diff --git a/x-pack/legacy/plugins/fleet/common/constants/index_names.ts b/x-pack/legacy/plugins/fleet/common/constants/index_names.ts
index 0184d29677a1f0..b45194e48fa886 100644
--- a/x-pack/legacy/plugins/fleet/common/constants/index_names.ts
+++ b/x-pack/legacy/plugins/fleet/common/constants/index_names.ts
@@ -5,7 +5,7 @@
  */
 
 export const INDEX_NAMES = {
-  FLEET: '.kibana-fleet',
+  FLEET: '.kibana',
 };
 
 export const POLICY_NAMES = {};
diff --git a/x-pack/legacy/plugins/fleet/public/components/search_bar.tsx b/x-pack/legacy/plugins/fleet/public/components/search_bar.tsx
new file mode 100644
index 00000000000000..282c4e8a77cbf5
--- /dev/null
+++ b/x-pack/legacy/plugins/fleet/public/components/search_bar.tsx
@@ -0,0 +1,107 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { SFC, useState, useEffect } from 'react';
+import {
+  // @ts-ignore
+  EuiSuggest,
+} from '@elastic/eui';
+import { FrontendLibs } from '../lib/types';
+import { ElasticsearchLib } from '../lib/elasticsearch';
+import { useDebounce } from '../hooks/use_debounce';
+
+const DEBOUNCE_SEARCH_MS = 150;
+
+interface Suggestion {
+  label: string;
+  description: string;
+  value: string;
+  type: {
+    color: string;
+    iconType: string;
+  };
+  start: number;
+  end: number;
+}
+
+interface Props {
+  libs: FrontendLibs;
+  value: string;
+  fieldPrefix: string;
+  onChange: (newValue: string) => void;
+}
+
+export const SearchBar: SFC<Props> = ({ libs, value, fieldPrefix, onChange }) => {
+  const { suggestions } = useSuggestions(libs.elasticsearch, fieldPrefix, value);
+
+  const onAutocompleteClick = (suggestion: Suggestion) => {
+    onChange(
+      [value.slice(0, suggestion.start), suggestion.value, value.slice(suggestion.end, -1)].join('')
+    );
+  };
+  const onChangeSearch = (s: string) => {
+    onChange(s);
+  };
+
+  return (
+    <EuiSuggest
+      value={value}
+      icon={'search'}
+      placeholder={'Search'}
+      onInputChange={onChangeSearch}
+      suggestions={suggestions}
+      onItemClick={onAutocompleteClick}
+    />
+  );
+};
+
+function transformSuggestionType(type: string): { iconType: string; color: string } {
+  switch (type) {
+    case 'field':
+      return { iconType: 'kqlField', color: 'tint4' };
+    case 'value':
+      return { iconType: 'kqlValue', color: 'tint0' };
+    case 'conjunction':
+      return { iconType: 'kqlSelector', color: 'tint3' };
+    case 'operator':
+      return { iconType: 'kqlOperand', color: 'tint1' };
+    default:
+      return { iconType: 'kqlOther', color: 'tint1' };
+  }
+}
+
+function useSuggestions(elasticsearch: ElasticsearchLib, fieldPrefix: string, search: string) {
+  const debouncedSearch = useDebounce(search, DEBOUNCE_SEARCH_MS);
+  const [suggestions, setSuggestions] = useState<Suggestion[]>([]);
+
+  const fetchSuggestions = async () => {
+    try {
+      const esSuggestions = (await elasticsearch.getSuggestions(
+        debouncedSearch,
+        debouncedSearch.length,
+        fieldPrefix
+      )).map(suggestion => ({
+        label: suggestion.text,
+        description: suggestion.description || '',
+        type: transformSuggestionType(suggestion.type),
+        start: suggestion.start,
+        end: suggestion.end,
+        value: suggestion.text,
+      }));
+      setSuggestions(esSuggestions);
+    } catch (err) {
+      setSuggestions([]);
+    }
+  };
+
+  useEffect(() => {
+    fetchSuggestions();
+  }, [debouncedSearch]);
+
+  return {
+    suggestions,
+  };
+}
diff --git a/x-pack/legacy/plugins/fleet/public/hooks/use_debounce.tsx b/x-pack/legacy/plugins/fleet/public/hooks/use_debounce.tsx
new file mode 100644
index 00000000000000..f701ebeaadbe50
--- /dev/null
+++ b/x-pack/legacy/plugins/fleet/public/hooks/use_debounce.tsx
@@ -0,0 +1,23 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { useState, useEffect } from 'react';
+
+export function useDebounce<T>(value: T, delay: number) {
+  const [debouncedValue, setDebouncedValue] = useState(value);
+
+  useEffect(() => {
+    const handler = setTimeout(() => {
+      setDebouncedValue(value);
+    }, delay);
+
+    return () => {
+      clearTimeout(handler);
+    };
+  }, [value, delay]);
+
+  return debouncedValue;
+}
diff --git a/x-pack/legacy/plugins/fleet/public/lib/adapters/agent/memory_agent_adapter.ts b/x-pack/legacy/plugins/fleet/public/lib/adapters/agent/memory_agent_adapter.ts
index 37b81ffe49d8f8..f4f256532e7020 100644
--- a/x-pack/legacy/plugins/fleet/public/lib/adapters/agent/memory_agent_adapter.ts
+++ b/x-pack/legacy/plugins/fleet/public/lib/adapters/agent/memory_agent_adapter.ts
@@ -20,9 +20,9 @@ export class AgentAdapter {
 
   public async getAgentEvents(
     id: string,
-    search: string,
     page: number,
-    perPage: number
+    perPage: number,
+    kuery?: string
   ): Promise<{
     total: number;
     list: AgentEvent[];
@@ -41,7 +41,7 @@ export class AgentAdapter {
     return true;
   }
 
-  public async getAll(page: number, perPage: number) {
+  public async getAll(page: number, perPage: number, kuery?: string) {
     const list = this.memoryDB.map<Agent>((beat: any) => omit(beat, ['access_token']));
     return { list, success: true, page, perPage, total: list.length };
   }
diff --git a/x-pack/legacy/plugins/fleet/public/lib/adapters/agent/rest_agent_adapter.ts b/x-pack/legacy/plugins/fleet/public/lib/adapters/agent/rest_agent_adapter.ts
index 1e09247612ea16..97ca2593641608 100644
--- a/x-pack/legacy/plugins/fleet/public/lib/adapters/agent/rest_agent_adapter.ts
+++ b/x-pack/legacy/plugins/fleet/public/lib/adapters/agent/rest_agent_adapter.ts
@@ -25,16 +25,16 @@ export class RestAgentAdapter extends AgentAdapter {
 
   public async getAgentEvents(
     id: string,
-    search: string,
     page: number,
-    perPage: number
+    perPage: number,
+    kuery?: string
   ): Promise<{
     total: number;
     list: AgentEvent[];
   }> {
     const { total, list } = await this.REST.get<ReturnTypeList<AgentEvent>>(
       `/api/fleet/agents/${id}/events`,
-      { page, per_page: perPage, search: search === '' ? undefined : search }
+      { page, per_page: perPage, kuery: kuery !== '' ? kuery : undefined }
     );
 
     return {
@@ -53,11 +53,16 @@ export class RestAgentAdapter extends AgentAdapter {
     }
   }
 
-  public async getAll(page: number, perPage: number): Promise<ReturnTypeList<Agent>> {
+  public async getAll(
+    page: number,
+    perPage: number,
+    kuery?: string
+  ): Promise<ReturnTypeList<Agent>> {
     try {
       return await this.REST.get<ReturnTypeList<Agent>>('/api/fleet/agents', {
         page,
         perPage,
+        kuery: kuery !== '' ? kuery : undefined,
       });
     } catch (e) {
       return {
diff --git a/x-pack/legacy/plugins/fleet/public/lib/agent.ts b/x-pack/legacy/plugins/fleet/public/lib/agent.ts
index 2badd45d996eb4..7acb4ca73976f4 100644
--- a/x-pack/legacy/plugins/fleet/public/lib/agent.ts
+++ b/x-pack/legacy/plugins/fleet/public/lib/agent.ts
@@ -7,13 +7,9 @@
 import { ReturnTypeList } from '../../common/return_types';
 import { Agent, AgentEvent } from '../../common/types/domain_data';
 import { AgentAdapter } from './adapters/agent/memory_agent_adapter';
-import { ElasticsearchLib } from './elasticsearch';
 
 export class AgentsLib {
-  constructor(
-    private readonly adapter: AgentAdapter,
-    private readonly elasticsearch: ElasticsearchLib
-  ) {}
+  constructor(private readonly adapter: AgentAdapter) {}
 
   /**
    * Get an agent by id
@@ -30,11 +26,11 @@ export class AgentsLib {
    */
   public async getAgentEvents(
     id: string,
-    search: string,
     page: number,
-    perPage: number
+    perPage: number,
+    kuery?: string
   ): Promise<{ total: number; list: AgentEvent[] }> {
-    return await this.adapter.getAgentEvents(id, search, page, perPage);
+    return await this.adapter.getAgentEvents(id, page, perPage, kuery);
   }
 
   /** Get a single agent using the token it was enrolled in for lookup */
@@ -55,13 +51,7 @@ export class AgentsLib {
     perPage: number,
     kuery?: string
   ): Promise<ReturnTypeList<Agent>> => {
-    // @ts-ignore
-    let ESQuery;
-    if (kuery) {
-      ESQuery = await this.elasticsearch.convertKueryToEsQuery(kuery);
-    }
-    // TODO: add back param to getAll() when endpoint supports query
-    return await this.adapter.getAll(page, perPage);
+    return await this.adapter.getAll(page, perPage, kuery);
   };
 
   /** Update a given agent via it's ID */
diff --git a/x-pack/legacy/plugins/fleet/public/lib/compose/kibana.ts b/x-pack/legacy/plugins/fleet/public/lib/compose/kibana.ts
index da64190b6e50e1..f38760934a5ff7 100644
--- a/x-pack/legacy/plugins/fleet/public/lib/compose/kibana.ts
+++ b/x-pack/legacy/plugins/fleet/public/lib/compose/kibana.ts
@@ -30,7 +30,7 @@ export function compose(): FrontendLibs {
   const api = new AxiosRestAPIAdapter(chrome.getXsrfToken(), chrome.getBasePath());
   const esAdapter = new RestElasticsearchAdapter(api, INDEX_NAMES.FLEET);
   const elasticsearchLib = new ElasticsearchLib(esAdapter);
-  const agents = new AgentsLib(new RestAgentAdapter(api), elasticsearchLib);
+  const agents = new AgentsLib(new RestAgentAdapter(api));
 
   const framework = new FrameworkLib(
     new KibanaFrameworkAdapter(
diff --git a/x-pack/legacy/plugins/fleet/public/lib/compose/memory.ts b/x-pack/legacy/plugins/fleet/public/lib/compose/memory.ts
index 94c755aab2c9ce..2ebc10d83f8303 100644
--- a/x-pack/legacy/plugins/fleet/public/lib/compose/memory.ts
+++ b/x-pack/legacy/plugins/fleet/public/lib/compose/memory.ts
@@ -35,7 +35,7 @@ export function compose(
   );
   const elasticsearchLib = new ElasticsearchLib(esAdapter);
 
-  const agents = new AgentsLib(new MemoryAgentAdapter([]), elasticsearchLib);
+  const agents = new AgentsLib(new MemoryAgentAdapter([]));
 
   const pluginUIModule = uiModules.get('app/fleet');
 
diff --git a/x-pack/legacy/plugins/fleet/public/lib/compose/scripts.ts b/x-pack/legacy/plugins/fleet/public/lib/compose/scripts.ts
index 174782150d6e02..0f0b2db520bf90 100644
--- a/x-pack/legacy/plugins/fleet/public/lib/compose/scripts.ts
+++ b/x-pack/legacy/plugins/fleet/public/lib/compose/scripts.ts
@@ -18,7 +18,7 @@ export function compose(basePath: string): FrontendLibs {
   const esAdapter = new MemoryElasticsearchAdapter(() => true, () => '', []);
   const elasticsearchLib = new ElasticsearchLib(esAdapter);
 
-  const agents = new AgentsLib(new RestAgentAdapter(api), elasticsearchLib);
+  const agents = new AgentsLib(new RestAgentAdapter(api));
 
   const framework = new FrameworkLib(
     new TestingFrameworkAdapter(
diff --git a/x-pack/legacy/plugins/fleet/public/lib/elasticsearch.ts b/x-pack/legacy/plugins/fleet/public/lib/elasticsearch.ts
index 0897dfd9c13928..ceebe33c266aae 100644
--- a/x-pack/legacy/plugins/fleet/public/lib/elasticsearch.ts
+++ b/x-pack/legacy/plugins/fleet/public/lib/elasticsearch.ts
@@ -7,29 +7,14 @@
 import { AutocompleteSuggestion } from '../../../../../../src/plugins/data/public';
 import { ElasticsearchAdapter } from './adapters/elasticsearch/adapter_types';
 
-interface HiddenFields {
-  op: 'is' | 'startsWith' | 'withoutPrefix';
-  value: string;
-}
+const HIDDEN_FIELDS = ['agents.actions'];
 
 export class ElasticsearchLib {
-  private readonly hiddenFields: HiddenFields[] = [
-    { op: 'startsWith', value: 'enrollment_token' },
-    { op: 'is', value: 'beat.active' },
-    { op: 'is', value: 'beat.enrollment_token' },
-    { op: 'is', value: 'beat.access_token' },
-    { op: 'is', value: 'beat.ephemeral_id' },
-    { op: 'is', value: 'beat.verified_on' },
-  ];
-
   constructor(private readonly adapter: ElasticsearchAdapter) {}
 
   public isKueryValid(kuery: string): boolean {
     return this.adapter.isKueryValid(kuery);
   }
-  public async convertKueryToEsQuery(kuery: string): Promise<string> {
-    return await this.adapter.convertKueryToEsQuery(kuery);
-  }
 
   public async getSuggestions(
     kuery: string,
@@ -39,29 +24,26 @@ export class ElasticsearchLib {
     const suggestions = await this.adapter.getSuggestions(kuery, selectionStart);
 
     const filteredSuggestions = suggestions.filter(suggestion => {
-      const hiddenFieldsCheck = this.hiddenFields;
-
-      if (fieldPrefix) {
-        hiddenFieldsCheck.push({
-          op: 'withoutPrefix',
-          value: `${fieldPrefix}.`,
-        });
+      if (suggestion.type === 'conjunction') {
+        return true;
+      }
+      if (suggestion.type === 'value') {
+        return true;
+      }
+      if (suggestion.type === 'operator') {
+        return true;
       }
 
-      return hiddenFieldsCheck.reduce((isvalid: boolean, field) => {
-        if (!isvalid) {
-          return false;
+      if (fieldPrefix && suggestion.text.startsWith(fieldPrefix)) {
+        for (const hiddenField of HIDDEN_FIELDS) {
+          if (suggestion.text.startsWith(hiddenField)) {
+            return false;
+          }
         }
+        return true;
+      }
 
-        switch (field.op) {
-          case 'startsWith':
-            return !suggestion.text.startsWith(field.value);
-          case 'is':
-            return suggestion.text.trim() !== field.value;
-          case 'withoutPrefix':
-            return suggestion.text.startsWith(field.value);
-        }
-      }, true);
+      return false;
     });
 
     return filteredSuggestions;
diff --git a/x-pack/legacy/plugins/fleet/public/pages/agent_details/components/agent_events_table.tsx b/x-pack/legacy/plugins/fleet/public/pages/agent_details/components/agent_events_table.tsx
index 5a4638848a88d7..9b4b2e7638895a 100644
--- a/x-pack/legacy/plugins/fleet/public/pages/agent_details/components/agent_events_table.tsx
+++ b/x-pack/legacy/plugins/fleet/public/pages/agent_details/components/agent_events_table.tsx
@@ -8,30 +8,42 @@ import React, { useState, useEffect, SFC } from 'react';
 import {
   EuiBasicTable,
   // @ts-ignore
-  EuiSearchBar,
+  EuiSuggest,
   EuiFlexGroup,
   EuiButton,
   EuiSpacer,
   EuiFlexItem,
   EuiTitle,
 } from '@elastic/eui';
+
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage, FormattedTime } from '@kbn/i18n/react';
-import { AgentsLib } from '../../../lib/agent';
 import { AgentEvent, Agent } from '../../../../common/types/domain_data';
 import { usePagination } from '../../../hooks/use_pagination';
+import { FrontendLibs } from '../../../lib/types';
+import { SearchBar } from '../../../components/search_bar';
+import { useDebounce } from '../../../hooks/use_debounce';
+
+const DEBOUNCE_SEARCH_MS = 300;
 
 function useSearch() {
-  const [search, setSearch] = useState('');
+  const [state, setState] = useState<{ search: string }>({
+    search: '',
+  });
+
+  const setSearch = (s: string) =>
+    setState({
+      search: s,
+    });
 
   return {
-    search,
+    ...state,
     setSearch,
   };
 }
 
 function useGetAgentEvents(
-  agents: AgentsLib,
+  libs: FrontendLibs,
   agent: Agent,
   search: string,
   pagination: { currentPage: number; pageSize: number }
@@ -41,18 +53,27 @@ function useGetAgentEvents(
     total: 0,
     isLoading: false,
   });
+  const debouncedSearch = useDebounce(search, DEBOUNCE_SEARCH_MS);
   const fetchAgentEvents = async () => {
     setState({
       isLoading: true,
       total: state.total,
       list: state.list,
     });
+    if (!libs.elasticsearch.isKueryValid(debouncedSearch)) {
+      return;
+      setState({
+        isLoading: false,
+        total: 0,
+        list: [],
+      });
+    }
     try {
-      const { list, total } = await agents.getAgentEvents(
+      const { list, total } = await libs.agents.getAgentEvents(
         agent.id,
-        search,
         pagination.currentPage,
-        pagination.pageSize
+        pagination.pageSize,
+        debouncedSearch
       );
 
       setState({
@@ -70,16 +91,16 @@ function useGetAgentEvents(
   };
   useEffect(() => {
     fetchAgentEvents();
-  }, [agent.id, search, pagination]);
+  }, [agent.id, debouncedSearch, pagination]);
 
   return { ...state, refresh: fetchAgentEvents };
 }
 
-export const AgentEventsTable: SFC<{ agents: AgentsLib; agent: Agent }> = ({ agents, agent }) => {
+export const AgentEventsTable: SFC<{ libs: FrontendLibs; agent: Agent }> = ({ libs, agent }) => {
   const { pageSizeOptions, pagination, setPagination } = usePagination();
   const { search, setSearch } = useSearch();
 
-  const { list, total, isLoading, refresh } = useGetAgentEvents(agents, agent, search, pagination);
+  const { list, total, isLoading, refresh } = useGetAgentEvents(libs, agent, search, pagination);
   const paginationOptions = {
     pageIndex: pagination.currentPage - 1,
     pageSize: pagination.pageSize,
@@ -135,9 +156,7 @@ export const AgentEventsTable: SFC<{ agents: AgentsLib; agent: Agent }> = ({ age
   const onClickRefresh = () => {
     refresh();
   };
-  const onChangeQuery = (e: any) => {
-    setSearch(e.queryText);
-  };
+
   const onChange = ({ page }: { page: { index: number; size: number } }) => {
     const newPagination = {
       ...pagination,
@@ -158,15 +177,7 @@ export const AgentEventsTable: SFC<{ agents: AgentsLib; agent: Agent }> = ({ age
       <EuiSpacer size="l" />
       <EuiFlexGroup>
         <EuiFlexItem>
-          <EuiSearchBar
-            query={search}
-            box={{
-              placeholder: 'e.g. type:STATE',
-              incremental: true,
-              schema: {},
-            }}
-            onChange={onChangeQuery}
-          />
+          <SearchBar value={search} libs={libs} onChange={setSearch} fieldPrefix={'agent_events'} />
         </EuiFlexItem>
         <EuiFlexItem grow={null}>
           <EuiButton color="secondary" iconType="refresh" onClick={onClickRefresh}>
diff --git a/x-pack/legacy/plugins/fleet/public/pages/agent_details/index.tsx b/x-pack/legacy/plugins/fleet/public/pages/agent_details/index.tsx
index 5bb5a7b12f7755..af4c109dd0b6b3 100644
--- a/x-pack/legacy/plugins/fleet/public/pages/agent_details/index.tsx
+++ b/x-pack/legacy/plugins/fleet/public/pages/agent_details/index.tsx
@@ -23,6 +23,7 @@ import { Loading } from '../../components/loading';
 import { PolicySection } from './components/policy_section';
 import { AgentDetailSection } from './components/details_section';
 import { AgentMetadataSection } from './components/metadata_section';
+import { FrontendLibs } from '../../lib/types';
 
 function useGetAgent(agents: AgentsLib, id: string) {
   const [state, setState] = useState<{
@@ -72,18 +73,18 @@ export const Layout: SFC = ({ children }) => (
 );
 
 type Props = {
-  libs: { agents: AgentsLib };
+  libs: FrontendLibs;
 } & RouteComponentProps<{
   agentId: string;
 }>;
 
 export const AgentDetailsPage: SFC<Props> = ({
-  libs: { agents },
+  libs,
   match: {
     params: { agentId },
   },
 }) => {
-  const { agent, isLoading, error } = useGetAgent(agents, agentId);
+  const { agent, isLoading, error } = useGetAgent(libs.agents, agentId);
   if (isLoading) {
     return <Loading />;
   }
@@ -135,7 +136,7 @@ export const AgentDetailsPage: SFC<Props> = ({
         </EuiFlexItem>
         <EuiFlexItem grow={7}>
           <EuiFlexItem grow={null}>
-            <AgentEventsTable agents={agents} agent={agent} />
+            <AgentEventsTable libs={libs} agent={agent} />
           </EuiFlexItem>
         </EuiFlexItem>
       </EuiFlexGroup>
diff --git a/x-pack/legacy/plugins/fleet/public/pages/agent_list/index.tsx b/x-pack/legacy/plugins/fleet/public/pages/agent_list/index.tsx
index 99514cb2f2ca2e..dcfcdd4576d940 100644
--- a/x-pack/legacy/plugins/fleet/public/pages/agent_list/index.tsx
+++ b/x-pack/legacy/plugins/fleet/public/pages/agent_list/index.tsx
@@ -27,6 +27,7 @@ import { FrontendLibs } from '../../lib/types';
 import { AgentHealth } from '../../components/agent_health';
 import { ConnectedLink } from '../../components/navigation/connected_link';
 import { usePagination } from '../../hooks/use_pagination';
+import { SearchBar } from '../../components/search_bar';
 
 interface RouterProps {
   libs: FrontendLibs;
@@ -40,9 +41,7 @@ export const AgentListPage: React.SFC<RouterProps> = ({ libs }) => {
   const [totalAgents, setTotalAgents] = useState<number>(0);
 
   // Table and search states
-  const [currentQuery, setCurrentQuery] = useState<typeof EuiSearchBar.Query>(
-    EuiSearchBar.Query.MATCH_ALL
-  );
+  const [search, setSearch] = useState('');
 
   const { pagination, pageSizeOptions, setPagination } = usePagination();
 
@@ -52,9 +51,8 @@ export const AgentListPage: React.SFC<RouterProps> = ({ libs }) => {
     setLastPolledAgentsMs(new Date().getTime());
     const { list, total } = await libs.agents.getAll(
       pagination.currentPage,
-      pagination.pageSize
-      // TODO: Adjust list endpoint to support query string
-      // currentQuery
+      pagination.pageSize,
+      search
     );
     setAgents(list);
     setTotalAgents(total);
@@ -69,7 +67,7 @@ export const AgentListPage: React.SFC<RouterProps> = ({ libs }) => {
   // Update agents if pagination or query state changes
   useEffect(() => {
     fetchAgents();
-  }, [pagination, currentQuery]);
+  }, [pagination, search]);
 
   // Poll for agents on interval
   useInterval(() => {
@@ -184,42 +182,7 @@ export const AgentListPage: React.SFC<RouterProps> = ({ libs }) => {
 
         <EuiFlexGroup>
           <EuiFlexItem grow={4}>
-            <EuiSearchBar
-              query={currentQuery}
-              box={{
-                incremental: true,
-                schema: {
-                  strict: true,
-                  fields: {
-                    policy_id: {
-                      type: 'string',
-                    },
-                  },
-                },
-              }}
-              filters={[
-                {
-                  type: 'field_value_selection',
-                  field: 'policy_id',
-                  name: i18n.translate('xpack.fleet.agentList.policyFilterLabel', {
-                    defaultMessage: 'Policy',
-                  }),
-                  multiSelect: 'or',
-                  cache: AGENT_POLLING_THRESHOLD_MS,
-                  // Temporary until we can load list of policies
-                  options: [...new Set(agents.map(agent => agent.policy_id))].map(policy => ({
-                    value: policy,
-                  })),
-                },
-              ]}
-              onChange={({ query, error }: { query: any; error: any }) => {
-                if (error) {
-                  // TODO: Handle malformed query error
-                } else {
-                  setCurrentQuery(query);
-                }
-              }}
-            />
+            <SearchBar libs={libs} value={search} onChange={setSearch} fieldPrefix="agents" />
           </EuiFlexItem>
           <EuiFlexItem>
             <EuiButton fill iconType="plusInCircle">
diff --git a/x-pack/legacy/plugins/fleet/scripts/dev_agent/script.ts b/x-pack/legacy/plugins/fleet/scripts/dev_agent/script.ts
index 39d568b53330e5..0ad986fa3a7a35 100644
--- a/x-pack/legacy/plugins/fleet/scripts/dev_agent/script.ts
+++ b/x-pack/legacy/plugins/fleet/scripts/dev_agent/script.ts
@@ -59,7 +59,16 @@ async function checkin(kibanaURL: string, agent: Agent, log: ToolingLog) {
   const res = await fetch(`${kibanaURL}/api/fleet/agents/${agent.id}/checkin`, {
     method: 'POST',
     body: JSON.stringify({
-      events: [],
+      events: [
+        {
+          type: 'STATE',
+          subtype: 'RUNNING',
+          message: 'state changed from STOPPED to RUNNING',
+          timestamp: new Date().toISOString(),
+          payload: { random: 'data', state: 'RUNNING', previous_state: 'STOPPED' },
+          data: '{}',
+        },
+      ],
     }),
     headers: {
       'kbn-xsrf': 'xxx',
diff --git a/x-pack/legacy/plugins/fleet/server/libs/agent.ts b/x-pack/legacy/plugins/fleet/server/libs/agent.ts
index e348f46dc9a717..986d3ebf716b3a 100644
--- a/x-pack/legacy/plugins/fleet/server/libs/agent.ts
+++ b/x-pack/legacy/plugins/fleet/server/libs/agent.ts
@@ -207,9 +207,10 @@ export class AgentLib {
     user: FrameworkUser,
     sortOptions: SortOptions = SortOptions.EnrolledAtDESC,
     page?: number,
-    perPage?: number
+    perPage?: number,
+    kuery?: string
   ): Promise<{ agents: Agent[]; total: number; page: number; perPage: number }> {
-    return this.agentsRepository.list(user, sortOptions, page, perPage);
+    return this.agentsRepository.list(user, sortOptions, page, perPage, kuery);
   }
 
   public _filterActionsForCheckin(agent: Agent): AgentAction[] {
diff --git a/x-pack/legacy/plugins/fleet/server/repositories/agent_events/__memorize_snapshots__/default.contract.test.slap_snap b/x-pack/legacy/plugins/fleet/server/repositories/agent_events/__memorize_snapshots__/default.contract.test.slap_snap
index 18446168975de2..6498f57c2e65fa 100644
--- a/x-pack/legacy/plugins/fleet/server/repositories/agent_events/__memorize_snapshots__/default.contract.test.slap_snap
+++ b/x-pack/legacy/plugins/fleet/server/repositories/agent_events/__memorize_snapshots__/default.contract.test.slap_snap
@@ -3699,3 +3699,1455 @@ exports['AgentsEventsRepository getEventsForAgent Get events for the agent - del
 exports['AgentsEventsRepository getEventsForAgent Get events for the agent - delete:agent_events:9fc49be0-e6a7-11e9-94e5-551854e0e358:{} (10)'] = {
   "results": {}
 }
+
+exports['AgentsEventsRepository createEventsForAgent Create events for an agent - create:agent_events (1)'] = {
+  "results": {
+    "type": "agent_events",
+    "id": "16e71e50-eae0-11e9-857a-5b15df4fd482",
+    "attributes": {
+      "type": "STATE",
+      "subtype": "STARTING",
+      "timestamp": "2019-09-27T18:50:32+0000",
+      "message": "...",
+      "agent_id": "agent:1"
+    },
+    "references": [],
+    "updated_at": "2019-10-09T21:59:38.932Z",
+    "version": "WzIsMV0="
+  }
+}
+
+exports['AgentsEventsRepository createEventsForAgent Create events for an agent - bulkCreate:[{"attributes":{"agent_id":"agent:1","type":"STATE","subtype":"STARTING","timestamp":"2019-09-27T18:50:33+0000","message":"..."},"type":"agent_events"},{"attributes":{"agent_id":"agent:1","type":"STATE","subtype":"STARTING","timestamp":"2019-09-27T18:50:34+0000","message":"..."},"type":"agent_events"}]:{} (2)'] = {
+  "results": {
+    "saved_objects": [
+      {
+        "id": "agent_events:1781fec0-eae0-11e9-857a-5b15df4fd482",
+        "type": "agent_events",
+        "updated_at": "2019-10-09T21:59:39.948Z",
+        "version": "WzMsMV0=",
+        "attributes": {
+          "agent_id": "agent:1",
+          "type": "STATE",
+          "subtype": "STARTING",
+          "timestamp": "2019-09-27T18:50:33+0000",
+          "message": "..."
+        },
+        "references": []
+      },
+      {
+        "id": "agent_events:1781fec1-eae0-11e9-857a-5b15df4fd482",
+        "type": "agent_events",
+        "updated_at": "2019-10-09T21:59:39.948Z",
+        "version": "WzQsMV0=",
+        "attributes": {
+          "agent_id": "agent:1",
+          "type": "STATE",
+          "subtype": "STARTING",
+          "timestamp": "2019-09-27T18:50:34+0000",
+          "message": "..."
+        },
+        "references": []
+      }
+    ]
+  }
+}
+
+exports['AgentsEventsRepository createEventsForAgent Create events for an agent - find:{"type":"agent_events"} (3)'] = {
+  "results": {
+    "page": 1,
+    "per_page": 20,
+    "total": 3,
+    "saved_objects": [
+      {
+        "type": "agent_events",
+        "id": "16e71e50-eae0-11e9-857a-5b15df4fd482",
+        "attributes": {
+          "type": "STATE",
+          "subtype": "STARTING",
+          "timestamp": "2019-09-27T18:50:32+0000",
+          "message": "...",
+          "agent_id": "agent:1"
+        },
+        "references": [],
+        "updated_at": "2019-10-09T21:59:38.932Z",
+        "version": "WzIsMV0="
+      },
+      {
+        "type": "agent_events",
+        "id": "1781fec0-eae0-11e9-857a-5b15df4fd482",
+        "attributes": {
+          "agent_id": "agent:1",
+          "type": "STATE",
+          "subtype": "STARTING",
+          "timestamp": "2019-09-27T18:50:33+0000",
+          "message": "..."
+        },
+        "references": [],
+        "updated_at": "2019-10-09T21:59:39.948Z",
+        "version": "WzMsMV0="
+      },
+      {
+        "type": "agent_events",
+        "id": "1781fec1-eae0-11e9-857a-5b15df4fd482",
+        "attributes": {
+          "agent_id": "agent:1",
+          "type": "STATE",
+          "subtype": "STARTING",
+          "timestamp": "2019-09-27T18:50:34+0000",
+          "message": "..."
+        },
+        "references": [],
+        "updated_at": "2019-10-09T21:59:39.948Z",
+        "version": "WzQsMV0="
+      }
+    ]
+  }
+}
+
+exports['AgentsEventsRepository createEventsForAgent Create events for an agent - find:{"type":"agent_events","perPage":1000} (4)'] = {
+  "results": {
+    "page": 1,
+    "per_page": 1000,
+    "total": 3,
+    "saved_objects": [
+      {
+        "type": "agent_events",
+        "id": "16e71e50-eae0-11e9-857a-5b15df4fd482",
+        "attributes": {
+          "type": "STATE",
+          "subtype": "STARTING",
+          "timestamp": "2019-09-27T18:50:32+0000",
+          "message": "...",
+          "agent_id": "agent:1"
+        },
+        "references": [],
+        "updated_at": "2019-10-09T21:59:38.932Z",
+        "version": "WzIsMV0="
+      },
+      {
+        "type": "agent_events",
+        "id": "1781fec0-eae0-11e9-857a-5b15df4fd482",
+        "attributes": {
+          "agent_id": "agent:1",
+          "type": "STATE",
+          "subtype": "STARTING",
+          "timestamp": "2019-09-27T18:50:33+0000",
+          "message": "..."
+        },
+        "references": [],
+        "updated_at": "2019-10-09T21:59:39.948Z",
+        "version": "WzMsMV0="
+      },
+      {
+        "type": "agent_events",
+        "id": "1781fec1-eae0-11e9-857a-5b15df4fd482",
+        "attributes": {
+          "agent_id": "agent:1",
+          "type": "STATE",
+          "subtype": "STARTING",
+          "timestamp": "2019-09-27T18:50:34+0000",
+          "message": "..."
+        },
+        "references": [],
+        "updated_at": "2019-10-09T21:59:39.948Z",
+        "version": "WzQsMV0="
+      }
+    ]
+  }
+}
+
+exports['AgentsEventsRepository createEventsForAgent Create events for an agent - delete:agent_events:16e71e50-eae0-11e9-857a-5b15df4fd482:{} (5)'] = {
+  "results": {}
+}
+
+exports['AgentsEventsRepository createEventsForAgent Create events for an agent - delete:agent_events:1781fec0-eae0-11e9-857a-5b15df4fd482:{} (6)'] = {
+  "results": {}
+}
+
+exports['AgentsEventsRepository createEventsForAgent Create events for an agent - delete:agent_events:1781fec1-eae0-11e9-857a-5b15df4fd482:{} (7)'] = {
+  "results": {}
+}
+
+exports['AgentsEventsRepository deleteEventsForAgent Delete correctly all events for the agent - create:agent_events (1)'] = {
+  "results": {
+    "type": "agent_events",
+    "id": "19f03fa0-eae0-11e9-857a-5b15df4fd482",
+    "attributes": {
+      "type": "STATE",
+      "subtype": "STARTING",
+      "timestamp": "2019-09-27T18:50:32+0000",
+      "message": "...",
+      "agent_id": "agent:1"
+    },
+    "references": [],
+    "updated_at": "2019-10-09T21:59:44.026Z",
+    "version": "WzksMV0="
+  }
+}
+
+exports['AgentsEventsRepository deleteEventsForAgent Delete correctly all events for the agent - create:agent_events (2)'] = {
+  "results": {
+    "type": "agent_events",
+    "id": "1a8b4720-eae0-11e9-857a-5b15df4fd482",
+    "attributes": {
+      "type": "STATE",
+      "subtype": "STARTING",
+      "timestamp": "2019-09-27T18:50:33+0000",
+      "message": "...",
+      "agent_id": "agent:1"
+    },
+    "references": [],
+    "updated_at": "2019-10-09T21:59:45.042Z",
+    "version": "WzEwLDFd"
+  }
+}
+
+exports['AgentsEventsRepository deleteEventsForAgent Delete correctly all events for the agent - create:agent_events (3)'] = {
+  "results": {
+    "type": "agent_events",
+    "id": "1b256440-eae0-11e9-857a-5b15df4fd482",
+    "attributes": {
+      "type": "STATE",
+      "subtype": "STARTING",
+      "timestamp": "2019-09-27T18:50:34+0000",
+      "message": "...",
+      "agent_id": "agent:1"
+    },
+    "references": [],
+    "updated_at": "2019-10-09T21:59:46.052Z",
+    "version": "WzExLDFd"
+  }
+}
+
+exports['AgentsEventsRepository deleteEventsForAgent Delete correctly all events for the agent - create:agent_events (4)'] = {
+  "results": {
+    "type": "agent_events",
+    "id": "1bc1cb50-eae0-11e9-857a-5b15df4fd482",
+    "attributes": {
+      "type": "STATE",
+      "subtype": "STARTING",
+      "timestamp": "2019-09-27T18:50:32+0000",
+      "message": "...",
+      "agent_id": "agent:2"
+    },
+    "references": [],
+    "updated_at": "2019-10-09T21:59:47.077Z",
+    "version": "WzEyLDFd"
+  }
+}
+
+exports['AgentsEventsRepository deleteEventsForAgent Delete correctly all events for the agent - find:{"type":"agent_events","fields":["id"],"search":"agent:1","searchFields":["agent_id"],"perPage":1000} (5)'] = {
+  "results": {
+    "page": 1,
+    "per_page": 1000,
+    "total": 3,
+    "saved_objects": [
+      {
+        "type": "agent_events",
+        "id": "19f03fa0-eae0-11e9-857a-5b15df4fd482",
+        "references": [],
+        "updated_at": "2019-10-09T21:59:44.026Z",
+        "version": "WzksMV0="
+      },
+      {
+        "type": "agent_events",
+        "id": "1a8b4720-eae0-11e9-857a-5b15df4fd482",
+        "references": [],
+        "updated_at": "2019-10-09T21:59:45.042Z",
+        "version": "WzEwLDFd"
+      },
+      {
+        "type": "agent_events",
+        "id": "1b256440-eae0-11e9-857a-5b15df4fd482",
+        "references": [],
+        "updated_at": "2019-10-09T21:59:46.052Z",
+        "version": "WzExLDFd"
+      }
+    ]
+  }
+}
+
+exports['AgentsEventsRepository deleteEventsForAgent Delete correctly all events for the agent - delete:agent_events:19f03fa0-eae0-11e9-857a-5b15df4fd482:{} (6)'] = {
+  "results": {}
+}
+
+exports['AgentsEventsRepository deleteEventsForAgent Delete correctly all events for the agent - delete:agent_events:1a8b4720-eae0-11e9-857a-5b15df4fd482:{} (7)'] = {
+  "results": {}
+}
+
+exports['AgentsEventsRepository deleteEventsForAgent Delete correctly all events for the agent - delete:agent_events:1b256440-eae0-11e9-857a-5b15df4fd482:{} (8)'] = {
+  "results": {}
+}
+
+exports['AgentsEventsRepository deleteEventsForAgent Delete correctly all events for the agent - find:{"type":"agent_events","fields":["id"],"search":"agent:1","searchFields":["agent_id"],"perPage":1000} (9)'] = {
+  "results": {
+    "page": 1,
+    "per_page": 1000,
+    "total": 0,
+    "saved_objects": []
+  }
+}
+
+exports['AgentsEventsRepository deleteEventsForAgent Delete correctly all events for the agent - find:{"type":"agent_events"} (10)'] = {
+  "results": {
+    "page": 1,
+    "per_page": 20,
+    "total": 1,
+    "saved_objects": [
+      {
+        "type": "agent_events",
+        "id": "1bc1cb50-eae0-11e9-857a-5b15df4fd482",
+        "attributes": {
+          "type": "STATE",
+          "subtype": "STARTING",
+          "timestamp": "2019-09-27T18:50:32+0000",
+          "message": "...",
+          "agent_id": "agent:2"
+        },
+        "references": [],
+        "updated_at": "2019-10-09T21:59:47.077Z",
+        "version": "WzEyLDFd"
+      }
+    ]
+  }
+}
+
+exports['AgentsEventsRepository deleteEventsForAgent Delete correctly all events for the agent - find:{"type":"agent_events","perPage":1000} (11)'] = {
+  "results": {
+    "page": 1,
+    "per_page": 1000,
+    "total": 1,
+    "saved_objects": [
+      {
+        "type": "agent_events",
+        "id": "1bc1cb50-eae0-11e9-857a-5b15df4fd482",
+        "attributes": {
+          "type": "STATE",
+          "subtype": "STARTING",
+          "timestamp": "2019-09-27T18:50:32+0000",
+          "message": "...",
+          "agent_id": "agent:2"
+        },
+        "references": [],
+        "updated_at": "2019-10-09T21:59:47.077Z",
+        "version": "WzEyLDFd"
+      }
+    ]
+  }
+}
+
+exports['AgentsEventsRepository deleteEventsForAgent Delete correctly all events for the agent - delete:agent_events:1bc1cb50-eae0-11e9-857a-5b15df4fd482:{} (12)'] = {
+  "results": {}
+}
+
+exports['AgentsEventsRepository getEventsForAgent Get events for the agent - create:agent_events (1)'] = {
+  "results": {
+    "type": "agent_events",
+    "id": "1ecbfe10-eae0-11e9-857a-5b15df4fd482",
+    "attributes": {
+      "type": "STATE",
+      "subtype": "STARTING",
+      "timestamp": "2019-09-27T18:50:32+0000",
+      "message": "...",
+      "payload": "{\"previous_state\": \"STOPPED\"}",
+      "data": "{serializedDATA}",
+      "agent_id": "agent:1"
+    },
+    "references": [],
+    "updated_at": "2019-10-09T21:59:52.176Z",
+    "version": "WzE3LDFd"
+  }
+}
+
+exports['AgentsEventsRepository getEventsForAgent Get events for the agent - create:agent_events (2)'] = {
+  "results": {
+    "type": "agent_events",
+    "id": "1f697690-eae0-11e9-857a-5b15df4fd482",
+    "attributes": {
+      "type": "STATE",
+      "subtype": "STOPPED",
+      "timestamp": "2019-09-27T18:50:33+0000",
+      "message": "...",
+      "agent_id": "agent:1"
+    },
+    "references": [],
+    "updated_at": "2019-10-09T21:59:53.209Z",
+    "version": "WzE4LDFd"
+  }
+}
+
+exports['AgentsEventsRepository getEventsForAgent Get events for the agent - create:agent_events (3)'] = {
+  "results": {
+    "type": "agent_events",
+    "id": "2003bac0-eae0-11e9-857a-5b15df4fd482",
+    "attributes": {
+      "type": "STATE",
+      "subtype": "STARTING",
+      "timestamp": "2019-09-27T18:50:34+0000",
+      "message": "...",
+      "agent_id": "agent:1"
+    },
+    "references": [],
+    "updated_at": "2019-10-09T21:59:54.220Z",
+    "version": "WzE5LDFd"
+  }
+}
+
+exports['AgentsEventsRepository getEventsForAgent Get events for the agent - create:agent_events (4)'] = {
+  "results": {
+    "type": "agent_events",
+    "id": "209f5e80-eae0-11e9-857a-5b15df4fd482",
+    "attributes": {
+      "type": "STATE",
+      "subtype": "STARTING",
+      "timestamp": "2019-09-27T18:50:32+0000",
+      "message": "...",
+      "agent_id": "agent:2"
+    },
+    "references": [],
+    "updated_at": "2019-10-09T21:59:55.240Z",
+    "version": "WzIwLDFd"
+  }
+}
+
+exports['AgentsEventsRepository getEventsForAgent Get events for the agent - find:{"type":"agent_events","search":"agent:1","searchFields":["agent_id"],"perPage":25,"page":1,"sortField":"timestamp","sortOrder":"DESC","defaultSearchOperator":"AND"} (5)'] = {
+  "results": {
+    "page": 1,
+    "per_page": 25,
+    "total": 3,
+    "saved_objects": [
+      {
+        "type": "agent_events",
+        "id": "2003bac0-eae0-11e9-857a-5b15df4fd482",
+        "attributes": {
+          "type": "STATE",
+          "subtype": "STARTING",
+          "timestamp": "2019-09-27T18:50:34+0000",
+          "message": "...",
+          "agent_id": "agent:1"
+        },
+        "references": [],
+        "updated_at": "2019-10-09T21:59:54.220Z",
+        "version": "WzE5LDFd"
+      },
+      {
+        "type": "agent_events",
+        "id": "1f697690-eae0-11e9-857a-5b15df4fd482",
+        "attributes": {
+          "type": "STATE",
+          "subtype": "STOPPED",
+          "timestamp": "2019-09-27T18:50:33+0000",
+          "message": "...",
+          "agent_id": "agent:1"
+        },
+        "references": [],
+        "updated_at": "2019-10-09T21:59:53.209Z",
+        "version": "WzE4LDFd"
+      },
+      {
+        "type": "agent_events",
+        "id": "1ecbfe10-eae0-11e9-857a-5b15df4fd482",
+        "attributes": {
+          "type": "STATE",
+          "subtype": "STARTING",
+          "timestamp": "2019-09-27T18:50:32+0000",
+          "message": "...",
+          "payload": "{\"previous_state\": \"STOPPED\"}",
+          "data": "{serializedDATA}",
+          "agent_id": "agent:1"
+        },
+        "references": [],
+        "updated_at": "2019-10-09T21:59:52.176Z",
+        "version": "WzE3LDFd"
+      }
+    ]
+  }
+}
+
+exports['AgentsEventsRepository getEventsForAgent Get events for the agent - find:{"type":"agent_events","perPage":1000} (6)'] = {
+  "results": {
+    "page": 1,
+    "per_page": 1000,
+    "total": 4,
+    "saved_objects": [
+      {
+        "type": "agent_events",
+        "id": "1ecbfe10-eae0-11e9-857a-5b15df4fd482",
+        "attributes": {
+          "type": "STATE",
+          "subtype": "STARTING",
+          "timestamp": "2019-09-27T18:50:32+0000",
+          "message": "...",
+          "payload": "{\"previous_state\": \"STOPPED\"}",
+          "data": "{serializedDATA}",
+          "agent_id": "agent:1"
+        },
+        "references": [],
+        "updated_at": "2019-10-09T21:59:52.176Z",
+        "version": "WzE3LDFd"
+      },
+      {
+        "type": "agent_events",
+        "id": "1f697690-eae0-11e9-857a-5b15df4fd482",
+        "attributes": {
+          "type": "STATE",
+          "subtype": "STOPPED",
+          "timestamp": "2019-09-27T18:50:33+0000",
+          "message": "...",
+          "agent_id": "agent:1"
+        },
+        "references": [],
+        "updated_at": "2019-10-09T21:59:53.209Z",
+        "version": "WzE4LDFd"
+      },
+      {
+        "type": "agent_events",
+        "id": "2003bac0-eae0-11e9-857a-5b15df4fd482",
+        "attributes": {
+          "type": "STATE",
+          "subtype": "STARTING",
+          "timestamp": "2019-09-27T18:50:34+0000",
+          "message": "...",
+          "agent_id": "agent:1"
+        },
+        "references": [],
+        "updated_at": "2019-10-09T21:59:54.220Z",
+        "version": "WzE5LDFd"
+      },
+      {
+        "type": "agent_events",
+        "id": "209f5e80-eae0-11e9-857a-5b15df4fd482",
+        "attributes": {
+          "type": "STATE",
+          "subtype": "STARTING",
+          "timestamp": "2019-09-27T18:50:32+0000",
+          "message": "...",
+          "agent_id": "agent:2"
+        },
+        "references": [],
+        "updated_at": "2019-10-09T21:59:55.240Z",
+        "version": "WzIwLDFd"
+      }
+    ]
+  }
+}
+
+exports['AgentsEventsRepository getEventsForAgent Get events for the agent - delete:agent_events:1ecbfe10-eae0-11e9-857a-5b15df4fd482:{} (7)'] = {
+  "results": {}
+}
+
+exports['AgentsEventsRepository getEventsForAgent Get events for the agent - delete:agent_events:1f697690-eae0-11e9-857a-5b15df4fd482:{} (8)'] = {
+  "results": {}
+}
+
+exports['AgentsEventsRepository getEventsForAgent Get events for the agent - delete:agent_events:2003bac0-eae0-11e9-857a-5b15df4fd482:{} (9)'] = {
+  "results": {}
+}
+
+exports['AgentsEventsRepository getEventsForAgent Get events for the agent - delete:agent_events:209f5e80-eae0-11e9-857a-5b15df4fd482:{} (10)'] = {
+  "results": {}
+}
+
+exports['AgentsEventsRepository getEventsForAgent allow to filter using KQL - create:agent_events (1)'] = {
+  "results": {
+    "type": "agent_events",
+    "id": "23a8f500-eae0-11e9-857a-5b15df4fd482",
+    "attributes": {
+      "type": "STATE",
+      "subtype": "STARTING",
+      "timestamp": "2019-09-27T18:50:32+0000",
+      "message": "...",
+      "payload": "{\"previous_state\": \"STOPPED\"}",
+      "data": "{serializedDATA}",
+      "agent_id": "agent:1"
+    },
+    "references": [],
+    "updated_at": "2019-10-09T22:00:00.336Z",
+    "version": "WzI1LDFd"
+  }
+}
+
+exports['AgentsEventsRepository getEventsForAgent allow to filter using KQL - create:agent_events (2)'] = {
+  "results": {
+    "type": "agent_events",
+    "id": "24444aa0-eae0-11e9-857a-5b15df4fd482",
+    "attributes": {
+      "type": "STATE",
+      "subtype": "STOPPED",
+      "timestamp": "2019-09-27T18:50:33+0000",
+      "message": "...",
+      "agent_id": "agent:1"
+    },
+    "references": [],
+    "updated_at": "2019-10-09T22:00:01.354Z",
+    "version": "WzI2LDFd"
+  }
+}
+
+exports['AgentsEventsRepository getEventsForAgent allow to filter using KQL - create:agent_events (3)'] = {
+  "results": {
+    "type": "agent_events",
+    "id": "24de67c0-eae0-11e9-857a-5b15df4fd482",
+    "attributes": {
+      "type": "STATE",
+      "subtype": "STARTING",
+      "timestamp": "2019-09-27T18:50:34+0000",
+      "message": "...",
+      "agent_id": "agent:1"
+    },
+    "references": [],
+    "updated_at": "2019-10-09T22:00:02.364Z",
+    "version": "WzI3LDFd"
+  }
+}
+
+exports['AgentsEventsRepository getEventsForAgent allow to filter using KQL - create:agent_events (4)'] = {
+  "results": {
+    "type": "agent_events",
+    "id": "257a3290-eae0-11e9-857a-5b15df4fd482",
+    "attributes": {
+      "type": "STATE",
+      "subtype": "STARTING",
+      "timestamp": "2019-09-27T18:50:32+0000",
+      "message": "...",
+      "agent_id": "agent:2"
+    },
+    "references": [],
+    "updated_at": "2019-10-09T22:00:03.385Z",
+    "version": "WzI4LDFd"
+  }
+}
+
+exports['AgentsEventsRepository getEventsForAgent allow to filter using KQL - find:{"type":"agent_events","search":"agent:1","searchFields":["agent_id"],"filter":"agent_events.attributes.subtype:STOPPED","sortField":"timestamp","sortOrder":"DESC","defaultSearchOperator":"AND"} (5)'] = {
+  "results": {
+    "page": 1,
+    "per_page": 20,
+    "total": 1,
+    "saved_objects": [
+      {
+        "type": "agent_events",
+        "id": "24444aa0-eae0-11e9-857a-5b15df4fd482",
+        "attributes": {
+          "type": "STATE",
+          "subtype": "STOPPED",
+          "timestamp": "2019-09-27T18:50:33+0000",
+          "message": "...",
+          "agent_id": "agent:1"
+        },
+        "references": [],
+        "updated_at": "2019-10-09T22:00:01.354Z",
+        "version": "WzI2LDFd"
+      }
+    ]
+  }
+}
+
+exports['AgentsEventsRepository getEventsForAgent allow to filter using KQL - find:{"type":"agent_events","perPage":1000} (6)'] = {
+  "results": {
+    "page": 1,
+    "per_page": 1000,
+    "total": 4,
+    "saved_objects": [
+      {
+        "type": "agent_events",
+        "id": "23a8f500-eae0-11e9-857a-5b15df4fd482",
+        "attributes": {
+          "type": "STATE",
+          "subtype": "STARTING",
+          "timestamp": "2019-09-27T18:50:32+0000",
+          "message": "...",
+          "payload": "{\"previous_state\": \"STOPPED\"}",
+          "data": "{serializedDATA}",
+          "agent_id": "agent:1"
+        },
+        "references": [],
+        "updated_at": "2019-10-09T22:00:00.336Z",
+        "version": "WzI1LDFd"
+      },
+      {
+        "type": "agent_events",
+        "id": "24444aa0-eae0-11e9-857a-5b15df4fd482",
+        "attributes": {
+          "type": "STATE",
+          "subtype": "STOPPED",
+          "timestamp": "2019-09-27T18:50:33+0000",
+          "message": "...",
+          "agent_id": "agent:1"
+        },
+        "references": [],
+        "updated_at": "2019-10-09T22:00:01.354Z",
+        "version": "WzI2LDFd"
+      },
+      {
+        "type": "agent_events",
+        "id": "24de67c0-eae0-11e9-857a-5b15df4fd482",
+        "attributes": {
+          "type": "STATE",
+          "subtype": "STARTING",
+          "timestamp": "2019-09-27T18:50:34+0000",
+          "message": "...",
+          "agent_id": "agent:1"
+        },
+        "references": [],
+        "updated_at": "2019-10-09T22:00:02.364Z",
+        "version": "WzI3LDFd"
+      },
+      {
+        "type": "agent_events",
+        "id": "257a3290-eae0-11e9-857a-5b15df4fd482",
+        "attributes": {
+          "type": "STATE",
+          "subtype": "STARTING",
+          "timestamp": "2019-09-27T18:50:32+0000",
+          "message": "...",
+          "agent_id": "agent:2"
+        },
+        "references": [],
+        "updated_at": "2019-10-09T22:00:03.385Z",
+        "version": "WzI4LDFd"
+      }
+    ]
+  }
+}
+
+exports['AgentsEventsRepository getEventsForAgent allow to filter using KQL - delete:agent_events:23a8f500-eae0-11e9-857a-5b15df4fd482:{} (7)'] = {
+  "results": {}
+}
+
+exports['AgentsEventsRepository getEventsForAgent allow to filter using KQL - delete:agent_events:24444aa0-eae0-11e9-857a-5b15df4fd482:{} (8)'] = {
+  "results": {}
+}
+
+exports['AgentsEventsRepository getEventsForAgent allow to filter using KQL - delete:agent_events:24de67c0-eae0-11e9-857a-5b15df4fd482:{} (9)'] = {
+  "results": {}
+}
+
+exports['AgentsEventsRepository getEventsForAgent allow to filter using KQL - delete:agent_events:257a3290-eae0-11e9-857a-5b15df4fd482:{} (10)'] = {
+  "results": {}
+}
+
+exports['AgentsEventsRepository createEventsForAgent Create events for an agent - create:agent_events (1)'] = {
+  "results": {
+    "type": "agent_events",
+    "id": "6cff37f0-eae0-11e9-9d90-8b5bf6199af3",
+    "attributes": {
+      "type": "STATE",
+      "subtype": "STARTING",
+      "timestamp": "2019-09-27T18:50:32+0000",
+      "message": "...",
+      "agent_id": "agent:1"
+    },
+    "references": [],
+    "updated_at": "2019-10-09T22:02:03.375Z",
+    "version": "WzIsMV0="
+  }
+}
+
+exports['AgentsEventsRepository createEventsForAgent Create events for an agent - bulkCreate:[{"attributes":{"agent_id":"agent:1","type":"STATE","subtype":"STARTING","timestamp":"2019-09-27T18:50:33+0000","message":"..."},"type":"agent_events"},{"attributes":{"agent_id":"agent:1","type":"STATE","subtype":"STARTING","timestamp":"2019-09-27T18:50:34+0000","message":"..."},"type":"agent_events"}]:{} (2)'] = {
+  "results": {
+    "saved_objects": [
+      {
+        "id": "agent_events:6d12e700-eae0-11e9-9d90-8b5bf6199af3",
+        "type": "agent_events",
+        "updated_at": "2019-10-09T22:02:03.504Z",
+        "version": "WzMsMV0=",
+        "attributes": {
+          "agent_id": "agent:1",
+          "type": "STATE",
+          "subtype": "STARTING",
+          "timestamp": "2019-09-27T18:50:33+0000",
+          "message": "..."
+        },
+        "references": []
+      },
+      {
+        "id": "agent_events:6d12e701-eae0-11e9-9d90-8b5bf6199af3",
+        "type": "agent_events",
+        "updated_at": "2019-10-09T22:02:03.504Z",
+        "version": "WzQsMV0=",
+        "attributes": {
+          "agent_id": "agent:1",
+          "type": "STATE",
+          "subtype": "STARTING",
+          "timestamp": "2019-09-27T18:50:34+0000",
+          "message": "..."
+        },
+        "references": []
+      }
+    ]
+  }
+}
+
+exports['AgentsEventsRepository createEventsForAgent Create events for an agent - find:{"type":"agent_events"} (3)'] = {
+  "results": {
+    "page": 1,
+    "per_page": 20,
+    "total": 3,
+    "saved_objects": [
+      {
+        "type": "agent_events",
+        "id": "6cff37f0-eae0-11e9-9d90-8b5bf6199af3",
+        "attributes": {
+          "type": "STATE",
+          "subtype": "STARTING",
+          "timestamp": "2019-09-27T18:50:32+0000",
+          "message": "...",
+          "agent_id": "agent:1"
+        },
+        "references": [],
+        "updated_at": "2019-10-09T22:02:03.375Z",
+        "version": "WzIsMV0="
+      },
+      {
+        "type": "agent_events",
+        "id": "6d12e700-eae0-11e9-9d90-8b5bf6199af3",
+        "attributes": {
+          "agent_id": "agent:1",
+          "type": "STATE",
+          "subtype": "STARTING",
+          "timestamp": "2019-09-27T18:50:33+0000",
+          "message": "..."
+        },
+        "references": [],
+        "updated_at": "2019-10-09T22:02:03.504Z",
+        "version": "WzMsMV0="
+      },
+      {
+        "type": "agent_events",
+        "id": "6d12e701-eae0-11e9-9d90-8b5bf6199af3",
+        "attributes": {
+          "agent_id": "agent:1",
+          "type": "STATE",
+          "subtype": "STARTING",
+          "timestamp": "2019-09-27T18:50:34+0000",
+          "message": "..."
+        },
+        "references": [],
+        "updated_at": "2019-10-09T22:02:03.504Z",
+        "version": "WzQsMV0="
+      }
+    ]
+  }
+}
+
+exports['AgentsEventsRepository createEventsForAgent Create events for an agent - find:{"type":"agent_events","perPage":1000} (4)'] = {
+  "results": {
+    "page": 1,
+    "per_page": 1000,
+    "total": 3,
+    "saved_objects": [
+      {
+        "type": "agent_events",
+        "id": "6cff37f0-eae0-11e9-9d90-8b5bf6199af3",
+        "attributes": {
+          "type": "STATE",
+          "subtype": "STARTING",
+          "timestamp": "2019-09-27T18:50:32+0000",
+          "message": "...",
+          "agent_id": "agent:1"
+        },
+        "references": [],
+        "updated_at": "2019-10-09T22:02:03.375Z",
+        "version": "WzIsMV0="
+      },
+      {
+        "type": "agent_events",
+        "id": "6d12e700-eae0-11e9-9d90-8b5bf6199af3",
+        "attributes": {
+          "agent_id": "agent:1",
+          "type": "STATE",
+          "subtype": "STARTING",
+          "timestamp": "2019-09-27T18:50:33+0000",
+          "message": "..."
+        },
+        "references": [],
+        "updated_at": "2019-10-09T22:02:03.504Z",
+        "version": "WzMsMV0="
+      },
+      {
+        "type": "agent_events",
+        "id": "6d12e701-eae0-11e9-9d90-8b5bf6199af3",
+        "attributes": {
+          "agent_id": "agent:1",
+          "type": "STATE",
+          "subtype": "STARTING",
+          "timestamp": "2019-09-27T18:50:34+0000",
+          "message": "..."
+        },
+        "references": [],
+        "updated_at": "2019-10-09T22:02:03.504Z",
+        "version": "WzQsMV0="
+      }
+    ]
+  }
+}
+
+exports['AgentsEventsRepository createEventsForAgent Create events for an agent - delete:agent_events:6cff37f0-eae0-11e9-9d90-8b5bf6199af3:{} (5)'] = {
+  "results": {}
+}
+
+exports['AgentsEventsRepository createEventsForAgent Create events for an agent - delete:agent_events:6d12e700-eae0-11e9-9d90-8b5bf6199af3:{} (6)'] = {
+  "results": {}
+}
+
+exports['AgentsEventsRepository createEventsForAgent Create events for an agent - delete:agent_events:6d12e701-eae0-11e9-9d90-8b5bf6199af3:{} (7)'] = {
+  "results": {}
+}
+
+exports['AgentsEventsRepository deleteEventsForAgent Delete correctly all events for the agent - create:agent_events (1)'] = {
+  "results": {
+    "type": "agent_events",
+    "id": "6f7d7e60-eae0-11e9-9d90-8b5bf6199af3",
+    "attributes": {
+      "type": "STATE",
+      "subtype": "STARTING",
+      "timestamp": "2019-09-27T18:50:32+0000",
+      "message": "...",
+      "agent_id": "agent:1"
+    },
+    "references": [],
+    "updated_at": "2019-10-09T22:02:07.558Z",
+    "version": "WzksMV0="
+  }
+}
+
+exports['AgentsEventsRepository deleteEventsForAgent Delete correctly all events for the agent - create:agent_events (2)'] = {
+  "results": {
+    "type": "agent_events",
+    "id": "701810b0-eae0-11e9-9d90-8b5bf6199af3",
+    "attributes": {
+      "type": "STATE",
+      "subtype": "STARTING",
+      "timestamp": "2019-09-27T18:50:33+0000",
+      "message": "...",
+      "agent_id": "agent:1"
+    },
+    "references": [],
+    "updated_at": "2019-10-09T22:02:08.571Z",
+    "version": "WzEwLDFd"
+  }
+}
+
+exports['AgentsEventsRepository deleteEventsForAgent Delete correctly all events for the agent - create:agent_events (3)'] = {
+  "results": {
+    "type": "agent_events",
+    "id": "70b33f40-eae0-11e9-9d90-8b5bf6199af3",
+    "attributes": {
+      "type": "STATE",
+      "subtype": "STARTING",
+      "timestamp": "2019-09-27T18:50:34+0000",
+      "message": "...",
+      "agent_id": "agent:1"
+    },
+    "references": [],
+    "updated_at": "2019-10-09T22:02:09.588Z",
+    "version": "WzExLDFd"
+  }
+}
+
+exports['AgentsEventsRepository deleteEventsForAgent Delete correctly all events for the agent - create:agent_events (4)'] = {
+  "results": {
+    "type": "agent_events",
+    "id": "714e6dd0-eae0-11e9-9d90-8b5bf6199af3",
+    "attributes": {
+      "type": "STATE",
+      "subtype": "STARTING",
+      "timestamp": "2019-09-27T18:50:32+0000",
+      "message": "...",
+      "agent_id": "agent:2"
+    },
+    "references": [],
+    "updated_at": "2019-10-09T22:02:10.605Z",
+    "version": "WzEyLDFd"
+  }
+}
+
+exports['AgentsEventsRepository deleteEventsForAgent Delete correctly all events for the agent - find:{"type":"agent_events","fields":["id"],"search":"agent:1","searchFields":["agent_id"],"perPage":1000} (5)'] = {
+  "results": {
+    "page": 1,
+    "per_page": 1000,
+    "total": 3,
+    "saved_objects": [
+      {
+        "type": "agent_events",
+        "id": "6f7d7e60-eae0-11e9-9d90-8b5bf6199af3",
+        "references": [],
+        "updated_at": "2019-10-09T22:02:07.558Z",
+        "version": "WzksMV0="
+      },
+      {
+        "type": "agent_events",
+        "id": "701810b0-eae0-11e9-9d90-8b5bf6199af3",
+        "references": [],
+        "updated_at": "2019-10-09T22:02:08.571Z",
+        "version": "WzEwLDFd"
+      },
+      {
+        "type": "agent_events",
+        "id": "70b33f40-eae0-11e9-9d90-8b5bf6199af3",
+        "references": [],
+        "updated_at": "2019-10-09T22:02:09.588Z",
+        "version": "WzExLDFd"
+      }
+    ]
+  }
+}
+
+exports['AgentsEventsRepository deleteEventsForAgent Delete correctly all events for the agent - delete:agent_events:6f7d7e60-eae0-11e9-9d90-8b5bf6199af3:{} (6)'] = {
+  "results": {}
+}
+
+exports['AgentsEventsRepository deleteEventsForAgent Delete correctly all events for the agent - delete:agent_events:701810b0-eae0-11e9-9d90-8b5bf6199af3:{} (7)'] = {
+  "results": {}
+}
+
+exports['AgentsEventsRepository deleteEventsForAgent Delete correctly all events for the agent - delete:agent_events:70b33f40-eae0-11e9-9d90-8b5bf6199af3:{} (8)'] = {
+  "results": {}
+}
+
+exports['AgentsEventsRepository deleteEventsForAgent Delete correctly all events for the agent - find:{"type":"agent_events","fields":["id"],"search":"agent:1","searchFields":["agent_id"],"perPage":1000} (9)'] = {
+  "results": {
+    "page": 1,
+    "per_page": 1000,
+    "total": 0,
+    "saved_objects": []
+  }
+}
+
+exports['AgentsEventsRepository deleteEventsForAgent Delete correctly all events for the agent - find:{"type":"agent_events"} (10)'] = {
+  "results": {
+    "page": 1,
+    "per_page": 20,
+    "total": 1,
+    "saved_objects": [
+      {
+        "type": "agent_events",
+        "id": "714e6dd0-eae0-11e9-9d90-8b5bf6199af3",
+        "attributes": {
+          "type": "STATE",
+          "subtype": "STARTING",
+          "timestamp": "2019-09-27T18:50:32+0000",
+          "message": "...",
+          "agent_id": "agent:2"
+        },
+        "references": [],
+        "updated_at": "2019-10-09T22:02:10.605Z",
+        "version": "WzEyLDFd"
+      }
+    ]
+  }
+}
+
+exports['AgentsEventsRepository deleteEventsForAgent Delete correctly all events for the agent - find:{"type":"agent_events","perPage":1000} (11)'] = {
+  "results": {
+    "page": 1,
+    "per_page": 1000,
+    "total": 1,
+    "saved_objects": [
+      {
+        "type": "agent_events",
+        "id": "714e6dd0-eae0-11e9-9d90-8b5bf6199af3",
+        "attributes": {
+          "type": "STATE",
+          "subtype": "STARTING",
+          "timestamp": "2019-09-27T18:50:32+0000",
+          "message": "...",
+          "agent_id": "agent:2"
+        },
+        "references": [],
+        "updated_at": "2019-10-09T22:02:10.605Z",
+        "version": "WzEyLDFd"
+      }
+    ]
+  }
+}
+
+exports['AgentsEventsRepository deleteEventsForAgent Delete correctly all events for the agent - delete:agent_events:714e6dd0-eae0-11e9-9d90-8b5bf6199af3:{} (12)'] = {
+  "results": {}
+}
+
+exports['AgentsEventsRepository getEventsForAgent Get events for the agent - create:agent_events (1)'] = {
+  "results": {
+    "type": "agent_events",
+    "id": "745719f0-eae0-11e9-9d90-8b5bf6199af3",
+    "attributes": {
+      "type": "STATE",
+      "subtype": "STARTING",
+      "timestamp": "2019-09-27T18:50:32+0000",
+      "message": "...",
+      "payload": "{\"previous_state\": \"STOPPED\"}",
+      "data": "{serializedDATA}",
+      "agent_id": "agent:1"
+    },
+    "references": [],
+    "updated_at": "2019-10-09T22:02:15.695Z",
+    "version": "WzE3LDFd"
+  }
+}
+
+exports['AgentsEventsRepository getEventsForAgent Get events for the agent - create:agent_events (2)'] = {
+  "results": {
+    "type": "agent_events",
+    "id": "74f1d350-eae0-11e9-9d90-8b5bf6199af3",
+    "attributes": {
+      "type": "STATE",
+      "subtype": "STOPPED",
+      "timestamp": "2019-09-27T18:50:33+0000",
+      "message": "...",
+      "agent_id": "agent:1"
+    },
+    "references": [],
+    "updated_at": "2019-10-09T22:02:16.709Z",
+    "version": "WzE4LDFd"
+  }
+}
+
+exports['AgentsEventsRepository getEventsForAgent Get events for the agent - create:agent_events (3)'] = {
+  "results": {
+    "type": "agent_events",
+    "id": "758e3a60-eae0-11e9-9d90-8b5bf6199af3",
+    "attributes": {
+      "type": "STATE",
+      "subtype": "STARTING",
+      "timestamp": "2019-09-27T18:50:34+0000",
+      "message": "...",
+      "agent_id": "agent:1"
+    },
+    "references": [],
+    "updated_at": "2019-10-09T22:02:17.734Z",
+    "version": "WzE5LDFd"
+  }
+}
+
+exports['AgentsEventsRepository getEventsForAgent Get events for the agent - create:agent_events (4)'] = {
+  "results": {
+    "type": "agent_events",
+    "id": "76299000-eae0-11e9-9d90-8b5bf6199af3",
+    "attributes": {
+      "type": "STATE",
+      "subtype": "STARTING",
+      "timestamp": "2019-09-27T18:50:32+0000",
+      "message": "...",
+      "agent_id": "agent:2"
+    },
+    "references": [],
+    "updated_at": "2019-10-09T22:02:18.752Z",
+    "version": "WzIwLDFd"
+  }
+}
+
+exports['AgentsEventsRepository getEventsForAgent Get events for the agent - find:{"type":"agent_events","search":"agent:1","searchFields":["agent_id"],"perPage":25,"page":1,"sortField":"timestamp","sortOrder":"DESC","defaultSearchOperator":"AND"} (5)'] = {
+  "results": {
+    "page": 1,
+    "per_page": 25,
+    "total": 3,
+    "saved_objects": [
+      {
+        "type": "agent_events",
+        "id": "758e3a60-eae0-11e9-9d90-8b5bf6199af3",
+        "attributes": {
+          "type": "STATE",
+          "subtype": "STARTING",
+          "timestamp": "2019-09-27T18:50:34+0000",
+          "message": "...",
+          "agent_id": "agent:1"
+        },
+        "references": [],
+        "updated_at": "2019-10-09T22:02:17.734Z",
+        "version": "WzE5LDFd"
+      },
+      {
+        "type": "agent_events",
+        "id": "74f1d350-eae0-11e9-9d90-8b5bf6199af3",
+        "attributes": {
+          "type": "STATE",
+          "subtype": "STOPPED",
+          "timestamp": "2019-09-27T18:50:33+0000",
+          "message": "...",
+          "agent_id": "agent:1"
+        },
+        "references": [],
+        "updated_at": "2019-10-09T22:02:16.709Z",
+        "version": "WzE4LDFd"
+      },
+      {
+        "type": "agent_events",
+        "id": "745719f0-eae0-11e9-9d90-8b5bf6199af3",
+        "attributes": {
+          "type": "STATE",
+          "subtype": "STARTING",
+          "timestamp": "2019-09-27T18:50:32+0000",
+          "message": "...",
+          "payload": "{\"previous_state\": \"STOPPED\"}",
+          "data": "{serializedDATA}",
+          "agent_id": "agent:1"
+        },
+        "references": [],
+        "updated_at": "2019-10-09T22:02:15.695Z",
+        "version": "WzE3LDFd"
+      }
+    ]
+  }
+}
+
+exports['AgentsEventsRepository getEventsForAgent Get events for the agent - find:{"type":"agent_events","perPage":1000} (6)'] = {
+  "results": {
+    "page": 1,
+    "per_page": 1000,
+    "total": 4,
+    "saved_objects": [
+      {
+        "type": "agent_events",
+        "id": "745719f0-eae0-11e9-9d90-8b5bf6199af3",
+        "attributes": {
+          "type": "STATE",
+          "subtype": "STARTING",
+          "timestamp": "2019-09-27T18:50:32+0000",
+          "message": "...",
+          "payload": "{\"previous_state\": \"STOPPED\"}",
+          "data": "{serializedDATA}",
+          "agent_id": "agent:1"
+        },
+        "references": [],
+        "updated_at": "2019-10-09T22:02:15.695Z",
+        "version": "WzE3LDFd"
+      },
+      {
+        "type": "agent_events",
+        "id": "74f1d350-eae0-11e9-9d90-8b5bf6199af3",
+        "attributes": {
+          "type": "STATE",
+          "subtype": "STOPPED",
+          "timestamp": "2019-09-27T18:50:33+0000",
+          "message": "...",
+          "agent_id": "agent:1"
+        },
+        "references": [],
+        "updated_at": "2019-10-09T22:02:16.709Z",
+        "version": "WzE4LDFd"
+      },
+      {
+        "type": "agent_events",
+        "id": "758e3a60-eae0-11e9-9d90-8b5bf6199af3",
+        "attributes": {
+          "type": "STATE",
+          "subtype": "STARTING",
+          "timestamp": "2019-09-27T18:50:34+0000",
+          "message": "...",
+          "agent_id": "agent:1"
+        },
+        "references": [],
+        "updated_at": "2019-10-09T22:02:17.734Z",
+        "version": "WzE5LDFd"
+      },
+      {
+        "type": "agent_events",
+        "id": "76299000-eae0-11e9-9d90-8b5bf6199af3",
+        "attributes": {
+          "type": "STATE",
+          "subtype": "STARTING",
+          "timestamp": "2019-09-27T18:50:32+0000",
+          "message": "...",
+          "agent_id": "agent:2"
+        },
+        "references": [],
+        "updated_at": "2019-10-09T22:02:18.752Z",
+        "version": "WzIwLDFd"
+      }
+    ]
+  }
+}
+
+exports['AgentsEventsRepository getEventsForAgent Get events for the agent - delete:agent_events:745719f0-eae0-11e9-9d90-8b5bf6199af3:{} (7)'] = {
+  "results": {}
+}
+
+exports['AgentsEventsRepository getEventsForAgent Get events for the agent - delete:agent_events:74f1d350-eae0-11e9-9d90-8b5bf6199af3:{} (8)'] = {
+  "results": {}
+}
+
+exports['AgentsEventsRepository getEventsForAgent Get events for the agent - delete:agent_events:758e3a60-eae0-11e9-9d90-8b5bf6199af3:{} (9)'] = {
+  "results": {}
+}
+
+exports['AgentsEventsRepository getEventsForAgent Get events for the agent - delete:agent_events:76299000-eae0-11e9-9d90-8b5bf6199af3:{} (10)'] = {
+  "results": {}
+}
+
+exports['AgentsEventsRepository getEventsForAgent allow to filter using KQL - create:agent_events (1)'] = {
+  "results": {
+    "type": "agent_events",
+    "id": "79334d90-eae0-11e9-9d90-8b5bf6199af3",
+    "attributes": {
+      "type": "STATE",
+      "subtype": "STARTING",
+      "timestamp": "2019-09-27T18:50:32+0000",
+      "message": "...",
+      "payload": "{\"previous_state\": \"STOPPED\"}",
+      "data": "{serializedDATA}",
+      "agent_id": "agent:1"
+    },
+    "references": [],
+    "updated_at": "2019-10-09T22:02:23.849Z",
+    "version": "WzI1LDFd"
+  }
+}
+
+exports['AgentsEventsRepository getEventsForAgent allow to filter using KQL - create:agent_events (2)'] = {
+  "results": {
+    "type": "agent_events",
+    "id": "79ce2e00-eae0-11e9-9d90-8b5bf6199af3",
+    "attributes": {
+      "type": "STATE",
+      "subtype": "STOPPED",
+      "timestamp": "2019-09-27T18:50:33+0000",
+      "message": "...",
+      "agent_id": "agent:1"
+    },
+    "references": [],
+    "updated_at": "2019-10-09T22:02:24.864Z",
+    "version": "WzI2LDFd"
+  }
+}
+
+exports['AgentsEventsRepository getEventsForAgent allow to filter using KQL - create:agent_events (3)'] = {
+  "results": {
+    "type": "agent_events",
+    "id": "7a67fd00-eae0-11e9-9d90-8b5bf6199af3",
+    "attributes": {
+      "type": "STATE",
+      "subtype": "STARTING",
+      "timestamp": "2019-09-27T18:50:34+0000",
+      "message": "...",
+      "agent_id": "agent:1"
+    },
+    "references": [],
+    "updated_at": "2019-10-09T22:02:25.871Z",
+    "version": "WzI3LDFd"
+  }
+}
+
+exports['AgentsEventsRepository getEventsForAgent allow to filter using KQL - create:agent_events (4)'] = {
+  "results": {
+    "type": "agent_events",
+    "id": "7b017de0-eae0-11e9-9d90-8b5bf6199af3",
+    "attributes": {
+      "type": "STATE",
+      "subtype": "STARTING",
+      "timestamp": "2019-09-27T18:50:32+0000",
+      "message": "...",
+      "agent_id": "agent:2"
+    },
+    "references": [],
+    "updated_at": "2019-10-09T22:02:26.878Z",
+    "version": "WzI4LDFd"
+  }
+}
+
+exports['AgentsEventsRepository getEventsForAgent allow to filter using KQL - find:{"type":"agent_events","search":"agent:1","searchFields":["agent_id"],"filter":"agent_events.attributes.subtype:STOPPED","sortField":"timestamp","sortOrder":"DESC","defaultSearchOperator":"AND"} (5)'] = {
+  "results": {
+    "page": 1,
+    "per_page": 20,
+    "total": 1,
+    "saved_objects": [
+      {
+        "type": "agent_events",
+        "id": "79ce2e00-eae0-11e9-9d90-8b5bf6199af3",
+        "attributes": {
+          "type": "STATE",
+          "subtype": "STOPPED",
+          "timestamp": "2019-09-27T18:50:33+0000",
+          "message": "...",
+          "agent_id": "agent:1"
+        },
+        "references": [],
+        "updated_at": "2019-10-09T22:02:24.864Z",
+        "version": "WzI2LDFd"
+      }
+    ]
+  }
+}
+
+exports['AgentsEventsRepository getEventsForAgent allow to filter using KQL - find:{"type":"agent_events","perPage":1000} (6)'] = {
+  "results": {
+    "page": 1,
+    "per_page": 1000,
+    "total": 4,
+    "saved_objects": [
+      {
+        "type": "agent_events",
+        "id": "79334d90-eae0-11e9-9d90-8b5bf6199af3",
+        "attributes": {
+          "type": "STATE",
+          "subtype": "STARTING",
+          "timestamp": "2019-09-27T18:50:32+0000",
+          "message": "...",
+          "payload": "{\"previous_state\": \"STOPPED\"}",
+          "data": "{serializedDATA}",
+          "agent_id": "agent:1"
+        },
+        "references": [],
+        "updated_at": "2019-10-09T22:02:23.849Z",
+        "version": "WzI1LDFd"
+      },
+      {
+        "type": "agent_events",
+        "id": "79ce2e00-eae0-11e9-9d90-8b5bf6199af3",
+        "attributes": {
+          "type": "STATE",
+          "subtype": "STOPPED",
+          "timestamp": "2019-09-27T18:50:33+0000",
+          "message": "...",
+          "agent_id": "agent:1"
+        },
+        "references": [],
+        "updated_at": "2019-10-09T22:02:24.864Z",
+        "version": "WzI2LDFd"
+      },
+      {
+        "type": "agent_events",
+        "id": "7a67fd00-eae0-11e9-9d90-8b5bf6199af3",
+        "attributes": {
+          "type": "STATE",
+          "subtype": "STARTING",
+          "timestamp": "2019-09-27T18:50:34+0000",
+          "message": "...",
+          "agent_id": "agent:1"
+        },
+        "references": [],
+        "updated_at": "2019-10-09T22:02:25.871Z",
+        "version": "WzI3LDFd"
+      },
+      {
+        "type": "agent_events",
+        "id": "7b017de0-eae0-11e9-9d90-8b5bf6199af3",
+        "attributes": {
+          "type": "STATE",
+          "subtype": "STARTING",
+          "timestamp": "2019-09-27T18:50:32+0000",
+          "message": "...",
+          "agent_id": "agent:2"
+        },
+        "references": [],
+        "updated_at": "2019-10-09T22:02:26.878Z",
+        "version": "WzI4LDFd"
+      }
+    ]
+  }
+}
+
+exports['AgentsEventsRepository getEventsForAgent allow to filter using KQL - delete:agent_events:79334d90-eae0-11e9-9d90-8b5bf6199af3:{} (7)'] = {
+  "results": {}
+}
+
+exports['AgentsEventsRepository getEventsForAgent allow to filter using KQL - delete:agent_events:79ce2e00-eae0-11e9-9d90-8b5bf6199af3:{} (8)'] = {
+  "results": {}
+}
+
+exports['AgentsEventsRepository getEventsForAgent allow to filter using KQL - delete:agent_events:7a67fd00-eae0-11e9-9d90-8b5bf6199af3:{} (9)'] = {
+  "results": {}
+}
+
+exports['AgentsEventsRepository getEventsForAgent allow to filter using KQL - delete:agent_events:7b017de0-eae0-11e9-9d90-8b5bf6199af3:{} (10)'] = {
+  "results": {}
+}
diff --git a/x-pack/legacy/plugins/fleet/server/repositories/agent_events/default.contract.test.ts b/x-pack/legacy/plugins/fleet/server/repositories/agent_events/default.contract.test.ts
index 637c81b986f40b..26f0363bd24756 100644
--- a/x-pack/legacy/plugins/fleet/server/repositories/agent_events/default.contract.test.ts
+++ b/x-pack/legacy/plugins/fleet/server/repositories/agent_events/default.contract.test.ts
@@ -184,7 +184,7 @@ describe('AgentsEventsRepository', () => {
         },
         {
           type: 'STATE',
-          subtype: 'STARTING',
+          subtype: 'STOPPED',
           timestamp: '2019-09-27T18:50:33+0000',
           message: '...',
         },
@@ -218,5 +218,16 @@ describe('AgentsEventsRepository', () => {
         previous_state: 'STOPPED',
       });
     });
+
+    it('allow to filter using KQL', async () => {
+      const { items, total } = await repository.getEventsForAgent(getUser(), 'agent:1', {
+        search: 'agent_events.subtype:STOPPED',
+      });
+
+      expect(total).toBe(1);
+      expect(items).toHaveLength(1);
+
+      expect(items[0].subtype).toBe('STOPPED');
+    });
   });
 });
diff --git a/x-pack/legacy/plugins/fleet/server/repositories/agent_events/default.ts b/x-pack/legacy/plugins/fleet/server/repositories/agent_events/default.ts
index 74243d12b59d08..9aadd79c01da54 100644
--- a/x-pack/legacy/plugins/fleet/server/repositories/agent_events/default.ts
+++ b/x-pack/legacy/plugins/fleet/server/repositories/agent_events/default.ts
@@ -42,25 +42,27 @@ export class AgentEventsRepository implements AgentEventsRepositoryType {
     agentId: string,
     options: {
       search?: string;
-      page: number;
-      perPage: number;
+      page?: number;
+      perPage?: number;
     } = {
       page: 1,
       perPage: 25,
     }
   ) {
     const { page, perPage, search } = options;
-    if (search && search !== '') {
-      throw new Error('Search with options.search is not implemented');
-    }
     const { total, saved_objects } = await this.soAdapter.find<AgentEventSOAttributes>(user, {
       type: SO_TYPE,
       search: agentId,
       searchFields: ['agent_id'],
+      filter:
+        search && search !== ''
+          ? search.replace(/agent_events\./g, 'agent_events.attributes.')
+          : undefined,
       perPage,
       page,
       sortField: 'timestamp',
       sortOrder: 'DESC',
+      defaultSearchOperator: 'AND',
     });
 
     const items: AgentEvent[] = saved_objects.map(so => {
diff --git a/x-pack/legacy/plugins/fleet/server/repositories/agents/default.ts b/x-pack/legacy/plugins/fleet/server/repositories/agents/default.ts
index 8675f3252a4873..d8b1bd8b346360 100644
--- a/x-pack/legacy/plugins/fleet/server/repositories/agents/default.ts
+++ b/x-pack/legacy/plugins/fleet/server/repositories/agents/default.ts
@@ -150,12 +150,14 @@ export class AgentsRepository implements AgentsRepositoryType {
     user: FrameworkUser,
     sortOptions?: SortOptions,
     page: number = 1,
-    perPage: number = DEFAULT_AGENTS_PAGE_SIZE
+    perPage: number = DEFAULT_AGENTS_PAGE_SIZE,
+    kuery?: string
   ): Promise<{ agents: Agent[]; total: number; page: number; perPage: number }> {
     const { saved_objects, total } = await this.soAdapter.find<SavedObjectAgentAttributes>(user, {
       type: 'agents',
       page,
       perPage,
+      filter: kuery && kuery !== '' ? kuery.replace(/agents\./g, 'agents.attributes.') : undefined,
       ...this._getSortFields(sortOptions),
     });
 
diff --git a/x-pack/legacy/plugins/fleet/server/repositories/agents/in_memory.ts b/x-pack/legacy/plugins/fleet/server/repositories/agents/in_memory.ts
index 14ec5be889da80..119070f80f44a1 100644
--- a/x-pack/legacy/plugins/fleet/server/repositories/agents/in_memory.ts
+++ b/x-pack/legacy/plugins/fleet/server/repositories/agents/in_memory.ts
@@ -65,7 +65,8 @@ export class InMemoryAgentsRepository implements AgentsRepository {
     user: FrameworkUser,
     sortOptions: any,
     page: number = 1,
-    perPage: number = DEFAULT_AGENTS_PAGE_SIZE
+    perPage: number = DEFAULT_AGENTS_PAGE_SIZE,
+    kuery?: string
   ): Promise<{ agents: Agent[]; total: number; page: number; perPage: number }> {
     const start = (page - 1) * perPage;
     const agents = Object.values(this.agents).slice(start, start + perPage);
diff --git a/x-pack/legacy/plugins/fleet/server/repositories/agents/types.ts b/x-pack/legacy/plugins/fleet/server/repositories/agents/types.ts
index 68cdca110d3abe..9c7cefc5372270 100644
--- a/x-pack/legacy/plugins/fleet/server/repositories/agents/types.ts
+++ b/x-pack/legacy/plugins/fleet/server/repositories/agents/types.ts
@@ -142,7 +142,8 @@ export interface AgentsRepository {
     user: FrameworkUser,
     sortOptions?: SortOptions,
     page?: number,
-    perPage?: number
+    perPage?: number,
+    kuery?: string
   ): Promise<{ agents: Agent[]; total: number; page: number; perPage: number }>;
 
   findEphemeralByPolicySharedId(user: FrameworkUser, policySharedId: string): Promise<Agent | null>;
diff --git a/x-pack/legacy/plugins/fleet/server/routes/agents/events.ts b/x-pack/legacy/plugins/fleet/server/routes/agents/events.ts
index c60ee589bf8b42..69e2714a9b8964 100644
--- a/x-pack/legacy/plugins/fleet/server/routes/agents/events.ts
+++ b/x-pack/legacy/plugins/fleet/server/routes/agents/events.ts
@@ -16,7 +16,9 @@ export const createGETAgentEventsRoute = (libs: FleetServerLib) => ({
   config: {
     validate: {
       query: Joi.object({
-        search: Joi.string().optional(),
+        kuery: Joi.string()
+          .trim()
+          .optional(),
         page: Joi.number()
           .optional()
           .min(1)
@@ -31,7 +33,7 @@ export const createGETAgentEventsRoute = (libs: FleetServerLib) => ({
   handler: async (
     request: FrameworkRequest<{
       params: { agentId: string };
-      query: { page: string; per_page: string; search: string };
+      query: { page: string; per_page: string; kuery: string };
     }>
   ): Promise<ReturnTypeList<AgentEvent>> => {
     const page = parseInt(request.query.page, 10);
@@ -40,7 +42,7 @@ export const createGETAgentEventsRoute = (libs: FleetServerLib) => ({
     const { items, total } = await libs.agents.getEventsById(
       request.user,
       request.params.agentId,
-      request.query.search,
+      request.query.kuery,
       page,
       perPage
     );
diff --git a/x-pack/legacy/plugins/fleet/server/routes/agents/list.ts b/x-pack/legacy/plugins/fleet/server/routes/agents/list.ts
index cc1893af0ffbaf..bd3df1dea4ce15 100644
--- a/x-pack/legacy/plugins/fleet/server/routes/agents/list.ts
+++ b/x-pack/legacy/plugins/fleet/server/routes/agents/list.ts
@@ -19,17 +19,21 @@ export const createListAgentsRoute = (libs: FleetServerLib) => ({
       query: {
         page: Joi.number().default(1),
         perPage: Joi.number().default(DEFAULT_AGENTS_PAGE_SIZE),
+        kuery: Joi.string()
+          .trim()
+          .optional(),
       },
     },
   },
   handler: async (
-    request: FrameworkRequest<{ query: { page: string; perPage: string } }>
+    request: FrameworkRequest<{ query: { page: string; perPage: string; kuery: string } }>
   ): Promise<ReturnTypeList<Agent>> => {
     const { agents, total, page, perPage } = await libs.agents.list(
       request.user,
       undefined,
       parseInt(request.query.page, 10),
-      parseInt(request.query.perPage, 10)
+      parseInt(request.query.perPage, 10),
+      request.query.kuery
     );
 
     return { list: agents, success: true, total, page, perPage };