Merge branch '8.0' into backport/8.0/pr-122859

docs/discover/document-explorer.asciidoc

@@ -0,0 +1,93 @@
+[[document-explorer]]
+== Document Explorer
+
+beta::[]
+
+*Discover* has a *Document Explorer* with resizable columns, better data sorting and comparison,
+and a fullscreen view.
+
+[role="screenshot"]
+image::images/document-explorer.png[Document Explorer with improved look over classic view]
+
+To use the *Document Explorer* instead of the classic document table:
+
+. Open *Discover*.
+. In the toolbar, click *Options*, and then click *Try Document Explorer*.
+. Turn off the classic view and save the changes.
+
+[float]
+[[document-explorer-columns]]
+=== Reorder and resize columns
+
+Use drag and drop to organize the columns and improve the view of the data.
+
+To reorder columns, do one of the following:
+
+* Click *Columns*. In the pop-up, select the column you want to move and drag it to the new location.
+
+* Click the header of the column you want to move. In the dropdown menu, click *Move left* or *Move right*.
+
+To resize a column, drag the right edge of the column header until the column is the width that you want.
+
+Column widths are stored with a saved search.  When you visualize saved searches on dashboards, the saved search appears the same as in **Discover**.
+
+[float]
+[[document-explorer-sort-data]]
+=== Sort data
+
+Sort your data by one or more fields, in ascending or descending order.
+The default sort is based on the time field, from new to old.
+
+. In the *Document Explorer*, click and open the *field sorted* options.
++
+[role="screenshot"]
+image::images/document-explorer-sort-data.png[Pop-up in Document Explorer for sorting columns, width="75%"]
+
+. To add more fields to the sort, expand the dropdown menu.
++
+By default, columns are sorted in the order they are added.
+For example, to sort by `order_date` then `geo.country_iso_code`, make sure `order_date` appears first.
++
+[role="screenshot"]
+image::images/document-explorer-multi-field.png[Multi field sort in Document Explorer, width="75%"]
+
+. To change the sort order, select a field in the pop-up, and then drag it to the new location.
+
+[float]
+[[document-explorer-compare-data]]
+=== Compare data
+
+Narrow your results to a subset documents.
+
+. Select the documents you want to compare.
+
+. Click and open the *documents selected* options, and then select *Show selected documents only*.
++
+[role="screenshot"]
+image::images/document-explorer-compare-data.png[Multi field sort in Document Explorer, width="75%"]
+
+[float]
+[[document-explorer-expand-documents]]
+=== Expand documents
+
+Dive into an individual document to inspect its fields, set filters, and view
+the documents that occurred before and after it.
+
+. Click the expand icon
+image:images/expand-icon-2.png[double arrow icon to open a flyout with the document details].
++
+[role="screenshot"]
+image::images/document-explorer-expand.png[Multi field sort in Document Explorer]
+
+. Scan through the fields and their values. If you find a field of interest,
+click
+image:images/actions-icon.png[three dots icon in table column] in the *Actions* column for filters and other controls.
+. To view documents that occurred before or after the event you are looking at, click <<discover-view-surrounding-documents,**Surrounding documents**>>.
+. For direct access to a particular document, click <<discover-view-single-document,**Single document**>>.
+
+[float]
+[[document-explorer-full-screen]]
+=== View documents in fullscreen
+
+To view as much data as possible and eliminate distractions, click the fullscreen icon
+image:images/fullscreen-icon.png[icon to display the Document Explorer in fullscreen mode].

docs/user/discover.asciidoc

@@ -284,4 +284,7 @@ include::{kib-repo-dir}/discover/save-search.asciidoc[]
 
 include::{kib-repo-dir}/discover/search-sessions.asciidoc[]
 
+include::{kib-repo-dir}/discover/document-explorer.asciidoc[]
+
 include::{kib-repo-dir}/discover/field-statistics.asciidoc[]
+

x-pack/plugins/screenshotting/server/browsers/chromium/driver.ts

@@ -351,16 +351,14 @@ export class HeadlessChromiumDriver {
       this.interceptedCount = this.interceptedCount + (isData ? 0 : 1);
     });
 
-    // Even though 3xx redirects go through our request
-    // handler, we should probably inspect responses just to
-    // avoid being bamboozled by some malicious request
     this.page.on('response', (interceptedResponse: puppeteer.HTTPResponse) => {
       const interceptedUrl = interceptedResponse.url();
       const allowed = !interceptedUrl.startsWith('file://');
+      const status = interceptedResponse.status();
 
-      if (!interceptedResponse.ok()) {
+      if (status >= 400 && !interceptedResponse.ok()) {
         logger.warn(
-          `Chromium received a non-OK response (${interceptedResponse.status()}) for request ${interceptedUrl}`
+          `Chromium received a non-OK response (${status}) for request ${interceptedUrl}`
         );
       }
 

x-pack/plugins/screenshotting/server/browsers/chromium/driver_factory/index.ts

@@ -16,7 +16,16 @@ import puppeteer, { Browser, ConsoleMessage, HTTPRequest, Page } from 'puppeteer
 import { createInterface } from 'readline';
 import * as Rx from 'rxjs';
 import { InnerSubscriber } from 'rxjs/internal/InnerSubscriber';
-import { catchError, ignoreElements, map, mergeMap, reduce, takeUntil, tap } from 'rxjs/operators';
+import {
+  catchError,
+  ignoreElements,
+  map,
+  concatMap,
+  mergeMap,
+  reduce,
+  takeUntil,
+  tap,
+} from 'rxjs/operators';
 import type { Logger } from 'src/core/server';
 import type { ScreenshotModePluginSetup } from 'src/plugins/screenshot_mode/server';
 import { ConfigType } from '../../../config';
@@ -241,18 +250,55 @@ export class HeadlessChromiumDriverFactory {
     });
   }
 
+  /**
+   * In certain cases the browser will emit an error object to console. To ensure
+   * we extract the message from the error object we need to go the browser's context
+   * and look at the error there.
+   *
+   * If we don't do this we we will get a string that says "JSHandle@error" from
+   * line.text().
+   *
+   * See https://github.com/puppeteer/puppeteer/issues/3397.
+   */
+  private async getErrorMessage(message: ConsoleMessage): Promise<undefined | string> {
+    for (const arg of message.args()) {
+      const errorMessage = await arg
+        .executionContext()
+        .evaluate<undefined | string>((_arg: unknown) => {
+          /* !! We are now in the browser context !! */
+          if (_arg instanceof Error) {
+            return _arg.message;
+          }
+          return undefined;
+          /* !! End of browser context !! */
+        }, arg);
+      if (errorMessage) {
+        return errorMessage;
+      }
+    }
+  }
+
   getBrowserLogger(page: Page, logger: Logger): Rx.Observable<void> {
     const consoleMessages$ = Rx.fromEvent<ConsoleMessage>(page, 'console').pipe(
-      map((line) => {
-        const formatLine = () => `{ text: "${line.text()?.trim()}", url: ${line.location()?.url} }`;
-
+      concatMap(async (line) => {
         if (line.type() === 'error') {
-          logger.get('headless-browser-console').error(`Error in browser console: ${formatLine()}`);
-        } else {
           logger
-            .get(`headless-browser-console:${line.type()}`)
-            .debug(`Message in browser console: ${formatLine()}`);
+            .get('headless-browser-console')
+            .error(
+              `Error in browser console: { message: "${
+                (await this.getErrorMessage(line)) ?? line.text()
+              }", url: "${line.location()?.url}" }`
+            );
+          return;
         }
+
+        logger
+          .get(`headless-browser-console:${line.type()}`)
+          .debug(
+            `Message in browser console: { text: "${line.text()?.trim()}", url: ${
+              line.location()?.url
+            } }`
+          );
       })
     );
 

x-pack/plugins/security_solution/common/utils/path_placeholder.ts

@@ -9,11 +9,11 @@ import { ConditionEntryField, OperatingSystem, TrustedAppEntryTypes } from '../e
 
 export const getPlaceholderText = () => ({
   windows: {
-    wildcard: 'C:\\sample\\**\\path.exe',
+    wildcard: 'C:\\sample\\*\\path.exe',
     exact: 'C:\\sample\\path.exe',
   },
   others: {
-    wildcard: '/opt/**/app',
+    wildcard: '/opt/*/app',
     exact: '/opt/bin',
   },
 });

x-pack/test/api_integration/apis/ml/jobs/jobs_summary.ts

@@ -303,7 +303,10 @@ export default ({ getService }: FtrProviderContext) => {
             if (expectedJob.fullJob) {
               expect(actualJob).to.have.property('fullJob');
               expect(actualJob.fullJob).to.have.property('analysis_config');
-              expect(actualJob.fullJob.analysis_config).to.eql(expectedJob.fullJob.analysis_config);
+              // only validate the expected parts of the analysis_config, ignore additional fields
+              for (const [key, value] of Object.entries(expectedJob.fullJob.analysis_config)) {
+                expect(actualJob.fullJob.analysis_config).to.have.property(key).eql(value);
+              }
             } else {
               expect(actualJob).not.to.have.property('fullJob');
             }