x-pack/test_serverless/functional/test_suites/search/common_configs/config.group6.ts b/x-pack/test_serverless/functional/test_suites/search/common_configs/config.group6.ts
index 25b3a8802a6f07..78496e3b4aedda 100644
--- a/x-pack/test_serverless/functional/test_suites/search/common_configs/config.group6.ts
+++ b/x-pack/test_serverless/functional/test_suites/search/common_configs/config.group6.ts
@@ -17,6 +17,7 @@ export default async function ({ readConfigFile }: FtrConfigProviderContext) {
       require.resolve('../../common/discover/x_pack'),
       require.resolve('../../common/discover_ml_uptime/discover'),
       require.resolve('../../common/context'),
+      require.resolve('../../common/discover/esql'),
     ],
     junit: {
       reportName: 'Serverless Search Functional Tests - Common Group 6',
diff --git a/x-pack/test_serverless/functional/test_suites/search/default_dataview.ts b/x-pack/test_serverless/functional/test_suites/search/default_dataview.ts
index e2ec4c24e70166..1b32eaefc2061e 100644
--- a/x-pack/test_serverless/functional/test_suites/search/default_dataview.ts
+++ b/x-pack/test_serverless/functional/test_suites/search/default_dataview.ts
@@ -12,20 +12,26 @@ export default function ({ getPageObject, getService }: FtrProviderContext) {
   const testSubjects = getService('testSubjects');
   const svlCommonNavigation = getPageObject('svlCommonNavigation');
   const svlCommonPage = getPageObject('svlCommonPage');
+  const dataViewApi = getService('dataViewApi');
 
   describe('default dataView', function () {
-    // Error: expected testSubject(kbnOverviewElasticsearchGettingStarted) to exist
-    this.tags(['failsOnMKI']);
     before(async () => {
       await svlCommonPage.login();
       await svlSearchNavigation.navigateToLandingPage();
+
+      // re-create the default data view in case it has been cleaned up by another test
+      await dataViewApi.create({
+        id: 'default_all_data_id',
+        name: 'default:all-data',
+        title: '*,-.*',
+      });
     });
 
     after(async () => {
       await svlCommonPage.forceLogout();
     });
 
-    it('should show dashboard but with no data', async () => {
+    it('should show discover but with no data', async () => {
       await svlCommonNavigation.sidenav.clickLink({ deepLinkId: 'discover' });
       await testSubjects.existOrFail('~breadcrumb-deepLinkId-discover');
       await testSubjects.existOrFail('discover-dataView-switch-link');
diff --git a/x-pack/test_serverless/functional/test_suites/search/index.ts b/x-pack/test_serverless/functional/test_suites/search/index.ts
index 2e62cf4fbee382..455acc04044299 100644
--- a/x-pack/test_serverless/functional/test_suites/search/index.ts
+++ b/x-pack/test_serverless/functional/test_suites/search/index.ts
@@ -20,6 +20,7 @@ export default function ({ loadTestFile }: FtrProviderContext) {
     loadTestFile(require.resolve('./advanced_settings'));
     loadTestFile(require.resolve('./rules/rule_details'));
     loadTestFile(require.resolve('./console_notebooks'));
+    loadTestFile(require.resolve('./playground_overview'));
 
     loadTestFile(require.resolve('./ml'));
   });
diff --git a/x-pack/test_serverless/functional/test_suites/search/navigation.ts b/x-pack/test_serverless/functional/test_suites/search/navigation.ts
index a8af6692be57f2..85042af186ebc4 100644
--- a/x-pack/test_serverless/functional/test_suites/search/navigation.ts
+++ b/x-pack/test_serverless/functional/test_suites/search/navigation.ts
@@ -15,6 +15,7 @@ export default function ({ getPageObject, getService }: FtrProviderContext) {
   const svlCommonPage = getPageObject('svlCommonPage');
   const testSubjects = getService('testSubjects');
   const browser = getService('browser');
+  const header = getPageObject('header');
 
   describe('navigation', function () {
     before(async () => {
@@ -70,6 +71,15 @@ export default function ({ getPageObject, getService }: FtrProviderContext) {
       await expectNoPageReload();
     });
 
+    it('navigate to playground from side nav', async () => {
+      await svlCommonNavigation.sidenav.clickLink({ deepLinkId: 'searchPlayground' });
+      await header.waitUntilLoadingHasFinished();
+      await svlCommonNavigation.breadcrumbs.expectBreadcrumbTexts(['Build', 'Playground']);
+
+      await svlCommonNavigation.sidenav.expectLinkActive({ deepLinkId: 'searchPlayground' });
+      expect(await browser.getCurrentUrl()).contain('/app/search_playground/chat');
+    });
+
     it("management apps from the sidenav hide the 'stack management' root from the breadcrumbs", async () => {
       await svlCommonNavigation.sidenav.clickLink({ deepLinkId: 'management:index_management' });
       await svlCommonNavigation.breadcrumbs.expectBreadcrumbTexts([
diff --git a/x-pack/test_serverless/functional/test_suites/search/playground_overview.ts b/x-pack/test_serverless/functional/test_suites/search/playground_overview.ts
new file mode 100644
index 00000000000000..17d9d81c1014c6
--- /dev/null
+++ b/x-pack/test_serverless/functional/test_suites/search/playground_overview.ts
@@ -0,0 +1,27 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { FtrProviderContext } from '../../ftr_provider_context';
+
+export default function ({ getPageObjects }: FtrProviderContext) {
+  const pageObjects = getPageObjects(['svlCommonPage', 'svlCommonNavigation', 'svlPlaygroundUI']);
+  describe('Playground', function () {
+    before(async () => {
+      await pageObjects.svlCommonPage.login();
+      await pageObjects.svlCommonNavigation.sidenav.clickLink({ deepLinkId: 'searchPlayground' });
+    });
+
+    after(async () => {
+      await pageObjects.svlCommonPage.forceLogout();
+    });
+
+    it('playground app is loaded', async () => {
+      await pageObjects.svlPlaygroundUI.PlaygrounStartChatPage.expectPlaygroundStartChatPageComponentsToExist();
+      await pageObjects.svlPlaygroundUI.PlaygrounStartChatPage.expectPlaygroundHeaderComponentsToExist();
+    });
+  });
+}
diff --git a/x-pack/test_serverless/functional/test_suites/security/common_configs/config.group6.ts b/x-pack/test_serverless/functional/test_suites/security/common_configs/config.group6.ts
index 8ebd1f6958ec78..9c263cf4c198e5 100644
--- a/x-pack/test_serverless/functional/test_suites/security/common_configs/config.group6.ts
+++ b/x-pack/test_serverless/functional/test_suites/security/common_configs/config.group6.ts
@@ -19,6 +19,7 @@ export default async function ({ readConfigFile }: FtrConfigProviderContext) {
       // https://github.com/elastic/kibana/issues/172365
       // require.resolve('../../common/discover_ml_uptime/discover'),
       require.resolve('../../common/context'),
+      require.resolve('../../common/discover/esql'),
     ],
     junit: {
       reportName: 'Serverless Security Functional Tests - Common Group 6',
diff --git a/x-pack/test_serverless/functional/test_suites/security/ftr/cases/attachment_framework.ts b/x-pack/test_serverless/functional/test_suites/security/ftr/cases/attachment_framework.ts
index 88e64b1b090e4d..99edcd7926905b 100644
--- a/x-pack/test_serverless/functional/test_suites/security/ftr/cases/attachment_framework.ts
+++ b/x-pack/test_serverless/functional/test_suites/security/ftr/cases/attachment_framework.ts
@@ -21,8 +21,7 @@ export default ({ getPageObject, getService }: FtrProviderContext) => {
   const header = getPageObject('header');
   const toasts = getService('toasts');
 
-  // FLAKY: https://github.com/elastic/kibana/issues/180295
-  describe.skip('Cases persistable attachments', () => {
+  describe('Cases persistable attachments', () => {
     describe('lens visualization', () => {
       before(async () => {
         await svlCommonPage.login();
@@ -52,17 +51,27 @@ export default ({ getPageObject, getService }: FtrProviderContext) => {
         await testSubjects.click('embeddablePanelToggleMenuIcon');
         await testSubjects.click('embeddablePanelMore-mainMenu');
         await testSubjects.click('embeddablePanelAction-embeddable_addToExistingCase');
-        await testSubjects.click('cases-table-add-case-filter-bar');
 
-        await testSubjects.existOrFail('create-case-flyout');
+        await retry.waitFor('wait for the modal to open', async () => {
+          return (
+            (await testSubjects.exists('all-cases-modal')) &&
+            (await testSubjects.exists('cases-table-add-case-filter-bar'))
+          );
+        });
 
-        await testSubjects.setValue('input', caseTitle);
+        await retry.waitFor('wait for the flyout to open', async () => {
+          if (await testSubjects.exists('cases-table-add-case-filter-bar')) {
+            await testSubjects.click('cases-table-add-case-filter-bar');
+          }
+
+          return testSubjects.exists('create-case-flyout');
+        });
 
+        await testSubjects.setValue('input', caseTitle);
         await testSubjects.setValue('euiMarkdownEditorTextArea', 'test description');
 
         // verify that solution picker is not visible
         await testSubjects.missingOrFail('caseOwnerSelector');
-
         await testSubjects.click('create-case-submit');
 
         await cases.common.expectToasterToContain(`${caseTitle} has been updated`);
@@ -77,7 +86,9 @@ export default ({ getPageObject, getService }: FtrProviderContext) => {
         const title = await find.byCssSelector('[data-test-subj="editable-title-header-value"]');
         expect(await title.getVisibleText()).toEqual(caseTitle);
 
-        await testSubjects.existOrFail('comment-persistableState-.lens');
+        await retry.waitFor('wait for the visualization to exist', async () => {
+          return testSubjects.exists('comment-persistableState-.lens');
+        });
       });
 
       it('adds lens visualization to an existing case from dashboard', async () => {
diff --git a/x-pack/test_serverless/shared/services/bsearch_secure.ts b/x-pack/test_serverless/shared/services/bsearch_secure.ts
new file mode 100644
index 00000000000000..2493c1d76e09cb
--- /dev/null
+++ b/x-pack/test_serverless/shared/services/bsearch_secure.ts
@@ -0,0 +1,133 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+// NOTE: This is pretty much a copy/paste from test/common/services/bsearch.ts but with the ability
+// to provide custom auth
+
+import expect from '@kbn/expect';
+import { GenericFtrService } from '@kbn/test';
+import request from 'superagent';
+import type SuperTest from 'supertest';
+import type { IEsSearchResponse } from '@kbn/search-types';
+import { ELASTIC_HTTP_VERSION_HEADER } from '@kbn/core-http-common';
+import { BFETCH_ROUTE_VERSION_LATEST } from '@kbn/bfetch-plugin/common';
+import { FtrProviderContext } from '../../functional/ftr_provider_context';
+
+const parseBfetchResponse = (resp: request.Response): Array<Record<string, any>> => {
+  return resp.text
+    .trim()
+    .split('\n')
+    .map((item) => JSON.parse(item));
+};
+
+interface SendOptions {
+  supertestWithoutAuth: SuperTest.SuperTest<SuperTest.Test>;
+  apiKeyHeader: { Authorization: string };
+  referer?: string;
+  kibanaVersion?: string;
+  options: object;
+  strategy: string;
+  space?: string;
+  internalOrigin: string;
+}
+
+export class BsearchSecureService extends GenericFtrService<FtrProviderContext> {
+  private readonly retry = this.ctx.getService('retry');
+
+  async send<T extends IEsSearchResponse>({
+    supertestWithoutAuth,
+    apiKeyHeader,
+    referer,
+    kibanaVersion,
+    internalOrigin,
+    options,
+    strategy,
+    space,
+  }: SendOptions) {
+    const { body } = await this.retry.try(async () => {
+      let result;
+      const url = `/internal/search/${strategy}`;
+      if (referer && kibanaVersion) {
+        result = await supertestWithoutAuth
+          .post(url)
+          .set(apiKeyHeader)
+          .set(ELASTIC_HTTP_VERSION_HEADER, '1')
+          .set('referer', referer)
+          .set('kbn-version', kibanaVersion)
+          .set('kbn-xsrf', 'true')
+          .send(options);
+      } else if (referer) {
+        result = await supertestWithoutAuth
+          .post(url)
+          .set(apiKeyHeader)
+          .set(ELASTIC_HTTP_VERSION_HEADER, '1')
+          .set('referer', referer)
+          .set('kbn-xsrf', 'true')
+          .send(options);
+      } else if (kibanaVersion) {
+        result = await supertestWithoutAuth
+          .post(url)
+          .set(apiKeyHeader)
+          .set(ELASTIC_HTTP_VERSION_HEADER, '1')
+          .set('kbn-version', kibanaVersion)
+          .set('kbn-xsrf', 'true')
+          .send(options);
+      } else if (internalOrigin) {
+        result = await supertestWithoutAuth
+          .post(url)
+          .set(apiKeyHeader)
+          .set(ELASTIC_HTTP_VERSION_HEADER, '1')
+          .set('x-elastic-internal-origin', internalOrigin)
+          .set('kbn-xsrf', 'true')
+          .send(options);
+      } else {
+        result = await supertestWithoutAuth
+          .post(url)
+          .set(apiKeyHeader)
+          .set(ELASTIC_HTTP_VERSION_HEADER, '1')
+          .set('kbn-xsrf', 'true')
+          .send(options);
+      }
+      if ((result.status === 500 || result.status === 200) && result.body) {
+        return result;
+      }
+      throw new Error('try again');
+    });
+
+    if (!body.isRunning) {
+      return body as T;
+    }
+
+    const result = await this.retry.try(async () => {
+      const resp = await supertestWithoutAuth
+        .post(`/internal/bsearch`)
+        .set(apiKeyHeader)
+        .set('kbn-xsrf', 'true')
+        .set('x-elastic-internal-origin', 'Kibana')
+        .set(ELASTIC_HTTP_VERSION_HEADER, BFETCH_ROUTE_VERSION_LATEST)
+        .send({
+          batch: [
+            {
+              request: {
+                id: body.id,
+                ...options,
+              },
+              options: {
+                strategy,
+              },
+            },
+          ],
+        })
+        .expect(200);
+      const [parsedResponse] = parseBfetchResponse(resp);
+      expect(parsedResponse.result.isRunning).equal(false);
+      return parsedResponse.result;
+    });
+
+    return result as T;
+  }
+}
diff --git a/x-pack/test_serverless/api_integration/services/data_view_api.ts b/x-pack/test_serverless/shared/services/data_view_api.ts
similarity index 95%
rename from x-pack/test_serverless/api_integration/services/data_view_api.ts
rename to x-pack/test_serverless/shared/services/data_view_api.ts
index 430ff60aac1e2d..f694039eea3347 100644
--- a/x-pack/test_serverless/api_integration/services/data_view_api.ts
+++ b/x-pack/test_serverless/shared/services/data_view_api.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { FtrProviderContext } from '../ftr_provider_context';
+import { FtrProviderContext } from '../../functional/ftr_provider_context';
 
 export function DataViewApiProvider({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
diff --git a/x-pack/test_serverless/shared/services/index.ts b/x-pack/test_serverless/shared/services/index.ts
index b8cfbaffc3683e..98a6eee96514b7 100644
--- a/x-pack/test_serverless/shared/services/index.ts
+++ b/x-pack/test_serverless/shared/services/index.ts
@@ -9,6 +9,7 @@ import { SupertestProvider, SupertestWithoutAuthProvider } from './supertest';
 import { SvlCommonApiServiceProvider } from './svl_common_api';
 import { SvlReportingServiceProvider } from './svl_reporting';
 import { SvlUserManagerProvider } from './svl_user_manager';
+import { DataViewApiProvider } from './data_view_api';
 
 export type { RoleCredentials } from './svl_user_manager';
 
@@ -18,4 +19,5 @@ export const services = {
   svlCommonApi: SvlCommonApiServiceProvider,
   svlReportingApi: SvlReportingServiceProvider,
   svlUserManager: SvlUserManagerProvider,
+  dataViewApi: DataViewApiProvider,
 };
diff --git a/x-pack/test_serverless/shared/services/svl_reporting.ts b/x-pack/test_serverless/shared/services/svl_reporting.ts
index 4fc6da28f082e6..2f5742b57d07e9 100644
--- a/x-pack/test_serverless/shared/services/svl_reporting.ts
+++ b/x-pack/test_serverless/shared/services/svl_reporting.ts
@@ -109,5 +109,13 @@ export function SvlReportingServiceProvider({ getService }: FtrProviderContext)
         .auth(username, password);
       return response.text as unknown;
     },
+    async deleteAllReports() {
+      log.debug('ReportingAPI.deleteAllReports');
+
+      // ignores 409 errs and keeps retrying
+      await retry.tryForTime(5000, async () => {
+        await supertest.post('/.reporting*/_delete_by_query').send({ query: { match_all: {} } });
+      });
+    },
   };
 }
diff --git a/x-pack/test_serverless/tsconfig.json b/x-pack/test_serverless/tsconfig.json
index 1df208cc8b81bd..020b861654dc93 100644
--- a/x-pack/test_serverless/tsconfig.json
+++ b/x-pack/test_serverless/tsconfig.json
@@ -98,6 +98,7 @@
     "@kbn/es-query",
     "@kbn/utility-types",
     "@kbn/synthetics-plugin",
-    "@kbn/dataset-quality-plugin"
+    "@kbn/dataset-quality-plugin",
+    "@kbn/search-types"
   ]
 }
diff --git a/yarn.lock b/yarn.lock
index ff292b52c71434..b4529660306285 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -1603,34 +1603,34 @@
   resolved "https://registry.yarnpkg.com/@discoveryjs/natural-compare/-/natural-compare-1.1.0.tgz#75f0642ad64701ffa9d42f1d7ada3b83f4e67cf3"
   integrity sha512-yuctPJs5lRXoI8LkpVZGAV6n+DKOuEsfpfcIDQ8ZjWHwazqk1QjBc4jMlof0UlZHyUqv4dwsOTooMiAmtzvwXA==
 
-"@dnd-kit/accessibility@^3.0.0":
-  version "3.0.0"
-  resolved "https://registry.yarnpkg.com/@dnd-kit/accessibility/-/accessibility-3.0.0.tgz#b56e3750414fd907b7d6972b3116aa8f96d07fde"
-  integrity sha512-QwaQ1IJHQHMMuAGOOYHQSx7h7vMZPfO97aDts8t5N/MY7n2QTDSnW+kF7uRQ1tVBkr6vJ+BqHWG5dlgGvwVjow==
+"@dnd-kit/accessibility@^3.1.0":
+  version "3.1.0"
+  resolved "https://registry.yarnpkg.com/@dnd-kit/accessibility/-/accessibility-3.1.0.tgz#1054e19be276b5f1154ced7947fc0cb5d99192e0"
+  integrity sha512-ea7IkhKvlJUv9iSHJOnxinBcoOI3ppGnnL+VDJ75O45Nss6HtZd8IdN8touXPDtASfeI2T2LImb8VOZcL47wjQ==
   dependencies:
     tslib "^2.0.0"
 
-"@dnd-kit/core@^3.1.1":
-  version "3.1.1"
-  resolved "https://registry.yarnpkg.com/@dnd-kit/core/-/core-3.1.1.tgz#c5ad6665931f5a51e74226220e58ac7514f3faf0"
-  integrity sha512-18YY5+1lTqJbGSg6JBSa/fjAOTUYAysFrQ5Ti8oppEPHFacQbC+owM51y2z2KN0LkDHBfGZKw2sFT7++ttwfpA==
+"@dnd-kit/core@^6.1.0":
+  version "6.1.0"
+  resolved "https://registry.yarnpkg.com/@dnd-kit/core/-/core-6.1.0.tgz#e81a3d10d9eca5d3b01cbf054171273a3fe01def"
+  integrity sha512-J3cQBClB4TVxwGo3KEjssGEXNJqGVWx17aRTZ1ob0FliR5IjYgTxl5YJbKTzA6IzrtelotH19v6y7uoIRUZPSg==
   dependencies:
-    "@dnd-kit/accessibility" "^3.0.0"
-    "@dnd-kit/utilities" "^2.0.0"
+    "@dnd-kit/accessibility" "^3.1.0"
+    "@dnd-kit/utilities" "^3.2.2"
     tslib "^2.0.0"
 
-"@dnd-kit/sortable@^4.0.0":
-  version "4.0.0"
-  resolved "https://registry.yarnpkg.com/@dnd-kit/sortable/-/sortable-4.0.0.tgz#81dd2b014a16527cf89602dc40060d9ee4dad352"
-  integrity sha512-teYVFy6mQG/u6F6CaGxAkzPfiNJvguFzWfJ/zonYQRxfANHX6QJ6GziMG9KON/Ae9Q2ODJP8vib+guWJrDXeGg==
+"@dnd-kit/sortable@^8.0.0":
+  version "8.0.0"
+  resolved "https://registry.yarnpkg.com/@dnd-kit/sortable/-/sortable-8.0.0.tgz#086b7ac6723d4618a4ccb6f0227406d8a8862a96"
+  integrity sha512-U3jk5ebVXe1Lr7c2wU7SBZjcWdQP+j7peHJfCspnA81enlu88Mgd7CC8Q+pub9ubP7eKVETzJW+IBAhsqbSu/g==
   dependencies:
-    "@dnd-kit/utilities" "^2.0.0"
+    "@dnd-kit/utilities" "^3.2.2"
     tslib "^2.0.0"
 
-"@dnd-kit/utilities@^2.0.0":
-  version "2.0.0"
-  resolved "https://registry.yarnpkg.com/@dnd-kit/utilities/-/utilities-2.0.0.tgz#a8462dff65c6f606ecbe95273c7e263b14a1ab97"
-  integrity sha512-bjs49yMNzMM+BYRsBUhTqhTk6HEvhuY3leFt6Em6NaYGgygaMbtGbbXof/UXBv7rqyyi0OkmBBnrCCcxqS2t/g==
+"@dnd-kit/utilities@^3.2.2":
+  version "3.2.2"
+  resolved "https://registry.yarnpkg.com/@dnd-kit/utilities/-/utilities-3.2.2.tgz#5a32b6af356dc5f74d61b37d6f7129a4040ced7b"
+  integrity sha512-+MKAJEOfaBe5SmV6t34p80MMKhjvUz0vRrvVJbPT0WElzaOJ/1xs+D+KDv+tD/NE5ujfrChEcshd4fLn0wpiqg==
   dependencies:
     tslib "^2.0.0"
 
@@ -1750,10 +1750,10 @@
   resolved "https://registry.yarnpkg.com/@elastic/eslint-plugin-eui/-/eslint-plugin-eui-0.0.2.tgz#56b9ef03984a05cc213772ae3713ea8ef47b0314"
   integrity sha512-IoxURM5zraoQ7C8f+mJb9HYSENiZGgRVcG4tLQxE61yHNNRDXtGDWTZh8N1KIHcsqN1CEPETjuzBXkJYF/fDiQ==
 
-"@elastic/eui@94.2.1-backport.0":
-  version "94.2.1-backport.0"
-  resolved "https://registry.yarnpkg.com/@elastic/eui/-/eui-94.2.1-backport.0.tgz#d456759bc29caa78840e45114b0041a3e523c89a"
-  integrity sha512-v/ws+ZKmT9Ei1LImKl4kfPd/tzqYusu8bosxLjPZdyIoraXbtuKr+kiuU8ttAbXwpbkIHdMYmPRJrip8VHD1mQ==
+"@elastic/eui@94.3.0":
+  version "94.3.0"
+  resolved "https://registry.yarnpkg.com/@elastic/eui/-/eui-94.3.0.tgz#77c07701128b6443e2ea55e2462ef0ccadd64582"
+  integrity sha512-qJTLrQYe11MPTX+8AqifJVYLDyO8VqdFWqPVJRYel11l/FvJOqyQi50x+xQK8I7h73TF50xywtUHCfhfkqpbYg==
   dependencies:
     "@hello-pangea/dnd" "^16.6.0"
     "@types/lodash" "^4.14.202"
@@ -4658,6 +4658,10 @@
   version "0.0.0"
   uid ""
 
+"@kbn/esql-ast-inspector-plugin@link:examples/esql_ast_inspector":
+  version "0.0.0"
+  uid ""
+
 "@kbn/esql-ast@link:packages/kbn-esql-ast":
   version "0.0.0"
   uid ""
@@ -5166,6 +5170,10 @@
   version "0.0.0"
   uid ""
 
+"@kbn/logs-data-access-plugin@link:x-pack/plugins/observability_solution/logs_data_access":
+  version "0.0.0"
+  uid ""
+
 "@kbn/logs-explorer-plugin@link:x-pack/plugins/observability_solution/logs_explorer":
   version "0.0.0"
   uid ""
@@ -7748,15 +7756,17 @@
     require-from-string "^2.0.2"
     uri-js "^4.2.2"
 
-"@redocly/cli@^1.6.0":
-  version "1.6.0"
-  resolved "https://registry.yarnpkg.com/@redocly/cli/-/cli-1.6.0.tgz#d3f6c8d6822eead487c2cb814d131e17d05c961f"
-  integrity sha512-0naVFJGR2tVcpMIHSFRr2HAoyy70qMqDAP6kXcnOdkGkwLRJ8s/5n1STwsym/yZwNkhrt2M0cKT6KAMlTUeCeg==
+"@redocly/cli@^1.12.0":
+  version "1.12.0"
+  resolved "https://registry.yarnpkg.com/@redocly/cli/-/cli-1.12.0.tgz#c2191e2d34161cdaf1fcb42d896fd4c5e3313ac8"
+  integrity sha512-k45WELRAvE0UbYPhEhUPq/T4WOCDx4zoCT3tLokCdnCyeUHgaDzNAzPM2qe5Y8m8k5FUYlNoPdND4PlvUhg9Wg==
   dependencies:
-    "@redocly/openapi-core" "1.6.0"
+    "@redocly/openapi-core" "1.12.0"
+    abort-controller "^3.0.0"
     chokidar "^3.5.1"
     colorette "^1.2.0"
     core-js "^3.32.1"
+    form-data "^4.0.0"
     get-port-please "^3.0.1"
     glob "^7.1.6"
     handlebars "^4.7.6"
@@ -7770,13 +7780,18 @@
     styled-components "^6.0.7"
     yargs "17.0.1"
 
-"@redocly/openapi-core@1.6.0", "@redocly/openapi-core@^1.0.0-rc.2":
-  version "1.6.0"
-  resolved "https://registry.yarnpkg.com/@redocly/openapi-core/-/openapi-core-1.6.0.tgz#09aee5e21a9cbad08f3230ced16685d043a9b197"
-  integrity sha512-oao6Aey4peLKfagzWGb6N7OBI6CoDWEP4ka/XjrUNZw+UoKVVg3hVBXW4Vr3CJ2O8j6wEa2i+Lbb92VQQsoxwg==
+"@redocly/config@^0.2.0":
+  version "0.2.0"
+  resolved "https://registry.yarnpkg.com/@redocly/config/-/config-0.2.0.tgz#c61fd0a8ccac330de398e26e8cac1a3fedbf9165"
+  integrity sha512-r0TqTPVXrxdvhpbOntWnJofOx0rC7u+A+tfC0KFwMtw38QCNb3pwodVjeLa7MT5Uu+fcPxfO119yLBj0QHvBuQ==
+
+"@redocly/openapi-core@1.12.0", "@redocly/openapi-core@^1.0.0-rc.2":
+  version "1.12.0"
+  resolved "https://registry.yarnpkg.com/@redocly/openapi-core/-/openapi-core-1.12.0.tgz#82047a92a138362c7f411046d855fdcde3a946b8"
+  integrity sha512-2Jfxv3iIk1JUwLSnLyewJ8GAsoxubROVieg13Sjo79TjuWaUBuI49j8GZqC08ljENqyEIp0JHReDjhKs4Snrhg==
   dependencies:
     "@redocly/ajv" "^8.11.0"
-    "@types/node" "^14.11.8"
+    "@redocly/config" "^0.2.0"
     colorette "^1.2.0"
     js-levenshtein "^1.1.6"
     js-yaml "^4.1.0"
@@ -7845,13 +7860,6 @@
   resolved "https://registry.yarnpkg.com/@remix-run/router/-/router-1.6.3.tgz#8205baf6e17ef93be35bf62c37d2d594e9be0dad"
   integrity sha512-EXJysQ7J3veRECd0kZFQwYYd5sJMcq2O/m60zu1W2l3oVQ9xtub8jTOtYRE0+M2iomyG/W3Ps7+vp2kna0C27Q==
 
-"@samverschueren/stream-to-observable@^0.3.0":
-  version "0.3.0"
-  resolved "https://registry.yarnpkg.com/@samverschueren/stream-to-observable/-/stream-to-observable-0.3.0.tgz#ecdf48d532c58ea477acfcab80348424f8d0662f"
-  integrity sha512-MI4Xx6LHs4Webyvi6EbspgyAb4D2Q2VtnCQ1blOJcoLS6mVa8lNN2rkIy1CVxfTUpoyIbCTkXES1rLXztFD1lg==
-  dependencies:
-    any-observable "^0.3.0"
-
 "@searchkit/sdk@^3.0.0":
   version "3.0.0"
   resolved "https://registry.yarnpkg.com/@searchkit/sdk/-/sdk-3.0.0.tgz#63fcec0edcba05d241042b8476be1b86d77142e4"
@@ -10082,14 +10090,6 @@
   resolved "https://registry.yarnpkg.com/@types/linkify-it/-/linkify-it-2.1.0.tgz#ea3dd64c4805597311790b61e872cbd1ed2cd806"
   integrity sha512-Q7DYAOi9O/+cLLhdaSvKdaumWyHbm7HAk/bFwwyTuU0arR5yyCeW5GOoqt4tJTpDRxhpx9Q8kQL6vMpuw9hDSw==
 
-"@types/listr@^0.14.0":
-  version "0.14.0"
-  resolved "https://registry.yarnpkg.com/@types/listr/-/listr-0.14.0.tgz#55161177ed5043987871bca5f66d87ca0a63a0b7"
-  integrity sha512-8ZLo3UiyxuzgmbJYc8vMC0kbF3RFaB3ZZOh7xM1nfcGxypFoJZi0P7ndD4MLSYqWW4M4zG6PWvObVkpHjg+45g==
-  dependencies:
-    "@types/node" "*"
-    rxjs "^6.5.1"
-
 "@types/loader-utils@^2.0.3":
   version "2.0.3"
   resolved "https://registry.yarnpkg.com/@types/loader-utils/-/loader-utils-2.0.3.tgz#fbc2337358f8f4a7dc532ac0a3646c74275edf2d"
@@ -10279,7 +10279,7 @@
   dependencies:
     "@types/node" "*"
 
-"@types/node@*", "@types/node@20.10.5", "@types/node@>= 8", "@types/node@>=12.12.47", "@types/node@>=13.7.0", "@types/node@>=18.0.0", "@types/node@^14.0.10 || ^16.0.0", "@types/node@^14.11.8", "@types/node@^14.14.20 || ^16.0.0", "@types/node@^18.0.0", "@types/node@^18.11.18":
+"@types/node@*", "@types/node@20.10.5", "@types/node@>= 8", "@types/node@>=12.12.47", "@types/node@>=13.7.0", "@types/node@>=18.0.0", "@types/node@^14.0.10 || ^16.0.0", "@types/node@^14.14.20 || ^16.0.0", "@types/node@^18.0.0", "@types/node@^18.11.18":
   version "20.10.5"
   resolved "https://registry.yarnpkg.com/@types/node/-/node-20.10.5.tgz#47ad460b514096b7ed63a1dae26fad0914ed3ab2"
   integrity sha512-nNPsNE65wjMxEKI93yOP+NPGGBJz/PoN3kZsVLee0XMiJolxSekEVD8wRwBUBqkwc7UWop0edW50yrCQW4CyRw==
@@ -11638,11 +11638,6 @@ ansi-colors@^3.0.0:
   resolved "https://registry.yarnpkg.com/ansi-colors/-/ansi-colors-3.2.4.tgz#e3a3da4bfbae6c86a9c285625de124a234026fbf"
   integrity sha512-hHUXGagefjN2iRrID63xckIvotOXOojhQKWIPUZ4mNUZ9nLZW+7FMNoE1lOkEhNWYsx/7ysGIuJYCiMAA9FnrA==
 
-ansi-escapes@^3.0.0:
-  version "3.2.0"
-  resolved "https://registry.yarnpkg.com/ansi-escapes/-/ansi-escapes-3.2.0.tgz#8780b98ff9dbf5638152d1f1fe5c1d7b4442976b"
-  integrity sha512-cBhpre4ma+U0T1oM5fXg7Dy1Jw7zzwv7lt/GoCpr+hDQJoYnKVPLL4dCvSEFMmQurOQvSrwT7SL/DAlhBI97RQ==
-
 ansi-escapes@^4.2.1, ansi-escapes@^4.3.0:
   version "4.3.0"
   resolved "https://registry.yarnpkg.com/ansi-escapes/-/ansi-escapes-4.3.0.tgz#a4ce2b33d6b214b7950d8595c212f12ac9cc569d"
@@ -11650,6 +11645,11 @@ ansi-escapes@^4.2.1, ansi-escapes@^4.3.0:
   dependencies:
     type-fest "^0.8.1"
 
+ansi-escapes@^6.2.0:
+  version "6.2.1"
+  resolved "https://registry.yarnpkg.com/ansi-escapes/-/ansi-escapes-6.2.1.tgz#76c54ce9b081dad39acec4b5d53377913825fb0f"
+  integrity sha512-4nJ3yixlEthEJ9Rk4vPcdBRkZvQZlYyu8j4/Mqz5sgIkddmEnH2Yj2ZrnP9S3tQOvSNRUIgVNF/1yPpRAGNRig==
+
 ansi-gray@^0.1.1:
   version "0.1.1"
   resolved "https://registry.yarnpkg.com/ansi-gray/-/ansi-gray-0.1.1.tgz#2962cf54ec9792c48510a3deb524436861ef7251"
@@ -11706,7 +11706,7 @@ ansi-styles@^5.0.0:
   resolved "https://registry.yarnpkg.com/ansi-styles/-/ansi-styles-5.2.0.tgz#07449690ad45777d1924ac2abb2fc8895dba836b"
   integrity sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==
 
-ansi-styles@^6.1.0:
+ansi-styles@^6.0.0, ansi-styles@^6.1.0, ansi-styles@^6.2.1:
   version "6.2.1"
   resolved "https://registry.yarnpkg.com/ansi-styles/-/ansi-styles-6.2.1.tgz#0e62320cf99c21afff3b3012192546aacbfb05c5"
   integrity sha512-bN798gFfQX+viw3R7yrGWRqnrN2oRkEkUjjl4JNn4E8GxxbjtG3FbrEIIY3l8/hrwUwIeCZvi4QuOTP4MErVug==
@@ -11728,11 +11728,6 @@ antlr4@^4.13.1-patch-1:
   resolved "https://registry.yarnpkg.com/antlr4/-/antlr4-4.13.1-patch-1.tgz#946176f863f890964a050c4f18c47fd6f7e57602"
   integrity sha512-OjFLWWLzDMV9rdFhpvroCWR4ooktNg9/nvVYSA5z28wuVpU36QUNuioR1XLnQtcjVlf8npjyz593PxnU/f/Cow==
 
-any-observable@^0.3.0:
-  version "0.3.0"
-  resolved "https://registry.yarnpkg.com/any-observable/-/any-observable-0.3.0.tgz#af933475e5806a67d0d7df090dd5e8bef65d119b"
-  integrity sha512-/FQM1EDkTsf63Ub2C6O7GuYFDsSXUwsaZDurV0np41ocwq0jthUAYCmhBX9f+KwlaCgIuWyr/4WlUQUBfKfZog==
-
 anymatch@^2.0.0:
   version "2.0.0"
   resolved "https://registry.yarnpkg.com/anymatch/-/anymatch-2.0.0.tgz#bcb24b4f37934d9aa7ac17b4adaf89e7c76ef2eb"
@@ -13448,7 +13443,7 @@ chalk@4.1.2, chalk@^4.0.0, chalk@^4.0.2, chalk@^4.1.0, chalk@^4.1.1, chalk@^4.1.
     ansi-styles "^4.1.0"
     supports-color "^7.1.0"
 
-chalk@^1.0.0, chalk@^1.1.3:
+chalk@^1.0.0:
   version "1.1.3"
   resolved "https://registry.yarnpkg.com/chalk/-/chalk-1.1.3.tgz#a8115c55e4a702fe4d150abd3872822a7e09fc98"
   integrity sha1-qBFcVeSnAv5NFQq9OHKCKn4J/Jg=
@@ -13684,13 +13679,6 @@ cli-boxes@^3.0.0:
   resolved "https://registry.yarnpkg.com/cli-boxes/-/cli-boxes-3.0.0.tgz#71a10c716feeba005e4504f36329ef0b17cf3145"
   integrity sha512-/lzGpEWL/8PfI0BmBOPRwp0c/wFNX1RdUML3jK/RcSBA9T8mZDdQpqYBKtCFTOfQbwPqWEOpjqW+Fnayc0969g==
 
-cli-cursor@^2.0.0, cli-cursor@^2.1.0:
-  version "2.1.0"
-  resolved "https://registry.yarnpkg.com/cli-cursor/-/cli-cursor-2.1.0.tgz#b35dac376479facc3e94747d41d0d0f5238ffcb5"
-  integrity sha1-s12sN2R5+sw+lHR9QdDQ9SOP/LU=
-  dependencies:
-    restore-cursor "^2.0.0"
-
 cli-cursor@^3.1.0:
   version "3.1.0"
   resolved "https://registry.yarnpkg.com/cli-cursor/-/cli-cursor-3.1.0.tgz#264305a7ae490d1d03bf0c9ba7c925d1753af307"
@@ -13698,6 +13686,13 @@ cli-cursor@^3.1.0:
   dependencies:
     restore-cursor "^3.1.0"
 
+cli-cursor@^4.0.0:
+  version "4.0.0"
+  resolved "https://registry.yarnpkg.com/cli-cursor/-/cli-cursor-4.0.0.tgz#3cecfe3734bf4fe02a8361cbdc0f6fe28c6a57ea"
+  integrity sha512-VGtlMu3x/4DOtIUwEkRezxUZ2lBacNJCHash0N0WeZDBS+7Ux1dm3XWAgWYxLJFMMdOeXMHXorshEFhbMSGelg==
+  dependencies:
+    restore-cursor "^4.0.0"
+
 cli-progress@^3.12.0:
   version "3.12.0"
   resolved "https://registry.yarnpkg.com/cli-progress/-/cli-progress-3.12.0.tgz#807ee14b66bcc086258e444ad0f19e7d42577942"
@@ -13719,14 +13714,6 @@ cli-table3@^0.6.1, cli-table3@~0.6.1:
   optionalDependencies:
     colors "1.4.0"
 
-cli-truncate@^0.2.1:
-  version "0.2.1"
-  resolved "https://registry.yarnpkg.com/cli-truncate/-/cli-truncate-0.2.1.tgz#9f15cfbb0705005369216c626ac7d05ab90dd574"
-  integrity sha1-nxXPuwcFAFNpIWxiasfQWrkN1XQ=
-  dependencies:
-    slice-ansi "0.0.4"
-    string-width "^1.0.1"
-
 cli-truncate@^2.1.0:
   version "2.1.0"
   resolved "https://registry.yarnpkg.com/cli-truncate/-/cli-truncate-2.1.0.tgz#c39e28bf05edcde5be3b98992a22deed5a2b93c7"
@@ -13735,6 +13722,14 @@ cli-truncate@^2.1.0:
     slice-ansi "^3.0.0"
     string-width "^4.2.0"
 
+cli-truncate@^4.0.0:
+  version "4.0.0"
+  resolved "https://registry.yarnpkg.com/cli-truncate/-/cli-truncate-4.0.0.tgz#6cc28a2924fee9e25ce91e973db56c7066e6172a"
+  integrity sha512-nPdaFdQ0h/GEigbPClz11D0v/ZJEwxmeVZGeMo3Z5StPtUTkA9o1lD6QwoirYiSDzbcwn2XcjwmCp68W1IS4TA==
+  dependencies:
+    slice-ansi "^5.0.0"
+    string-width "^7.0.0"
+
 cli-width@^3.0.0:
   version "3.0.0"
   resolved "https://registry.yarnpkg.com/cli-width/-/cli-width-3.0.0.tgz#a2f48437a2caa9a22436e794bf071ec9e61cedf6"
@@ -13936,10 +13931,10 @@ colorette@^1.2.0, colorette@^1.2.1, colorette@^1.2.2:
   resolved "https://registry.yarnpkg.com/colorette/-/colorette-1.4.0.tgz#5190fbb87276259a86ad700bff2c6d6faa3fca40"
   integrity sha512-Y2oEozpomLn7Q3HFP7dpww7AtMJplbM9lGZP6RDfHqmbeRjiwRg4n6VM6j4KLmRke85uWEI7JqF17f3pqdRA0g==
 
-colorette@^2.0.10, colorette@^2.0.14:
-  version "2.0.19"
-  resolved "https://registry.yarnpkg.com/colorette/-/colorette-2.0.19.tgz#cdf044f47ad41a0f4b56b3a0d5b4e6e1a2d5a798"
-  integrity sha512-3tlv/dIP7FWvj3BsbHrGLJ6l/oKh1O3TcgBqMn+yyCagOxc23fyzDS6HypQbgxWbkpDnf52p1LuR4eWDQ/K9WQ==
+colorette@^2.0.10, colorette@^2.0.14, colorette@^2.0.20:
+  version "2.0.20"
+  resolved "https://registry.yarnpkg.com/colorette/-/colorette-2.0.20.tgz#9eb793e6833067f7235902fcd3b09917a000a95a"
+  integrity sha512-IfEDxwoWIjkeXL1eXcDiow4UbKjhLdq6/EuSVR9GMN7KVH3r9gQ83e73hsz1Nd1T3ijd5xv1wcWRYO+D6kCI2w==
 
 colors@1.4.0:
   version "1.4.0"
@@ -15067,7 +15062,7 @@ data-urls@^3.0.2:
     whatwg-mimetype "^3.0.0"
     whatwg-url "^11.0.0"
 
-date-fns@^1.27.2, date-fns@^1.30.1:
+date-fns@^1.30.1:
   version "1.30.1"
   resolved "https://registry.yarnpkg.com/date-fns/-/date-fns-1.30.1.tgz#2e71bf0b119153dbb4cc4e88d9ea5acfb50dc05c"
   integrity sha512-hBSVCvSmWC+QypYObzwGOd9wqdDpOt+0wl0KbU+R+uuZBS1jN8VsD1ss3irQDknRj5NvxiTF6oj/nDRnN/UQNw==
@@ -15754,9 +15749,9 @@ domhandler@^5.0.1, domhandler@^5.0.2, domhandler@^5.0.3:
     domelementtype "^2.3.0"
 
 dompurify@^2.2.8:
-  version "2.4.7"
-  resolved "https://registry.yarnpkg.com/dompurify/-/dompurify-2.4.7.tgz#277adeb40a2c84be2d42a8bcd45f582bfa4d0cfc"
-  integrity sha512-kxxKlPEDa6Nc5WJi+qRgPbOAbgTpSULL+vI3NUXsZMlkJxTqYI9wg5ZTay2sFrdZRWHPWNi+EdAhcJf81WtoMQ==
+  version "2.5.2"
+  resolved "https://registry.yarnpkg.com/dompurify/-/dompurify-2.5.2.tgz#e02be61d621bea36a76eb2beb23b043f347aa9c7"
+  integrity sha512-5vSyvxRAb45EoWwAktUT3AYqAwXK4FL7si22Cgj46U6ICsj/YJczCN+Bk7WNABIQmpWRymGfslMhrRUZkQNnqA==
 
 domutils@^2.0.0, domutils@^2.5.2, domutils@^2.8.0:
   version "2.8.0"
@@ -16001,11 +15996,6 @@ electron-to-chromium@^1.4.668:
   resolved "https://registry.yarnpkg.com/electron-to-chromium/-/electron-to-chromium-1.4.701.tgz#7335e5761331774b4dea54cd24a1b84861d45cdf"
   integrity sha512-K3WPQ36bUOtXg/1+69bFlFOvdSm0/0bGqmsfPDLRXLanoKXdA+pIWuf/VbA9b+2CwBFuONgl4NEz4OEm+OJOKA==
 
-elegant-spinner@^1.0.1:
-  version "1.0.1"
-  resolved "https://registry.yarnpkg.com/elegant-spinner/-/elegant-spinner-1.0.1.tgz#db043521c95d7e303fd8f345bedc3349cfb0729e"
-  integrity sha1-2wQ1IcldfjA/2PNFvtwzSc+wcp4=
-
 element-resize-detector@^1.2.2:
   version "1.2.3"
   resolved "https://registry.yarnpkg.com/element-resize-detector/-/element-resize-detector-1.2.3.tgz#5078d9b99398fe4c589f8c8df94ff99e5d413ff3"
@@ -16041,6 +16031,11 @@ emittery@^0.13.1:
   resolved "https://registry.yarnpkg.com/emoji-regex/-/emoji-regex-6.1.1.tgz#c6cd0ec1b0642e2a3c67a1137efc5e796da4f88e"
   integrity sha1-xs0OwbBkLio8Z6ETfvxeeW2k+I4=
 
+emoji-regex@^10.3.0:
+  version "10.3.0"
+  resolved "https://registry.yarnpkg.com/emoji-regex/-/emoji-regex-10.3.0.tgz#76998b9268409eb3dae3de989254d456e70cfe23"
+  integrity sha512-QpLs9D9v9kArv4lfDEgg1X/gN5XLnf/A6l9cs8SPZLRZR3ZkY9+kwIQTxm+fsSej5UMYGE8fdoaZVIBlqG0XTw==
+
 emoji-regex@^8.0.0:
   version "8.0.0"
   resolved "https://registry.yarnpkg.com/emoji-regex/-/emoji-regex-8.0.0.tgz#e818fd69ce5ccfcb404594f842963bf53164cc37"
@@ -16906,6 +16901,11 @@ eventemitter3@^4.0.0, eventemitter3@^4.0.4, eventemitter3@^4.0.7:
   resolved "https://registry.yarnpkg.com/eventemitter3/-/eventemitter3-4.0.7.tgz#2de9b68f6528d5644ef5c59526a1b4a07306169f"
   integrity sha512-8guHBZCwKnFhYdHr2ysuRWErTwhoN2X8XELRlrRwpmfeY2jjuUN4taQMsULKUVo1K4DvZl+0pgfyoysHxvmvEw==
 
+eventemitter3@^5.0.1:
+  version "5.0.1"
+  resolved "https://registry.yarnpkg.com/eventemitter3/-/eventemitter3-5.0.1.tgz#53f5ffd0a492ac800721bb42c66b841de96423c4"
+  integrity sha512-GWkBvjiSZK87ELrYOSESUYeVIc9mvLLf/nXalMOS5dYrgZq9o5OVkbZAVM06CVxYsCwH9BDZFPlQTlPA1j4ahA==
+
 events@^1.0.2:
   version "1.1.1"
   resolved "https://registry.yarnpkg.com/events/-/events-1.1.1.tgz#9ebdb7635ad099c70dcc4c2a1f5004288e8bd924"
@@ -17360,21 +17360,6 @@ figgy-pudding@^3.5.1:
   resolved "https://registry.yarnpkg.com/figgy-pudding/-/figgy-pudding-3.5.1.tgz#862470112901c727a0e495a80744bd5baa1d6790"
   integrity sha512-vNKxJHTEKNThjfrdJwHc7brvM6eVevuO5nTj6ez8ZQ1qbXTvGthucRF7S4vf2cr71QVnT70V34v0S1DyQsti0w==
 
-figures@^1.7.0:
-  version "1.7.0"
-  resolved "https://registry.yarnpkg.com/figures/-/figures-1.7.0.tgz#cbe1e3affcf1cd44b80cadfed28dc793a9701d2e"
-  integrity sha1-y+Hjr/zxzUS4DK3+0o3Hk6lwHS4=
-  dependencies:
-    escape-string-regexp "^1.0.5"
-    object-assign "^4.1.0"
-
-figures@^2.0.0:
-  version "2.0.0"
-  resolved "https://registry.yarnpkg.com/figures/-/figures-2.0.0.tgz#3ab1a2d2a62c8bfb431a0c94cb797a2fce27c962"
-  integrity sha1-OrGi0qYsi/tDGgyUy3l6L84nyWI=
-  dependencies:
-    escape-string-regexp "^1.0.5"
-
 figures@^3.0.0, figures@^3.2.0:
   version "3.2.0"
   resolved "https://registry.yarnpkg.com/figures/-/figures-3.2.0.tgz#625c18bd293c604dc4a8ddb2febf0c88341746af"
@@ -18033,6 +18018,11 @@ get-caller-file@^2.0.1, get-caller-file@^2.0.5:
   resolved "https://registry.yarnpkg.com/get-caller-file/-/get-caller-file-2.0.5.tgz#4f94412a82db32f36e3b0b9741f8a97feb031f7e"
   integrity sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg==
 
+get-east-asian-width@^1.0.0:
+  version "1.2.0"
+  resolved "https://registry.yarnpkg.com/get-east-asian-width/-/get-east-asian-width-1.2.0.tgz#5e6ebd9baee6fb8b7b6bd505221065f0cd91f64e"
+  integrity sha512-2nk+7SIVb14QrgXFHcm84tD4bKQz0RxPuMT8Ag5KPOq7J5fEmAg0UbXdTOSHqNuHSU28k55qnceesxXRZGzKWA==
+
 get-intrinsic@^1.0.2, get-intrinsic@^1.1.1, get-intrinsic@^1.1.3, get-intrinsic@^1.2.0, get-intrinsic@^1.2.1, get-intrinsic@^1.2.2, get-intrinsic@^1.2.4:
   version "1.2.4"
   resolved "https://registry.yarnpkg.com/get-intrinsic/-/get-intrinsic-1.2.4.tgz#e385f5a4b5227d449c3eabbad05494ef0abbeadd"
@@ -19314,11 +19304,6 @@ indent-string@^2.1.0:
   dependencies:
     repeating "^2.0.0"
 
-indent-string@^3.0.0:
-  version "3.2.0"
-  resolved "https://registry.yarnpkg.com/indent-string/-/indent-string-3.2.0.tgz#4a5fd6d27cc332f37e5419a504dbb837105c9289"
-  integrity sha1-Sl/W0nzDMvN+VBmlBNu4NxBckok=
-
 indent-string@^4.0.0:
   version "4.0.0"
   resolved "https://registry.yarnpkg.com/indent-string/-/indent-string-4.0.0.tgz#624f8f4497d619b2d9768531d58f4122854d7251"
@@ -19750,16 +19735,23 @@ is-fullwidth-code-point@^1.0.0:
   dependencies:
     number-is-nan "^1.0.0"
 
-is-fullwidth-code-point@^2.0.0:
-  version "2.0.0"
-  resolved "https://registry.yarnpkg.com/is-fullwidth-code-point/-/is-fullwidth-code-point-2.0.0.tgz#a3b30a5c4f199183167aaab93beefae3ddfb654f"
-  integrity sha1-o7MKXE8ZkYMWeqq5O+764937ZU8=
-
 is-fullwidth-code-point@^3.0.0:
   version "3.0.0"
   resolved "https://registry.yarnpkg.com/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz#f116f8064fe90b3f7844a38997c0b75051269f1d"
   integrity sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==
 
+is-fullwidth-code-point@^4.0.0:
+  version "4.0.0"
+  resolved "https://registry.yarnpkg.com/is-fullwidth-code-point/-/is-fullwidth-code-point-4.0.0.tgz#fae3167c729e7463f8461ce512b080a49268aa88"
+  integrity sha512-O4L094N2/dZ7xqVdrXhh9r1KODPJpFms8B5sGdJLPy664AgvXsreZUyCQQNItZRDlYug4xStLjNp/sz3HvBowQ==
+
+is-fullwidth-code-point@^5.0.0:
+  version "5.0.0"
+  resolved "https://registry.yarnpkg.com/is-fullwidth-code-point/-/is-fullwidth-code-point-5.0.0.tgz#9609efced7c2f97da7b60145ef481c787c7ba704"
+  integrity sha512-OVa3u9kkBbw7b8Xw5F9P+D/T9X+Z4+JruYVNapTjPYZYUznQ5YfWeFkOj606XYYW8yugTfC8Pj0hYqvi4ryAhA==
+  dependencies:
+    get-east-asian-width "^1.0.0"
+
 is-function@^1.0.2:
   version "1.0.2"
   resolved "https://registry.yarnpkg.com/is-function/-/is-function-1.0.2.tgz#4f097f30abf6efadac9833b17ca5dc03f8144e08"
@@ -19889,13 +19881,6 @@ is-object@^1.0.1:
   resolved "https://registry.yarnpkg.com/is-object/-/is-object-1.0.1.tgz#8952688c5ec2ffd6b03ecc85e769e02903083470"
   integrity sha1-iVJojF7C/9awPsyF52ngKQMINHA=
 
-is-observable@^1.1.0:
-  version "1.1.0"
-  resolved "https://registry.yarnpkg.com/is-observable/-/is-observable-1.1.0.tgz#b3e986c8f44de950867cab5403f5a3465005975e"
-  integrity sha512-NqCa4Sa2d+u7BWc6CukaObG3Fh+CU9bvixbpcXYhy2VvYS7vVGIdAgnIS5Ks3A/cqk4rebLJ9s8zBstT2aKnIA==
-  dependencies:
-    symbol-observable "^1.1.0"
-
 is-odd@^2.0.0:
   version "2.0.0"
   resolved "https://registry.yarnpkg.com/is-odd/-/is-odd-2.0.0.tgz#7646624671fd7ea558ccd9a2795182f2958f1b24"
@@ -21523,35 +21508,6 @@ listenercount@~1.0.1:
   resolved "https://registry.yarnpkg.com/listenercount/-/listenercount-1.0.1.tgz#84c8a72ab59c4725321480c975e6508342e70937"
   integrity sha512-3mk/Zag0+IJxeDrxSgaDPy4zZ3w05PRZeJNnlWhzFz5OkX49J4krc+A8X2d2M69vGMBEX0uyl8M+W+8gH+kBqQ==
 
-listr-silent-renderer@^1.1.1:
-  version "1.1.1"
-  resolved "https://registry.yarnpkg.com/listr-silent-renderer/-/listr-silent-renderer-1.1.1.tgz#924b5a3757153770bf1a8e3fbf74b8bbf3f9242e"
-  integrity sha1-kktaN1cVN3C/Go4/v3S4u/P5JC4=
-
-listr-update-renderer@^0.5.0:
-  version "0.5.0"
-  resolved "https://registry.yarnpkg.com/listr-update-renderer/-/listr-update-renderer-0.5.0.tgz#4ea8368548a7b8aecb7e06d8c95cb45ae2ede6a2"
-  integrity sha512-tKRsZpKz8GSGqoI/+caPmfrypiaq+OQCbd+CovEC24uk1h952lVj5sC7SqyFUm+OaJ5HN/a1YLt5cit2FMNsFA==
-  dependencies:
-    chalk "^1.1.3"
-    cli-truncate "^0.2.1"
-    elegant-spinner "^1.0.1"
-    figures "^1.7.0"
-    indent-string "^3.0.0"
-    log-symbols "^1.0.2"
-    log-update "^2.3.0"
-    strip-ansi "^3.0.1"
-
-listr-verbose-renderer@^0.5.0:
-  version "0.5.0"
-  resolved "https://registry.yarnpkg.com/listr-verbose-renderer/-/listr-verbose-renderer-0.5.0.tgz#f1132167535ea4c1261102b9f28dac7cba1e03db"
-  integrity sha512-04PDPqSlsqIOaaaGZ+41vq5FejI9auqTInicFRndCBgE3bXG8D6W1I+mWhk+1nqbHmyhla/6BUrd5OSiHwKRXw==
-  dependencies:
-    chalk "^2.4.1"
-    cli-cursor "^2.1.0"
-    date-fns "^1.27.2"
-    figures "^2.0.0"
-
 listr2@^3.8.3:
   version "3.10.0"
   resolved "https://registry.yarnpkg.com/listr2/-/listr2-3.10.0.tgz#58105a53ed7fa1430d1b738c6055ef7bb006160f"
@@ -21565,20 +21521,17 @@ listr2@^3.8.3:
     through "^2.3.8"
     wrap-ansi "^7.0.0"
 
-listr@^0.14.1:
-  version "0.14.3"
-  resolved "https://registry.yarnpkg.com/listr/-/listr-0.14.3.tgz#2fea909604e434be464c50bddba0d496928fa586"
-  integrity sha512-RmAl7su35BFd/xoMamRjpIE4j3v+L28o8CT5YhAXQJm1fD+1l9ngXY8JAQRJ+tFK2i5njvi0iRUKV09vPwA0iA==
+listr2@^8.2.1:
+  version "8.2.1"
+  resolved "https://registry.yarnpkg.com/listr2/-/listr2-8.2.1.tgz#06a1a6efe85f23c5324180d7c1ddbd96b5eefd6d"
+  integrity sha512-irTfvpib/rNiD637xeevjO2l3Z5loZmuaRi0L0YE5LfijwVY96oyVn0DFD3o/teAok7nfobMG1THvvcHh/BP6g==
   dependencies:
-    "@samverschueren/stream-to-observable" "^0.3.0"
-    is-observable "^1.1.0"
-    is-promise "^2.1.0"
-    is-stream "^1.1.0"
-    listr-silent-renderer "^1.1.1"
-    listr-update-renderer "^0.5.0"
-    listr-verbose-renderer "^0.5.0"
-    p-map "^2.0.0"
-    rxjs "^6.3.3"
+    cli-truncate "^4.0.0"
+    colorette "^2.0.20"
+    eventemitter3 "^5.0.1"
+    log-update "^6.0.0"
+    rfdc "^1.3.1"
+    wrap-ansi "^9.0.0"
 
 lmdb@^2.9.2:
   version "2.9.2"
@@ -21822,13 +21775,6 @@ log-symbols@4.1.0, log-symbols@^4.0.0, log-symbols@^4.1.0:
     chalk "^4.1.0"
     is-unicode-supported "^0.1.0"
 
-log-symbols@^1.0.2:
-  version "1.0.2"
-  resolved "https://registry.yarnpkg.com/log-symbols/-/log-symbols-1.0.2.tgz#376ff7b58ea3086a0f09facc74617eca501e1a18"
-  integrity sha1-N2/3tY6jCGoPCfrMdGF+ylAeGhg=
-  dependencies:
-    chalk "^1.0.0"
-
 log-symbols@^3.0.0:
   version "3.0.0"
   resolved "https://registry.yarnpkg.com/log-symbols/-/log-symbols-3.0.0.tgz#f3a08516a5dea893336a7dee14d18a1cfdab77c4"
@@ -21836,15 +21782,6 @@ log-symbols@^3.0.0:
   dependencies:
     chalk "^2.4.2"
 
-log-update@^2.3.0:
-  version "2.3.0"
-  resolved "https://registry.yarnpkg.com/log-update/-/log-update-2.3.0.tgz#88328fd7d1ce7938b29283746f0b1bc126b24708"
-  integrity sha1-iDKP19HOeTiykoN0bwsbwSayRwg=
-  dependencies:
-    ansi-escapes "^3.0.0"
-    cli-cursor "^2.0.0"
-    wrap-ansi "^3.0.1"
-
 log-update@^4.0.0:
   version "4.0.0"
   resolved "https://registry.yarnpkg.com/log-update/-/log-update-4.0.0.tgz#589ecd352471f2a1c0c570287543a64dfd20e0a1"
@@ -21855,6 +21792,17 @@ log-update@^4.0.0:
     slice-ansi "^4.0.0"
     wrap-ansi "^6.2.0"
 
+log-update@^6.0.0:
+  version "6.0.0"
+  resolved "https://registry.yarnpkg.com/log-update/-/log-update-6.0.0.tgz#0ddeb7ac6ad658c944c1de902993fce7c33f5e59"
+  integrity sha512-niTvB4gqvtof056rRIrTZvjNYE4rCUzO6X/X+kYjd7WFxXeJ0NwEFnRxX6ehkvv3jTwrXnNdtAak5XYZuIyPFw==
+  dependencies:
+    ansi-escapes "^6.2.0"
+    cli-cursor "^4.0.0"
+    slice-ansi "^7.0.0"
+    strip-ansi "^7.1.0"
+    wrap-ansi "^9.0.0"
+
 logform@^2.3.2, logform@^2.4.0:
   version "2.4.0"
   resolved "https://registry.yarnpkg.com/logform/-/logform-2.4.0.tgz#131651715a17d50f09c2a2c1a524ff1a4164bcfe"
@@ -22573,11 +22521,6 @@ mime@2.6.0, mime@^2.4.4:
   resolved "https://registry.yarnpkg.com/mime/-/mime-2.6.0.tgz#a2a682a95cd4d0cb1d6257e28f83da7e35800367"
   integrity sha512-USPkMeET31rOMiarsBNIHZKLGgvKc/LrjofAnBlOttf5ajRvqiRA8QsenbcooctK6d6Ts6aqZXBA+XbkKthiQg==
 
-mimic-fn@^1.0.0:
-  version "1.2.0"
-  resolved "https://registry.yarnpkg.com/mimic-fn/-/mimic-fn-1.2.0.tgz#820c86a39334640e99516928bd03fca88057d022"
-  integrity sha512-jf84uxzwiuiIVKiOLpfYk7N46TSy8ubTonmneY9vrpHNAnp0QBt2BxWV9dO3/j+BoVAb+a5G6YDPW3M5HOdMWQ==
-
 mimic-fn@^2.1.0:
   version "2.1.0"
   resolved "https://registry.yarnpkg.com/mimic-fn/-/mimic-fn-2.1.0.tgz#7ed2c2ccccaf84d3ffcb7a69b57711fc2083401b"
@@ -23922,13 +23865,6 @@ one-time@^1.0.0:
   dependencies:
     fn.name "1.x.x"
 
-onetime@^2.0.0:
-  version "2.0.1"
-  resolved "https://registry.yarnpkg.com/onetime/-/onetime-2.0.1.tgz#067428230fd67443b2794b22bba528b6867962d4"
-  integrity sha1-BnQoIw/WdEOyeUsiu6UotoZ5YtQ=
-  dependencies:
-    mimic-fn "^1.0.0"
-
 onetime@^5.1.0, onetime@^5.1.2:
   version "5.1.2"
   resolved "https://registry.yarnpkg.com/onetime/-/onetime-5.1.2.tgz#d0e96ebb56b07476df1dd9c4806e5237985ca45e"
@@ -27183,14 +27119,6 @@ responselike@^3.0.0:
   dependencies:
     lowercase-keys "^3.0.0"
 
-restore-cursor@^2.0.0:
-  version "2.0.0"
-  resolved "https://registry.yarnpkg.com/restore-cursor/-/restore-cursor-2.0.0.tgz#9f7ee287f82fd326d4fd162923d62129eee0dfaf"
-  integrity sha1-n37ih/gv0ybU/RYpI9YhKe7g368=
-  dependencies:
-    onetime "^2.0.0"
-    signal-exit "^3.0.2"
-
 restore-cursor@^3.1.0:
   version "3.1.0"
   resolved "https://registry.yarnpkg.com/restore-cursor/-/restore-cursor-3.1.0.tgz#39f67c54b3a7a58cea5236d95cf0034239631f7e"
@@ -27199,6 +27127,14 @@ restore-cursor@^3.1.0:
     onetime "^5.1.0"
     signal-exit "^3.0.2"
 
+restore-cursor@^4.0.0:
+  version "4.0.0"
+  resolved "https://registry.yarnpkg.com/restore-cursor/-/restore-cursor-4.0.0.tgz#519560a4318975096def6e609d44100edaa4ccb9"
+  integrity sha512-I9fPXU9geO9bHOt9pHHOhOkYerIMsmVaWB0rA2AI9ERh/+x/i7MV5HKBNrg+ljO5eoPVgCcnFuRjJ9uH6I/3eg==
+  dependencies:
+    onetime "^5.1.0"
+    signal-exit "^3.0.2"
+
 resumer@^0.0.0:
   version "0.0.0"
   resolved "https://registry.yarnpkg.com/resumer/-/resumer-0.0.0.tgz#f1e8f461e4064ba39e82af3cdc2a8c893d076759"
@@ -27231,6 +27167,11 @@ rfc4648@^1.5.2:
   resolved "https://registry.yarnpkg.com/rfc4648/-/rfc4648-1.5.2.tgz#cf5dac417dd83e7f4debf52e3797a723c1373383"
   integrity sha512-tLOizhR6YGovrEBLatX1sdcuhoSCXddw3mqNVAcKxGJ+J0hFeJ+SjeWCv5UPA/WU3YzWPPuCVYgXBKZUPGpKtg==
 
+rfdc@^1.3.1:
+  version "1.3.1"
+  resolved "https://registry.yarnpkg.com/rfdc/-/rfdc-1.3.1.tgz#2b6d4df52dffe8bb346992a10ea9451f24373a8f"
+  integrity sha512-r5a3l5HzYlIC68TpmYKlxWjmOP6wiPJ1vWv2HeLhNsRZMrCkxeqxiHlQ21oXmQ4F3SiryXBHhAD7JZqvOJjFmg==
+
 rgbcolor@^1.0.1:
   version "1.0.1"
   resolved "https://registry.yarnpkg.com/rgbcolor/-/rgbcolor-1.0.1.tgz#d6505ecdb304a6595da26fa4b43307306775945d"
@@ -27343,7 +27284,7 @@ rxjs-report-usage@^1.0.4:
     glob "~7.2.0"
     prompts "~2.4.2"
 
-rxjs@^6.3.3, rxjs@^6.4.0, rxjs@^6.5.1, rxjs@^6.6.0, rxjs@^6.6.7:
+rxjs@^6.4.0, rxjs@^6.6.0, rxjs@^6.6.7:
   version "6.6.7"
   resolved "https://registry.yarnpkg.com/rxjs/-/rxjs-6.6.7.tgz#90ac018acabf491bf65044235d5863c4dab804c9"
   integrity sha512-hTdwr+7yYNIT5n4AMYp85KA6yw2Va0FLa3Rguvbpa4W3I5xynaBZo41cM3XM+4Q6fRMj3sBYIR1VAmZMXYJvRQ==
@@ -28109,11 +28050,6 @@ slash@^3.0.0:
   resolved "https://registry.yarnpkg.com/slash/-/slash-3.0.0.tgz#6539be870c165adbd5240220dbe361f1bc4d4634"
   integrity sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q==
 
-slice-ansi@0.0.4:
-  version "0.0.4"
-  resolved "https://registry.yarnpkg.com/slice-ansi/-/slice-ansi-0.0.4.tgz#edbf8903f66f7ce2f8eafd6ceed65e264c831b35"
-  integrity sha1-7b+JA/ZvfOL46v1s7tZeJkyDGzU=
-
 slice-ansi@^3.0.0:
   version "3.0.0"
   resolved "https://registry.yarnpkg.com/slice-ansi/-/slice-ansi-3.0.0.tgz#31ddc10930a1b7e0b67b08c96c2f49b77a789787"
@@ -28132,6 +28068,22 @@ slice-ansi@^4.0.0:
     astral-regex "^2.0.0"
     is-fullwidth-code-point "^3.0.0"
 
+slice-ansi@^5.0.0:
+  version "5.0.0"
+  resolved "https://registry.yarnpkg.com/slice-ansi/-/slice-ansi-5.0.0.tgz#b73063c57aa96f9cd881654b15294d95d285c42a"
+  integrity sha512-FC+lgizVPfie0kkhqUScwRu1O/lF6NOgJmlCgK+/LYxDCTk8sGelYaHDhFcDN+Sn3Cv+3VSa4Byeo+IMCzpMgQ==
+  dependencies:
+    ansi-styles "^6.0.0"
+    is-fullwidth-code-point "^4.0.0"
+
+slice-ansi@^7.0.0:
+  version "7.1.0"
+  resolved "https://registry.yarnpkg.com/slice-ansi/-/slice-ansi-7.1.0.tgz#cd6b4655e298a8d1bdeb04250a433094b347b9a9"
+  integrity sha512-bSiSngZ/jWeX93BqeIAbImyTbEihizcwNjFoRUIY/T1wWQsfsm2Vw1agPKylXvQTU7iASGdHhyqRlqQzfz+Htg==
+  dependencies:
+    ansi-styles "^6.2.1"
+    is-fullwidth-code-point "^5.0.0"
+
 slide@~1.1.3:
   version "1.1.6"
   resolved "https://registry.yarnpkg.com/slide/-/slide-1.1.6.tgz#56eb027d65b4d2dce6cb2e2d32c4d4afc9e1d707"
@@ -28809,14 +28761,6 @@ string-width@^1.0.1:
     is-fullwidth-code-point "^1.0.0"
     strip-ansi "^3.0.0"
 
-string-width@^2.1.1:
-  version "2.1.1"
-  resolved "https://registry.yarnpkg.com/string-width/-/string-width-2.1.1.tgz#ab93f27a8dc13d28cac815c462143a6d9012ae9e"
-  integrity sha512-nOqH59deCq9SRHlxq1Aw85Jnt4w6KvLKqWVik6oA9ZklXLNIOlqg4F2yrT1MVaTjAqvVwdfeZ7w7aCvJD7ugkw==
-  dependencies:
-    is-fullwidth-code-point "^2.0.0"
-    strip-ansi "^4.0.0"
-
 string-width@^5.0.1, string-width@^5.1.2:
   version "5.1.2"
   resolved "https://registry.yarnpkg.com/string-width/-/string-width-5.1.2.tgz#14f8daec6d81e7221d2a357e668cab73bdbca794"
@@ -28826,6 +28770,15 @@ string-width@^5.0.1, string-width@^5.1.2:
     emoji-regex "^9.2.2"
     strip-ansi "^7.0.1"
 
+string-width@^7.0.0:
+  version "7.1.0"
+  resolved "https://registry.yarnpkg.com/string-width/-/string-width-7.1.0.tgz#d994252935224729ea3719c49f7206dc9c46550a"
+  integrity sha512-SEIJCWiX7Kg4c129n48aDRwLbFb2LJmXXFrWBG4NGaRtMQ3myKPKbwrD1BKqQn74oCoNMBVrfDEr5M9YxCsrkw==
+  dependencies:
+    emoji-regex "^10.3.0"
+    get-east-asian-width "^1.0.0"
+    strip-ansi "^7.1.0"
+
 "string.prototype.matchall@^4.0.0 || ^3.0.1", string.prototype.matchall@^4.0.8:
   version "4.0.8"
   resolved "https://registry.yarnpkg.com/string.prototype.matchall/-/string.prototype.matchall-4.0.8.tgz#3bf85722021816dcd1bf38bb714915887ca79fd3"
@@ -28931,13 +28884,6 @@ strip-ansi@^3.0.0, strip-ansi@^3.0.1:
   dependencies:
     ansi-regex "^2.0.0"
 
-strip-ansi@^4.0.0:
-  version "4.0.0"
-  resolved "https://registry.yarnpkg.com/strip-ansi/-/strip-ansi-4.0.0.tgz#a8479022eb1ac368a871389b635262c505ee368f"
-  integrity sha1-qEeQIusaw2iocTibY1JixQXuNo8=
-  dependencies:
-    ansi-regex "^3.0.0"
-
 strip-ansi@^7.0.1, strip-ansi@^7.1.0:
   version "7.1.0"
   resolved "https://registry.yarnpkg.com/strip-ansi/-/strip-ansi-7.1.0.tgz#d5b6568ca689d8561370b0707685d22434faff45"
@@ -29290,7 +29236,7 @@ swrv@1.0.4:
   resolved "https://registry.yarnpkg.com/swrv/-/swrv-1.0.4.tgz#278b4811ed4acbb1ae46654972a482fd1847e480"
   integrity sha512-zjEkcP8Ywmj+xOJW3lIT65ciY/4AL4e/Or7Gj0MzU3zBJNMdJiT8geVZhINavnlHRMMCcJLHhraLTAiDOTmQ9g==
 
-symbol-observable@^1.1.0, symbol-observable@^1.2.0:
+symbol-observable@^1.2.0:
   version "1.2.0"
   resolved "https://registry.yarnpkg.com/symbol-observable/-/symbol-observable-1.2.0.tgz#c22688aed4eab3cdc2dfeacbb561660560a00804"
   integrity sha512-e900nM8RRtGhlV36KGEU9k65K3mPb1WV70OdjfxlG2EAuM1noi/E/BaW/uMhL7bPEssK8QV57vN3esixjUvcXQ==
@@ -31828,14 +31774,6 @@ wrap-ansi@^2.0.0:
     string-width "^1.0.1"
     strip-ansi "^3.0.1"
 
-wrap-ansi@^3.0.1:
-  version "3.0.1"
-  resolved "https://registry.yarnpkg.com/wrap-ansi/-/wrap-ansi-3.0.1.tgz#288a04d87eda5c286e060dfe8f135ce8d007f8ba"
-  integrity sha1-KIoE2H7aXChuBg3+jxNc6NAH+Lo=
-  dependencies:
-    string-width "^2.1.1"
-    strip-ansi "^4.0.0"
-
 wrap-ansi@^6.2.0:
   version "6.2.0"
   resolved "https://registry.yarnpkg.com/wrap-ansi/-/wrap-ansi-6.2.0.tgz#e9393ba07102e6c91a3b221478f0257cd2856e53"
@@ -31854,6 +31792,15 @@ wrap-ansi@^8.1.0:
     string-width "^5.0.1"
     strip-ansi "^7.0.1"
 
+wrap-ansi@^9.0.0:
+  version "9.0.0"
+  resolved "https://registry.yarnpkg.com/wrap-ansi/-/wrap-ansi-9.0.0.tgz#1a3dc8b70d85eeb8398ddfb1e4a02cd186e58b3e"
+  integrity sha512-G8ura3S+3Z2G+mkgNRq8dqaFZAuxfsxpBB8OCTGRTCtp+l/v9nbFNmCUP1BZMts3G1142MsZfn6eeUKrr4PD1Q==
+  dependencies:
+    ansi-styles "^6.2.1"
+    string-width "^7.0.0"
+    strip-ansi "^7.1.0"
+
 wrappy@1:
   version "1.0.2"
   resolved "https://registry.yarnpkg.com/wrappy/-/wrappy-1.0.2.tgz#b5243d8f3ec1aa35f1364605bc0d1036e30ab69f"