Merge branch '7.x' into backport/7.x/pr-96071

docs/development/plugins/data/public/kibana-plugin-plugins-data-public.autorefreshdonefn.md

@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AutoRefreshDoneFn](./kibana-plugin-plugins-data-public.autorefreshdonefn.md)
+
+## AutoRefreshDoneFn type
+
+<b>Signature:</b>
+
+```typescript
+export declare type AutoRefreshDoneFn = () => void;
+```

docs/development/plugins/data/public/kibana-plugin-plugins-data-public.kbn_field_types.md

@@ -27,6 +27,7 @@ export declare enum KBN_FIELD_TYPES
 |  HISTOGRAM | <code>&quot;histogram&quot;</code> |  |
 |  IP | <code>&quot;ip&quot;</code> |  |
 |  IP\_RANGE | <code>&quot;ip_range&quot;</code> |  |
+|  MISSING | <code>&quot;missing&quot;</code> |  |
 |  MURMUR3 | <code>&quot;murmur3&quot;</code> |  |
 |  NESTED | <code>&quot;nested&quot;</code> |  |
 |  NUMBER | <code>&quot;number&quot;</code> |  |

docs/development/plugins/data/public/kibana-plugin-plugins-data-public.md

@@ -47,6 +47,7 @@
 |  [getSearchParamsFromRequest(searchRequest, dependencies)](./kibana-plugin-plugins-data-public.getsearchparamsfromrequest.md) |  |
 |  [getTime(indexPattern, timeRange, options)](./kibana-plugin-plugins-data-public.gettime.md) |  |
 |  [plugin(initializerContext)](./kibana-plugin-plugins-data-public.plugin.md) |  |
+|  [waitUntilNextSessionCompletes$(sessionService, { waitForIdle })](./kibana-plugin-plugins-data-public.waituntilnextsessioncompletes_.md) | Creates an observable that emits when next search session completes. This utility is helpful to use in the application to delay some tasks until next session completes. |
 
 ## Interfaces
 
@@ -92,6 +93,7 @@
 |  [SearchInterceptorDeps](./kibana-plugin-plugins-data-public.searchinterceptordeps.md) |  |
 |  [SearchSessionInfoProvider](./kibana-plugin-plugins-data-public.searchsessioninfoprovider.md) | Provide info about current search session to be stored in the Search Session saved object |
 |  [SearchSourceFields](./kibana-plugin-plugins-data-public.searchsourcefields.md) | search source fields |
+|  [WaitUntilNextSessionCompletesOptions](./kibana-plugin-plugins-data-public.waituntilnextsessioncompletesoptions.md) | Options for [waitUntilNextSessionCompletes$()](./kibana-plugin-plugins-data-public.waituntilnextsessioncompletes_.md) |
 
 ## Variables
 
@@ -141,6 +143,7 @@
 |  [AggParam](./kibana-plugin-plugins-data-public.aggparam.md) |  |
 |  [AggsStart](./kibana-plugin-plugins-data-public.aggsstart.md) | AggsStart represents the actual external contract as AggsCommonStart is only used internally. The difference is that AggsStart includes the typings for the registry with initialized agg types. |
 |  [AutocompleteStart](./kibana-plugin-plugins-data-public.autocompletestart.md) | \* |
+|  [AutoRefreshDoneFn](./kibana-plugin-plugins-data-public.autorefreshdonefn.md) |  |
 |  [CustomFilter](./kibana-plugin-plugins-data-public.customfilter.md) |  |
 |  [EsaggsExpressionFunctionDefinition](./kibana-plugin-plugins-data-public.esaggsexpressionfunctiondefinition.md) |  |
 |  [EsdslExpressionFunctionDefinition](./kibana-plugin-plugins-data-public.esdslexpressionfunctiondefinition.md) |  |

docs/development/plugins/data/public/kibana-plugin-plugins-data-public.waituntilnextsessioncompletes_.md

@@ -0,0 +1,25 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [waitUntilNextSessionCompletes$](./kibana-plugin-plugins-data-public.waituntilnextsessioncompletes_.md)
+
+## waitUntilNextSessionCompletes$() function
+
+Creates an observable that emits when next search session completes. This utility is helpful to use in the application to delay some tasks until next session completes.
+
+<b>Signature:</b>
+
+```typescript
+export declare function waitUntilNextSessionCompletes$(sessionService: ISessionService, { waitForIdle }?: WaitUntilNextSessionCompletesOptions): import("rxjs").Observable<SearchSessionState>;
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  sessionService | <code>ISessionService</code> | [ISessionService](./kibana-plugin-plugins-data-public.isessionservice.md) |
+|  { waitForIdle } | <code>WaitUntilNextSessionCompletesOptions</code> |  |
+
+<b>Returns:</b>
+
+`import("rxjs").Observable<SearchSessionState>`
+

docs/development/plugins/data/public/kibana-plugin-plugins-data-public.waituntilnextsessioncompletesoptions.md

@@ -0,0 +1,20 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [WaitUntilNextSessionCompletesOptions](./kibana-plugin-plugins-data-public.waituntilnextsessioncompletesoptions.md)
+
+## WaitUntilNextSessionCompletesOptions interface
+
+Options for [waitUntilNextSessionCompletes$()](./kibana-plugin-plugins-data-public.waituntilnextsessioncompletes_.md)
+
+<b>Signature:</b>
+
+```typescript
+export interface WaitUntilNextSessionCompletesOptions 
+```
+
+## Properties
+
+|  Property | Type | Description |
+|  --- | --- | --- |
+|  [waitForIdle](./kibana-plugin-plugins-data-public.waituntilnextsessioncompletesoptions.waitforidle.md) | <code>number</code> | For how long to wait between session state transitions before considering that session completed |
+

docs/development/plugins/data/public/kibana-plugin-plugins-data-public.waituntilnextsessioncompletesoptions.waitforidle.md

@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [WaitUntilNextSessionCompletesOptions](./kibana-plugin-plugins-data-public.waituntilnextsessioncompletesoptions.md) &gt; [waitForIdle](./kibana-plugin-plugins-data-public.waituntilnextsessioncompletesoptions.waitforidle.md)
+
+## WaitUntilNextSessionCompletesOptions.waitForIdle property
+
+For how long to wait between session state transitions before considering that session completed
+
+<b>Signature:</b>
+
+```typescript
+waitForIdle?: number;
+```

docs/development/plugins/data/server/kibana-plugin-plugins-data-server.kbn_field_types.md

@@ -27,6 +27,7 @@ export declare enum KBN_FIELD_TYPES
 |  HISTOGRAM | <code>&quot;histogram&quot;</code> |  |
 |  IP | <code>&quot;ip&quot;</code> |  |
 |  IP\_RANGE | <code>&quot;ip_range&quot;</code> |  |
+|  MISSING | <code>&quot;missing&quot;</code> |  |
 |  MURMUR3 | <code>&quot;murmur3&quot;</code> |  |
 |  NESTED | <code>&quot;nested&quot;</code> |  |
 |  NUMBER | <code>&quot;number&quot;</code> |  |

docs/development/plugins/embeddable/public/kibana-plugin-plugins-embeddable-public.embeddable.getupdated_.md

@@ -9,9 +9,9 @@ Merges input$ and output$ streams and debounces emit till next macro-task. Could
 <b>Signature:</b>
 
 ```typescript
-getUpdated$(): Readonly<Rx.Observable<void>>;
+getUpdated$(): Readonly<Rx.Observable<TEmbeddableInput | TEmbeddableOutput>>;
 ```
 <b>Returns:</b>
 
-`Readonly<Rx.Observable<void>>`
+`Readonly<Rx.Observable<TEmbeddableInput | TEmbeddableOutput>>`
 

docs/getting-started/quick-start-guide.asciidoc

@@ -12,7 +12,7 @@ When you've finished, you'll know how to:
 [float]
 === Required privileges
 When security is enabled, you must have `read`, `write`, and `manage` privileges on the `kibana_sample_data_*` indices. 
-For more information, refer to {ref}/security-privileges.html[Security privileges].
+Learn how to <<tutorial-secure-access-to-kibana, secure access to {kib}>>, or refer to {ref}/security-privileges.html[Security privileges] for more information.
 
 [float]
 [[set-up-on-cloud]]
@@ -141,3 +141,5 @@ For more information, refer to <<dashboard,Dashboard>>.
 If you are you ready to add your own data, refer to <<connect-to-elasticsearch,Add data to {kib}>>.
 
 If you want to ingest your data, refer to {fleet-guide}/fleet-quick-start.html[Quick start: Get logs and metrics into the Elastic Stack].
+
+If you want to secure access to your data, refer to our guide on <<tutorial-secure-access-to-kibana, securing {kib}>>

docs/index.asciidoc

@@ -21,6 +21,8 @@ include::user/index.asciidoc[]
 
 include::accessibility.asciidoc[]
 
+// include::migration.asciidoc[]
+
 include::CHANGELOG.asciidoc[]
 
 include::developer/index.asciidoc[]

docs/management/advanced-options.asciidoc

@@ -119,8 +119,12 @@ When date histograms use the `auto` interval, Kibana attempts to generate this
 number of bars.
 
 [[histogram-maxbars]]`histogram:maxBars`::
-Date histograms are not generated with more bars than the value of this property, 
-scaling values when necessary.
+To improve performance, limits the density of date and number histograms across {kib}
+using a test query. When the test query contains too many buckets,
+the interval between buckets increases. This setting applies separately
+to each histogram aggregation, and does not apply to other types of aggregations.
+To find the maximum value of this setting, divide the {es} `search.max_buckets`
+value by the maximum number of aggregations in each visualization.
 
 [[history-limit]]`history:limit`::
 In fields that have history, such as query inputs, show this many recent values.
@@ -134,9 +138,7 @@ Fields that exist outside of `_source`. Kibana merges these fields into the
 document when displaying it.
 
 [[metrics-maxbuckets]]`metrics:max_buckets`::
-The maximum numbers of buckets that a single data source can return. This might
-arise when the user selects a short interval (for example, 1s) for a long time
-period (1 year).
+Affects the *TSVB* histogram density. Must be set higher than `histogram:maxBars`.
 
 [[query-allowleadingwildcards]]`query:allowLeadingWildcards`::
 Allows a wildcard (*) as the first character in a query clause. Only applies
@@ -222,7 +224,7 @@ Banners are a https://www.elastic.co/subscriptions[subscription feature].
 
 [horizontal]
 [[banners-placement]]`banners:placement`::
-Set to `Top` to display a banner above the Elastic header for this space. Defaults to the value of 
+Set to `Top` to display a banner above the Elastic header for this space. Defaults to the value of
 the `xpack.banners.placement` configuration property.
 
 [[banners-textcontent]]`banners:textContent`::

docs/maps/import-geospatial-data.asciidoc

@@ -6,6 +6,30 @@ To import geospatical data into the Elastic Stack, the data must be indexed as {
 Geospatial data comes in many formats.
 Choose an import tool based on the format of your geospatial data.
 
+[discrete]
+[[import-geospatial-privileges]]
+=== Security privileges
+
+The {stack-security-features} provide roles and privileges that control which users can upload files.
+You can manage your roles, privileges, and
+spaces in **{stack-manage-app}** in {kib}. For more information, see
+{ref}/security-privileges.html[Security privileges],
+<<kibana-privileges, {kib} privileges>>, and <<kibana-role-management, {kib} role management>>.
+
+To upload GeoJSON files in {kib} with *Maps*, you must have:
+
+* The `all` {kib} privilege for *Maps*.
+* The `all` {kib} privilege for *Index Pattern Management*.
+* The `create` and `create_index` index privileges for destination indices.
+* To use the index in *Maps*, you must also have the `read` and `view_index_metadata` index privileges for destination indices.
+
+To upload CSV files in {kib} with the *{file-data-viz}*, you must have privileges to upload GeoJSON files and:
+
+* The `manage_pipeline` cluster privilege.
+* The `read` {kib} privilege for *Machine Learning*.
+* The `machine_learning_admin` or `machine_learning_user` role.
+
+
 [discrete]
 === Upload CSV with latitude and longitude columns
 

docs/maps/trouble-shooting.asciidoc

@@ -44,10 +44,13 @@ Increase <<settings, `server.maxPayloadBytes`>> for large index patterns.
 * Ensure fill color and border color are distinguishable from map tiles. It's hard to see white features on a white background.
 
 [float]
-==== Tiles are not displayed
+==== Elastic Maps Service basemaps are not displayed
+*Maps* uses tile and vector data from Elastic Maps Service by default. See <<maps-connect-to-ems, Connect to Elastic Maps Service>> for more info.
 
-* Ensure your tile server has configured https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS[Cross-Origin Resource Sharing (CORS)] so tile requests from your Kibana domain have permission to access your tile server domain.
-* Ensure tiles have the required coordinate system. Vector data must use EPSG:4326 and tiles must use EPSG:3857.
+[float]
+==== Custom tiles are not displayed
+* When using a custom tile service, ensure your tile server has configured https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS[Cross-Origin Resource Sharing (CORS)] so tile requests from your {kib} domain have permission to access your tile server domain.
+* Ensure custom vector and tile services have the required coordinate system. Vector data must use EPSG:4326 and tiles must use EPSG:3857.
 
 [float]
 ==== Coordinate and region map visualizations not available in New Visualization menu

docs/redirects.asciidoc

@@ -308,3 +308,8 @@ This content has moved. refer to <<timelion>>.
 
 This content has moved. Refer to <<release-notes, Release notes>>.
 
+
+[role="exclude",id="space-rbac-tutorial"]
+== Tutorial: Use role-based access control to customize Kibana spaces
+
+This content has moved. refer to <<tutorial-secure-access-to-kibana>>.

docs/settings/alert-action-settings.asciidoc

@@ -59,6 +59,12 @@ You can configure the following settings in the `kibana.yml` file.
 | `xpack.actions.proxyUrl` {ess-icon}
   | Specifies the proxy URL to use, if using a proxy for actions. By default, no proxy is used.
 
+| `xpack.actions.proxyBypassHosts` {ess-icon}
+  | Specifies hostnames which should not use the proxy, if using a proxy for actions. The value is an array of hostnames as strings.  By default, all hosts will use the proxy, but if an action's hostname is in this list, the proxy will not be used.  The settings `xpack.actions.proxyBypassHosts` and `xpack.actions.proxyOnlyHosts` cannot be used at the same time.
+
+| `xpack.actions.proxyOnlyHosts` {ess-icon}
+  | Specifies hostnames which should only use the proxy, if using a proxy for actions. The value is an array of hostnames as strings.  By default, no hosts will use the proxy, but if an action's hostname is in this list, the proxy will be used.  The settings `xpack.actions.proxyBypassHosts` and `xpack.actions.proxyOnlyHosts` cannot be used at the same time.
+
 | `xpack.actions.proxyHeaders` {ess-icon}
   | Specifies HTTP headers for the proxy, if using a proxy for actions. Defaults to {}.
 
@@ -71,6 +77,13 @@ a|`xpack.actions.`
   +
   As an alternative to setting both `xpack.actions.proxyRejectUnauthorizedCertificates` and `xpack.actions.rejectUnauthorized`, you can point the OS level environment variable `NODE_EXTRA_CA_CERTS` to a file that contains the root CAs needed to trust certificates.
 
+| `xpack.actions.maxResponseContentLength` {ess-icon}
+  | Specifies the max number of bytes of the http response for requests to external resources. Defaults to 1000000 (1MB).
+
+| `xpack.actions.responseTimeout` {ess-icon}
+  | Specifies the time allowed for requests to external resources. Requests that take longer are aborted. The time is formatted as <count>[ms|s|m|h|d|w|M|Y], for example, '20m', '24h', '7d', '1w'. Defaults to 60s.
+
+
 |===
 
 [float]

docs/setup/settings.asciidoc

@@ -429,6 +429,15 @@ to display map tiles in tilemap visualizations. By default,
 override this parameter to use their own Tile Map Service. For example:
 `"https://tiles.elastic.co/v2/default/{z}/{x}/{y}.png?elastic_tile_service_tos=agree&my_app_name=kibana"`
 
+| `migrations.batchSize:`
+ | Defines the number of documents migrated at a time. The higher the value, the faster the Saved Objects migration process performs at the cost of higher memory consumption. If the migration fails due to a `circuit_breaking_exception`, set a smaller `batchSize` value. *Default: `1000`*
+
+| `migrations.enableV2:`
+ | experimental[]. Enables the new Saved Objects migration algorithm. For information about the migration algorithm, refer to <<upgrade-migrations>>. When `migrations v2` is stable, the setting will be removed in an upcoming release without any further notice. Setting the value to `false` causes {kib} to use the legacy migration algorithm, which shipped in 7.11 and earlier versions. *Default: `true`*
+
+| `migrations.retryAttempts:`
+ | The number of times migrations retry temporary failures, such as a network timeout, 503 status code, or `snapshot_in_progress_exception`. When upgrade migrations frequently fail after exhausting all retry attempts with a message such as `Unable to complete the [...] step after 15 attempts, terminating.`, increase the setting value. *Default: `15`*
+
 | `newsfeed.enabled:`
  | Controls whether to enable the newsfeed
 system for the {kib} UI notification center. Set to `false` to disable the

docs/user/security/authentication/index.asciidoc

@@ -292,7 +292,11 @@ xpack.security.authc.providers:
     order: 1
 -----------------------------------------------
 
-Kibana uses SPNEGO, which wraps the Kerberos protocol for use with HTTP, extending it to web applications. At the end of the Kerberos handshake, Kibana will forward the service ticket to Elasticsearch. Elasticsearch will unpack it and it will respond with an access and refresh token which are then used for subsequent authentication.
+IMPORTANT: {kib} uses SPNEGO, which wraps the Kerberos protocol for use with HTTP, extending it to web applications. 
+At the end of the Kerberos handshake, {kib} forwards the service ticket to {es}, then {es} unpacks the service ticket and responds with an access and refresh token, which are used for subsequent authentication.
+On every {es} node that {kib} connects to, the keytab file should always contain the HTTP service principal for the {kib} host. 
+The HTTP service principal name must have the `HTTP/[email protected]` format.
+
 
 [[anonymous-authentication]]
 ==== Anonymous authentication

docs/user/security/index.asciidoc

@@ -47,4 +47,3 @@ include::authorization/kibana-privileges.asciidoc[]
 include::api-keys/index.asciidoc[]
 include::encryption-keys/index.asciidoc[]
 include::role-mappings/index.asciidoc[]
-include::rbac_tutorial.asciidoc[]