Merge branch 'main' into 2655-implement-log-data-stream-selector-rebased

docs/discover/log-pattern-analysis.asciidoc

@@ -1,7 +1,7 @@
 [[run-pattern-analysis-discover]]
 == Run a pattern analysis on your log data
 
-preview::[]
+preview::["This functionality is in technical preview, requires a link:https://www.elastic.co/subscriptions[Platinum subscription], and may be changed or removed in a future release. Elastic will apply best effort to fix any issues, but features in technical preview are not subject to the support SLA of official GA features."]
 
 include::../user/ml/index.asciidoc[tag=log-pattern-analysis-intro]
 Log pattern analysis works on every text field.

x-pack/plugins/fleet/server/services/elastic_agent_manifest.ts

@@ -77,6 +77,15 @@ spec:
             #    - BPF # (since Linux 5.8) allows loading of BPF programs, create most map types, load BTF, iterate programs and maps.
             #    - PERFMON # (since Linux 5.8) allows attaching of BPF programs used for performance metrics and observability operations.
             #    - SYS_RESOURCE # Allow use of special resources or raising of resource limits. Used by 'Defend for Containers' to modify 'rlimit_memlock'
+            ########################################################################################
+            # The following capabilities are needed for Universal Profiling.
+            # More fine graded capabilities are only available for newer Linux kernels.
+            # If you are using the Universal Profiling integration, please uncomment these lines before applying.
+            #procMount: "Unmasked"
+            #privileged: true
+            #capabilities:
+            #  add:
+            #    - SYS_ADMIN
           resources:
             limits:
               memory: 700Mi
@@ -113,6 +122,9 @@ spec:
               mountPath: /sys/kernel/debug
             - name: elastic-agent-state
               mountPath: /usr/share/elastic-agent/state
+            # If you are using the Universal Profiling integration, please uncomment these lines before applying.
+            #- name: universal-profiling-cache
+            #  mountPath: /var/cache/Elastic
       volumes:
         - name: datastreams
           configMap:
@@ -142,8 +154,8 @@ spec:
         - name: var-lib
           hostPath:
             path: /var/lib
-        # Needed for 'Defend for containers' integration (cloud-defend)
-        # If you are not using this integration, then these volumes and the corresponding
+        # Needed for 'Defend for containers' integration (cloud-defend) and Universal Profiling
+        # If you are not using one of these integrations, then these volumes and the corresponding
         # mounts can be removed.
         - name: sys-kernel-debug
           hostPath:
@@ -154,6 +166,12 @@ spec:
           hostPath:
             path: /var/lib/elastic-agent/kube-system/state
             type: DirectoryOrCreate
+        # Mount required for Universal Profiling.
+        # If you are using the Universal Profiling integration, please uncomment these lines before applying.
+        #- name: universal-profiling-cache
+        #  hostPath:
+        #    path: /var/cache/Elastic
+        #    type: DirectoryOrCreate
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -380,6 +398,15 @@ spec:
             #    - BPF # (since Linux 5.8) allows loading of BPF programs, create most map types, load BTF, iterate programs and maps.
             #    - PERFMON # (since Linux 5.8) allows attaching of BPF programs used for performance metrics and observability operations.
             #    - SYS_RESOURCE # Allow use of special resources or raising of resource limits. Used by 'Defend for Containers' to modify 'rlimit_memlock'
+            ########################################################################################
+            # The following capabilities are needed for Universal Profiling.
+            # More fine graded capabilities are only available for newer Linux kernels.
+            # If you are using the Universal Profiling integration, please uncomment these lines before applying.
+            #procMount: "Unmasked"
+            #privileged: true
+            #capabilities:
+            #  add:
+            #    - SYS_ADMIN
           resources:
             limits:
               memory: 700Mi
@@ -412,6 +439,9 @@ spec:
               mountPath: /sys/kernel/debug
             - name: elastic-agent-state
               mountPath: /usr/share/elastic-agent/state
+            # If you are using the Universal Profiling integration, please uncomment these lines before applying.
+            #- name: universal-profiling-cache
+            #  mountPath: /var/cache/Elastic
       volumes:
         - name: proc
           hostPath:
@@ -440,8 +470,8 @@ spec:
           hostPath:
             path: /etc/machine-id
             type: File
-        # Needed for 'Defend for containers' integration (cloud-defend)
-        # If you are not using this integration, then these volumes and the corresponding
+        # Needed for 'Defend for containers' integration (cloud-defend) and Universal Profiling
+        # If you are not using one of these integrations, then these volumes and the corresponding
         # mounts can be removed.
         - name: sys-kernel-debug
           hostPath:
@@ -452,6 +482,12 @@ spec:
           hostPath:
             path: /var/lib/elastic-agent-managed/kube-system/state
             type: DirectoryOrCreate
+        # Mount required for Universal Profiling.
+        # If you are using the Universal Profiling integration, please uncomment these lines before applying.
+        #- name: universal-profiling-cache
+        #  hostPath:
+        #    path: /var/cache/Elastic
+        #    type: DirectoryOrCreate
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding

x-pack/plugins/lists/public/exceptions/components/builder/exception_items_renderer.tsx

@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import React, { useCallback, useEffect, useMemo, useReducer } from 'react';
+import React, { useCallback, useEffect, useMemo, useReducer, useState } from 'react';
 import { EuiFlexGroup, EuiFlexItem, EuiSpacer } from '@elastic/eui';
 import styled from 'styled-components';
 import { HttpStart } from '@kbn/core/public';
@@ -34,14 +34,14 @@ import {
 } from '@kbn/securitysolution-list-utils';
 import { DataViewBase } from '@kbn/es-query';
 import type { AutocompleteStart } from '@kbn/unified-search-plugin/public';
+import deepEqual from 'fast-deep-equal';
 
 import { AndOrBadge } from '../and_or_badge';
 
 import { BuilderExceptionListItemComponent } from './exception_item_renderer';
 import { BuilderLogicButtons } from './logic_buttons';
 import { getTotalErrorExist } from './selectors';
 import { EntryFieldError, State, exceptionsBuilderReducer } from './reducer';
-
 const MyInvisibleAndBadge = styled(EuiFlexItem)`
   visibility: hidden;
 `;
@@ -131,6 +131,7 @@ export const ExceptionBuilderComponent = ({
     disableNested: isNestedDisabled,
     disableOr: isOrDisabled,
   });
+  const [areAllEntriesDeleted, setAreAllEntriesDeleted] = useState<boolean>(false);
 
   const {
     addNested,
@@ -252,6 +253,7 @@ export const ExceptionBuilderComponent = ({
         // just add a default entry to it
         if (updatedExceptions.length === 0) {
           setDefaultExceptions(item);
+          setAreAllEntriesDeleted(true);
         } else if (updatedExceptions.length > 0 && exceptionListItemSchema.is(item)) {
           setUpdateExceptionsToDelete([...exceptionsToDelete, item]);
         } else {
@@ -394,12 +396,36 @@ export const ExceptionBuilderComponent = ({
     }
   }, [exceptions, handleAddNewExceptionItem]);
 
+  /**
+   * This component relies on the "exceptionListItems" to pre-fill its entries,
+   *  but any subsequent updates to the entries are not reflected back to
+   * the "exceptionListItems". To ensure correct behavior, we need to only
+   * fill the entries from the "exceptionListItems" during initialization.
+   *
+   * In the initialization phase, if there are "exceptionListItems" with
+   * pre-filled entries, the exceptions array will be empty. However,
+   * there are cases where the "exceptionListItems" may not be sent
+   * correctly during initialization, leading to the exceptions
+   * array being filled with empty entries. Therefore, we need to
+   *  check if the exception is correctly populated with a valid
+   * "field" when the "exceptionListItems" has entries. that's why
+   * "exceptionsEntriesPopulated" is used
+   *
+   * It's important to differentiate this case from when the user
+   * deletes all the entries and the "exceptionListItems" has pre-filled values.
+   * that's why "allEntriesDeleted" is used
+   *
+   *  deepEqual(exceptionListItems, exceptions) to handle the exceptionListItems in
+   * the EventFiltersFlyout
+   */
   useEffect(() => {
-    if (exceptionListItems.length > 0) {
+    if (!exceptionListItems.length || deepEqual(exceptionListItems, exceptions)) return;
+    const exceptionsEntriesPopulated = exceptions.some((exception) =>
+      exception.entries.some((entry) => entry.field)
+    );
+    if (!exceptionsEntriesPopulated && !areAllEntriesDeleted)
       setUpdateExceptions(exceptionListItems);
-    }
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, []);
+  }, [areAllEntriesDeleted, exceptionListItems, exceptions, setUpdateExceptions]);
 
   return (
     <EuiFlexGroup gutterSize="s" direction="column" data-test-subj="exceptionsBuilderWrapper">

x-pack/plugins/profiling/public/components/flamegraph/index.tsx

@@ -13,6 +13,7 @@ import {
   PartialTheme,
   Settings,
   Tooltip,
+  FlameSpec,
 } from '@elastic/charts';
 import { EuiFlexGroup, EuiFlexItem, useEuiTheme } from '@elastic/eui';
 import { Maybe } from '@kbn/observability-plugin/common/typings';
@@ -27,13 +28,15 @@ import { ComparisonMode } from '../normalization_menu';
 
 interface Props {
   id: string;
-  comparisonMode: ComparisonMode;
+  comparisonMode?: ComparisonMode;
   primaryFlamegraph?: ElasticFlameGraph;
   comparisonFlamegraph?: ElasticFlameGraph;
   baseline?: number;
   comparison?: number;
   showInformationWindow: boolean;
   toggleShowInformationWindow: () => void;
+  searchText?: string;
+  onChangeSearchText?: FlameSpec['onSearchTextChange'];
 }
 
 export function FlameGraph({
@@ -45,6 +48,8 @@ export function FlameGraph({
   comparison,
   showInformationWindow,
   toggleShowInformationWindow,
+  searchText,
+  onChangeSearchText,
 }: Props) {
   const theme = useEuiTheme();
 
@@ -165,6 +170,8 @@ export function FlameGraph({
                     valueFormatter={(value) => `${value}`}
                     animation={{ duration: 100 }}
                     controlProviderCallback={{}}
+                    search={searchText ? { text: searchText } : undefined}
+                    onSearchTextChange={onChangeSearchText}
                   />
                 </Chart>
               </EuiFlexItem>

x-pack/plugins/profiling/public/components/stack_frame_summary/index.tsx

@@ -0,0 +1,51 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { EuiFlexGroup, EuiFlexItem, EuiLink, EuiText } from '@elastic/eui';
+import React from 'react';
+import { getCalleeFunction, getCalleeSource, StackFrameMetadata } from '../../../common/profiling';
+
+interface Props {
+  frame: StackFrameMetadata;
+  onFrameClick?: (functionName: string) => void;
+}
+
+function CalleeFunctionText({ calleeFunctionName }: { calleeFunctionName: string }) {
+  return (
+    <EuiText size="s" style={{ fontWeight: 'bold', overflowWrap: 'anywhere' }}>
+      {calleeFunctionName}
+    </EuiText>
+  );
+}
+
+export function StackFrameSummary({ frame, onFrameClick }: Props) {
+  const calleeFunctionName = getCalleeFunction(frame);
+
+  function handleOnClick() {
+    if (onFrameClick) {
+      onFrameClick(calleeFunctionName);
+    }
+  }
+
+  return (
+    <EuiFlexGroup direction="column" gutterSize="xs">
+      <EuiFlexItem>
+        <div>
+          {onFrameClick ? (
+            <EuiLink onClick={handleOnClick}>
+              <CalleeFunctionText calleeFunctionName={calleeFunctionName} />
+            </EuiLink>
+          ) : (
+            <CalleeFunctionText calleeFunctionName={calleeFunctionName} />
+          )}
+        </div>
+      </EuiFlexItem>
+      <EuiFlexItem style={{ overflowWrap: 'anywhere' }}>
+        <EuiText size="s">{getCalleeSource(frame) || '‎'}</EuiText>
+      </EuiFlexItem>
+    </EuiFlexGroup>
+  );
+}

x-pack/plugins/profiling/public/components/stacked_bar_chart/index.tsx

@@ -17,7 +17,6 @@ import {
   Tooltip,
   XYChartElementEvent,
   TooltipContainer,
-  CustomTooltip,
 } from '@elastic/charts';
 import { EuiPanel } from '@elastic/eui';
 import { keyBy } from 'lodash';
@@ -57,7 +56,7 @@ export function StackedBarChart({
 
   const { chartsBaseTheme, chartsTheme } = useProfilingChartsTheme();
 
-  const CustomTooltipWithSubChart: CustomTooltip = () => {
+  function CustomTooltipWithSubChart() {
     if (!highlightedSample) {
       return null;
     }
@@ -90,7 +89,7 @@ export function StackedBarChart({
         </EuiPanel>
       </TooltipContainer>
     );
-  };
+  }
 
   return (
     <Chart size={{ height }}>